RescheduleReminder walked the cron schedule on a UTC instant, and
robfig's Next walks the calendar in the location it is handed. So
'0 9 * * *' created for 09:00 Moscow rescheduled to the next 09:00 UTC,
which is noon the same day: the reminder fired again that afternoon and
every day at noon after. The same offset walk moved it an hour across a
DST changeover. The walk runs in the owner's location now.
Worse and quieter: any outage longer than one period killed the
recurrence for good. next is the occurrence after the last fire, so
next.Before(now) marked a daily reminder fired when the daemon was down
overnight. Past occurrences roll forward to the first one after now,
with no backlog replay, matching routine.DueAccepted.
internal/routine is clean. Its IntervalDays*24h is an elapsed measure
rather than a wall clock, so the hour arithmetic is right there.
(V-616)
RescheduleReminder walked the cron on the UTC instant scanReminder returns,
so a daily 09:00 Moscow reminder rescheduled to 09:00 UTC — noon the same day,
and noon every day after. And any occurrence earlier than now marked the
reminder fired, so a daemon down overnight ended the recurrence for good.
The walk now runs in the owner's location and skips past occurrences instead
of killing the reminder. Skipping and not replaying keeps the no-backlog rule
routine.DueAccepted already follows.
Client.call treated a frame carrying our id and neither result nor error
as success, so CallTool returned an empty string and no error: the act
is logged as run and the tool never ran, and ListTools returned an empty
catalogue silently. httpTransport.Call already refused exactly this and
names it 'the one answer that lies'; stdioTransport.Call did not, so the
refusal depended on which door the server was behind. Refused centrally
now, so both transports are covered.
ReadResource collapsed 'not configured' and 'configured but down' into
ErrNoServer by discarding lookup's configured return. Manager.Call keeps
them apart on purpose, since a caller needs the distinction to avoid
proposing a capability that already exists.
internal/memeval was read end to end and is clean. No commit there.
(V-613)
Two pages rendered UTC where their siblings render local. /events showed
NoticedAt local and OccurredAt UTC in one row, on a page whose own hint
says that gap is meaningful. /morning showed a reminder at a different
hour than /reminders, which called .Local() on the same instant since
V-469. Both now .Local.Format.
/tasks read formWeight inside the due-date branch, so promoting a
candidate as srochno with no deadline discarded the importance and said
nothing. It is read unconditionally now.
Every table is already wrapped, every interpolation already escapes, and
the step-up gate is already on the mutating posts. Those were checked
and left alone.
(V-612)
Three defects on the server-rendered pages.
/events printed both timestamps in whatever zone the value arrived in.
NoticedAt is the bus's local instant; OccurredAt is the store's UTC, or a
pubDate internal/rss parsed to UTC. So one row carried two zones and a feed
item read hours older than it was, on a page whose hint tells him that column
gap is real.
/morning printed a plan item's At raw. It is a calendar fact's Ts or a
reminder's FireTs, both UTC out of the store, so the same reminder named a
different hour here than on /reminders — which does call Local, since V-469.
promoteCandidate read the importance select inside `if due != nil`.
Confirming a candidate as "срочно" with no deadline threw the word away and
the row came back normal with nothing saying why.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Two defects in internal/mcp, both about a call that reports done when
nothing happened.
Client.call accepted a frame carrying our id and neither result nor
error. The HTTP transport already refuses one; the stdio transport does
not, so the refusal depended on which door the server was behind. Down
that path tools/call returns an empty string and a nil error, and the
act is recorded as run.
Manager.ReadResource reported ErrNoServer for a server that is
configured but down. Call keeps those two apart on purpose — one says
the tool can never exist, the other says not right now.
V-610: teaching #252 that 'к' names an hour made HasTime true without
making the value resolvable, so 'напомни завтра к трём часам дня'
committed at the current clock. dateparser joins a day word to a clock
through 'в' and no other Russian preposition, so it read the day and
dropped the hour. The rewrite now normalises к, ко, на, во to в, which
also fixes 'напомни завтра на 9', silently broken the same way.
The durable half is ResolvedTheHour: both gates that read NamesAnHour
now refuse a parse whose minute nobody spoke, rather than defaulting to
the current clock. Same class as V-577. Fixture unmoved at 64/91.
(V-610)
"напомни завтра к трём часам дня позвонить врачу" now sets 15:00. It set 03:53,
which was the clock at the moment of the turn. She confirmed that as the hour he
had just said.
#252 taught hourPrepositions and the dateparser rewrite the preposition "к". So
HasTime and NamesAnHour started answering true for the sentence. The value did
not follow. The rewrite kept his preposition and handed dateparser "завтра к
03:00 pm". dateparser joins a day word to a clock through "в" and through no
other Russian preposition. It read the day, dropped the clock and filled the time
from its relative base. The completeness rule then saw what, time and day all
answered, and committed at the current minute.
The preposition is normalised along with the hour now. "на" was losing the clock
the same way and was never measured. So "напомни завтра на 9" was landing on the
current minute too.
The second half is the durable one. ResolvedTheHour is the gate the reminder slot
reads, and it refuses a parse whose minute nobody spoke. A spoken hour lands on
the hour. The three shapes that name a minute of their own are a written clock, a
half hour and a quarter to. Anything else came off the clock the parser was
handed. An interval is exempt, because it lands where the arithmetic says.
Comparing the whole instant to now is the obvious test and it is wrong.
ru-rem-006 resolves to 12:00 and the fixture reference clock is 12:00. That is an
hour he did say, reading as an hour nobody did.
The five sentences measured on the box are pinned as tests. They run against the
stub and against the production parser, and the two that already passed are in
there too.
Fixture unchanged. classifier+hash is 27/91 and classifier+onnx is 64/91, before
and after. reach is 18/30 and 27/30, before and after. No case moved and no
clarify count changed. Suite green under -race.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Four defects in cmd/mavpoll/main.go, all found by sweeping the file:
-interval 0 panicked NewTicker, -timeout 0 removed the HTTP deadline
entirely, -wg-cmd "" panicked on fields[0], and get() silently truncated
an oversized body so every monitor past the cut read as "unknown" and
overwrote live services. run() now refuses the three flag values and
get() errors on overflow, leaving the previous facts in place. pollWg
appends ExitError stderr so a missing CAP_NET_ADMIN says so.
(V-611)
Three ways a mavpoll process died or lied after start:
- -interval 0 panicked time.NewTicker on the first tick.
- -timeout 0 is 'no deadline' to http.Client, so one wedged source
stalls every source behind it forever.
- -wg-cmd '' indexed field 0 of an empty slice in pollWg.
All three are now refused in run(), where the operator reads the
message, and pollWg guards its own command as well.
A body that hits maxBodyBytes was silently truncated. A cut kuma page
parses cleanly up to the cut and every monitor past it looks deleted,
so the poller would write 'unknown' over live services and the
down-rule would go quiet. Read one byte past the cap and refuse.
wg's stderr was dropped by Output(), leaving 'exit status 1' in the log
where the real cause is a missing CAP_NET_ADMIN or a bad interface.
The measured symptom was that напомни к двум часам позвонить маме answered
Когда? while к трём read the hour. The filed cause was that часам is missing
from four hour-unit sets in the router while the lexicon already lists it. That
was true and it was not the cause.
NamesAnHour already returned true for the failing sentence. The gap was HasTime,
and the parser never read it, because hourPrepositions in slots.go knew в, во
and на and not к. The dateparser rewrite carried the same three prepositions and
the same short hour forms. Both take к and ко now, and the oblique hour with
them. The sentence parses to two o'clock and the turn asks утра или вечера?,
which is the answer к трём already gave.
The filed defect is fixed too, since it is a fifth copy of a closed class either
way. hour_units and minute_units are lexicon sets now, validated at load, and
the four router sites read them. минутам had the same gap in all four sets.
SlotValueFrame appends both sets, so the old copy at line 220 is gone rather
than left to drift.
Three new tests, all of which fail on master.
The fixture did not move. The classifier and hash arm scores 27/91 before and
after, and reach is 18/30 before and after. The ONNX and LLM arms were not
measured, since neither MAVEN_ONNX_LIB nor MAVEN_LLM_URL is set in a worktree,
so judge the cascade number again on the box.
(V-609)
"напомни к двум часам позвонить маме" now reads two o'clock. It read no
time at all, so the reminder reached the daemon with an empty slot and she
asked the open "Когда?" about an hour he had just said.
The word that lost it was "часам", the dative plural of "час". Four sets in
internal/router listed the hour noun and every one of them stopped at
"часу". They are now one lexicon key, hour_units, read by all four through
lexicon.HourUnits and lexicon.IsHourUnit. The minute noun had the same gap
one word over and gets the same treatment in minute_units: "минутам" was
missing everywhere "минут" and "минуты" were present. The slot_value_frame
set no longer lists either noun and appends both, so there is one copy of
each closed class rather than a copy per caller.
Two more sites had to move for the sentence to parse. hourPrepositions knew
"в", "во" and "на" and not "к", and the python dateparser rewrite knew the
same three. Both now read the fifth preposition and the oblique forms of the
hour that follow it.
Fixture unchanged: classifier+hash 27/91 before and after, reach 18/30
before and after, no case moved in either direction.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The double-wait on the offload seam is real and is fixed. Pair.Complete passed
the caller's context to the workstation unchanged, so a remote that accepted the
connection and then hung consumed the whole turn budget. The fallback then ran
on an already-expired context and returned the deadline error rather than an
answer, which means the turn broke on the workstation being slow. docs/offload.md
rules that out explicitly. remoteBudget gives the remote at most half of a
deadline that exists. A context with no deadline is untouched, because there the
configured workstation.timeout is the intended bound and shortening it silently
would change the operator's setting.
Two check-then-close races, same shape. Pair.Stop and worker.Server.Close each
let two concurrent callers see an open channel, and the second close panics. A
shutdown racing a signal handler took the process down the one way a clean
shutdown exists to prevent. Both are sync.Once now, which is what Stop's
Idempotent comment already claimed.
Load names the environment variables it could not resolve, in file order, once
each.
The agent refuted the brief on that last point and is right. Making an
unresolved fatal contradicts a decision already in the tree:
deployconfig_test.go parses the real deploy/mavend.json and documents that
telegram.env is gitignored and absent in CI, so unset expands to empty on
purpose. None of the three references is a socket path, and telegramsink.New
already refuses an empty token. Fatal would turn the suite red and delete a
working not-configured state.
internal/update needed nothing. worker.Server already waits for in-flight
connections and already recovers a panic per dispatch.
(V-581)
The next duplicated closed class is the weekdays, and it had four copies outside
lexicon_ru_v1.json. Each was short in a different direction: habit.go missed
средам and понедельником, calendar.go missed среде and воскресеньях, weatherq.go
missed среде and субботам. They fold into one WeekdayIndex, which reads
lexicon.Weekdays and asks morph.SameWord about the case. Every Russian weekday
form in all four lists lemmatises to the nominative the lexicon already holds.
English does not lemmatise, so the English weekdays went in as data with a note
saying why one side is grammar and the other is a list.
The fourth copy was a live bug. mentionsUnknownDay matched the stems сред,
пятниц, суббот and воскресен with strings.Contains, so среди, средство, средний
and среднем all read as Wednesday. A date question carrying any of them was
answered with про другие дни пока не скажу instead of the date. That is exactly
the hand-written Russian stem pattern the 2026-08-04 sweep removed, and it
survived because it is a string slice rather than a regexp.
weatherq.go held a third copy of three lexicon sets at once. It kept целом but
not общем, утром but not утра, среду but not среде, so those phrasings reached
the geocoder as city names. It keeps only the rooms of the house now, which are
genuinely its own.
Cardinals had a real gap. Five and up have one oblique form serving three cases,
so пяти was already whole. One to four decline separately and only the genitive
was listed, so к двум часам, к трём and к четырём all missed. Dative and
instrumental added for one to four.
The SameWord caller audit found no defect. Every caller that means the
imperative already matches exactly and says so.
(V-581)
router.WeekdayIndex reads the lexicon and asks the dictionary about the case.
Four private lists go away: the habit declension map, the weekday block of the
day-plan refusal, the weekday and part-of-day entries of the weather guard, and
the stem list in ruwords.go.
The stem list was the real defect. mentionsUnknownDay matched sred, pyatnits
and subbot with strings.Contains, so sredi, sredstvo and sredniy all read as
Wednesday and a question carrying one was answered with onlyNearDaysReply
instead of a date. It matches whole tokens now.
The weather guard was a third copy of three closed sets that already exist.
It kept the rooms of the house, which are its own, and asks the lexicon for the
weekdays, the parts of the day and the words that follow v without naming a
place. Questions phrased v srede, v utra and v obshchem reached the geocoder as
cities before.
Full suite green under -race.
Weekday names lived in four files outside internal/lexicon and each copy was
short in a different direction. The habit map had the prepositional plural of
Sunday and no dative of Wednesday. The plan refusal had the accusative of
Wednesday and not the prepositional. cmd/mavend matched the stem.
Weekdays hands out the seven nominatives whole, because every Russian case
lemmatises to one of them and the case is morph's question. WeekdayEnglish is
the half that has to be data: the vendored dictionary is Russian and leaves
mondays as it found it.
Cardinals gain the dative and instrumental of one to four. A spoken hour
declines and five upward has one oblique form for the genitive, dative and
prepositional, so pyati was already whole while dvum was missing and k dvum
chasam is an hour he says.
Pair.Complete handed the caller's context to the workstation unchanged, so a
remote that accepted the connection and then hung spent the whole turn budget.
The fallback then ran on an expired context and the floor returned the deadline
error instead of an answer, which broke the turn on the workstation being slow.
docs/offload.md rules that out. The remote now gets at most half of a deadline
that exists, and a context without a deadline is left to the configured
workstation timeout.
Pair.Stop and worker.Server.Close both closed their channel after a
check-then-close, so two concurrent callers could race and the second close
panics. Both are sync.Once now, which is what the doc comments already claimed.
config.Load names the environment variables it could not resolve. An unset
variable still expands to the empty string, because every block reads that as
not configured and CI parses deploy/mavend.json with no secrets present. What
was missing is the line telling the operator which capability a forgotten env
file just turned off.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
PCMFromWAV found the data chunk by scanning forward byte by byte from offset 36
for the literal data. A LIST or INFO chunk between fmt and data is common, both
arecord and ffmpeg write one, and its payload is free text that can contain that
word. So the parser could take a comment for a chunk header and read it as
samples. It walks chunk headers with word alignment now, and a new test builds
exactly that file.
Three smaller things. WAVHeader named a different function in its error, which
matters because internal/capture calls it directly twice. The tts stub wrote
16000 three times and now reads the rate and the sample width off
audio.PCM16kMono. PCMFromWAV returns a subslice of the caller's buffer, which is
the right trade for a long recording and was undocumented.
The agent refuted three of the brief's premises. The lexicon two-pass loop is
correct for any run length, because the first pass takes every other name and
frees both boundaries of the ones it skipped, measured at runs of three, four
and five. There is no duration-to-byte truncation here, since every length is a
float64 in seconds. There is no resampler and no subprocess in these four
packages.
The offload contract is not touched here. stt.Remote and tts.Remote are plain
worker clients, and the workstation preference lives in modelSeam and the
phraser.
(V-581)
One real defect, in the one package where a retained pointer is more than a nit.
decision.Ring.Push appended and then resliced forward without clearing the
dropped slots, so up to 25 aged-out records stayed addressable from the backing
array until the next append reallocated. Those records hold the owner's
utterances verbatim, and the package is memory-only precisely so his words do
not outlive the diagnosis. Push nils the dropped slots now.
The claim package doc had drifted. It claimed roughly ten stage-0 grammars and
four stateful pre-emptors. There are 22 grammar names in non-test router code
and 7 rungs in preRouteLadder. BandStructural names preRouteLadder as its
roster, so the count is checkable rather than remembered.
The band ordering has not drifted and stays as it is. The one apparent
inversion, stateful pre-emptors sitting below stage 0 while runTurn runs them
first, is the V-558 defect the band set exists to expose.
preRouteLadder matches runTurn exactly: seven names, seven notePreRoute call
sites, same order. querySourceNames derives from querySources rather than
duplicating it, so that roster cannot drift.
The agent corrected the brief on one point. internal/claim is not zero-caller.
router/claim.go defines ClaimOf and its helpers and claim_test.go exercises
them. Nothing in Route calls ClaimOf yet, which is V-560.
(V-581)
The WAV parser now walks chunk headers to find the data chunk instead of
scanning for the four bytes "data". A LIST chunk between fmt and data is
common, arecord and ffmpeg both write one, and its payload is free text that
can spell the word. A byte scan took that text for a chunk header and read the
comment as samples.
WAVHeader named WAVFromPCM in its error, so a caller of WAVHeader read the
wrong function. internal/capture calls it twice.
PCMFromWAV returns PCM that aliases the buffer it was given. That is the right
trade for a long recording and it was undocumented, so the doc comment now says
so and names the two ways a caller gets it wrong.
The TTS stub wrote 16000 three times. It reads the rate and the sample width
off audio.PCM16kMono now, so the tone stays in tune with the shape the seam
declares, and the sample write goes through binary.LittleEndian.
Identify computed the clip length twice to report it once.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The decision ring kept evicted turn records reachable. Push resliced the
backing array forward without clearing the dropped pointers, so up to
ringSize records stayed addressable until the next append reallocated. The
package holds this store in memory precisely so his words do not outlive the
diagnosis, and the reslice quietly broke that. Push now nils the dropped
slots first.
internal/claim carried three drifted counts in its package doc. The cascade
has twenty-two stage-0 grammars and not ten, and seven stateful pre-emptors
and not four. The band ordering itself did not drift: bandOf still maps stage
0 to anchored, the LLM router to structural and the classifier to nearest,
which is the order buildRouter and querySources actually run in.
BandStructural now names preRouteLadder as the roster so the next count is
checkable rather than remembered.
netscan formatted a port with fmt.Sprintf once per probe. A default scan is
1016 probes, so strconv.Itoa is the same string for less work, and the local
itoa helper goes with it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Two bugs a stranger can reach, both on the seam V-515 is about to put on the
network.
The netaddr token handshake ran inline in Listener.Accept, so a peer that
connected and never spoke was owed the full 5s handshake timeout, and no other
connection could be accepted during it. One unauthenticated stranger holding a
socket froze the seam. Accept now reads authorized conns off a channel fed by a
loop that greets each one in its own goroutine, and Close releases what is still
queued. A unix seam delegates straight through and grows nothing.
webauthn kept regs and asserts as bare maps, driven from four HTTP handlers. A
concurrent map write is a fatal runtime error rather than a recovered panic, so
two browsers beginning a challenge at once take the web daemon down, from an
endpoint that answers before any credential is proven. A mutex covers every
access, and lookup and delete fold into takeReg and takeAssert.
That fold is a security fix in its own right. Two replays of one response both
found the challenge before either deleted it, so a challenge was not single-use.
The clientDataJSON comparison is constant time now.
Checked and already right: every gating value comes from crypto/rand, expiry is
checked on use rather than on issue, readFrame caps at 4 MiB before allocating,
and internal/auth fails closed on every arm including AuthStepUp with a nil
session. stepUpOK's fail-open and fail-closed story rests on package behaviour,
since a nil PasskeySession returns false from IsStepUp.
(V-581)
Four real defects, two of them silent.
FactSpan built both instants as midnight.Add(hours). A day is 23 or 25 hours
wide on the two DST changeovers, so every span on those days was an hour off and
the busy gate read a 14:00 meeting as 13:00 or 15:00. Both readings are
time.Date now, and the midnight crossing is AddDate rather than adding 24 hours.
parseVEVENT split the block on newlines and trimmed each one, which destroys the
leading space that marks a folded continuation. Servers fold at 75 octets and a
Russian summary is two bytes a letter, so the tail of an ordinary weekly standup
was read as an unknown property and dropped. The event was filed under a
truncated name, and through safeKey a truncated fact key. Unfolding runs before
the split now.
RenderICal escaped TEXT and the parse never unescaped it, so a server-written
summary reached the day plan with its backslashes.
The MIME walk recursed with no depth cap and the nesting comes off the wire. A
boundary line is a few bytes, so one message inside MaxMessageBytes can declare
tens of thousands of levels. MaxMIMEDepth is 12 and the headers still come
through. Two whole-body copies went with it.
Read-only IMAP confirmed rather than assumed: EXAMINE not SELECT, BODY.PEEK not
BODY, and no STORE, APPEND, EXPUNGE, COPY or MOVE anywhere in the package or the
daemon. No credential is logged, and the dial seam is unexported so no caller
can point the reader at a plaintext transport.
internal/event needed nothing.
(V-581)
The RP kept its two in-flight challenge maps bare, and mavweb serves the four
passkey endpoints from HTTP handlers. Two browsers beginning a challenge at once
were a concurrent map write, which is a fatal runtime error rather than a
recovered panic, so it takes the daemon down. The endpoint that reaches it
answers before any credential is proven.
Every read and write of regs and asserts is now under a mutex. Lookup and delete
moved into takeReg and takeAssert so they happen under one hold, which is what
makes a challenge single-use: separately, two replays of the same response both
found it before either deleted it.
The challenge in clientDataJSON is compared in constant time. It is the one
secret in that blob, 32 bytes of crypto/rand the browser has to echo back, and a
byte-at-a-time compare is the shape that leaks a guessed prefix.
Also corrected the comment over ipc.codeOf, which claimed an unmatched error
keeps its text server-side. rpcErr ships that text deliberately, and on a tcp
seam it leaves the box.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A peer that connected and then said nothing froze the whole seam. The token
handshake ran inline in Listener.Accept, so the five seconds of handshakeTimeout
the silent peer was owed were five seconds no other connection could be
accepted. One unauthenticated stranger holding a socket open was a denial of
service on every daemon behind a tcp seam, which is the path V-515 is about to
put mavwaked and mavenclient on.
Accept now takes authorized connections off a channel. A background loop pulls
from the wrapped listener and greets each connection in its own goroutine, so a
slow greeting costs only its own connection. Listener.Close releases anything
still waiting to be handed over.
A unix seam delegates straight to the wrapped listener and grows no machinery,
because it has no handshake to run.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The MIME tree walk had no depth limit, and the nesting comes off the wire.
A boundary line is a few bytes, so one message inside MaxMessageBytes can
declare tens of thousands of multipart levels and pick the recursion depth
of a daemon reading his mail. MaxMIMEDepth stops the walk at 12, well past
the three levels real mail uses, and the headers still come through.
ParseMessage converted the raw message to a string to read it, which copied
up to 2 MiB per mail on a box already holding the resident model. It reads
the bytes directly now. decodeCP1251 collected runes and then copied them
into a string, four bytes a character for the whole body, and writes into a
Builder instead.
No behaviour change to what is read: EXAMINE and BODY.PEEK are still the
only mailbox commands, and no credential reaches a log line.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
FactSpan built both instants by adding a duration to local midnight, so on
the two DST changeover days every span was an hour off. A day is 23 or 25
hours wide there, and the busy gate then read a 14:00 meeting as 13:00 or
15:00. Both readings are time.Date now, and the midnight crossing is AddDate
rather than a 24-hour add.
The iCal parse did not unfold content lines. A server folds a property at 75
octets and a Russian summary is two bytes a letter, so the tail of an
ordinary weekly standup was read as an unknown property and dropped, and the
event was filed under a truncated name. RFC 5545 TEXT escapes are also
reversed now, which RenderICal has always written and the parse never undid.
Two regression tests: a folded and escaped summary, and a span across the
start of DST in Europe/Berlin.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A spoken defect she says out loud. ttsnorm rewrote a time as
p[1] + " часов " + p[2] + " минут", a literal join with no agreement and no
zero handling. So 21:00 was read as 21 часов, 22:00 as 22 часов, and 14:00 as
14 часов 00 минут. Russian inflects the noun after a numeral, and say.CountWord
already owns that rule. A new spokenTime calls it for both halves and drops the
minute clause when it is zero. 21:00 is 21 час now, and 22:02 is 22 часа 2
минуты.
persona held a fourth copy of the months and the weekdays as hand-written
arrays. CLAUDE.md names months a closed class with exactly one copy in
internal/lexicon, and ruwords.go already gave its copy up under V-525. The block
calls lexicon.Weekday and lexicon.MonthGenitive now, and the existing test
already asserted the output.
LoadSummaries required {n} and {days} on stall_sitting but not {word} or
{dayword}, the two count forms beside them. A variant dropping one would have
loaded and spoken a bare number.
The brief's premise about the persona checks was wrong and is worth recording.
The say lines are already folded into the same CheckAddress, CheckFeminine and
CheckCringe run as the four phraser families, at fallbacks_test.go:56. Read by
hand as well: the self-reference is feminine throughout, the owner is ты, and
there is no вы, no он and no pet name. They are checked and they pass.
(V-581)
A clock time read aloud now inflects its nouns and drops its leading zeros.
The old rewrite said "часов" for every hour and "минут" for every minute, so
21:00 came out as "21 часов" and 14:00 as "14 часов 00 минут". Russian
inflects a noun after a numeral and internal/say already owns that rule, so
spokenTime calls say.CountWord for both halves and omits the minutes when
there are none. 21:00 is "21 час", 22:02 is "22 часа 2 минуты", 14:00 is
"14 часов".
internal/persona held its own copies of the twelve months and the seven
weekdays. Both are closed classes and both already live in internal/lexicon,
which is where cmd/mavend/ruwords.go sent its copy. The block now reads
lexicon.Weekday and lexicon.MonthGenitive and carries no word list of its own.
LoadSummaries asserted that stall_sitting keeps its two counts and not the two
count words beside them. A variant dropping {word} or {dayword} would have
loaded and spoken a bare number. Both are required now.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The embedder prefix audit came back clean, which was the one finding worth
escalating. Every EmbedQuery, EmbedPassage and Embed call site across
internal/store, internal/memory and their cmd/mavend callers agrees. No naked
Embed on a note.
ReembedAll and RepairFactVectors each ran an identical select and scan over
memory_vectors before diverging on what to do with the row. One
allMemVectorMetas now, parameterized over a small interface so it serves
backfill's transaction and factvectors' plain read alike.
Two swallowed errors. AcceptProposedRoutine read RowsAffected with a discarded
error where every other call in the same file checks it, so a driver error read
as zero rows. MarkAcked did the same, and the branch it fed was dead, since both
arms returned nil. The swallowed error and the branch went together.
The agent refuted the rest of the brief. Repeated scans and swallowed errors
were one instance each rather than the pattern tasks.go showed. Both packages
carry per-type scan helpers already, and every magic value is already named with
its reason beside it, which reads as the residue of earlier sweep waves.
(V-581)
allMemVectorMetas (memory.go) replaces the identical query-then-scan
block ReembedAll and RepairFactVectors each had for reading id+meta
out of memory_vectors — same query, same json.Unmarshal, different
structs built from the result.
Two RowsAffected() errors were silently dropped with `_`, inconsistent
with every other call site in the same files: AcceptProposedRoutine
now wraps the error instead of treating it as zero rows, and MarkAcked
had it stranded behind a dead branch (both arms returned nil) removed
along with the swallowed error.
No behavior change; internal/store and internal/memory pass with
-race.
Three of the four packages were already clean on the brief's priorities. The
brief predicted missing timeouts and unbounded reads; websearch already had a
status check, a deferred close, a 4 MiB limit, an 8s total and a 1.5s connect
cap on a cloned transport.
The one bug with reach was a string grep across a package boundary.
crawl.isServerError decided whether a failed robots.txt blocks a crawl by
scanning err.Error() for " 50", " 51", " 52" and " 53", in a message built two
packages away. Rewording that message would silently turn a 503 robots.txt into
permission to crawl, which the surrounding comment says must never happen. Both
packages now carry a typed StatusError that unwraps to the existing sentinel, so
errors.Is is unchanged, and isServerError reads a number.
webfetch checked the status after reading the body, the same shape the weather
sweep found. A 500 pulled its error page up to MaxBytes off the wire, and an
error page over the cap returned ErrTooLarge, naming the size and hiding the
status. rss.Parse copied a feed document that can reach a megabyte through
strings.NewReader(string(...)).
Two comments claimed callers that do not exist.
The privacy invariant holds across all four. None of them can read the store.
rss.Ranker is the one seam that could carry notes outward, it is nil in the
daemon, and its doc states the constraint. Every regex here is over structured
input.
(V-581)
Four real bugs, all of them the kind that show as a wrong number or a silence.
tasks.Stalls compared Due against an instant while Rank compares whole calendar
days through dayDelta, under a long comment about that exact trap. Both render
on /tasks, so a task due at 09:00 counted as просрочено in the header from 09:01
while its own row still read сегодня. Stalls reads dayDelta now.
tasks.Stalls also counted a row with no capture time as sitting, because the
zero time is January of year 1. score() already guarded IsZero and Stalls did
not.
morning and routine both key their last-fired map by name, and neither Validate
rejected a duplicate. Two routines sharing one name take turns suppressing each
other, and the operator sees a routine that never runs and no error. Both
Validate functions reject it now.
parseHHMM checked digits arithmetically, so a stray character could cancel out.
window_start: "2 :00" parsed as 04:00 and passed the validation whose whole job
is catching that typo. All four positions are checked as digits, which makes the
negative bounds unreachable, so they are gone.
FormatRU and Spoken each carried a byte-identical open and candidate partition,
now one split. They have to agree on where that line falls, or she reads one
list and binds ordinals against another. The three copies of the unevidenced
item loop folded into one helper.
The not-a-nag check passes. All three packages are pure, return candidates, and
reach no sink.
(V-581)
One bug with teeth. capture.windowBytes computed int64(window.Seconds()) *
bytesPerSecond, truncating to whole seconds. A sub-second window came out as
zero bytes, which transcribeFile reads as no window, so it hands the transcriber
the entire recording in one call. Multiplied in float now.
One drifted comment. Peek said expired entries below the top are left alone. The
code deletes the whole stack, which is what Pop and TakeExpired both document.
The corrected comment also names the ordering the silent drop depends on:
TakeExpired must run before Peek on a turn, or the expiry notice is unreachable.
Two default TTL literals became DefaultClarifyTTL and DefaultSessionTTL, beside
the existing DefaultMaxAttempts. PendingQuestion was not gofmt clean.
Push and Pop are unused outside tests and stay. Push documents itself as the
widening V-561 fills in, and the stack tests cover it.
Neither package holds a Russian stem pattern. The only Russian strings are two
markers and two prompts, and none of them routes or becomes a fact.
(V-581)
A non-2xx reply was read in full first and only then rejected. Two costs
followed. A 500 with a large error page pulled up to MaxBytes off the wire for
nothing. An error page over the cap returned ErrTooLarge, which names the size
and hides the status the server actually sent.
The status is a typed error now. webfetch.StatusError carries the code and
unwraps to ErrStatus, so errors.Is keeps working and errors.As reads the number.
crawl.StatusError is the same shape on the other side of the seam, and
cmd/mavend/crawls.go carries the code across.
That removes the string grep in crawl.isServerError, which decided whether a
failed robots.txt blocks a crawl by looking for " 50" in an error message it did
not own. A reworded error would have turned a 503 robots.txt into permission to
crawl. It reads the code now.
Two comments corrected. webfetch.HostMatches said the crawler calls it and
nothing outside the package does. rss.PlainText said the crawler's extractor
goes through it and crawl/extract.go has its own pass.
The rss poller parses the feed straight off the byte slice instead of copying a
document that can run to a megabyte through a string.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Both Due functions key their last-fired map by routine name, so two routines sharing a name took turns suppressing each other and one of them never fired. Validate now rejects a duplicate name in either package.
parseHHMM checked the digits arithmetically, which let a stray character cancel out: window_start of 2 :00 loaded as 04:00 and passed the validation that exists to catch that typo. Each of the four positions is now checked as a digit, which makes the negative bounds unreachable and they are gone.
Folded the three copies of the unevidenced-item loop in Evaluate, Outstanding and Due into one helper.
One real bug. tool.Exec built argv as append(t.Cmd, args...), so an enabled row
with an empty Cmd made args[0] the program name. The len(argv) == 0 guard never
fired, because args is non-empty exactly when there is spoken text. That is free
text reaching a mutating call, in the one place that is literally exec.
It needed no compromise to reach. A proposal drafted with no cmd gets
TierDestructive from RiskOf, so one да clears the confirm, and then the tail of
the utterance runs as a program. Exec now refuses with ErrNotEnabled before it
builds argv, and TestExecEmptyCmdRefuses pins it.
Three smaller things. CapabilityOf hand-parsed a Home Assistant entity id where
smarthome.DomainOf owns that format. GroupByDomain recomputed its map key twice
per row. The zenmoney and Home Assistant clients both read a capped body before
the status check that throws it away, so the status check moved ahead of it.
Checked and found already right: risk.go reads Hexis rather than deriving and
sends unknown tiers up, smarthome.CallService drops spoken args and validates
the service against the controllable table, and zenmoney reads currency per
instrument rather than assuming one.
(V-581)
Stalls compared the due instant to now while Rank compares whole calendar days, so a task due at 09:00 was counted overdue from 09:01 while its own row on the same page still read the reason as today. Stalls now reads dayDelta.
A row with no capture time also counted as sitting, because the zero time is January of year 1 and every span from it clears ten days. Rank already guarded that and Stalls did not.
Folded the open-versus-candidate partition FormatRU and Spoken each carried into one split helper. The two have to agree on where that line falls.
Sweep of internal/capture and internal/dialogue. Both packages were already in
good shape, so this is four small corrections rather than a rework.
windowBytes truncated the STT window to whole seconds. A sub-second window
therefore came out as zero bytes, which transcribeFile reads as "no window" and
answers by handing the transcriber the whole meeting in one call. The
multiplication is now done in float, so a fractional window is a real window.
Peek's comment claimed expired entries below the top are left alone. The code
deletes the whole stack, which is what Pop and TakeExpired both document and
what the clock argues for. The comment now says so, and it names the ordering
the silent drop depends on: TakeExpired has to run before Peek on a turn or the
expiry notice becomes unreachable.
The two store default TTLs were unnamed literals. They are DefaultClarifyTTL
and DefaultSessionTTL now, next to DefaultMaxAttempts, and the comment on each
says why the clarify one is the shorter of the two.
PendingQuestion was not gofmt clean and ChunkText copied a slice one element at
a time.
Full suite passes with -race.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
An enabled row whose Cmd is empty built argv from the spoken args alone. So
args[0] became the program name, and free text picked the binary. A proposal is
drafted with no cmd. /tools can enable one before anybody fills it in, so
reaching this took no compromise. Exec now refuses such a row with ErrNotEnabled
before it builds argv. TestExecEmptyCmdRefuses pins it.
Three smaller reads in the same sweep. CapabilityOf parsed a Home Assistant
entity id by hand where smarthome.DomainOf already does it. The fallback for an
id with no dot is unchanged. GroupByDomain built its map key twice per row. The
zenmoney and Home Assistant HTTP clients read an error body before checking the
status that discards it. The status check moved ahead of the read in both.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Read all of mavsttd, mavttsd, mavwaked and mavenclient. What changed is small
and behaviour-preserving: whisperThreads and noSpeechFloor named in
whisper_handler.go, piperSampleRate and targetSampleRate named in
piper_handler.go where 22050 and 16000 were repeated four times across the
resampler, and mavenclient/main.go lost four imports kept alive by var _ lines
for helpers that never arrived.
Three things the sweep checked and found already right, which is why they are
worth recording. mavwaked's header says it has no wake-word model, which is
true and matches V-487 rather than being a drifted comment. whisperHandler.Close
does not race an in-flight Transcribe, because worker.Server.Close closes the
listener and then waits on the group before main's deferred Close runs. No
subprocess, pipe or CGO context leaks on an error path.
defaultSocket is genuinely duplicated between mavsttd and mavttsd and stays
that way: folding it means exporting an unexported config helper, which is a
larger change than this sweep's scope.
The agent refuted the brief's prediction of swallowed errors and leaked
handles. This file set had magic values and dead code instead.
(V-581)
mavsttd/whisper_handler.go: name the no_speech_prob confidence-zeroing
floor (0.9) and the whisper thread count (4), both previously bare
literals with no reason attached.
mavttsd/piper_handler.go: name piper's render rate (22050) and the
canonical wire rate (16000) used by the resampler, instead of repeating
the two numbers inline four times.
mavenclient/main.go: remove the strconv/io/net/time imports and their
`var _ = ...` keep-alive lines — dead weight with no caller, not future
scaffolding.
Behaviour-preserving; no test changed. go test -race ./internal/...
./cmd/... is green.
V-592 is a phrasing defect. The store was never wrong: DefaultFactParser files
я выпил воды as key=water value=drank, and no стакан reaches the index. The
glass was copied out of the prompt. ReplySystemPrompt's example was literally
'Записала, что ты выпил стакан воды', replyContext hands the model
'записала факт: water "drank"' with no Russian to work from, and the nearest
plausible sentence in context was the example itself. выпел is the 1.7B
garbling the verb.
So the fact path stops generating and echoes, per V-576. The prompt example is
contentless now. Two smaller things fell out: the stub read the parser's key
back at him as 'отметила: water = "drank"', and a fact clarified out of запиши
confirmed as запиши, because a fact answer fills no Text slot.
V-593: whenKnownOf reads the three things he must say off the same predicates
whenGapOf uses. An answer that moved any of them forward puts 'Поняла: <his
words>.' between the clock and the question. An answer that moved nothing
repeats the question unchanged, which is honest. The acknowledgement echoes and
never restates, for the same reason as V-592.
A new differs field on a trace turn fails a byte-identical consecutive reply.
Open for the owner: whether the clock repeats on every ask of one flow. He
ruled that she states the time, not that she states it on every question.
(V-592) (V-593)
After "на 9" and then "на завтра" she asked "Сейчас 02:34. Это утра или
вечера?" twice, byte for byte. Asking again is right — the half of the
day is still unsaid — but a reply with no trace of his turn in it is
indistinguishable from not having been heard, which is the failure mode
the V-558 family exists to remove.
whenKnownOf reads the three things he has to say about the time off the
same predicates whenGapOf reads. When his answer moved any of them
forward, the ask carries an acknowledgement of what it took, in his own
words and never a restatement: a 1.7B asked to say a Russian sentence
back is exactly where V-592 came from. When it moved nothing, there is
nothing to acknowledge and the question repeats honestly.
The clock still opens every time question, per the owner's ruling. The
acknowledgement goes between it and the question. Whether she should
state the clock on every ask of one flow is his call, not mine.
Also folds a fact's raw answer into the parked utterance (V-592): a fact
fills no Text slot, so "запиши" + "пил воду" confirmed as "запиши".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
"я выпил воды" came back as "Проверила, что ты выпел стакан воды". The
verb is not a Russian word, the glass was never mentioned, and nothing
had been checked.
The store was right throughout: DefaultFactParser files this as
key=water value="drank", and no row anywhere held "стакан". Every
Russian word in that sentence was generated. replyContext hands the
model "записала факт: water \"drank\"", so the model had nothing to
phrase FROM and reached for the nearest plausible sentence — the example
in ReplySystemPrompt, which was literally "Записала, что ты выпил стакан
воды."
So the fact path stops generating, the way the note payload did in
V-576. The confirmation is a fixed deck frame with his own sentence in
it, in both repliers, and the prompt example is contentless now. The
stub also read the parser's KEY back at him, which is machine
vocabulary he never said.
The clarify half of this — a fact clarified out of "запиши" answers with
"запиши" and nothing else — lands with V-593, which touches the same
lines.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A Hexis 401 was spoken as an outage, which sent the owner to inspect a service
running fine when the fix is a token in config. errors.As could never match:
the vendored client is a separate implementation and wraps nothing in
*ecosystemError. hexisError re-wraps at Maven's boundary, mapping the
http.StatusText spelling back to a code, with anything unrecognised staying at
status 0, which is Unreachable.
The execute hop did not call ecosystemGap at all and named neither the service
nor the cause. It does now, but only for an ecosystem error: an execution Hexis
accepted and then failed keeps ActFailEntity, because calling a failed restart
an outage is the same defect pointed the other way.
A Praxis failure named no service. The classifiers already worked and handle()
threw the answer away.
Authorization is untouched. A 401 is still terminal. Only the sentence changed.
No new Russian was written; both halves are shipped lines.
The boundary adapter is the wrong layer and says so in a comment. Parsing
http.StatusText output is a string contract with another repo, and a typed
Hexis-side error carrying the code is the real fix.
(V-587) (V-588)
praxisItemAction.handle returned a hardcoded per-verb constant on any error, so
a Praxis outage, a refused token, a contract mismatch and a decode failure all
said the same thing and none of them said "Praxis". The information already
existed: praxisClient embeds ecosystemHTTP, so the error is an *ecosystemError
with working classifiers, and handle() logged it, traced it and threw it away.
servicePraxis joins the two service constants and the failure goes through
ecosystemGap, which is what Nexus and Hexis already use. The per-verb string is
kept in front of it rather than replaced: it carries which operation did not
happen, and the trace is the only other place that exists. No new Russian is
added — both halves are lines that already ship.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The vendored Hexis client is a separate implementation and returns a plain
fmt.Errorf for every status at or above 400, so errors.As for *ecosystemError
never matched, Unauthorized() was never consulted, and ecosystemGap always fell
through to the outage line. A wrong token sent him to inspect a healthy service.
hexisError classifies at Maven's boundary, since the client is vendored from
another repo and a local edit there is lost on the next re-vendor. The status
text is the only signal that survives the wrapping, so that is what it reads;
anything unrecognised stays at status 0, which is what Unreachable() means. The
correct fix is a typed error upstream carrying the code, and Maven cannot land
it unilaterally.
execHexis is the second site and it did not call ecosystemGap at all. It now
does, but only for a failure that belongs to the service. An execution that Hexis
accepted and that then failed keeps the command-level line: that is the command
failing, not Hexis degrading, and calling it an outage would be the same defect
pointed the other way. Authorization is unchanged: a 401 is still a refusal, it
is not retried and nothing proceeds on it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
CurrentWeather and geocodeOne decoded the body without checking the status, so
a non-200 became a successful zero-value answer. He was told it is 0 degrees,
or that the city he named does not exist. The second blamed him for a service
failure.
Both now check the status and return an error naming it. The caller needed no
change: it already branches on not-configured, unknown-location and a generic
error in that order. Three httptest cases cover what nothing covered before.
A 500 and a connection refused still produce one sentence, and the agent said
so rather than rounding it up. Splitting them was not asked for and both are an
honest named gap.
(V-589)
Neither CurrentWeather nor geocodeOne checked resp.StatusCode, so a
non-200 forecast reply decoded into a zero-value struct reported as a
real 0-degree answer, and a non-200 geocode reply decoded into an empty
result list and was reported as ErrLocationUnknown — blaming the owner
for a service outage. Both now check http.StatusOK first, matching the
sibling kiwix and websearch clients, and return a wrapped error naming
the status instead.
Adds httptest coverage for a 500 from the forecast endpoint, a 500 from
the geocode endpoint, and a genuine empty geocode result, asserting each
takes a different path.
claude
claude