Four real defects, two of them silent.
FactSpan built both instants as midnight.Add(hours). A day is 23 or 25 hours
wide on the two DST changeovers, so every span on those days was an hour off and
the busy gate read a 14:00 meeting as 13:00 or 15:00. Both readings are
time.Date now, and the midnight crossing is AddDate rather than adding 24 hours.
parseVEVENT split the block on newlines and trimmed each one, which destroys the
leading space that marks a folded continuation. Servers fold at 75 octets and a
Russian summary is two bytes a letter, so the tail of an ordinary weekly standup
was read as an unknown property and dropped. The event was filed under a
truncated name, and through safeKey a truncated fact key. Unfolding runs before
the split now.
RenderICal escaped TEXT and the parse never unescaped it, so a server-written
summary reached the day plan with its backslashes.
The MIME walk recursed with no depth cap and the nesting comes off the wire. A
boundary line is a few bytes, so one message inside MaxMessageBytes can declare
tens of thousands of levels. MaxMIMEDepth is 12 and the headers still come
through. Two whole-body copies went with it.
Read-only IMAP confirmed rather than assumed: EXAMINE not SELECT, BODY.PEEK not
BODY, and no STORE, APPEND, EXPUNGE, COPY or MOVE anywhere in the package or the
daemon. No credential is logged, and the dial seam is unexported so no caller
can point the reader at a plaintext transport.
internal/event needed nothing.
(V-581)
The MIME tree walk had no depth limit, and the nesting comes off the wire.
A boundary line is a few bytes, so one message inside MaxMessageBytes can
declare tens of thousands of multipart levels and pick the recursion depth
of a daemon reading his mail. MaxMIMEDepth stops the walk at 12, well past
the three levels real mail uses, and the headers still come through.
ParseMessage converted the raw message to a string to read it, which copied
up to 2 MiB per mail on a box already holding the resident model. It reads
the bytes directly now. decodeCP1251 collected runes and then copied them
into a string, four bytes a character for the whole body, and writes into a
Builder instead.
No behaviour change to what is read: EXAMINE and BODY.PEEK are still the
only mailbox commands, and no credential reaches a log line.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
FactSpan built both instants by adding a duration to local midnight, so on
the two DST changeover days every span was an hour off. A day is 23 or 25
hours wide there, and the busy gate then read a 14:00 meeting as 13:00 or
15:00. Both readings are time.Date now, and the midnight crossing is AddDate
rather than a 24-hour add.
The iCal parse did not unfold content lines. A server folds a property at 75
octets and a Russian summary is two bytes a letter, so the tail of an
ordinary weekly standup was read as an unknown property and dropped, and the
event was filed under a truncated name. RFC 5545 TEXT escapes are also
reversed now, which RenderICal has always written and the parse never undid.
Two regression tests: a folded and escaped summary, and a span across the
start of DST in Europe/Berlin.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A spoken defect she says out loud. ttsnorm rewrote a time as
p[1] + " часов " + p[2] + " минут", a literal join with no agreement and no
zero handling. So 21:00 was read as 21 часов, 22:00 as 22 часов, and 14:00 as
14 часов 00 минут. Russian inflects the noun after a numeral, and say.CountWord
already owns that rule. A new spokenTime calls it for both halves and drops the
minute clause when it is zero. 21:00 is 21 час now, and 22:02 is 22 часа 2
минуты.
persona held a fourth copy of the months and the weekdays as hand-written
arrays. CLAUDE.md names months a closed class with exactly one copy in
internal/lexicon, and ruwords.go already gave its copy up under V-525. The block
calls lexicon.Weekday and lexicon.MonthGenitive now, and the existing test
already asserted the output.
LoadSummaries required {n} and {days} on stall_sitting but not {word} or
{dayword}, the two count forms beside them. A variant dropping one would have
loaded and spoken a bare number.
The brief's premise about the persona checks was wrong and is worth recording.
The say lines are already folded into the same CheckAddress, CheckFeminine and
CheckCringe run as the four phraser families, at fallbacks_test.go:56. Read by
hand as well: the self-reference is feminine throughout, the owner is ты, and
there is no вы, no он and no pet name. They are checked and they pass.
(V-581)
A clock time read aloud now inflects its nouns and drops its leading zeros.
The old rewrite said "часов" for every hour and "минут" for every minute, so
21:00 came out as "21 часов" and 14:00 as "14 часов 00 минут". Russian
inflects a noun after a numeral and internal/say already owns that rule, so
spokenTime calls say.CountWord for both halves and omits the minutes when
there are none. 21:00 is "21 час", 22:02 is "22 часа 2 минуты", 14:00 is
"14 часов".
internal/persona held its own copies of the twelve months and the seven
weekdays. Both are closed classes and both already live in internal/lexicon,
which is where cmd/mavend/ruwords.go sent its copy. The block now reads
lexicon.Weekday and lexicon.MonthGenitive and carries no word list of its own.
LoadSummaries asserted that stall_sitting keeps its two counts and not the two
count words beside them. A variant dropping {word} or {dayword} would have
loaded and spoken a bare number. Both are required now.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The embedder prefix audit came back clean, which was the one finding worth
escalating. Every EmbedQuery, EmbedPassage and Embed call site across
internal/store, internal/memory and their cmd/mavend callers agrees. No naked
Embed on a note.
ReembedAll and RepairFactVectors each ran an identical select and scan over
memory_vectors before diverging on what to do with the row. One
allMemVectorMetas now, parameterized over a small interface so it serves
backfill's transaction and factvectors' plain read alike.
Two swallowed errors. AcceptProposedRoutine read RowsAffected with a discarded
error where every other call in the same file checks it, so a driver error read
as zero rows. MarkAcked did the same, and the branch it fed was dead, since both
arms returned nil. The swallowed error and the branch went together.
The agent refuted the rest of the brief. Repeated scans and swallowed errors
were one instance each rather than the pattern tasks.go showed. Both packages
carry per-type scan helpers already, and every magic value is already named with
its reason beside it, which reads as the residue of earlier sweep waves.
(V-581)
allMemVectorMetas (memory.go) replaces the identical query-then-scan
block ReembedAll and RepairFactVectors each had for reading id+meta
out of memory_vectors — same query, same json.Unmarshal, different
structs built from the result.
Two RowsAffected() errors were silently dropped with `_`, inconsistent
with every other call site in the same files: AcceptProposedRoutine
now wraps the error instead of treating it as zero rows, and MarkAcked
had it stranded behind a dead branch (both arms returned nil) removed
along with the swallowed error.
No behavior change; internal/store and internal/memory pass with
-race.
Three of the four packages were already clean on the brief's priorities. The
brief predicted missing timeouts and unbounded reads; websearch already had a
status check, a deferred close, a 4 MiB limit, an 8s total and a 1.5s connect
cap on a cloned transport.
The one bug with reach was a string grep across a package boundary.
crawl.isServerError decided whether a failed robots.txt blocks a crawl by
scanning err.Error() for " 50", " 51", " 52" and " 53", in a message built two
packages away. Rewording that message would silently turn a 503 robots.txt into
permission to crawl, which the surrounding comment says must never happen. Both
packages now carry a typed StatusError that unwraps to the existing sentinel, so
errors.Is is unchanged, and isServerError reads a number.
webfetch checked the status after reading the body, the same shape the weather
sweep found. A 500 pulled its error page up to MaxBytes off the wire, and an
error page over the cap returned ErrTooLarge, naming the size and hiding the
status. rss.Parse copied a feed document that can reach a megabyte through
strings.NewReader(string(...)).
Two comments claimed callers that do not exist.
The privacy invariant holds across all four. None of them can read the store.
rss.Ranker is the one seam that could carry notes outward, it is nil in the
daemon, and its doc states the constraint. Every regex here is over structured
input.
(V-581)
Four real bugs, all of them the kind that show as a wrong number or a silence.
tasks.Stalls compared Due against an instant while Rank compares whole calendar
days through dayDelta, under a long comment about that exact trap. Both render
on /tasks, so a task due at 09:00 counted as просрочено in the header from 09:01
while its own row still read сегодня. Stalls reads dayDelta now.
tasks.Stalls also counted a row with no capture time as sitting, because the
zero time is January of year 1. score() already guarded IsZero and Stalls did
not.
morning and routine both key their last-fired map by name, and neither Validate
rejected a duplicate. Two routines sharing one name take turns suppressing each
other, and the operator sees a routine that never runs and no error. Both
Validate functions reject it now.
parseHHMM checked digits arithmetically, so a stray character could cancel out.
window_start: "2 :00" parsed as 04:00 and passed the validation whose whole job
is catching that typo. All four positions are checked as digits, which makes the
negative bounds unreachable, so they are gone.
FormatRU and Spoken each carried a byte-identical open and candidate partition,
now one split. They have to agree on where that line falls, or she reads one
list and binds ordinals against another. The three copies of the unevidenced
item loop folded into one helper.
The not-a-nag check passes. All three packages are pure, return candidates, and
reach no sink.
(V-581)
One bug with teeth. capture.windowBytes computed int64(window.Seconds()) *
bytesPerSecond, truncating to whole seconds. A sub-second window came out as
zero bytes, which transcribeFile reads as no window, so it hands the transcriber
the entire recording in one call. Multiplied in float now.
One drifted comment. Peek said expired entries below the top are left alone. The
code deletes the whole stack, which is what Pop and TakeExpired both document.
The corrected comment also names the ordering the silent drop depends on:
TakeExpired must run before Peek on a turn, or the expiry notice is unreachable.
Two default TTL literals became DefaultClarifyTTL and DefaultSessionTTL, beside
the existing DefaultMaxAttempts. PendingQuestion was not gofmt clean.
Push and Pop are unused outside tests and stay. Push documents itself as the
widening V-561 fills in, and the stack tests cover it.
Neither package holds a Russian stem pattern. The only Russian strings are two
markers and two prompts, and none of them routes or becomes a fact.
(V-581)
A non-2xx reply was read in full first and only then rejected. Two costs
followed. A 500 with a large error page pulled up to MaxBytes off the wire for
nothing. An error page over the cap returned ErrTooLarge, which names the size
and hides the status the server actually sent.
The status is a typed error now. webfetch.StatusError carries the code and
unwraps to ErrStatus, so errors.Is keeps working and errors.As reads the number.
crawl.StatusError is the same shape on the other side of the seam, and
cmd/mavend/crawls.go carries the code across.
That removes the string grep in crawl.isServerError, which decided whether a
failed robots.txt blocks a crawl by looking for " 50" in an error message it did
not own. A reworded error would have turned a 503 robots.txt into permission to
crawl. It reads the code now.
Two comments corrected. webfetch.HostMatches said the crawler calls it and
nothing outside the package does. rss.PlainText said the crawler's extractor
goes through it and crawl/extract.go has its own pass.
The rss poller parses the feed straight off the byte slice instead of copying a
document that can run to a megabyte through a string.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Both Due functions key their last-fired map by routine name, so two routines sharing a name took turns suppressing each other and one of them never fired. Validate now rejects a duplicate name in either package.
parseHHMM checked the digits arithmetically, which let a stray character cancel out: window_start of 2 :00 loaded as 04:00 and passed the validation that exists to catch that typo. Each of the four positions is now checked as a digit, which makes the negative bounds unreachable and they are gone.
Folded the three copies of the unevidenced-item loop in Evaluate, Outstanding and Due into one helper.
One real bug. tool.Exec built argv as append(t.Cmd, args...), so an enabled row
with an empty Cmd made args[0] the program name. The len(argv) == 0 guard never
fired, because args is non-empty exactly when there is spoken text. That is free
text reaching a mutating call, in the one place that is literally exec.
It needed no compromise to reach. A proposal drafted with no cmd gets
TierDestructive from RiskOf, so one да clears the confirm, and then the tail of
the utterance runs as a program. Exec now refuses with ErrNotEnabled before it
builds argv, and TestExecEmptyCmdRefuses pins it.
Three smaller things. CapabilityOf hand-parsed a Home Assistant entity id where
smarthome.DomainOf owns that format. GroupByDomain recomputed its map key twice
per row. The zenmoney and Home Assistant clients both read a capped body before
the status check that throws it away, so the status check moved ahead of it.
Checked and found already right: risk.go reads Hexis rather than deriving and
sends unknown tiers up, smarthome.CallService drops spoken args and validates
the service against the controllable table, and zenmoney reads currency per
instrument rather than assuming one.
(V-581)
Stalls compared the due instant to now while Rank compares whole calendar days, so a task due at 09:00 was counted overdue from 09:01 while its own row on the same page still read the reason as today. Stalls now reads dayDelta.
A row with no capture time also counted as sitting, because the zero time is January of year 1 and every span from it clears ten days. Rank already guarded that and Stalls did not.
Folded the open-versus-candidate partition FormatRU and Spoken each carried into one split helper. The two have to agree on where that line falls.
Sweep of internal/capture and internal/dialogue. Both packages were already in
good shape, so this is four small corrections rather than a rework.
windowBytes truncated the STT window to whole seconds. A sub-second window
therefore came out as zero bytes, which transcribeFile reads as "no window" and
answers by handing the transcriber the whole meeting in one call. The
multiplication is now done in float, so a fractional window is a real window.
Peek's comment claimed expired entries below the top are left alone. The code
deletes the whole stack, which is what Pop and TakeExpired both document and
what the clock argues for. The comment now says so, and it names the ordering
the silent drop depends on: TakeExpired has to run before Peek on a turn or the
expiry notice becomes unreachable.
The two store default TTLs were unnamed literals. They are DefaultClarifyTTL
and DefaultSessionTTL now, next to DefaultMaxAttempts, and the comment on each
says why the clarify one is the shorter of the two.
PendingQuestion was not gofmt clean and ChunkText copied a slice one element at
a time.
Full suite passes with -race.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
An enabled row whose Cmd is empty built argv from the spoken args alone. So
args[0] became the program name, and free text picked the binary. A proposal is
drafted with no cmd. /tools can enable one before anybody fills it in, so
reaching this took no compromise. Exec now refuses such a row with ErrNotEnabled
before it builds argv. TestExecEmptyCmdRefuses pins it.
Three smaller reads in the same sweep. CapabilityOf parsed a Home Assistant
entity id by hand where smarthome.DomainOf already does it. The fallback for an
id with no dot is unchanged. GroupByDomain built its map key twice per row. The
zenmoney and Home Assistant HTTP clients read an error body before checking the
status that discards it. The status check moved ahead of the read in both.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Read all of mavsttd, mavttsd, mavwaked and mavenclient. What changed is small
and behaviour-preserving: whisperThreads and noSpeechFloor named in
whisper_handler.go, piperSampleRate and targetSampleRate named in
piper_handler.go where 22050 and 16000 were repeated four times across the
resampler, and mavenclient/main.go lost four imports kept alive by var _ lines
for helpers that never arrived.
Three things the sweep checked and found already right, which is why they are
worth recording. mavwaked's header says it has no wake-word model, which is
true and matches V-487 rather than being a drifted comment. whisperHandler.Close
does not race an in-flight Transcribe, because worker.Server.Close closes the
listener and then waits on the group before main's deferred Close runs. No
subprocess, pipe or CGO context leaks on an error path.
defaultSocket is genuinely duplicated between mavsttd and mavttsd and stays
that way: folding it means exporting an unexported config helper, which is a
larger change than this sweep's scope.
The agent refuted the brief's prediction of swallowed errors and leaked
handles. This file set had magic values and dead code instead.
(V-581)
mavsttd/whisper_handler.go: name the no_speech_prob confidence-zeroing
floor (0.9) and the whisper thread count (4), both previously bare
literals with no reason attached.
mavttsd/piper_handler.go: name piper's render rate (22050) and the
canonical wire rate (16000) used by the resampler, instead of repeating
the two numbers inline four times.
mavenclient/main.go: remove the strconv/io/net/time imports and their
`var _ = ...` keep-alive lines — dead weight with no caller, not future
scaffolding.
Behaviour-preserving; no test changed. go test -race ./internal/...
./cmd/... is green.
V-592 is a phrasing defect. The store was never wrong: DefaultFactParser files
я выпил воды as key=water value=drank, and no стакан reaches the index. The
glass was copied out of the prompt. ReplySystemPrompt's example was literally
'Записала, что ты выпил стакан воды', replyContext hands the model
'записала факт: water "drank"' with no Russian to work from, and the nearest
plausible sentence in context was the example itself. выпел is the 1.7B
garbling the verb.
So the fact path stops generating and echoes, per V-576. The prompt example is
contentless now. Two smaller things fell out: the stub read the parser's key
back at him as 'отметила: water = "drank"', and a fact clarified out of запиши
confirmed as запиши, because a fact answer fills no Text slot.
V-593: whenKnownOf reads the three things he must say off the same predicates
whenGapOf uses. An answer that moved any of them forward puts 'Поняла: <his
words>.' between the clock and the question. An answer that moved nothing
repeats the question unchanged, which is honest. The acknowledgement echoes and
never restates, for the same reason as V-592.
A new differs field on a trace turn fails a byte-identical consecutive reply.
Open for the owner: whether the clock repeats on every ask of one flow. He
ruled that she states the time, not that she states it on every question.
(V-592) (V-593)
After "на 9" and then "на завтра" she asked "Сейчас 02:34. Это утра или
вечера?" twice, byte for byte. Asking again is right — the half of the
day is still unsaid — but a reply with no trace of his turn in it is
indistinguishable from not having been heard, which is the failure mode
the V-558 family exists to remove.
whenKnownOf reads the three things he has to say about the time off the
same predicates whenGapOf reads. When his answer moved any of them
forward, the ask carries an acknowledgement of what it took, in his own
words and never a restatement: a 1.7B asked to say a Russian sentence
back is exactly where V-592 came from. When it moved nothing, there is
nothing to acknowledge and the question repeats honestly.
The clock still opens every time question, per the owner's ruling. The
acknowledgement goes between it and the question. Whether she should
state the clock on every ask of one flow is his call, not mine.
Also folds a fact's raw answer into the parked utterance (V-592): a fact
fills no Text slot, so "запиши" + "пил воду" confirmed as "запиши".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
"я выпил воды" came back as "Проверила, что ты выпел стакан воды". The
verb is not a Russian word, the glass was never mentioned, and nothing
had been checked.
The store was right throughout: DefaultFactParser files this as
key=water value="drank", and no row anywhere held "стакан". Every
Russian word in that sentence was generated. replyContext hands the
model "записала факт: water \"drank\"", so the model had nothing to
phrase FROM and reached for the nearest plausible sentence — the example
in ReplySystemPrompt, which was literally "Записала, что ты выпил стакан
воды."
So the fact path stops generating, the way the note payload did in
V-576. The confirmation is a fixed deck frame with his own sentence in
it, in both repliers, and the prompt example is contentless now. The
stub also read the parser's KEY back at him, which is machine
vocabulary he never said.
The clarify half of this — a fact clarified out of "запиши" answers with
"запиши" and nothing else — lands with V-593, which touches the same
lines.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A Hexis 401 was spoken as an outage, which sent the owner to inspect a service
running fine when the fix is a token in config. errors.As could never match:
the vendored client is a separate implementation and wraps nothing in
*ecosystemError. hexisError re-wraps at Maven's boundary, mapping the
http.StatusText spelling back to a code, with anything unrecognised staying at
status 0, which is Unreachable.
The execute hop did not call ecosystemGap at all and named neither the service
nor the cause. It does now, but only for an ecosystem error: an execution Hexis
accepted and then failed keeps ActFailEntity, because calling a failed restart
an outage is the same defect pointed the other way.
A Praxis failure named no service. The classifiers already worked and handle()
threw the answer away.
Authorization is untouched. A 401 is still terminal. Only the sentence changed.
No new Russian was written; both halves are shipped lines.
The boundary adapter is the wrong layer and says so in a comment. Parsing
http.StatusText output is a string contract with another repo, and a typed
Hexis-side error carrying the code is the real fix.
(V-587) (V-588)
praxisItemAction.handle returned a hardcoded per-verb constant on any error, so
a Praxis outage, a refused token, a contract mismatch and a decode failure all
said the same thing and none of them said "Praxis". The information already
existed: praxisClient embeds ecosystemHTTP, so the error is an *ecosystemError
with working classifiers, and handle() logged it, traced it and threw it away.
servicePraxis joins the two service constants and the failure goes through
ecosystemGap, which is what Nexus and Hexis already use. The per-verb string is
kept in front of it rather than replaced: it carries which operation did not
happen, and the trace is the only other place that exists. No new Russian is
added — both halves are lines that already ship.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The vendored Hexis client is a separate implementation and returns a plain
fmt.Errorf for every status at or above 400, so errors.As for *ecosystemError
never matched, Unauthorized() was never consulted, and ecosystemGap always fell
through to the outage line. A wrong token sent him to inspect a healthy service.
hexisError classifies at Maven's boundary, since the client is vendored from
another repo and a local edit there is lost on the next re-vendor. The status
text is the only signal that survives the wrapping, so that is what it reads;
anything unrecognised stays at status 0, which is what Unreachable() means. The
correct fix is a typed error upstream carrying the code, and Maven cannot land
it unilaterally.
execHexis is the second site and it did not call ecosystemGap at all. It now
does, but only for a failure that belongs to the service. An execution that Hexis
accepted and that then failed keeps the command-level line: that is the command
failing, not Hexis degrading, and calling it an outage would be the same defect
pointed the other way. Authorization is unchanged: a 401 is still a refusal, it
is not retried and nothing proceeds on it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
CurrentWeather and geocodeOne decoded the body without checking the status, so
a non-200 became a successful zero-value answer. He was told it is 0 degrees,
or that the city he named does not exist. The second blamed him for a service
failure.
Both now check the status and return an error naming it. The caller needed no
change: it already branches on not-configured, unknown-location and a generic
error in that order. Three httptest cases cover what nothing covered before.
A 500 and a connection refused still produce one sentence, and the agent said
so rather than rounding it up. Splitting them was not asked for and both are an
honest named gap.
(V-589)
Neither CurrentWeather nor geocodeOne checked resp.StatusCode, so a
non-200 forecast reply decoded into a zero-value struct reported as a
real 0-degree answer, and a non-200 geocode reply decoded into an empty
result list and was reported as ErrLocationUnknown — blaming the owner
for a service outage. Both now check http.StatusOK first, matching the
sibling kiwix and websearch clients, and return a wrapped error naming
the status instead.
Adds httptest coverage for a 500 from the forecast endpoint, a 500 from
the geocode endpoint, and a genuine empty geocode result, asserting each
takes a different path.
Two bare client timeouts named. Everything else in kiwix, weather and websearch
matched its description, including the measured dual-timeout transport that
only the internet-facing SearXNG leg carries. Unifying that would undo V-508.
Neither client sends anything but the query string. No note, fact or persona
block reaches an upstream engine.
Filed rather than fixed, V-589: the weather client checks no status code before
decoding, so a non-200 becomes a successful zero-value answer. He is told it is
0 degrees, or that a city he named does not exist.
(V-581)
Both clients used a bare 10*time.Second literal for the http.Client
timeout, unlike websearch.DefaultTimeout which carries a comment
explaining the number. Naming them puts the reason (LAN ZIM read vs.
a public API over the internet) next to the value; the constants
equal what was there before, so behaviour is unchanged.
Markdown only, and the pre-commit hook refuses master, so --no-verify.
All four of the owner's cases hold. The invented clock is gone and the agenda
question mid-flow now reaches the calendar. Two new defects, V-592 and V-593.
The pinned acceptance transcript is superseded by the rule the owner ruled
after writing it, and the doc says where they disagree.
narrativeQueryBuild hand-rolled a nested token loop that hasTok already does,
identically, in question.go and calendar.go. AnaphoraResolver's doc claimed
Resolve returns a key and value pair; it returns a ref and an ok. The pronoun
list omitted cases the switch already handles.
Filed rather than fixed, V-586: DefaultFactParser matches Russian by
hand-written substring stem and is wired live through voicewire.go. That is the
fourth mechanism CLAUDE.md says was swept out on 2026-08-04, and its output is a
fact. Changing it needs its own measurement.
Classifier baseline unmoved at 27/91 before and after. The ONNX tests skip
without the model and the cascade number needs a live llama-server.
(V-581)
One shared response-body read cap named. Both daemons wrote 4<<20 as a bare
literal in two files with no reason beside it.
The rest of the brief was refuted. No swallowed error, no drifted comment, no
repeated connect block. The IMAP password is read once from a file, never
logged, and never crosses to core: mailIngester has one method and it takes
mail content. internal/email/imap.go names no STORE, Seen, Move or Delete verb,
so read-only holds.
(V-581)
narrativeQueryBuild reimplemented the "any token in list" check the
package already has as hasTok; use it instead of a nested loop.
AnaphoraResolver's doc comments described a stale return shape (a
key/value pair) and an incomplete pronoun list (missing the "that" and
"mine" classes the switch already handled) — fixed the comments to
match the code, no behaviour change.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
fetchEvents and listPublished both bounded their HTTP body reads at
4<<20 with no name for what the number was for. One constant,
maxResponseBody, documents the reason (cap every CalDAV response this
daemon reads) once instead of twice. No functional change.
The study named four live defects in the ecosystem clients and left them in a
plan doc nobody reads by default. Each is now its own task, and the doc points
at the ids so the plan and the tracker agree.
V-587 a Hexis 401 is spoken as an outage, because the vendored client returns a
plain error and unauthorizedEcosystemError's errors.As can never match it.
Worst of the four: it is the only one that makes the owner check a healthy
service.
V-588 a Praxis failure names no service. There is no servicePraxis constant and
the per-verb strings bypass ecosystemGap, so an outage and a refused token both
say "не получилось".
V-590 the Hexis discovery hop carries no correlation id. Two context keys, and
the only bridge sits inside executeCapability, which runs after discovery. The
comment above discoverCapabilities asserts the opposite.
V-591 the causation id is computed, written to Maven's own trace, and never
sent, though both the header and the request field exist.
No code changed. Verified each against the source before filing.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A parked clarify ate a foreign utterance and the clock answered for him.
Root cause was a step earlier than filed. ownContent("что у меня сегодня?")
returns empty, every token being frame, so needsRoute said no and no route was
computed at all. classifyTurnRole fell through to roleAnswer, the extractor read
сегодня, and the date parser answered a bare day word with that day at the
current minute.
needsRoute now routes a question shape even when every token is frame, and the
route decides when the utterance fills nothing she asked about. A frame match is
a hint, not a decision. roleAside is new: a note or fact stated mid-flow is
stored and the question comes back on the same reply.
router.NamesAnHour is the single gate on the reminder time slot, so a sentence
naming no hour never fills it. IsClockEcho is deleted; it could not catch на
завтра on the stub, which returns midnight rather than the clock. на joins в and
во as a frame around a spoken hour.
The owner's rule, ruled on 2026-08-06: a reminder commits only when what, what
time and what day are all answered, and every time question opens by stating the
clock. He confirmed both derived cases himself, so завтра в 15:00 and через час
commit with no question.
A global assertion in checkEnd now fails any trace whose reminder fires at the
current clock.
(V-577) (V-579)
Almost nothing to do, which is the finding. Both packages already name every
literal beside its reason, every comment still describes its code, and the
three reaches share one dispatcher that owns retry, outbox bookkeeping and
error classification. The phraser's one-transport-logs-and-one-does-not shape
was looked for here and is absent.
One dead import removed. voicesink held internal/audio alive with a placeholder
var whose comment claimed a method call needed it. Calling a method on a value
never requires importing the package that defines the type.
Left alone: loop.Gate and explain.ExplainGate are two hand-maintained copies of
the same restraint checks, and ExplainGate says outright that it mirrors Gate.
Unifying them is a refactor of the trace path, not a sweep.
(V-581)
His two asks and his two commits, plus the check that no trace anywhere ends
with a reminder firing at the current clock. The transcript row from V-561 keeps
his verbatim words and loses its skip: "на 9" is read now, and under the commit
rule it is a question rather than a reminder.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
audio.PCM16kMono was only referenced by a `var _ =` placeholder whose
comment claimed to keep the import "honest" for a method call that
doesn't need it — out.Format's IsValid() is a method value, calling it
never requires importing the package that defines the type. The import
had no other use in the file, so both it and the placeholder were dead.
The owner's rule of 2026-08-06. Anything of the three that is missing is asked
for, and every ask states the current time so he can tell what she is reasoning
from. A bare hour is asked which half of the day it is. A time with no day named
is asked which day, because today being a valid reading is not him saying it.
Two things go straight through, both his call: a time that already reads only
one way, and an interval, which resolves to one instant and answers all three at
once.
An answer about the time is read against the whole request rather than alone.
"вечера" says which nine and names no hour by itself, so the answers accumulate
on the parked question and the newest statement wins.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Both parsers answer a bare day word with that day at the current minute, so "на
завтра" set a reminder at 01:38, the minute he happened to be speaking. The gate
is textual now: NamesAnHour reads the sentence, and the slot stays empty when
nobody said an hour.
Beside it, NamesAnInterval and HourIsAmbiguous, which the owner's commit rule
reads. "на" joins "в" as a frame around a spoken hour in both parsers, a clock
keeps its meaning with a full stop after it, and the stub applies a day word and
a part-of-day qualifier from anywhere in the sentence rather than only from the
token after the hour.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Every token of "что у меня сегодня?" is frame, so ownContent left nothing,
needsRoute returned false and no route was computed at all. The parked reminder
then read "сегодня" as its time and the question was answered nowhere.
A question shape now gets routed even when it leaves no content of its own, and
a role that fills nothing she asked about is decided by the route. A statement
he makes mid-flow gets a role of its own, roleAside, so a note or a fact is
stored and the question comes back instead of being dropped in silence.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
docs/plans/20-two-artifacts-and-neither-is-spring.md. No Go changed.
The thesis holds for the routing cascade, querySources and the pre-route
ladder, and is refuted for reach selection: ChannelsFor is a total pure
function that returns several winners, so nothing claims and nothing loses.
The digestion tick is not the odd seam out but the one already done right, and
the proposal is that the other three come to look like it.
The strongest finding is not the shape. The three structural holes that make a
route untrustworthy are written three times for three consumers with three
return types. internal/claim is built and tested and has no callers.
(V-585)
Two theses, tested against the code.
Thesis one, one recurring claimant shape, holds for four seams and fails for
one. The routing cascade, the query source chain, the pre-route resolver ladder
and the digestion tick are one shape. Reach selection is not: ChannelsFor is a
total pure function with no claimants and no losers, and it returns several
winners rather than one.
The digestion tick corrects the brief. loop.Tick is not a first-to-claim walk.
It already has a declared comparator, a gate with named reasons, a loser trace
with LostTo and a loser rescue path. It is the model, not a candidate.
Thesis two holds. The kernel is a package and a convention inside one program.
The framework-sized artifact is the ecosystem contract, and Maven implements its
side twice and a half: Nexus and Praxis share one embedded client, Hexis is a
vendored client in another repo with eleven divergences, four of them defects.
Abstractions: Claim, Record, Arbiter. Claim and Record already exist and neither
is wired. Drop Claimant, because every seam already rejected an interface for
the same reason.
Authorization stays out of both artifacts.
Plan 19 was already taken by 19-dialogue-arbitration.md, so this is 20.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Named three repeated thresholds in the persona checks: the shortest a word can
be and still carry a matched suffix, the word window around a self-reference
marker, and the plural-verb length floor. Five bare length tests and three bare
window bounds now read from them. One doubled sentence in checkAddress's doc
block, left by an edit that did not fully replace the old text, is now stated
once.
No word list moved. They are scoring data and moving one changes what the eval
measures.
The brief asked for a word-boundary defect and there is none here. The cringe
patterns already omit the ASCII-only \b around their Cyrillic alternatives and
say why, and the tokenizers match Cyrillic character classes rather than
boundaries.
(V-581)
chatHistory's doc comment pointed at a line range that had moved. It now names
runTurn's step 6, which survives the next edit. chatHistory and rememberTurn
each built the same dialogue.Turn projection inline; one sessionAsTurn helper
now serves both. The history cap was a bare 3 with no tie to the four turns
both doc comments quote.
The clarify decision points are left untouched. V-577 and V-579 own them.
(V-581)
Five near-duplicate magic-number checks (< 3 runes for a suffix to be
grammar, +/-3 word windows around a self-reference marker, < 5 runes
for a plural verb ending) get named constants with the reasoning
beside them: minInflectedRunes, selfRefWindow, minPluralVerbRunes.
Also dedupes a doubled sentence in the checkAddress comment block that
said the same thing about time-word stoplisting twice. No check logic
changed; word lists and check firing behaviour are untouched.
chatHistory (voice.go) and rememberTurn (clarify.go) both built the same
dialogue.Turn{Intent, Slots, Text} projection of a *dialogue.Session
inline; factor it into sessionAsTurn and use it in both. Also name the
history-depth cap (previously a bare "3") as maxCarriedHistory, and fix
chatHistory's doc comment, which cited "lines 373-395" for the dialogue
merge in runTurn -- that block has since moved to lines 385-394. Point
at the step-6 comment instead of a line range so the reference survives
future edits. No behavior change; bookkeeping only, not the clarify/
reminder slot-decision logic.
lookupLiveTaskByNorm wrote its live-status predicate as a SQL literal beside
the named liveTaskStatuses constants ListTasks already binds for the same
predicate. bestRecall carried two stacked doc comments, both opening the same
way, from an edit that appended rather than replaced. The daemon top-k was a
bare 3 with no tie to memoryRecallWidth, which holds the same value.
Nothing that decides what recalleval measures was touched.
(V-581)
bestRecall carried two stacked doc comments (both starting "bestRecall
mirrors...") from a prior edit that appended rather than replaced;
folded into one. Also named the literal 3 passed to Search as
daemonTopK, mirroring memoryRecallWidth in actions_query.go, so the
Recall3 doc and the call site cannot drift from each other again.
claude