gofmt mcp_test.go too (V-623)

Second file behind the first: fmt-check stops at the first failure, so the
mcp sweep's test file was invisible until ecosystem_acts.go was clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

cmd/mavend/actions_query.go

@@ -235,7 +235,13 @@ func (h *reactiveHandler) queryFactByKey(ctx context.Context, t *queryTurn) (str
 //
 // Read-only by construction — the plan is assembled and rendered core-side and
 // nothing here schedules or announces. "что дальше?" asks for the rest of the
-// day, so that phrasing trims what has already passed.
+// day, so that phrasing trims what has already passed and reads only the next
+// morning.NextSpoken entries. Trimming alone was not enough: asked early it cuts
+// nothing, and she read 43 entries aloud in one sentence (V-618).
+//
+// "что у меня сегодня?" is a different question and is not narrowed here — it
+// carries no plan word, so IsDayPlanQuery declines it and the calendar source
+// answers the whole day.
 //
 // What surface this belongs on is still open, tracked as Vikunja #431 ("Board
 // surface: Maven holds the work board, runs the intake form, never argues").
@@ -254,16 +260,23 @@ func (h *reactiveHandler) queryDayPlan(ctx context.Context, t *queryTurn) (strin
 	}
 	// Rebuild the pure plan so the rest-of-day rendering is the same code that
 	// rendered the whole day — one formatter, one persona.
-	p := morning.Plan{Date: plan.Date}
+	//
+	// The instants are put back in the asking clock's zone on the way in. They
+	// arrive carrying whatever zone the core read them in — a calendar fact's Ts
+	// and a reminder's FireTs are UTC out of the store — and FormatRU reads the
+	// hours in the plan's own frame, so setting that frame here is what makes
+	// the recital name his clock rather than the store's (V-614).
+	zone := h.now().Location()
+	p := morning.Plan{Date: plan.Date.In(zone)}
 	for _, it := range plan.Items {
 		p.Items = append(p.Items, morning.PlanEntry{
-			At:        it.At,
+			At:        it.At.In(zone),
 			Text:      it.Text,
 			Kind:      morning.PlanKind(it.Kind),
 			Uncertain: it.Uncertain,
 		})
 	}
-	return p.After(h.now()).FormatRU(), true
+	return p.Next(h.now(), morning.NextSpoken).FormatRU(), true
 }
 
 // habitFactWindow — how many recent SELF facts the behaviour profile is counted

cmd/mavend/actions_reminder.go

@@ -19,9 +19,10 @@ func (h *reactiveHandler) actionReminder(ctx context.Context, dec router.Decisio
 		// time wasn't parsed. Run the parser as a fallback.
 		if dec.Stage == 0 && h.timeParser != nil {
 			t, ok, err := h.timeParser.Parse(ctx, dec.Utterance, h.now())
-			// Same gate as the extractor (V-577, V-579): a request that named
-			// no hour gets asked about, never completed from the clock.
-			if err == nil && ok && router.NamesAnHour(dec.Utterance) {
+			// Same gate as the extractor (V-577, V-579, V-610): a request whose
+			// hour was not spoken, or was spoken and not read, gets asked about
+			// and is never completed from the clock.
+			if err == nil && ok && router.ResolvedTheHour(dec.Utterance, t) {
 				dec.Slots.Time = t
 				dec.Slots.HasTime = true
 			}

cmd/mavend/confirm.go

@@ -24,6 +24,14 @@ type pendingHexisExec struct {
 	entityID     string
 	displayName  string
 	expiry       time.Time
+
+	// correlationID — the id the proposing turn minted for this action. A
+	// confirm arrives on a later turn with a context of its own, so without
+	// carrying it here the execution recorded a fresh id and no causation at
+	// all, and the resolve, the discovery and the thing they authorised sat in
+	// the trace as unrelated calls. The contract mints one id per action, and
+	// the action began when she asked.
+	correlationID string
 }
 
 // pendingRoutineConfirm — a proposed routine awaiting a spoken y/n to become
@@ -144,7 +152,11 @@ func (h *reactiveHandler) confirmResolvers(ctx context.Context) []confirmResolve
 				return hx != nil && !h.now().After(hx.expiry)
 			},
 			yes: func() string {
-				return h.execHexis(ctx, hx.capabilityID, hx.capName, hx.entityID, hx.displayName)
+				execCtx := ctx
+				if hx.correlationID != "" {
+					execCtx = withCorrelationID(execCtx, hx.correlationID)
+				}
+				return h.execHexis(execCtx, hx.capabilityID, hx.capName, hx.entityID, hx.displayName)
 			},
 			no: func() string { return phraser.C(phraser.ConfirmCancelled, nil) },
 		},

cmd/mavend/crawls.go

@@ -173,6 +173,13 @@ func (a *crawlFetcher) Get(ctx context.Context, u string) (*crawl.Response, erro
 		case errors.Is(err, webfetch.ErrBlocked), errors.Is(err, webfetch.ErrPrivate), errors.Is(err, webfetch.ErrScheme):
 			return nil, fmt.Errorf("%w: %v", crawl.ErrFetchRefused, err)
 		case errors.Is(err, webfetch.ErrStatus):
+			// Carry the code across the seam. The crawler needs to tell a 5xx
+			// from a 404 to decide what a failed robots.txt means, and it must
+			// not learn that by reading this sentence.
+			var se *webfetch.StatusError
+			if errors.As(err, &se) {
+				return nil, &crawl.StatusError{Code: se.Code}
+			}
 			return nil, fmt.Errorf("%w: %v", crawl.ErrFetchStatus, err)
 		}
 		return nil, err

cmd/mavend/dayplan_test.go

@@ -4,12 +4,14 @@ import (
 	"context"
 	"database/sql"
 	"errors"
+	"fmt"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/kami/maven/internal/calendar"
 	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/morning"
 	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/store"
@@ -111,6 +113,88 @@ func TestQueryDayPlanRestOfDayWhenNothingIsLeft(t *testing.T) {
 	}
 }
 
+// "что дальше?" rebuilds the plan off the wire and renders it here, and the
+// instants on it carry the zone the core read them in — a calendar fact's Ts
+// and a reminder's FireTs are UTC out of the store. Read raw, the recital named
+// the store's clock instead of his (V-614). The asking clock is three hours off
+// whatever this machine runs in, so the assertion holds under TZ=UTC too.
+func TestQueryDayPlanRestOfDayReadsHisClock(t *testing.T) {
+	_, off := time.Now().Zone()
+	away := time.FixedZone("away", off+3*60*60)
+	stored := time.Date(2026, 8, 3, 8, 0, 0, 0, time.UTC)
+
+	h := &reactiveHandler{
+		api: &planAPI{plan: ipc.DayPlan{
+			Date:  time.Date(2026, 8, 3, 0, 0, 0, 0, time.UTC),
+			Items: []ipc.DayPlanItem{{At: stored, Text: "позвонить маме", Kind: "reminder"}},
+		}},
+		now: func() time.Time { return time.Date(2026, 8, 3, 9, 0, 0, 0, away) },
+	}
+	reply, ok := h.queryDayPlan(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "что дальше?"},
+	})
+	if !ok {
+		t.Fatal("expected the plan source to claim it")
+	}
+	if want := stored.In(away).Format("15:04"); !strings.Contains(reply, want) {
+		t.Errorf("the reminder is not read in his clock (%s): %q", want, reply)
+	}
+	if bad := stored.Format("15:04"); strings.Contains(reply, bad) {
+		t.Errorf("the reminder is read in the store's zone (%s): %q", bad, reply)
+	}
+}
+
+// The defect V-618 fixes, at the handler: asked at 04:45 the trim removes
+// nothing, because the whole day is still ahead. She read 43 entries aloud as
+// one sentence. The zone is three hours off UTC so the test also fails under
+// TZ=UTC if the rendering ever slips zones.
+func TestQueryDayPlanCapsWhatItReadsAloud(t *testing.T) {
+	zone := time.FixedZone("MSK", 3*60*60)
+	mid := time.Date(2026, 8, 3, 0, 0, 0, 0, zone)
+	plan := ipc.DayPlan{Date: mid, Spoken: "план на 03.08.2026: …"}
+	for i := 0; i < 43; i++ {
+		plan.Items = append(plan.Items, ipc.DayPlanItem{
+			At:   mid.Add(time.Duration(345+i*20) * time.Minute), // 05:45 onward
+			Text: fmt.Sprintf("пункт %d", i),
+			Kind: "event",
+		})
+	}
+	h := &reactiveHandler{api: &planAPI{plan: plan}, now: func() time.Time {
+		return time.Date(2026, 8, 3, 4, 45, 0, 0, zone)
+	}}
+	reply, ok := h.queryDayPlan(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "что дальше?"},
+	})
+	if !ok {
+		t.Fatal("expected the plan source to claim it")
+	}
+	if n := strings.Count(reply, "пункт "); n != morning.NextSpoken {
+		t.Errorf("read %d entries aloud, want %d: %q", n, morning.NextSpoken, reply)
+	}
+	if !strings.HasPrefix(reply, "дальше: 05:45 — пункт 0;") {
+		t.Errorf("the next thing is not first: %q", reply)
+	}
+	// The rest is counted, not silently dropped.
+	if !strings.Contains(reply, "и ещё 40 дел до конца дня.") {
+		t.Errorf("the sentence hides that the day goes on: %q", reply)
+	}
+}
+
+// "что у меня сегодня?" is the whole day and is not narrowed. It carries no
+// plan word, so the plan source declines it and the calendar listing answers —
+// asserted here beside the cap so the two questions cannot drift together.
+func TestWholeDayQuestionIsNotTheRestOfTheDay(t *testing.T) {
+	if router.IsDayPlanQuery("что у меня сегодня?") {
+		t.Error("the plan source claims the whole-day question")
+	}
+	if !router.IsDayPlanQuery("что дальше?") {
+		t.Error("the plan source stopped claiming the rest-of-day question")
+	}
+	if router.IsRestOfDayQuery("какие планы на сегодня?") {
+		t.Error("the whole-day plan question got narrowed to the rest of the day")
+	}
+}
+
 // A question that is not about the plan must fall through, or the plan buries
 // the calendar listing and the weather behind it.
 func TestQueryDayPlanPassesOnEverythingElse(t *testing.T) {

cmd/mavend/ecosystem_acts.go

@@ -139,9 +139,9 @@ func (h *reactiveHandler) handlePraxisAct(ctx context.Context, dec router.Decisi
 // praxisItemAction is the shared shape of the item-lifecycle capabilities: take
 // an item id from the value slot, call one Praxis endpoint, trace the result.
 type praxisItemAction struct {
-	verbs   []string
-	ask     string // reply when no item id was given
-	op      string // trace + log name of the operation
+	verbs []string
+	ask   string // reply when no item id was given
+	op    string // trace + log name of the operation
 	// failure is the first half of the reply when the Praxis call errors: which
 	// operation did not happen. ecosystemGap supplies the second half, which
 	// names Praxis and splits a refused token from an outage — those two used to
@@ -346,14 +346,24 @@ func (entityAttentionCapability) handle(ctx context.Context, h *reactiveHandler,
 	})
 
 	var parts []string
+	var spoken []string
 	for _, item := range items {
 		title, _ := item["title"].(string)
 		if title == "" {
 			continue
 		}
 		parts = append(parts, title)
-		surfaceSpoken(ctx, px, item)
+		if id := surfaceSpoken(ctx, px, item); id != "" {
+			spoken = append(spoken, id)
+		}
 	}
+	// The scoped digest is a list she read out, so it replaces the positional
+	// memory exactly as the unscoped one does. It used to surface these items
+	// and remember none of them, which left the previous digest live: "отметь
+	// второй как сделанное" then indexed into a list he had not just heard and
+	// transitioned somebody else's item (docs/ecosystem.md — a wrong guess here
+	// transitions the wrong item).
+	h.rememberSurfaced(spoken)
 	if known := h.localFactsForEntity(ctx, entityID); known != "" {
 		parts = append(parts, known)
 	}
@@ -768,6 +778,9 @@ func (h *reactiveHandler) handleHexisAct(ctx context.Context, dec router.Decisio
 			entityID:     entityID,
 			displayName:  displayName,
 			expiry:       h.now().Add(confirmTTL),
+			// This action's id, so the execution the confirm authorises is
+			// joined to the resolve and the discovery that proposed it.
+			correlationID: correlationIDFromCtx(ctx),
 		}
 		h.mu.Unlock()
 		h.recordEcosystemTrace(ctx, "hexis", "confirmation", tracePending, started,

cmd/mavend/ecosystem_harness_test.go

@@ -115,3 +115,83 @@ func TestFakeNexus_FaultInjectionThenRecovery(t *testing.T) {
 		t.Fatalf("expected success once nexus recovers, got %q", reply)
 	}
 }
+
+// TestPraxisEntityAttention_RemembersWhatItReadOut: the scoped digest is a list
+// she read out, so a positional follow-up must land on one of ITS items. It
+// surfaced them and remembered none, which left the previous digest live and
+// sent "отметь второй" at somebody else's item.
+func TestPraxisEntityAttention_RemembersWhatItReadOut(t *testing.T) {
+	ctx := context.Background()
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_muzick", "Muzick indexer", "service"))
+	scoped := fixturePraxisAttentionScoped("ent_muzick",
+		map[string]any{"id": "item_scoped_1", "title": "indexer wedged"})
+	praxis := newFakePraxis(t, scoped)
+	h := ecoHandler(t, nexus, praxis, nil)
+
+	// A digest from an earlier turn, still the positional memory.
+	h.rememberSurfaced([]string{"item_stale"})
+
+	reply := h.handlePraxisAct(ctx, router.Decision{
+		Intent: router.IntentAct,
+		Slots:  router.Slots{Fn: "entity_attention", HasFn: true, Value: "muzick indexer"},
+	})
+	if !strings.Contains(reply, "indexer wedged") {
+		t.Fatalf("expected the scoped item to be read out, got %q", reply)
+	}
+
+	h.mu.Lock()
+	surfaced := append([]string(nil), h.surfacedItems...)
+	h.mu.Unlock()
+	if len(surfaced) != 1 || surfaced[0] != "item_scoped_1" {
+		t.Fatalf("scoped digest must replace the positional memory, got %v", surfaced)
+	}
+
+	// The follow-up resolves against what he just heard, not the stale list.
+	if reply := h.handlePraxisAct(ctx, praxisItemDec("resolve_item", "last")); reply == "" {
+		t.Fatal("positional follow-up should have been claimed by praxis")
+	}
+	var body string
+	for _, r := range praxis.Requests() {
+		if r.Method == "POST" && r.Path == "/api/v1/tools/resolve" {
+			body = string(r.Body)
+		}
+	}
+	if !strings.Contains(body, "item_scoped_1") {
+		t.Fatalf("resolve must transition the item she read out, posted %q", body)
+	}
+	if strings.Contains(body, "item_stale") {
+		t.Fatal("resolve transitioned an item from a previous digest")
+	}
+}
+
+// TestHexisConfirm_KeepsOneCorrelationIDPerAction: the confirm arrives on a
+// later turn with a context of its own. The contract mints one id per action,
+// so the execution it authorises must still be joinable to the resolve and the
+// discovery that proposed it — it recorded a fresh id and no causation at all.
+func TestHexisConfirm_KeepsOneCorrelationIDPerAction(t *testing.T) {
+	ctx := context.Background()
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_muzick", "Muzick indexer", "service"))
+	caps := fixtureHexisCapabilities(map[string]any{"id": "cap_restart", "name": "restart", "read_only": false})
+	hexis := newFakeHexis(t, caps, fixtureHexisExecuted("exec_1", "succeeded"))
+	h := ecoHandler(t, nexus, nil, hexis)
+
+	if reply := h.handleHexisAct(ctx, actDec("restart")); !strings.Contains(reply, "да") {
+		t.Fatalf("mutating capability must ask for confirmation, got %q", reply)
+	}
+	resolve := findTrace(t, h, "nexus", "resolve")
+	if resolve == nil || resolve.CorrelationID == "" {
+		t.Fatalf("expected a nexus resolve trace carrying a correlation id, got %+v", resolve)
+	}
+
+	if _, handled := h.resolveConfirm(ctx, "да"); !handled {
+		t.Fatal("confirm should have been claimed")
+	}
+	exec := findTrace(t, h, "hexis", "execute")
+	if exec == nil {
+		t.Fatal("expected a hexis execute trace")
+	}
+	if exec.CausationID != resolve.CorrelationID {
+		t.Fatalf("confirmed execution must cite the action that proposed it: causation %q, action %q",
+			exec.CausationID, resolve.CorrelationID)
+	}
+}

cmd/mavend/ruwords.go

@@ -17,6 +17,7 @@ import (
 	"time"
 
 	"github.com/kami/maven/internal/lexicon"
+	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/say"
 )
 
@@ -73,22 +74,26 @@ func mentionsUnknownPlace(u string) bool {
 // date for a day she did not understand.
 const onlyNearDaysReply = "я считаю только сегодня, завтра, послезавтра и вчера — про другие дни пока не скажу."
 
-// dayWords — day references the calendar parser cannot resolve. A weekday name
-// or a "через …" phrase means he asked about a specific other day.
-var dayWords = []string{
-	"понедельник", "вторник", "сред", "четверг", "пятниц", "суббот", "воскресен",
-	"через", "monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday",
-}
-
 // mentionsUnknownDay reports whether the question names a day the calendar
 // parser could not resolve. Mirror of mentionsUnknownPlace: it exists only to
 // pick an honest reply over a confidently wrong one.
 //
 // Only called after ParseCalendarDate has already failed, so "завтра" and the
 // other words it does know never reach here.
+//
+// The weekday half was a list of STEMS matched with strings.Contains until
+// V-581 — "сред", "пятниц", "суббот". That is the hand-written Russian pattern
+// the sweep of 2026-08-04 took out, and it was wrong in the way such a pattern
+// always is: "среди", "средство" and "средний" all contain "сред", so a question
+// carrying any of them was answered with onlyNearDaysReply instead of the date.
+// Whole tokens now, and the weekday itself is router.WeekdayIndex, which reads
+// the lexicon and asks the dictionary about the case.
 func mentionsUnknownDay(u string) bool {
-	for _, w := range dayWords {
-		if strings.Contains(u, w) {
+	for _, tok := range quietTokens(u) {
+		if tok == "через" {
+			return true
+		}
+		if _, ok := router.WeekdayIndex(tok); ok {
 			return true
 		}
 	}
@@ -149,6 +154,11 @@ func hasDurationWords(u string) bool {
 // Used by the query handler when answering "когда я это сделал?"-style questions.
 func formatTime(t time.Time) string {
 	now := time.Now()
+	// The argument is a fact's Ts, which the store hands back as UTC. Only the
+	// last branch names a wall clock, and it named the store's until V-614: an
+	// answer to "когда я это сделал?" read hours off, in the same sentence
+	// shape the plan reads a day in.
+	t = t.Local()
 	if t.After(now.Add(-2*time.Minute)) && t.Before(now.Add(2*time.Minute)) {
 		return "только что"
 	}

cmd/mavend/ruwords_test.go

@@ -0,0 +1,57 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// "когда я это сделал?" answers off a fact's Ts, which the store hands back as
+// UTC, and the branch that names a wall clock printed it in whatever zone it
+// arrived in (V-614). The instant here is built three hours off this machine's
+// zone, so the assertion holds under TZ=UTC as well.
+func TestFormatTimeReadsHisClock(t *testing.T) {
+	_, off := time.Now().Zone()
+	away := time.FixedZone("away", off+3*60*60)
+	stored := time.Now().Add(-72 * time.Hour).In(away)
+
+	got := formatTime(stored)
+	if want := stored.Local().Format("15:04"); !strings.Contains(got, want) {
+		t.Errorf("formatTime = %q, want the hour on his clock (%s)", got, want)
+	}
+	if bad := stored.Format("15:04"); strings.Contains(got, bad) {
+		t.Errorf("formatTime = %q reads the zone the fact arrived in (%s)", got, bad)
+	}
+}
+
+// TestMentionsUnknownDayReadsWordsNotStems — the defect V-581 found. The
+// weekday half of this guard was a list of stems matched with strings.Contains,
+// so "среди", "средство" and "средний" all read as Wednesday and the question
+// was answered with onlyNearDaysReply instead of a date.
+//
+// The other half of the fix is coverage: a stem list stops at the forms whoever
+// wrote it thought of, and "воскресеньях" was not one of them.
+func TestMentionsUnknownDayReadsWordsNotStems(t *testing.T) {
+	for _, u := range []string{
+		"какое число в понедельник",
+		"какое число в среду",
+		"какое число в среде",
+		"что там по воскресеньям",
+		"what is the date on friday",
+		"какое число через неделю",
+	} {
+		if !mentionsUnknownDay(u) {
+			t.Errorf("mentionsUnknownDay(%q) = false, want true", u)
+		}
+	}
+	for _, u := range []string{
+		"какое число в среднем",
+		"сколько это в среднем",
+		"какое сегодня средство",
+		"какое число",
+	} {
+		if mentionsUnknownDay(u) {
+			t.Errorf("mentionsUnknownDay(%q) = true; it names no day", u)
+		}
+	}
+}

cmd/mavend/weatherq.go

@@ -7,6 +7,10 @@ package main
 import (
 	"regexp"
 	"strings"
+
+	"github.com/kami/maven/internal/lexicon"
+	"github.com/kami/maven/internal/morph"
+	"github.com/kami/maven/internal/router"
 )
 
 // isWeatherQuery returns true if the utterance is about weather.
@@ -27,16 +31,42 @@ func isWeatherQuery(u string) bool {
 // come through whole and "в 5 утра" does not.
 var weatherPlace = regexp.MustCompile(`(?i)(?:^|\s)(?:в|во|in)\s+([\p{L}-]+(?:\s+[\p{L}-]+)?)`)
 
-// weatherNonPlaces — words that follow "в" in a weather question and are not
-// cities. "какая погода в доме" is the smart-home sensor, not Open-Meteo, and
-// "тепло в комнате" is the same question about the same room.
-var weatherNonPlaces = map[string]bool{
+// weatherRooms — the rooms of the house, which are the only words in this
+// guard that belong to it. "какая погода в доме" is the smart-home sensor, not
+// Open-Meteo, and "тепло в комнате" is the same question about the same room.
+//
+// The rest of the guard used to be a third copy of three closed sets that
+// already exist in the lexicon: the weekdays, the parts of the day, and the
+// words that follow "в" without naming a place (V-581). Each copy was short in
+// its own direction — "среду" but not "среде", "утром" but not "утра", "целом"
+// but not "общем" — so the same question phrased one word differently reached
+// the geocoder as a city.
+var weatherRooms = map[string]bool{
 	"доме": true, "квартире": true, "комнате": true, "спальне": true,
 	"гостиной": true, "кухне": true, "гараже": true, "офисе": true,
-	"выходные": true, "субботу": true, "воскресенье": true, "понедельник": true,
-	"вторник": true, "среду": true, "четверг": true, "пятницу": true,
-	"обед": true, "обеде": true, "утро": true, "утром": true, "вечер": true,
-	"вечером": true, "ночь": true, "ночью": true, "целом": true, "принципе": true,
+	"обед": true, "обеде": true, "выходные": true, "выходных": true,
+}
+
+// isWeatherNonPlace reports whether the word after "в" names something other
+// than a place he could ask the weather for.
+func isWeatherNonPlace(word string) bool {
+	if weatherRooms[word] {
+		return true
+	}
+	if _, ok := router.WeekdayIndex(word); ok {
+		return true
+	}
+	for _, w := range lexicon.PartsOfDay() {
+		if word == w || morph.SameWord(word, w) {
+			return true
+		}
+	}
+	for _, w := range lexicon.NotPlaceAfterV() {
+		if word == w {
+			return true
+		}
+	}
+	return false
 }
 
 // extractWeatherLocation returns the place he named, or the configured default
@@ -63,7 +93,7 @@ func extractWeatherLocation(u, defaultLoc string) string {
 	}
 	place := strings.TrimSpace(m[1])
 	first := strings.ToLower(strings.Fields(place)[0])
-	if weatherNonPlaces[first] {
+	if isWeatherNonPlace(first) {
 		return defaultLoc
 	}
 	return place

cmd/mavend/weatherq_test.go

@@ -29,6 +29,13 @@ func TestExtractWeatherLocation(t *testing.T) {
 		// the house sensors and the day words answer elsewhere.
 		{"тепло в комнате?", "Berlin", "Berlin"},
 		{"какая погода в выходные", "Berlin", "Berlin"},
+		// The cases the three private copies of the lexicon were short by
+		// (V-581): a weekday in a case the old map did not list, a part of the
+		// day in one it did not list, and "в общем".
+		{"какая погода в среде", "Berlin", "Berlin"},
+		{"какая погода в воскресеньях", "Berlin", "Berlin"},
+		{"какая погода в понедельникам", "Berlin", "Berlin"},
+		{"какая погода в общем", "Berlin", "Berlin"},
 	}
 	for _, c := range cases {
 		if got := extractWeatherLocation(c.utterance, c.def); got != c.want {

cmd/mavpoll/main.go

@@ -77,6 +77,21 @@ func run(args []string) error {
 	if *netdataURL == "" && *kumaURL == "" && *wgIface == "" && *zenTokenFile == "" {
 		return fmt.Errorf("nothing to poll: set -netdata, -kuma, -wg and/or -zenmoney-token-file")
 	}
+	// A bad duration or an empty -wg-cmd used to get past start and kill the
+	// poller on the first tick — time.NewTicker panics on a non-positive
+	// interval, and pollWg indexed field 0 of an empty command. A zero -timeout
+	// is worse than a crash: http.Client reads it as "no deadline", so one
+	// wedged source stalls every other source behind it forever. Refuse all
+	// three here, where the operator sees the message.
+	if *interval <= 0 {
+		return fmt.Errorf("-interval must be positive, got %s", *interval)
+	}
+	if *timeout <= 0 {
+		return fmt.Errorf("-timeout must be positive, got %s", *timeout)
+	}
+	if *wgIface != "" && strings.TrimSpace(*wgCmd) == "" {
+		return fmt.Errorf("-wg-cmd is empty but -wg is set")
+	}
 
 	zen, err := newZenClient(*zenTokenFile, *zenURL, *timeout)
 	if err != nil {
@@ -283,9 +298,19 @@ const (
 // `wg show` needs CAP_NET_ADMIN; run mavpoll with the cap or set -wg-cmd "sudo wg".
 func (p *poller) pollWg(ctx context.Context) error {
 	fields := strings.Fields(p.wgCmd)
+	if len(fields) == 0 {
+		return fmt.Errorf("wg command is empty")
+	}
 	args := append(fields[1:], "show", p.wgIface, "latest-handshakes")
 	out, err := exec.CommandContext(ctx, fields[0], args...).Output()
 	if err != nil {
+		// wg says why it refused on stderr — usually a missing CAP_NET_ADMIN or
+		// an interface that does not exist. Output() drops that, leaving a log
+		// line that reads "exit status 1" and diagnoses nothing.
+		var ee *exec.ExitError
+		if errors.As(err, &ee) && len(ee.Stderr) > 0 {
+			return fmt.Errorf("run %s: %w: %s", p.wgCmd, err, strings.TrimSpace(string(ee.Stderr)))
+		}
 		return fmt.Errorf("run %s: %w", p.wgCmd, err)
 	}
 	maxTs := parseMaxHandshake(string(out))
@@ -552,6 +577,11 @@ func isNoFact(err error) bool {
 
 // maxBodyBytes caps what a source can make the poller hold. Kuma's whole
 // metrics page is a few hundred kilobytes, so 4 MiB is slack, not a budget.
+//
+// Hitting the cap is an error, not a shorter body. A truncated kuma page parses
+// cleanly right up to the cut, and every monitor past it reads as deleted — the
+// poller would write "unknown" over live services and the down-rule would go
+// quiet. Reading one byte past the cap is how we tell full from truncated.
 const maxBodyBytes = 4 << 20
 
 func (p *poller) get(ctx context.Context, url, basicUser string) ([]byte, error) {
@@ -567,12 +597,15 @@ func (p *poller) get(ctx context.Context, url, basicUser string) ([]byte, error)
 		return nil, err
 	}
 	defer resp.Body.Close()
-	body, err := io.ReadAll(io.LimitReader(resp.Body, maxBodyBytes))
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxBodyBytes+1))
 	if err != nil {
 		return nil, err
 	}
 	if resp.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("GET %s: %s", url, resp.Status)
 	}
+	if len(body) > maxBodyBytes {
+		return nil, fmt.Errorf("GET %s: body over %d bytes", url, maxBodyBytes)
+	}
 	return body, nil
 }

cmd/mavpoll/main_test.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -212,3 +213,59 @@ func TestRunRequiresSomethingToPoll(t *testing.T) {
 		t.Errorf("err = %v, want a 'nothing to poll' refusal", err)
 	}
 }
+
+// A flag value that would kill the poller later is refused at start, before it
+// dials core: a non-positive interval panics time.NewTicker on the first tick, a
+// zero timeout means http.Client waits forever, and an empty wg command used to
+// index field 0 of an empty slice.
+func TestRunRefusesFlagsThatCrashLater(t *testing.T) {
+	cases := []struct {
+		name string
+		args []string
+		want string
+	}{
+		{"zero interval", []string{"-interval", "0"}, "-interval must be positive"},
+		{"negative interval", []string{"-interval", "-5s"}, "-interval must be positive"},
+		{"zero timeout", []string{"-timeout", "0"}, "-timeout must be positive"},
+		{"empty wg command", []string{"-wg", "wg0", "-wg-cmd", " "}, "-wg-cmd is empty"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			args := append([]string{"-socket", "/tmp/nope.sock"}, c.args...)
+			err := run(args)
+			if err == nil || !strings.Contains(err.Error(), c.want) {
+				t.Errorf("err = %v, want %q", err, c.want)
+			}
+		})
+	}
+}
+
+// pollWg refuses an empty command rather than panicking on fields[0].
+func TestPollWgEmptyCommand(t *testing.T) {
+	p := &poller{core: &factCore{}, wgIface: "wg0", wgCmd: ""}
+	if err := p.pollWg(context.Background()); err == nil {
+		t.Error("want an error, got a poll that ran something")
+	}
+}
+
+// A body at the cap is a truncated body, and a truncated kuma page reads as
+// "every monitor past the cut was deleted". Refuse it instead of parsing it.
+func TestGetRefusesTruncatedBody(t *testing.T) {
+	big := strings.Repeat("x", maxBodyBytes+64)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, big)
+	}))
+	defer srv.Close()
+	p := &poller{http: srv.Client()}
+	if _, err := p.get(context.Background(), srv.URL, ""); err == nil {
+		t.Error("want an over-size refusal, got a silently truncated body")
+	}
+	small := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, "ok")
+	}))
+	defer small.Close()
+	body, err := p.get(context.Background(), small.URL, "")
+	if err != nil || string(body) != "ok" {
+		t.Errorf("get = %q, %v; want the whole small body", body, err)
+	}
+}

cmd/mavweb/events.html

@@ -14,8 +14,13 @@ memory only, so a restart empties this.</div>
 <div class=scroll><table class=mono>
 <tr><th>noticed<th>happened<th>source<th>kind<th>pri<th>what<th>detail</tr>
 {{range .Events}}<tr>
-<td>{{.NoticedAt.Format "02.01 15:04:05"}}</td>
-<td class=gray>{{.OccurredAt.Format "02.01 15:04:05"}}</td>
+<!-- Both columns in his clock (V-469 on /reminders, same rule here). NoticedAt
+     is the bus's local instant, OccurredAt is whatever zone the source used —
+     the store hands back UTC and internal/rss parses a pubDate to UTC — so
+     rendering them raw put two zones side by side in the same row and made a
+     feed item look hours older than it was. -->
+<td>{{.NoticedAt.Local.Format "02.01 15:04:05"}}</td>
+<td class=gray>{{.OccurredAt.Local.Format "02.01 15:04:05"}}</td>
 <td class=gray>{{.Source}}</td>
 <td class=gray>{{.Kind}}</td>
 <td class=gray>{{.Priority}}</td>

cmd/mavweb/events_test.go

@@ -46,7 +46,8 @@ func TestEventsPageRendersTheJournal(t *testing.T) {
 		t.Fatalf("status = %d, want 200", w.Code)
 	}
 	body := w.Body.String()
-	for _, want := range []string{"rss:tech", "Вышло ядро 6.19", "ambient:notif", "10:00-11:00 планёрка", "01.08 10:00:00"} {
+	occurred := time.Date(2026, 8, 1, 10, 0, 0, 0, time.UTC).Local().Format("02.01 15:04:05")
+	for _, want := range []string{"rss:tech", "Вышло ядро 6.19", "ambient:notif", "10:00-11:00 планёрка", occurred} {
 		if !strings.Contains(body, want) {
 			t.Errorf("page does not mention %q", want)
 		}
@@ -89,6 +90,38 @@ func TestEventsPageWithoutCore(t *testing.T) {
 	}
 }
 
+// awayFromLocal returns a zone three hours off whatever this machine runs in,
+// so a test can tell "rendered in his clock" apart from "rendered in whatever
+// zone the value arrived in" without depending on TZ.
+func awayFromLocal() *time.Location {
+	_, off := time.Now().Zone()
+	return time.FixedZone("away", off+3*60*60)
+}
+
+func TestEventsPageRendersBothTimesInLocalZone(t *testing.T) {
+	// OccurredAt carries the source's zone — the store hands back UTC and
+	// internal/rss parses a pubDate to UTC — while NoticedAt is the bus's local
+	// instant. Rendered raw, the two columns of one row were in two zones and a
+	// feed item read hours older than it was.
+	away := awayFromLocal()
+	occurred := time.Date(2026, 8, 1, 7, 15, 0, 0, time.UTC).In(away)
+	noticed := occurred.Add(2 * time.Minute)
+	core := &eventsCore{events: []ipc.IntakeEvent{{
+		Source: "rss:tech", Kind: "note", Title: "Вышло ядро 6.19", Priority: "low",
+		OccurredAt: occurred, NoticedAt: noticed,
+	}}}
+	body := getEvents(t, core).Body.String()
+	const layout = "02.01 15:04:05"
+	for _, ts := range []time.Time{occurred, noticed} {
+		if !strings.Contains(body, ts.Local().Format(layout)) {
+			t.Errorf("page does not render %s in his clock (%s)", ts, ts.Local().Format(layout))
+		}
+		if strings.Contains(body, ts.In(away).Format(layout)) {
+			t.Errorf("page rendered %s in the source's zone", ts)
+		}
+	}
+}
+
 func TestEventsPageEscapesIntakeText(t *testing.T) {
 	// Titles come from outside — a feed headline, a notification. They are shown
 	// on a page and must never be able to inject markup into it.

cmd/mavweb/morning.html

@@ -8,7 +8,10 @@
 <div class=scroll><table class=mono>
 <tr><th>at<th>kind<th>what</tr>
 {{range .Items}}<tr>
-<td>{{.At.Format "15:04"}}</td>
+<!-- In his clock. A plan item's At is a calendar fact's Ts or a reminder's
+     FireTs, and the store hands both back as UTC, so the raw hour printed a
+     reminder here at an hour /reminders did not agree with (V-469). -->
+<td>{{.At.Local.Format "15:04"}}</td>
 <td class=gray>{{.Kind}}</td>
 <td>{{if .Uncertain}}<span class=hint title="relayed notification, not a calendar read">похоже,</span> {{end}}{{.Text}}</td>
 </tr>{{end}}

cmd/mavweb/morning_test.go

@@ -0,0 +1,49 @@
+package main
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/ipc"
+)
+
+// morningCore serves a canned checklist and day plan.
+type morningCore struct {
+	ipc.UnimplementedCoreAPI
+	status []ipc.MorningRoutineStatus
+	plan   ipc.DayPlan
+}
+
+func (c *morningCore) MorningStatus(context.Context) ([]ipc.MorningRoutineStatus, error) {
+	return c.status, nil
+}
+
+func (c *morningCore) DayPlan(context.Context) (ipc.DayPlan, error) { return c.plan, nil }
+
+func TestMorningRendersPlanTimesInLocalZone(t *testing.T) {
+	// A plan item's At is a calendar fact's Ts or a reminder's FireTs, and the
+	// store hands both back as UTC. Printed raw, /morning named an hour for a
+	// reminder that /reminders — which does call Local — disagreed with.
+	away := awayFromLocal()
+	at := time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC).In(away)
+	core := &morningCore{plan: ipc.DayPlan{
+		Date:  at,
+		Items: []ipc.DayPlanItem{{At: at, Text: "выпить таблетки", Kind: "reminder"}},
+	}}
+	w := httptest.NewRecorder()
+	handleMorning(w, httptest.NewRequest(http.MethodGet, "/morning", nil), core)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", w.Code)
+	}
+	body := w.Body.String()
+	if !strings.Contains(body, at.Local().Format("15:04")) {
+		t.Errorf("plan item not rendered in his clock (%s): %s", at.Local().Format("15:04"), body)
+	}
+	if strings.Contains(body, at.In(away).Format("15:04")) {
+		t.Errorf("plan item rendered in the stored zone: %s", body)
+	}
+}

cmd/mavweb/tasks.go

@@ -300,11 +300,15 @@ func promoteCandidate(ctx context.Context, core ipc.CoreAPI, r *http.Request, id
 	if err := core.SetTaskFields(ctx, id, doneWhen, blockedOn); err != nil {
 		return "", err
 	}
-	if due != nil {
-		wgt, err := formWeight(r)
-		if err != nil {
-			return "", err
-		}
+	wgt, err := formWeight(r)
+	if err != nil {
+		return "", err
+	}
+	// The importance select is posted whether or not a date is. This ran under
+	// `if due != nil`, so confirming a candidate as "срочно" with no deadline
+	// dropped the word on the floor — the row came back normal and nothing said
+	// why. A promote with neither field set still writes nothing.
+	if due != nil || wgt != 0 {
 		if err := core.EditTask(ctx, id, text, due, wgt); err != nil {
 			return "", err
 		}

cmd/mavweb/tasks_test.go

@@ -32,6 +32,31 @@ type fakeTaskCore struct {
 	statusErr error
 
 	promoted bool
+
+	// The promote path's two extra writes.
+	fields   []any
+	edits    []editCall
+	editErr  error
+	fieldErr error
+}
+
+// editCall records one EditTask, so a test can say what the form actually sent
+// down rather than only that the promotion succeeded.
+type editCall struct {
+	ID     int64
+	Text   string
+	Due    *time.Time
+	Weight int
+}
+
+func (f *fakeTaskCore) EditTask(_ context.Context, id int64, text string, due *time.Time, weight int) error {
+	f.edits = append(f.edits, editCall{id, text, due, weight})
+	return f.editErr
+}
+
+func (f *fakeTaskCore) SetTaskFields(_ context.Context, id int64, doneWhen, blockedOn string) error {
+	f.fields = append(f.fields, []any{id, doneWhen, blockedOn})
+	return f.fieldErr
 }
 
 func (f *fakeTaskCore) ListTasks(_ context.Context, status string) ([]ipc.Task, error) {
@@ -220,6 +245,49 @@ func TestApplyTaskPostCarriesWeight(t *testing.T) {
 	}
 }
 
+// Confirming a candidate posts the importance select whether or not a date is
+// set. The weight write hung off `if due != nil`, so "срочно" with no deadline
+// was read off the form and thrown away, and the row came back normal.
+func TestPromoteCandidateCarriesWeightWithoutADueDate(t *testing.T) {
+	core := &fakeTaskCore{}
+	form := url.Values{
+		"action": {"promote"}, "id": {"4"}, "text": {"продлить страховку"},
+		"done_when": {"полис на руках"}, "weight": {"3"},
+	}
+	req := httptest.NewRequest(http.MethodPost, "/tasks", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	handleTasks(httptest.NewRecorder(), req, core)
+
+	if len(core.edits) != 1 {
+		t.Fatalf("edits = %+v, want the weight written once", core.edits)
+	}
+	if core.edits[0].Weight != 3 || core.edits[0].ID != 4 {
+		t.Errorf("edit = %+v, want id 4 at weight 3", core.edits[0])
+	}
+	if core.edits[0].Due != nil {
+		t.Errorf("edit invented a due date: %v", core.edits[0].Due)
+	}
+	if core.statusVal != "open" {
+		t.Errorf("status = %q, want the candidate promoted", core.statusVal)
+	}
+}
+
+// A promote with neither field set still writes nothing: the row is unchanged
+// apart from its status, and an EditTask here would be a no-op that can fail.
+func TestPromoteCandidateWithNoDateAndNoWeightDoesNotEdit(t *testing.T) {
+	core := &fakeTaskCore{}
+	form := url.Values{
+		"action": {"promote"}, "id": {"4"}, "text": {"продлить страховку"},
+		"done_when": {"полис на руках"}, "weight": {"0"},
+	}
+	req := httptest.NewRequest(http.MethodPost, "/tasks", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	handleTasks(httptest.NewRecorder(), req, core)
+	if len(core.edits) != 0 {
+		t.Errorf("edits = %+v, want none", core.edits)
+	}
+}
+
 // Out of range clamps rather than 400s; a non-number is a real client error.
 func TestApplyTaskPostClampsWeight(t *testing.T) {
 	core := &fakeTaskCore{created: true}

internal/audio/audio_test.go

@@ -82,6 +82,38 @@ func TestWAVRoundTrip(t *testing.T) {
 	}
 }
 
+// A LIST chunk sitting between fmt and data is common (arecord and ffmpeg both
+// write one), and its payload is free text that can spell "data". The parser
+// walks chunk headers, so the text is skipped and the real samples are read.
+func TestPCMFromWAVSkipsLISTChunk(t *testing.T) {
+	t.Parallel()
+	pcm := []byte{1, 0, 2, 0, 3, 0, 4, 0}
+	list := []byte("LIST")
+	payload := []byte("INFOICMTdata is not here")
+	list = binary.LittleEndian.AppendUint32(list, uint32(len(payload)))
+	list = append(list, payload...)
+
+	plain, err := WAVFromPCM(PCM16kMono, pcm)
+	if err != nil {
+		t.Fatalf("WAVFromPCM: %v", err)
+	}
+	wav := append([]byte{}, plain[:36]...)
+	wav = append(wav, list...)
+	wav = append(wav, plain[36:]...)
+	binary.LittleEndian.PutUint32(wav[4:8], uint32(len(wav)-8))
+
+	f, got, err := PCMFromWAV(wav)
+	if err != nil {
+		t.Fatalf("PCMFromWAV: %v", err)
+	}
+	if !f.IsValid() {
+		t.Fatalf("parsed format invalid: %+v", f)
+	}
+	if !bytes.Equal(got, pcm) {
+		t.Fatalf("PCM mismatch: got %v, want %v", got, pcm)
+	}
+}
+
 func TestPCMFromWAVRejectsNonCanonical(t *testing.T) {
 	t.Parallel()
 	// too short

internal/audio/pcmwav.go

@@ -36,6 +36,10 @@ const wavHeaderSize = 44
 // raw PCM samples (little-endian int16 as bytes). A non-canonical blob is
 // rejected with ErrNotCanonicalPCM; the format mismatch is logged at the seam
 // so the caller surfaces it, not a hidden silent downmix.
+//
+// The returned PCM aliases wav rather than copying it, because a recording is
+// large and the caller already owns the bytes. A caller that keeps the PCM past
+// the life of wav, or that reuses wav as a read buffer, must copy first.
 func PCMFromWAV(wav []byte) (Format, []byte, error) {
 	if len(wav) < wavHeaderSize {
 		return Format{}, nil, fmt.Errorf("audio: wav too short: %d bytes", len(wav))
@@ -61,17 +65,13 @@ func PCMFromWAV(wav []byte) (Format, []byte, error) {
 		return Format{}, nil, fmt.Errorf("%w: channels=%d bits=%d (want 1/16)", ErrNotCanonicalPCM, channels, bitsPerSample)
 	}
 	// data chunk: the spec mandates it appears right after fmt, but real
-	// recorders sometimes append extra chunks (LIST, fact). Find the "data"
-	// chunk by scanning; require it within the region we'd expect.
-	dataIdx := -1
-	for i := wavHeaderSize - 8; i+8 <= len(wav) && i < wavHeaderSize+4096; i++ {
-		if string(wav[i:i+4]) == "data" {
-			dataIdx = i
-			break
-		}
-	}
-	if dataIdx < 0 {
-		return Format{}, nil, fmt.Errorf("%w: no data chunk", ErrNotCanonicalPCM)
+	// recorders sometimes append extra chunks (LIST, fact). Walk the chunk
+	// headers rather than scanning for the four bytes "data", because those
+	// bytes occur inside a LIST/INFO payload as ordinary text and a byte scan
+	// would take the middle of a comment for a chunk header.
+	dataIdx, err := findDataChunk(wav)
+	if err != nil {
+		return Format{}, nil, err
 	}
 	dataSize := binary.LittleEndian.Uint32(wav[dataIdx+4 : dataIdx+8])
 	body := wav[dataIdx+8:]
@@ -90,6 +90,24 @@ func PCMFromWAV(wav []byte) (Format, []byte, error) {
 	return f, body, nil
 }
 
+// findDataChunk returns the offset of the "data" chunk header, walking the
+// chunk list that starts after the 16-byte fmt chunk. Chunks are word-aligned,
+// so an odd size carries one pad byte the next header sits behind.
+func findDataChunk(wav []byte) (int, error) {
+	for pos := wavHeaderSize - 8; pos+8 <= len(wav); {
+		size := int(binary.LittleEndian.Uint32(wav[pos+4 : pos+8]))
+		if string(wav[pos:pos+4]) == "data" {
+			return pos, nil
+		}
+		next := pos + 8 + size + size%2
+		if next <= pos || next > len(wav) {
+			break
+		}
+		pos = next
+	}
+	return 0, fmt.Errorf("%w: no data chunk", ErrNotCanonicalPCM)
+}
+
 // WAVFromPCM wraps raw 16-bit mono PCM bytes in a canonical 44-byte WAV
 // header so the result can be written to disk and played with `aplay`.
 // Used by the reference client to write the TTS reply; not on the wire.
@@ -115,7 +133,7 @@ const WAVHeaderSize = wavHeaderSize
 // avoiding.
 func WAVHeader(format Format, n int) ([]byte, error) {
 	if !format.IsValid() {
-		return nil, fmt.Errorf("audio: WAVFromPCM: %w: %+v", ErrNotCanonicalPCM, format)
+		return nil, fmt.Errorf("audio: WAVHeader: %w: %+v", ErrNotCanonicalPCM, format)
 	}
 	out := make([]byte, wavHeaderSize)
 	// RIFF header

internal/calendar/calendar.go

@@ -140,6 +140,12 @@ const EventKeyPrefix = "calendar_event_"
 //
 // An end at or before the start is read as crossing midnight, so a 23:30-00:15
 // meeting covers the quarter hour it actually covers.
+//
+// Both readings are built with time.Date rather than added to midnight as a
+// duration. A day is 23 or 25 hours wide on the two DST changeovers, so
+// midnight plus fourteen hours is 13:00 or 15:00 on those days, and the busy
+// gate would then read a 14:00 meeting an hour off. The same goes for the
+// midnight crossing, which is AddDate and not a 24-hour add.
 func FactSpan(key, value string, loc *time.Location) (start, end time.Time, ok bool) {
 	if !strings.HasPrefix(key, EventKeyPrefix) {
 		return time.Time{}, time.Time{}, false
@@ -172,10 +178,11 @@ func FactSpan(key, value string, loc *time.Location) (start, end time.Time, ok b
 	if !ok1 || !ok2 {
 		return time.Time{}, time.Time{}, false
 	}
-	start = day.Add(time.Duration(sh)*time.Hour + time.Duration(sm)*time.Minute)
-	end = day.Add(time.Duration(eh)*time.Hour + time.Duration(em)*time.Minute)
+	y, mo, d := day.Date()
+	start = time.Date(y, mo, d, sh, sm, 0, 0, loc)
+	end = time.Date(y, mo, d, eh, em, 0, 0, loc)
 	if !end.After(start) {
-		end = end.Add(24 * time.Hour)
+		end = end.AddDate(0, 0, 1)
 	}
 	return start, end, true
 }

internal/calendar/ical.go

@@ -66,7 +66,7 @@ func ParseICalDay(body []byte, now time.Time) []Event {
 // Reports false for all-day events and parse failures.
 func parseVEVENT(block string, loc *time.Location) (Event, bool) {
 	var e Event
-	for _, line := range strings.Split(block, "\n") {
+	for _, line := range strings.Split(unfold(block), "\n") {
 		line = strings.TrimSpace(line)
 		switch {
 		case strings.HasPrefix(line, "DTSTART"):
@@ -78,9 +78,9 @@ func parseVEVENT(block string, loc *time.Location) (Event, bool) {
 				e.End = t
 			}
 		case strings.HasPrefix(line, "SUMMARY"):
-			e.Summary = afterColon(line)
+			e.Summary = unescapeText(afterColon(line))
 		case strings.HasPrefix(line, "UID"):
-			e.UID = afterColon(line)
+			e.UID = unescapeText(afterColon(line))
 		}
 	}
 	if e.Start.IsZero() || e.End.IsZero() {
@@ -89,6 +89,48 @@ func parseVEVENT(block string, loc *time.Location) (Event, bool) {
 	return e, true
 }
 
+// unfold undoes RFC 5545 content-line folding, where a long property is split
+// with a CRLF and the continuation begins with one space or tab.
+//
+// It runs before the block is split into lines, because splitting first and
+// trimming each line destroys the leading space that marks a continuation. A
+// server folds at 75 octets and a Russian summary is two bytes a letter, so
+// "Еженедельная планёрка с командой" crosses the limit easily — without this
+// the tail of the summary was read as an unknown property and dropped, and the
+// event was filed under a truncated name.
+func unfold(block string) string {
+	if !strings.Contains(block, "\n ") && !strings.Contains(block, "\n\t") {
+		return block
+	}
+	return strings.NewReplacer("\r\n ", "", "\r\n\t", "", "\n ", "", "\n\t", "").Replace(block)
+}
+
+// unescapeText reverses the RFC 5545 TEXT escaping escapeText applies. Without
+// it a summary a server wrote as "Обед\, потом созвон" reaches the day plan
+// with the backslash still in it, and FactKey folds that literal into the key.
+func unescapeText(s string) string {
+	if !strings.Contains(s, `\`) {
+		return s
+	}
+	var b strings.Builder
+	b.Grow(len(s))
+	for i := 0; i < len(s); i++ {
+		if s[i] != '\\' || i+1 >= len(s) {
+			b.WriteByte(s[i])
+			continue
+		}
+		i++
+		switch s[i] {
+		case 'n', 'N':
+			b.WriteByte('\n')
+		default:
+			// ";", ",", "\\" and anything else a writer escaped needlessly.
+			b.WriteByte(s[i])
+		}
+	}
+	return b.String()
+}
+
 func afterColon(line string) string {
 	if i := strings.Index(line, ":"); i >= 0 {
 		return strings.TrimSpace(line[i+1:])

internal/calendar/ical_render_test.go

@@ -61,6 +61,44 @@ func TestRenderICalEscapesInjection(t *testing.T) {
 	}
 }
 
+// A folded SUMMARY is one property, not a property plus a dropped tail. Servers
+// fold at 75 octets and a Russian summary is two bytes a letter.
+func TestParseICalUnfoldsAndUnescapes(t *testing.T) {
+	body := []byte("BEGIN:VEVENT\r\n" +
+		"UID:u1\r\n" +
+		"DTSTART:20260703T130000Z\r\n" +
+		"DTEND:20260703T140000Z\r\n" +
+		"SUMMARY:Еженедельная планёрка\\, потом\r\n  созвон\r\n" +
+		"END:VEVENT\r\n")
+	from := time.Date(2026, 7, 3, 0, 0, 0, 0, time.UTC)
+	events := ParseICal(body, from, from.AddDate(0, 0, 1))
+	if len(events) != 1 {
+		t.Fatalf("got %d events, want 1", len(events))
+	}
+	if want := "Еженедельная планёрка, потом созвон"; events[0].Summary != want {
+		t.Errorf("Summary = %q, want %q", events[0].Summary, want)
+	}
+}
+
+// A day is 23 hours wide where DST starts, so a wall clock reading has to be
+// built with time.Date and never as midnight plus a duration.
+func TestFactSpanAcrossDSTStart(t *testing.T) {
+	loc, err := time.LoadLocation("Europe/Berlin")
+	if err != nil {
+		t.Skipf("no tzdata for Europe/Berlin: %v", err)
+	}
+	start, end, ok := FactSpan("calendar_event_20260329_Planerka", "Planerka @ 14:00-15:00", loc)
+	if !ok {
+		t.Fatal("FactSpan reported not ok")
+	}
+	if start.Hour() != 14 || start.Minute() != 0 {
+		t.Errorf("start = %s, want a 14:00 wall clock", start)
+	}
+	if end.Hour() != 15 {
+		t.Errorf("end = %s, want a 15:00 wall clock", end)
+	}
+}
+
 func TestReminderEventEmptyPayload(t *testing.T) {
 	e := ReminderEvent(3, time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC), "   ", 0)
 	if e.Summary != "напоминание" {

internal/claim/claim.go

@@ -2,8 +2,8 @@
 // utterance (V-565, umbrella V-558, design in
 // docs/plans/19-dialogue-arbitration.md).
 //
-// Maven's cascade has roughly ten stage-0 grammars, seven router intents,
-// twenty-two query sources and four stateful pre-emptors, and every one of them
+// Maven's cascade has twenty-two stage-0 grammars, seven router intents,
+// twenty-two query sources and seven stateful pre-emptors, and every one of them
 // answers "is this mine?" alone. None can answer "is this more mine than
 // yours?", because their scores are not comparable: stage 0 asserts 1.0 by
 // fiat, the classifier reports a cosine, the LLM router derives one from
@@ -56,8 +56,9 @@ const (
 	// BandStructural — the claimant read the whole sentence and produced a
 	// complete route, every slot its intent requires filled. The LLM router at
 	// full confidence, and a stateful claimant holding a pending question.
-	// Below BandAnchored on purpose: the four stateful claimants pre-empt
-	// unconditionally today, and that is the V-558 defect.
+	// Below BandAnchored on purpose: the stateful claimants pre-empt
+	// unconditionally today, and that is the V-558 defect. There are seven of
+	// them and preRouteLadder in cmd/mavend/decisiontrace.go is the roster.
 	BandStructural
 
 	// BandAnchored — a literal pattern anchored in the utterance matched, and

internal/config/config.go

@@ -15,6 +15,7 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"log"
 	"os"
 	"path/filepath"
 	"time"
@@ -329,7 +330,15 @@ func Load(path string) (*Config, error) {
 	// Expand ${VAR} or $VAR patterns from environment variables. This lets
 	// secrets live in env (docker-compose env_file) rather than the config
 	// file committed to git.
-	expanded := os.ExpandEnv(string(b))
+	expanded, missing := expandEnv(string(b))
+	if len(missing) > 0 {
+		// An unset variable expands to "", which every block reads as "not
+		// configured" and none of them complains about. That is the intended
+		// behaviour and it stays: CI parses this same file with no secrets
+		// present. What was missing is the line telling the operator which
+		// capability he just turned off by forgetting an env file.
+		log.Printf("config: %s references unset environment variables %v — those settings are empty, so whatever they configure is off", path, missing)
+	}
 	var c Config
 	if err := json.Unmarshal([]byte(expanded), &c); err != nil {
 		return nil, fmt.Errorf("config: parse %s: %w", path, err)
@@ -341,6 +350,23 @@ func Load(path string) (*Config, error) {
 	return &c, nil
 }
 
+// expandEnv is os.ExpandEnv plus the names it could not resolve, each reported
+// once and in the order the file mentions them. A variable set to the empty
+// string counts as set: the operator wrote it down, so he meant it.
+func expandEnv(s string) (string, []string) {
+	var missing []string
+	seen := map[string]bool{}
+	out := os.Expand(s, func(name string) string {
+		v, ok := os.LookupEnv(name)
+		if !ok && !seen[name] {
+			seen[name] = true
+			missing = append(missing, name)
+		}
+		return v
+	})
+	return out, missing
+}
+
 func (c *Config) applyDefaults() {
 	if c.IntakeJournal == 0 {
 		c.IntakeJournal = DefaultIntakeJournal

internal/crawl/crawl.go

@@ -57,6 +57,16 @@ var (
 	ErrFetchStatus = errors.New("crawl: the server answered with an error status")
 )
 
+// StatusError is ErrFetchStatus with the code the server actually sent. The
+// adapter builds it; isServerError reads Code rather than the message, so a
+// reworded error can no longer turn a 503 robots.txt into permission to crawl.
+type StatusError struct{ Code int }
+
+func (e *StatusError) Error() string {
+	return fmt.Sprintf("crawl: the server answered with status %d", e.Code)
+}
+func (e *StatusError) Unwrap() error { return ErrFetchStatus }
+
 // Fetcher is the guarded HTTP door (internal/webfetch adapted by the daemon). An
 // interface so this package constructs no http.Client of its own and can be
 // tested without a network.
@@ -233,16 +243,15 @@ func (c *Crawler) markFetched(host string) {
 	c.mu.Unlock()
 }
 
-// isServerError — a 5xx rather than any other non-2xx. The adapter formats the
-// status into the message, which is the only place it survives.
+// isServerError — a 5xx rather than any other non-2xx. A status the adapter
+// could not recover reads as 0 and is not a server error, which keeps the
+// standard's "404 means allow" as the default for an unknown.
 func isServerError(err error) bool {
-	s := err.Error()
-	for _, code := range []string{" 50", " 51", " 52", " 53"} {
-		if strings.Contains(s, code) {
-			return true
-		}
+	var se *StatusError
+	if !errors.As(err, &se) {
+		return false
 	}
-	return false
+	return se.Code >= 500 && se.Code <= 599
 }
 
 // Hash is the dedup key for a crawl result: the sha256 of the extracted text,

internal/crawl/politeness_test.go

@@ -79,7 +79,7 @@ func TestPage_ABrokenRobotsServerIsNotPermissionToCrawl(t *testing.T) {
 	// way to resolve an unknown.
 	f := &timedFetcher{
 		pages: map[string]Response{"https://example.org/a": {Body: []byte("<html><body>a</body></html>")}},
-		errs:  map[string]error{"https://example.org/robots.txt": fmt.Errorf("%w: 503", ErrFetchStatus)},
+		errs:  map[string]error{"https://example.org/robots.txt": &StatusError{Code: 503}},
 	}
 	c := New(f, Config{UserAgent: "Maven/1.0"})
 	if _, err := c.Page(context.Background(), "https://example.org/a"); !errors.Is(err, ErrFetchStatus) {

internal/decision/ring.go

@@ -19,6 +19,13 @@ type Ring struct {
 func NewRing() *Ring { return &Ring{} }
 
 // Push adds one finished record and drops the oldest past the bound.
+//
+// The dropped pointers are cleared before the reslice. Resliceing alone moves
+// the window forward and leaves the evicted records addressable from the
+// backing array, so up to ringSize turns he had already aged out stayed in
+// memory until the next append reallocated. That is a leak anywhere and it is
+// the wrong one here, because the reason this store is memory-only is that his
+// words should not outlive the diagnosis.
 func (r *Ring) Push(rec *Record) {
 	if r == nil || rec == nil {
 		return
@@ -26,8 +33,11 @@ func (r *Ring) Push(rec *Record) {
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	r.recs = append(r.recs, rec)
-	if len(r.recs) > ringSize {
-		r.recs = r.recs[len(r.recs)-ringSize:]
+	if drop := len(r.recs) - ringSize; drop > 0 {
+		for i := 0; i < drop; i++ {
+			r.recs[i] = nil
+		}
+		r.recs = r.recs[drop:]
 	}
 }
 

internal/delivery/telegramsink/telegramsink.go

@@ -172,21 +172,49 @@ func (s *Sink) Send(ctx context.Context, d delivery.Sendable) error {
 		return fmt.Errorf("telegramsink: sendMessage: %w", s.redact(err))
 	}
 	defer resp.Body.Close()
-	rb, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+	rb, _ := io.ReadAll(io.LimitReader(resp.Body, maxRespBytes))
 
 	// telegram returns 200 with ok=true on success; non-2xx with ok=false +
 	// error_code + description on failure. parse the body either way so a 200
 	// with ok=false (shouldn't happen, but the API reserves that) still surfaces.
 	var tr telegramResp
-	if jsonErr := json.Unmarshal(rb, &tr); jsonErr == nil && !tr.Ok {
+	jsonErr := json.Unmarshal(rb, &tr)
+	if jsonErr == nil && !tr.Ok {
 		return fmt.Errorf("telegramsink: telegram returned error %d: %s", tr.ErrorCode, strings.TrimSpace(tr.Description))
 	}
 	if resp.StatusCode/100 != 2 {
-		return fmt.Errorf("telegramsink: telegram returned %d: %s", resp.StatusCode, strings.TrimSpace(string(rb)))
+		return fmt.Errorf("telegramsink: telegram returned %d: %s", resp.StatusCode, snippet(rb))
+	}
+	// A 2xx whose body is not the bot API's envelope did not come from the bot
+	// API. The normal path here is the relay: this box reaches telegram through
+	// an HTTP/SOCKS5 proxy, and a proxy that is up but cannot reach
+	// api.telegram.org answers 200 with an HTML page of its own. Reading that as
+	// a delivered message is the worst outcome the sink has — the dispatcher
+	// writes a 'sent' outbox row, MarkSent restarts the repeat clock, and the
+	// sev4 alarm that never arrived goes quiet for a whole interval. Only
+	// ok=true is a send.
+	if jsonErr != nil {
+		return fmt.Errorf("telegramsink: telegram returned %d with a body that is not the bot API envelope (not a confirmed send): %s", resp.StatusCode, snippet(rb))
 	}
 	return nil
 }
 
+// maxRespBytes caps the response read — the body is wire-controlled and the
+// relay in front of it is not telegram. It is far above any sendMessage
+// envelope (a few hundred bytes; the result echoes one short away message),
+// because a truncated body no longer parses and now reads as a failed send.
+const maxRespBytes = 64 << 10
+
+// snippet trims a response body down to something an error line can carry. A
+// relay's HTML page is measured in kilobytes and none of it belongs in the log.
+func snippet(rb []byte) string {
+	s := strings.TrimSpace(string(rb))
+	if len(s) > 200 {
+		return s[:200] + "…"
+	}
+	return s
+}
+
 // sendMessageURL — the bot API path. the token is in the URL path
 // (https://api.telegram.org/bot<token>/sendMessage); telegram does not accept
 // it anywhere else. the URL is built per-send from the resolved base and never

internal/delivery/telegramsink/telegramsink_test.go

@@ -291,6 +291,66 @@ func TestSendReturnsErrorOnTelegramError(t *testing.T) {
 	}
 }
 
+// A relay that is up but cannot reach api.telegram.org answers 200 with a page
+// of its own. That is not a delivered message, and calling it one silences a
+// sev4 alarm for a full repeat interval.
+func TestSendRefusesA200ThatIsNotTheBotAPIEnvelope(t *testing.T) {
+	rs := newRecordingServer(t, http.StatusOK, `<html><body>proxy: upstream unreachable</body></html>`)
+	srv := httptest.NewServer(rs.handler())
+	defer srv.Close()
+
+	sink, _ := New(sinkCfg(srv.URL))
+	err := sink.Send(context.Background(), nudgeSendable(loop.Sev4, "down"))
+	if err == nil {
+		t.Fatal("want error on a 200 that is not the bot API envelope")
+	}
+	if !strings.Contains(err.Error(), "not a confirmed send") {
+		t.Fatalf("error should say the send is unconfirmed, got: %v", err)
+	}
+}
+
+// The success path must stay a success: ok=true on 200 is a send.
+func TestSendAcceptsOkTrue(t *testing.T) {
+	rs := newRecordingServer(t, http.StatusOK, `{"ok":true,"result":{"message_id":7}}`)
+	srv := httptest.NewServer(rs.handler())
+	defer srv.Close()
+
+	sink, _ := New(sinkCfg(srv.URL))
+	if err := sink.Send(context.Background(), nudgeSendable(loop.Sev4, "down")); err != nil {
+		t.Fatalf("want success on ok=true, got: %v", err)
+	}
+}
+
+// A body long enough to have been truncated by the old 4096-byte cap still
+// parses, so a real send is not reported as a failure.
+func TestSendAcceptsAnOversizedButValidEnvelope(t *testing.T) {
+	rs := newRecordingServer(t, http.StatusOK,
+		`{"ok":true,"result":{"message_id":7,"text":"`+strings.Repeat("x", 8000)+`"}}`)
+	srv := httptest.NewServer(rs.handler())
+	defer srv.Close()
+
+	sink, _ := New(sinkCfg(srv.URL))
+	if err := sink.Send(context.Background(), nudgeSendable(loop.Sev4, "down")); err != nil {
+		t.Fatalf("want success on a large ok=true envelope, got: %v", err)
+	}
+}
+
+// The error line carries a snippet, not the relay's whole page.
+func TestSendErrorDoesNotCarryTheWholeBody(t *testing.T) {
+	rs := newRecordingServer(t, http.StatusBadGateway, strings.Repeat("z", 5000))
+	srv := httptest.NewServer(rs.handler())
+	defer srv.Close()
+
+	sink, _ := New(sinkCfg(srv.URL))
+	err := sink.Send(context.Background(), nudgeSendable(loop.Sev4, "down"))
+	if err == nil {
+		t.Fatal("want error on 502")
+	}
+	if len(err.Error()) > 500 {
+		t.Fatalf("error line should be trimmed, got %d bytes", len(err.Error()))
+	}
+}
+
 func TestSendReturnsErrorOnNon2xx(t *testing.T) {
 	rs := newRecordingServer(t, http.StatusBadGateway, "bad gateway")
 	srv := httptest.NewServer(rs.handler())

internal/email/charset.go

@@ -1,5 +1,7 @@
 package email
 
+import "strings"
+
 // windows-1251 (and its ASCII-compatible low half) is decoded here rather than
 // pulled in from x/text.
 //
@@ -35,14 +37,19 @@ var cp1251High = [128]rune{
 
 // decodeCP1251 maps each byte through the table. Every byte has a defined
 // meaning in this charset, so decoding cannot fail.
+//
+// It writes into a Builder rather than collecting runes: a []rune of the whole
+// body is four bytes a character and was then copied again into the string, so
+// a 1 MiB cp1251 mail allocated about 6 MiB to produce roughly 2.
 func decodeCP1251(b []byte) string {
-	out := make([]rune, 0, len(b))
+	var out strings.Builder
+	out.Grow(len(b))
 	for _, c := range b {
 		if c < 0x80 {
-			out = append(out, rune(c))
+			out.WriteByte(c)
 			continue
 		}
-		out = append(out, cp1251High[c-0x80])
+		out.WriteRune(cp1251High[c-0x80])
 	}
-	return string(out)
+	return out.String()
 }

internal/email/message.go

@@ -18,6 +18,7 @@
 package email
 
 import (
+	"bytes"
 	"encoding/base64"
 	"fmt"
 	"io"
@@ -57,7 +58,10 @@ type Message struct {
 // through, because a subject line alone is often the whole task ("Счёт за
 // интернет"). Only a message whose headers cannot be read at all is an error.
 func ParseMessage(uid uint32, raw []byte) (Message, error) {
-	m, err := mail.ReadMessage(strings.NewReader(string(raw)))
+	// bytes.NewReader, not strings.NewReader(string(raw)): the conversion copied
+	// the whole message, and MaxMessageBytes lets that be 2 MiB per mail on a box
+	// already holding the resident model.
+	m, err := mail.ReadMessage(bytes.NewReader(raw))
 	if err != nil {
 		return Message{}, fmt.Errorf("email: parse message: %w", err)
 	}
@@ -82,6 +86,23 @@ func ParseMessage(uid uint32, raw []byte) (Message, error) {
 // wholesale — an attachment is a file, not a sentence, and reading one would
 // mean parsing arbitrary formats from the network.
 func plaintextBody(contentType, encoding string, body io.Reader) (string, error) {
+	return plaintextBodyAt(contentType, encoding, body, 0)
+}
+
+// MaxMIMEDepth — how deep the MIME tree is walked.
+//
+// The nesting comes off the wire, so the recursion depth is the sender's to
+// pick: a boundary line is a few bytes, and one message inside MaxMessageBytes
+// can declare tens of thousands of multipart levels. Real mail is three deep
+// (mixed, then alternative, then related), so a message past this is malformed
+// or hostile and truncating the walk costs a body nobody was going to read.
+const MaxMIMEDepth = 12
+
+// plaintextBodyAt is plaintextBody carrying the current nesting depth.
+func plaintextBodyAt(contentType, encoding string, body io.Reader, depth int) (string, error) {
+	if depth > MaxMIMEDepth {
+		return "", nil
+	}
 	mediaType, params, err := mime.ParseMediaType(contentType)
 	if contentType == "" || err != nil {
 		// No Content-Type at all is legal and means text/plain; a broken one is
@@ -94,7 +115,7 @@ func plaintextBody(contentType, encoding string, body io.Reader) (string, error)
 		if boundary == "" {
 			return "", fmt.Errorf("email: multipart without boundary")
 		}
-		plain, html, err := multipartText(multipart.NewReader(body, boundary))
+		plain, html, err := multipartText(multipart.NewReader(body, boundary), depth+1)
 		if err != nil {
 			return "", err
 		}
@@ -124,7 +145,7 @@ func plaintextBody(contentType, encoding string, body io.Reader) (string, error)
 // contribute either kind. Folding a nested level's answer into one string put
 // HTML-derived text in the plain bucket, and a real text/plain sibling later in
 // the message was then thrown away by the "plain is already set" guard.
-func multipartText(mr *multipart.Reader) (plain, html string, err error) {
+func multipartText(mr *multipart.Reader, depth int) (plain, html string, err error) {
 	for {
 		part, err := mr.NextPart()
 		if err == io.EOF {
@@ -143,8 +164,8 @@ func multipartText(mr *multipart.Reader) (plain, html string, err error) {
 		switch {
 		case strings.HasPrefix(mediaType, "multipart/"):
 			var np, nh string
-			if b := params["boundary"]; b != "" {
-				np, nh, _ = multipartText(multipart.NewReader(part, b))
+			if b := params["boundary"]; b != "" && depth <= MaxMIMEDepth {
+				np, nh, _ = multipartText(multipart.NewReader(part, b), depth+1)
 			}
 			part.Close()
 			if plain == "" {
@@ -154,7 +175,7 @@ func multipartText(mr *multipart.Reader) (plain, html string, err error) {
 				html = nh
 			}
 		default:
-			text, terr := plaintextBody(ct, part.Header.Get("Content-Transfer-Encoding"), part)
+			text, terr := plaintextBodyAt(ct, part.Header.Get("Content-Transfer-Encoding"), part, depth)
 			part.Close()
 			if terr != nil || strings.TrimSpace(text) == "" {
 				continue

internal/email/message_test.go

@@ -1,6 +1,7 @@
 package email
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -143,6 +144,24 @@ func TestParseTruncatesLongBody(t *testing.T) {
 	}
 }
 
+// Nesting depth comes off the wire, so a hostile message must not get to pick
+// the recursion depth. The walk stops and the headers still come through.
+func TestParseMessageBoundsMIMEDepth(t *testing.T) {
+	var b strings.Builder
+	b.WriteString("Subject: deep\r\nMIME-Version: 1.0\r\n")
+	for i := 0; i < MaxMIMEDepth+20; i++ {
+		fmt.Fprintf(&b, "Content-Type: multipart/mixed; boundary=\"b%d\"\r\n\r\n--b%d\r\n", i, i)
+	}
+	b.WriteString("Content-Type: text/plain\r\n\r\nглубоко\r\n")
+	msg, err := ParseMessage(7, []byte(b.String()))
+	if err != nil {
+		t.Fatalf("ParseMessage: %v", err)
+	}
+	if msg.Subject != "deep" {
+		t.Errorf("Subject = %q, want the headers to survive", msg.Subject)
+	}
+}
+
 func TestCollapseSqueezesBlankLines(t *testing.T) {
 	got := collapse("  a  b \r\n\r\n\r\n\r\n  c  \r\n")
 	if got != "a b\n\nc" {

internal/ipc/wire.go

@@ -131,9 +131,15 @@ const (
 	codeInternal        = "internal"
 )
 
-// codeOf maps a server-side sentinel to its wire code. Anything not matched
-// is codeInternal — we never leak internal Go error text to a module; it
-// gets a generic "internal" and the daemon logs the real error server-side.
+// codeOf maps a server-side sentinel to its wire code. Anything not matched is
+// codeInternal.
+//
+// This used to claim the text of an unmatched error stays server-side. It does
+// not: rpcErr below ships err.Error() for codeInternal and codeBadParams,
+// deliberately, because on those two codes the text is the whole diagnostic and
+// a module has no other way to see it. Worth knowing before putting a secret in
+// an error string, and worth knowing twice on a tcp seam, where that string
+// leaves the box.
 func codeOf(err error) string {
 	switch {
 	case err == nil:

internal/lexicon/lexicon.go

@@ -62,10 +62,10 @@ func mustLoad() lexiconFile {
 	}
 	for _, name := range []string{
 		"interrogatives", "capture_verbs", "narrative_requests", "cardinals", "ordinals",
-		"day_offsets", "weekdays", "months_genitive", "hours_spoken",
+		"day_offsets", "weekdays", "weekdays_english", "months_genitive", "hours_spoken",
 		"not_place_after_v", "parts_of_day", "reminder_verbs", "half_hour",
 		"filler_particles", "task_done_words", "task_drop_words",
-		"confirm_yes", "confirm_no",
+		"confirm_yes", "confirm_no", "hour_units", "minute_units",
 	} {
 		s, ok := f.Sets[name]
 		if !ok || (len(s.Words) == 0 && len(s.Values) == 0) {
@@ -139,7 +139,40 @@ func TaskDropWords() []string { return words("task_drop_words") }
 // making the utterance a request of its own. A caller strips these (along with
 // the numbers and the other closed time sets) to see whether an utterance
 // carries any content beside the value it was asked for. See the set's note.
-func SlotValueFrame() []string { return words("slot_value_frame") }
+// The hour and the minute nouns are part of the frame and are kept in their own
+// sets, so there is one copy of each closed class rather than a copy per caller.
+func SlotValueFrame() []string {
+	out := words("slot_value_frame")
+	out = append(out, HourUnits()...)
+	out = append(out, MinuteUnits()...)
+	return out
+}
+
+// HourUnits returns every form of the hour noun, and MinuteUnits every form of
+// the minute noun. One home for each, because four router sets used to list the
+// hour and all four stopped at "часу" (V-609). A caller folding time words into
+// one set reads these; a caller asking about a single word reads IsHourUnit or
+// IsMinuteUnit.
+func HourUnits() []string { return words("hour_units") }
+
+// MinuteUnits — see HourUnits.
+func MinuteUnits() []string { return words("minute_units") }
+
+// IsHourUnit reports whether a word is the hour noun in any form.
+func IsHourUnit(word string) bool { return inSet("hour_units", word) }
+
+// IsMinuteUnit reports whether a word is the minute noun in any form.
+func IsMinuteUnit(word string) bool { return inSet("minute_units", word) }
+
+func inSet(set, word string) bool {
+	w := norm(word)
+	for _, s := range ru.Sets[set].Words {
+		if w == s {
+			return true
+		}
+	}
+	return false
+}
 
 // DialogueCancel returns the ways he calls off the request Maven is assembling.
 // Distinct from TaskDropWords, which abandons an item that already exists.
@@ -283,6 +316,20 @@ func DayOffsetIn(text string) (int, bool) {
 // Go's time.Weekday. An index off the end returns "".
 func Weekday(i int) string { return at("weekdays", i) }
 
+// Weekdays returns the seven Russian names in one slice, Sunday first, for a
+// caller matching a token against all of them rather than rendering one. Only
+// the nominative is here: every other case lemmatises to it, so an oblique form
+// is morph's question and not a second list (V-581).
+func Weekdays() []string { return words("weekdays") }
+
+// WeekdayEnglish reports the Go time.Weekday index an English weekday names,
+// singular or plural. English needs the list that Russian does not, because the
+// vendored dictionary is Russian and leaves "mondays" as it found it.
+func WeekdayEnglish(word string) (int, bool) {
+	n, ok := ru.Sets["weekdays_english"].Values[norm(word)]
+	return n, ok
+}
+
 // MonthGenitive returns the month name a date takes — "10 июля", not "июль".
 // The set is 1-indexed, so MonthGenitive(int(t.Month())) is the whole call.
 func MonthGenitive(m int) string { return at("months_genitive", m) }

internal/lexicon/lexicon_ru_v1.json

@@ -56,13 +56,13 @@
       }
     },
     "cardinals": {
-      "note": "Number words as spoken, with the gender variants Russian requires (один/одна/одно and два/две agree with the noun that follows) and the oblique forms, because a spoken time declines: \"в семь\", \"к семи\", \"около семи\" are three forms of one hour (Vikunja #530). Values are the number itself. Twenties and up are compounds and are read as their parts, so only the round members are listed.",
+      "note": "Number words as spoken, with the gender variants Russian requires (один/одна/одно and два/две agree with the noun that follows) and the oblique forms, because a spoken time declines: \"в семь\", \"к семи\", \"около семи\" are three forms of one hour (Vikunja #530). Values are the number itself. Twenties and up are compounds and are read as their parts, so only the round members are listed. From five up one oblique form serves the genitive, dative and prepositional, so \"пяти\" is the whole set; one to four decline separately and carry the dative and instrumental of their own, because \"к двум часам\" and \"к трём\" are hours he says (V-581).",
       "values": {
         "ноль": 0, "нуль": 0, "zero": 0,
-        "один": 1, "одна": 1, "одно": 1, "одного": 1, "одной": 1, "одну": 1, "one": 1,
-        "два": 2, "две": 2, "двух": 2, "two": 2,
-        "три": 3, "трёх": 3, "трех": 3, "three": 3,
-        "четыре": 4, "четырёх": 4, "четырех": 4, "four": 4,
+        "один": 1, "одна": 1, "одно": 1, "одного": 1, "одной": 1, "одну": 1, "одному": 1, "одним": 1, "one": 1,
+        "два": 2, "две": 2, "двух": 2, "двум": 2, "двумя": 2, "two": 2,
+        "три": 3, "трёх": 3, "трех": 3, "трём": 3, "трем": 3, "тремя": 3, "three": 3,
+        "четыре": 4, "четырёх": 4, "четырех": 4, "четырём": 4, "четырем": 4, "четырьмя": 4, "four": 4,
         "пять": 5, "пяти": 5, "five": 5,
         "шесть": 6, "шести": 6, "six": 6,
         "семь": 7, "семи": 7, "seven": 7,
@@ -111,6 +111,18 @@
         "четверг", "пятница", "суббота"
       ]
     },
+    "weekdays_english": {
+      "note": "The English weekday names with their Go time.Weekday index, plus the plural a habit is spoken in (\"on mondays\"). English is listed as words where Russian is not, because the vendored dictionary is Russian: it lemmatises \"пятницу\" to \"пятница\" on its own and leaves \"mondays\" alone (V-581). So the Russian side of a weekday match is grammar and the English side is data.",
+      "values": {
+        "sunday": 0, "sundays": 0,
+        "monday": 1, "mondays": 1,
+        "tuesday": 2, "tuesdays": 2,
+        "wednesday": 3, "wednesdays": 3,
+        "thursday": 4, "thursdays": 4,
+        "friday": 5, "fridays": 5,
+        "saturday": 6, "saturdays": 6
+      }
+    },
     "months_genitive": {
       "note": "The form a date takes: \"10 июля\", not \"июль\". 1-indexed, so slot 0 is empty and month numbers need no arithmetic.",
       "words": [
@@ -198,6 +210,20 @@
         "передумал", "передумала", "неактуально"
       ]
     },
+    "hour_units": {
+      "note": "Every form of the hour noun, Russian and English (V-609). One home for a closed class that four router sets used to list separately, and all four stopped at \"часу\": \"напомни к двум часам\" lost its hour and the reminder was left asking \"Когда?\". Russian declines, so the dative plural is as ordinary a way to say an hour as the accusative singular. A caller that folds time words into one set reads HourUnits; a caller asking about one word reads IsHourUnit.",
+      "words": [
+        "час", "часа", "часов", "часу", "часам", "часами", "часах",
+        "hour", "hours"
+      ]
+    },
+    "minute_units": {
+      "note": "Every form of the minute noun, Russian and English (V-609). Same class as hour_units one noun over, and it had the same gap: the dative plural \"минутам\" was missing everywhere \"минут\" and \"минуты\" were present.",
+      "words": [
+        "минута", "минуты", "минуту", "минут", "минуте", "минутам", "минутами", "минутах",
+        "minute", "minutes"
+      ]
+    },
     "slot_value_frame": {
       "note": "The words that can stand around a bare slot value without making the utterance a request of its own (Vikunja #560). Prepositions, hedges and the nouns a spoken time is built from: strip these, the numbers, the interrogatives, the filler particles and the other time sets, and whatever is left is the utterance's OWN content. \"а что если в 11:00\" leaves nothing and is an answer; \"какая сейчас погода в Риме\" leaves \"погода\" and \"Риме\" and is not. Closed because each part of it is closed — Russian has a fixed list of prepositions, and a clock is built from a fixed list of nouns. It is not a stopword list: a word goes in only if it can never be the thing he is asking about.",
       "words": [
@@ -205,10 +231,10 @@
         "at", "on", "in", "by", "to", "till", "until", "after", "before", "about", "for",
         "нет", "не", "да", "ага", "угу", "ой", "ох", "тогда", "лучше", "может", "можно", "наверное", "наверно", "пожалуй", "точнее", "скорее", "если", "пусть", "прости", "извини", "слушай", "значит", "как-то", "типа", "вообще-то",
         "no", "yes", "yeah", "ok", "okay", "sorry", "maybe", "actually", "rather", "then", "well",
-        "час", "часа", "часов", "часу", "часам", "минут", "минута", "минуты", "минуту", "минутах", "полдень", "полночь", "полдня",
+        "полдень", "полночь", "полдня",
         "утра", "утро", "утру", "дня", "день", "днями", "вечера", "вечер", "вечеру", "ночи", "ночь", "ночью",
         "сейчас", "теперь", "сегодняшний", "ближайший", "ближайшее",
-        "hour", "hours", "minute", "minutes", "noon", "midnight", "am", "pm", "oclock", "now"
+        "noon", "midnight", "am", "pm", "oclock", "now"
       ]
     },
     "dialogue_cancel": {

internal/lexicon/lexicon_test.go

@@ -36,6 +36,46 @@ func TestClosedSetsAreComplete(t *testing.T) {
 	if _, ok := Cardinal("бэкап"); ok {
 		t.Error("Cardinal must not answer for a word that is not a number")
 	}
+
+	// A spoken hour declines, and one to four decline further than the rest:
+	// "к двум часам" and "к трём" are hours, and only the dative says so (V-581).
+	for _, tc := range []struct {
+		word string
+		want int
+	}{
+		{"одному", 1}, {"двум", 2}, {"двумя", 2}, {"трём", 3}, {"трем", 3},
+		{"четырём", 4}, {"четырем", 4}, {"пяти", 5}, {"семи", 7},
+	} {
+		if got, ok := Cardinal(tc.word); !ok || got != tc.want {
+			t.Errorf("Cardinal(%q) = %d, %v; want %d, true", tc.word, got, ok, tc.want)
+		}
+	}
+}
+
+// TestWeekdaysAreOneList — the second copy of a closed class is the bug (V-581).
+// Weekdays lived in four files outside this one, so the list is handed out whole
+// and the English forms, which the Russian dictionary cannot lemmatise, are here.
+func TestWeekdaysAreOneList(t *testing.T) {
+	days := Weekdays()
+	if len(days) != 7 || days[0] != "воскресенье" || days[1] != "понедельник" {
+		t.Fatalf("Weekdays() = %v; want the seven, Sunday first", days)
+	}
+	for i, name := range days {
+		if Weekday(i) != name {
+			t.Errorf("Weekdays()[%d] = %q, but Weekday(%d) = %q", i, name, i, Weekday(i))
+		}
+	}
+	for _, tc := range []struct {
+		word string
+		want int
+	}{{"sunday", 0}, {"monday", 1}, {"mondays", 1}, {"Friday", 5}, {"saturdays", 6}} {
+		if got, ok := WeekdayEnglish(tc.word); !ok || got != tc.want {
+			t.Errorf("WeekdayEnglish(%q) = %d, %v; want %d, true", tc.word, got, ok, tc.want)
+		}
+	}
+	if _, ok := WeekdayEnglish("понедельник"); ok {
+		t.Error("WeekdayEnglish answered for a Russian word; that side is morph's")
+	}
 }
 
 // TestDayOffsetHasNoOrderingTrap — the defect a lookup removes. The callers this

internal/llm/remote.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"log"
 	"net/http"
+	"sync"
 	"sync/atomic"
 	"time"
 )
@@ -46,6 +47,7 @@ type Pair struct {
 	interval time.Duration
 	http     *http.Client
 	stop     chan struct{}
+	stopOnce sync.Once
 }
 
 // ErrRemoteUnavailable — the workstation model was required and is not
@@ -107,13 +109,11 @@ func (p *Pair) Start(ctx context.Context) {
 	}()
 }
 
-// Stop ends the prober. Idempotent.
+// Stop ends the prober. Idempotent, and safe from two goroutines at once. The
+// check-then-close it replaced let both callers see an open channel and the
+// second close panicked, which turned a shutdown race into a crash.
 func (p *Pair) Stop() {
-	select {
-	case <-p.stop:
-	default:
-		close(p.stop)
-	}
+	p.stopOnce.Do(func() { close(p.stop) })
 }
 
 // Available reports whether the workstation will take work right now. It reads
@@ -170,7 +170,9 @@ func (p *Pair) Complete(ctx context.Context, r Req) (string, error) {
 	}
 	why := "workstation down"
 	if p.Available() {
-		out, err := p.remote.Complete(ctx, r)
+		rctx, cancel := remoteBudget(ctx)
+		out, err := p.remote.Complete(rctx, r)
+		cancel()
 		if err == nil {
 			log.Print("llm: served by the workstation model")
 			return out, nil
@@ -184,6 +186,30 @@ func (p *Pair) Complete(ctx context.Context, r Req) (string, error) {
 	return p.floor.Complete(ctx, r)
 }
 
+// remoteBudget bounds the workstation attempt so the floor still has time to
+// answer. A turn carrying a deadline used to hand the whole of it to the
+// remote, so a workstation that accepted the connection and then hung ate the
+// budget and the fallback ran on an already-expired context: the floor
+// returned the deadline error and the turn broke on the workstation being
+// slow, which docs/offload.md says must never happen. Half is the split
+// because both halves have to be able to finish, and there is no reason to
+// prefer either one when the remote is the part that failed.
+//
+// A context with no deadline is left alone. The remote client's own timeout
+// (workstation.timeout, 90s by default) bounds it there, and shortening that
+// silently would change the configured budget.
+func remoteBudget(ctx context.Context) (context.Context, context.CancelFunc) {
+	dl, ok := ctx.Deadline()
+	if !ok {
+		return ctx, func() {}
+	}
+	left := time.Until(dl)
+	if left <= 0 {
+		return ctx, func() {}
+	}
+	return context.WithTimeout(ctx, left/2)
+}
+
 // CompleteRemote runs r on the workstation or refuses. It never falls back,
 // because for a world question the resident 1.7B does not answer worse, it
 // invents. Callers turn ErrRemoteUnavailable into a named gap.

internal/llm/remote_test.go

@@ -154,6 +154,48 @@ func TestRemoteErrorMidRequestFallsBack(t *testing.T) {
 	}
 }
 
+// A workstation that accepts the connection and then hangs must not spend the
+// whole turn budget. It used to: the remote got the caller's context unchanged,
+// so the fallback ran on an expired one and the floor returned the deadline
+// error instead of an answer. The turn broke on the workstation being slow,
+// which is the one outcome docs/offload.md rules out.
+func TestHangingRemoteLeavesTheFloorABudget(t *testing.T) {
+	var floorHits atomic.Int64
+	// released, not r.Context().Done(): httptest.Server.Close waits for the
+	// handler, and a handler that only watches the request context can outlive
+	// the test when the client hangs up without the server noticing.
+	released := make(chan struct{})
+	hang := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		select {
+		case <-released:
+		case <-r.Context().Done():
+		}
+	}))
+	defer hang.Close()
+	defer close(released)
+	floor := completionServer(t, "floor", &floorHits)
+	up := &atomic.Bool{}
+	up.Store(true)
+	health := healthServer(t, up)
+
+	p := NewPair(New(hang.URL, time.Minute), New(floor.URL, time.Minute), health.URL, time.Hour)
+	p.Start(context.Background())
+	defer p.Stop()
+	if !waitFor(t, p.Available) {
+		t.Fatal("prober never saw the remote come up")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 400*time.Millisecond)
+	defer cancel()
+	out, err := p.Complete(ctx, Req{User: "привет"})
+	if err != nil {
+		t.Fatalf("complete: %v", err)
+	}
+	if out != "floor" || floorHits.Load() != 1 {
+		t.Fatalf("out = %q, floor hits = %d", out, floorHits.Load())
+	}
+}
+
 // The naming half of the degradation rule. A world question must not be handed
 // to the resident model, because it answers by inventing.
 func TestCompleteRemoteNamesTheGap(t *testing.T) {

internal/mcp/client.go

@@ -257,7 +257,16 @@ func (c *Client) call(ctx context.Context, method string, params any, out any) e
 	if resp.Error != nil {
 		return fmt.Errorf("mcp: %s: %s: %w", c.name, method, resp.Error)
 	}
-	if out == nil || len(resp.Result) == 0 {
+	// A frame carrying our id and neither result nor error is not an answer.
+	// The HTTP transport already refuses one; the stdio transport does not, and
+	// without this check the refusal depended on which door the server was
+	// behind. Letting it through is the one failure that lies: tools/call
+	// returns an empty string and a nil error, so the act is recorded as done
+	// and the tool never ran.
+	if len(resp.Result) == 0 {
+		return fmt.Errorf("mcp: %s: %s: response carries neither result nor error", c.name, method)
+	}
+	if out == nil {
 		return nil
 	}
 	if err := json.Unmarshal(resp.Result, out); err != nil {

internal/mcp/manager.go

@@ -525,10 +525,16 @@ func (m *Manager) Resources(ctx context.Context) []Resource {
 
 // ReadResource reads one resource from one server.
 func (m *Manager) ReadResource(ctx context.Context, server, uri string) (string, error) {
-	cl, cfg, _, _, _ := m.lookup(server, "")
-	if cl == nil {
+	cl, cfg, _, configured, _ := m.lookup(server, "")
+	if !configured {
 		return "", fmt.Errorf("%w: %s", ErrNoServer, server)
 	}
+	// A configured server that is merely down is not an unknown server. Call
+	// already keeps the two apart; reporting ErrNoServer here tells a caller
+	// the resource can never exist, when the truth is "not right now".
+	if cl == nil {
+		return "", fmt.Errorf("%w: %s", ErrNotConnected, server)
+	}
 	cctx, cancel := context.WithTimeout(ctx, cfg.Timeout)
 	defer cancel()
 	return cl.ReadResource(cctx, uri)

internal/mcp/mcp_test.go

@@ -641,3 +641,59 @@ func TestReconnectBackoffGrows(t *testing.T) {
 		t.Fatalf("first retry = %v, want %v", c.backoff(), DefaultReconnectEvery)
 	}
 }
+
+// emptyFrameTransport answers the handshake normally and then replies to every
+// later call with a well-formed frame carrying our id and nothing else — no
+// result, no error. That is the answer a partially-implemented server gives,
+// and it is the one that lies: without a check it reads as success.
+type emptyFrameTransport struct{ handshaken bool }
+
+func (t *emptyFrameTransport) Call(ctx context.Context, req *rpcRequest) (*rpcResponse, error) {
+	id := req.ID
+	if !t.handshaken {
+		t.handshaken = true
+		raw, _ := json.Marshal(map[string]any{
+			"protocolVersion": ProtocolVersion,
+			"serverInfo":      map[string]any{"name": "empty", "version": "0"},
+		})
+		return &rpcResponse{JSONRPC: "2.0", ID: &id, Result: raw}, nil
+	}
+	return &rpcResponse{JSONRPC: "2.0", ID: &id}, nil
+}
+
+func (t *emptyFrameTransport) Notify(context.Context, string, any) error { return nil }
+func (t *emptyFrameTransport) Close() error                              { return nil }
+
+func TestResultlessResponseIsNotSuccess(t *testing.T) {
+	c := newClient("empty", &emptyFrameTransport{})
+	if err := c.Initialize(context.Background()); err != nil {
+		t.Fatalf("initialize: %v", err)
+	}
+	out, err := c.CallTool(context.Background(), "break_thing", map[string]any{"q": "x"})
+	if err == nil {
+		t.Fatalf("a frame with neither result nor error must not read as success (got %q)", out)
+	}
+	if out != "" {
+		t.Fatalf("out = %q", out)
+	}
+	if _, err := c.ListTools(context.Background()); err == nil {
+		t.Fatal("tools/list with no result must be an error, not an empty catalogue")
+	}
+}
+
+func TestReadResourceOnDownServerIsNotConnected(t *testing.T) {
+	// A url server with no poster factory: configured, validated, never dialed.
+	m, err := NewManager(nil, []ServerConfig{{
+		Name: "down", URL: "http://example.test/mcp", Enabled: true,
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	m.Connect(context.Background())
+	if _, err := m.ReadResource(context.Background(), "down", "note://one"); !errors.Is(err, ErrNotConnected) {
+		t.Fatalf("err = %v, want ErrNotConnected", err)
+	}
+	if _, err := m.ReadResource(context.Background(), "nosuch", "note://one"); !errors.Is(err, ErrNoServer) {
+		t.Fatalf("err = %v, want ErrNoServer", err)
+	}
+}

internal/media/store.go

@@ -265,6 +265,16 @@ func (s *Store) Put(kind Kind, mime, source string, data []byte) (Blob, error) {
 		}
 	}
 
+	// Every return past the reservation has to give it back, so the defer owns
+	// that rather than each error path: a path that forgot over-counted the
+	// store until the next Open re-walked the directory.
+	stored := false
+	defer func() {
+		if fresh && !stored {
+			s.release(b.Size)
+		}
+	}()
+
 	// The sidecar goes first. Written second, a full disk or a crash between
 	// the two left the bytes on disk with no sidecar, and List only sees
 	// sidecars, so Prune could never collect them: Put returned an error and an
@@ -274,11 +284,9 @@ func (s *Store) Put(kind Kind, mime, source string, data []byte) (Blob, error) {
 	}
 	if err := writeFile(blobPath, data); err != nil {
 		_ = os.Remove(metaPath)
-		if fresh {
-			s.release(b.Size)
-		}
 		return Blob{}, err
 	}
+	stored = true
 	return b, nil
 }
 
@@ -331,12 +339,22 @@ func (s *Store) PutFile(kind Kind, mime, source, src string) (Blob, error) {
 			return Blob{}, err
 		}
 	}
+	// Same reasoning as Put: the reservation is released by one defer, not by
+	// whichever error path remembered to.
+	stored := false
+	defer func() {
+		if fresh && !stored {
+			s.release(b.Size)
+		}
+	}()
+
 	if err := writeMeta(metaPath, b); err != nil {
 		return Blob{}, err
 	}
 	if !fresh {
 		// Same bytes already here. Drop the spool copy.
 		_ = os.Remove(src)
+		stored = true
 		return b, nil
 	}
 	if err := os.Chmod(src, filePerm); err != nil {
@@ -344,9 +362,9 @@ func (s *Store) PutFile(kind Kind, mime, source, src string) (Blob, error) {
 	}
 	if err := os.Rename(src, blobPath); err != nil {
 		_ = os.Remove(metaPath)
-		s.release(b.Size)
 		return Blob{}, fmt.Errorf("media: move spool: %w", err)
 	}
+	stored = true
 	return b, nil
 }
 

internal/media/store_test.go

@@ -287,6 +287,73 @@ func TestPutLeavesNothingWhenTheBytesCannotBeWritten(t *testing.T) {
 	}
 }
 
+// An over-counted store answers ErrStoreFull while the disk has room, and only
+// the next Open corrects it. So every failed write has to give its reservation
+// back, not just the one that remembered to.
+func TestPutReleasesTheBudgetWhenTheSidecarCannotBeWritten(t *testing.T) {
+	s := testStore(t)
+	data := []byte("no sidecar for this")
+	blockSidecar(t, s, KindImage, data)
+	if _, err := s.Put(KindImage, "image/png", "web:upload", data); err == nil {
+		t.Fatal("put must fail")
+	}
+	if s.Total() != 0 {
+		t.Errorf("total = %d, want the failed put not counted", s.Total())
+	}
+}
+
+func TestPutFileReleasesTheBudgetWhenTheSidecarCannotBeWritten(t *testing.T) {
+	s := testStore(t)
+	data := []byte("no sidecar for this either")
+	blockSidecar(t, s, KindAudio, data)
+	src := filepath.Join(t.TempDir(), "capture.wav")
+	if err := os.WriteFile(src, data, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := s.PutFile(KindAudio, "audio/wav", "meeting", src); err == nil {
+		t.Fatal("put file must fail")
+	}
+	if s.Total() != 0 {
+		t.Errorf("total = %d, want the failed put not counted", s.Total())
+	}
+}
+
+// The chmod arm is PutFile's alone: Put never touches a spool file.
+func TestPutFileReleasesTheBudgetWhenTheSpoolCannotBeChmodded(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root can chmod a file it does not own")
+	}
+	// A symlink to a file owned by somebody else. Stat and the hash follow it
+	// and succeed; chmod follows it too and is refused.
+	src := filepath.Join(t.TempDir(), "capture.wav")
+	if err := os.Symlink("/etc/hosts", src); err != nil {
+		t.Fatal(err)
+	}
+	info, err := os.Stat(src)
+	if err != nil || info.Size() == 0 {
+		t.Skip("no readable /etc/hosts to point at")
+	}
+	s := testStore(t)
+	if _, err := s.PutFile(KindAudio, "audio/wav", "meeting", src); err == nil {
+		t.Fatal("put file must fail")
+	}
+	if s.Total() != 0 {
+		t.Errorf("total = %d, want the failed put not counted", s.Total())
+	}
+}
+
+// blockSidecar puts a directory where the sidecar for data has to go, so
+// writeMeta fails while the blob path is still free.
+func blockSidecar(t *testing.T, s *Store, kind Kind, data []byte) {
+	t.Helper()
+	sum := sha256.Sum256(data)
+	id := hex.EncodeToString(sum[:])
+	bucket := filepath.Join(s.dir, string(kind), id[:2])
+	if err := os.MkdirAll(filepath.Join(bucket, id+".json"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+}
+
 // The per-blob cap bounds one call and nothing bounded their sum. 64 MiB per
 // call times unlimited calls inside a seven-day window fills the disk mavend's
 // database lives on.

internal/morning/plan.go

@@ -52,10 +52,13 @@ type PlanEntry struct {
 // Plan — the ordered day. Date is the calendar day it describes. Rest marks a
 // plan trimmed by After, which changes what an empty one means: a day with
 // nothing on it and a day whose last item has passed are different answers.
+// More counts what Next dropped off the end, so the sentence can say that more
+// remains instead of implying the day ends after the third line.
 type Plan struct {
 	Date  time.Time
 	Items []PlanEntry
 	Rest  bool
+	More  int
 }
 
 // BuildPlan orders everything known about the day Now falls on: calendar
@@ -142,13 +145,24 @@ func checklistEntries(routines []Routine, facts map[string]store.Fact, now time.
 	return out
 }
 
+// NextSpoken — how many entries "что дальше?" reads aloud. Three, for the same
+// reason the feed reads three headlines: the answer is spoken once and cannot be
+// scrolled back, and a list longer than a breath is not an answer, it is a
+// recital. Asked at 04:45 on a day with 43 entries, the trim below removes
+// nothing — everything is still ahead — so the cap is what makes "дальше" mean
+// next rather than today (V-618).
+const NextSpoken = 3
+
 // After returns the part of the plan that has not happened yet — the answer to
 // "что дальше?" as opposed to "какие планы на сегодня?". The Date is kept, so an
 // empty result still knows which day it is empty for.
+//
+// Strictly after: an entry at exactly now is the thing happening, not the thing
+// next.
 func (p Plan) After(now time.Time) Plan {
 	out := Plan{Date: p.Date, Rest: true}
 	for _, it := range p.Items {
-		if it.At.Before(now) {
+		if !it.At.After(now) {
 			continue
 		}
 		out.Items = append(out.Items, it)
@@ -156,10 +170,30 @@ func (p Plan) After(now time.Time) Plan {
 	return out
 }
 
+// Next is After with a spoken cap — what "что дальше?" actually answers with.
+// The overflow is counted rather than dropped, because "дальше: 10:00 …" with
+// forty entries hidden behind it is a false picture of the day.
+func (p Plan) Next(now time.Time, n int) Plan {
+	out := p.After(now)
+	if n > 0 && len(out.Items) > n {
+		out.More = len(out.Items) - n
+		out.Items = out.Items[:n]
+	}
+	return out
+}
+
 // FormatRU renders the plan as maven says it. Feminine self-reference,
 // informal address, no pet names — and no exhortation: she reads the day back,
 // she does not tell him to get on with it.
+//
+// Every hour is read in the plan's own zone — Date's, which BuildPlan sets from
+// the asking clock. Printed raw, an hour read whatever zone its instant arrived
+// in: an event or a reminder comes off the store as UTC, while a checklist line
+// is built local, so one spoken sentence named two zones. This is the voice
+// path, so that is what the owner heard (V-614); the same defect on the two web
+// pages was V-612.
 func (p Plan) FormatRU() string {
+	zone := p.Date.Location()
 	if len(p.Items) == 0 {
 		// "что дальше?" after the last item of the day. The day was not empty,
 		// it is over, and saying it was empty is a false statement about a day
@@ -171,14 +205,28 @@ func (p Plan) FormatRU() string {
 	}
 	parts := make([]string, len(p.Items))
 	for i, it := range p.Items {
-		line := fmt.Sprintf("%s — %s", it.At.Format("15:04"), it.Text)
+		line := fmt.Sprintf("%s — %s", it.At.In(zone).Format("15:04"), it.Text)
 		if it.Uncertain {
 			line = say.S(say.PlanUncertain, map[string]string{"line": line})
 		}
 		parts[i] = line
 	}
+	items := strings.Join(parts, "; ")
+	// The rest of the day is a different sentence, not a shorter day plan. It
+	// carries no date — he asked what is next, and he knows which day he is in —
+	// and it says out loud when there is more behind the cap.
+	if p.Rest {
+		if p.More > 0 {
+			return say.S(say.PlanNextMore, map[string]string{
+				"items": items,
+				"n":     fmt.Sprint(p.More),
+				"word":  say.CountWord(p.More, "дело", "дела", "дел"),
+			})
+		}
+		return say.S(say.PlanNext, map[string]string{"items": items})
+	}
 	return say.S(say.PlanDay, map[string]string{
 		"date":  p.Date.Format("02.01.2006"),
-		"items": strings.Join(parts, "; "),
+		"items": items,
 	})
 }

internal/morning/plan_test.go

@@ -1,6 +1,7 @@
 package morning
 
 import (
+	"fmt"
 	"strings"
 	"testing"
 	"time"
@@ -151,6 +152,37 @@ func TestPlanFormatRU(t *testing.T) {
 	}
 }
 
+// One spoken sentence names one clock. An event and a reminder come off the
+// store as UTC and a checklist line is built in the asking clock's zone, so the
+// raw Format printed the two halves of one sentence in two zones (V-614). The
+// zones here are three hours off whatever this machine runs in, so the test
+// tells "read in his clock" apart from "read in the zone the instant arrived
+// in" under TZ=UTC as well.
+func TestPlanFormatRUReadsEveryHourInThePlansZone(t *testing.T) {
+	_, off := time.Now().Zone()
+	away := time.FixedZone("away", off+3*60*60)
+
+	stored := time.Date(2026, 8, 3, 14, 0, 0, 0, time.UTC)
+	p := Plan{
+		Date: time.Date(2026, 8, 3, 0, 0, 0, 0, away),
+		Items: []PlanEntry{
+			{At: stored, Text: "Планёрка", Kind: PlanEvent},
+			{At: planAt(time.Date(2026, 8, 3, 0, 0, 0, 0, away), 10, 30),
+				Text: "утро — осталось: витамины", Kind: PlanChecklist},
+		},
+	}
+	got := p.FormatRU()
+	if want := stored.In(away).Format("15:04"); !strings.Contains(got, want) {
+		t.Errorf("the event is not read in the plan's zone (%s): %q", want, got)
+	}
+	if bad := stored.Format("15:04"); strings.Contains(got, bad) {
+		t.Errorf("the event is read in the zone it was stored in (%s): %q", bad, got)
+	}
+	if !strings.Contains(got, "10:30") {
+		t.Errorf("the checklist line moved zone: %q", got)
+	}
+}
+
 func TestPlanAfter(t *testing.T) {
 	p, now := planFixture(t)
 	rest := p.After(planAt(now, 11, 0))
@@ -171,6 +203,84 @@ func TestPlanAfter(t *testing.T) {
 	}
 }
 
+// nextFixture — a day with more entries than the cap, built in a zone three
+// hours off UTC so the test fails under TZ=UTC as well as under the machine's
+// own zone if the plan ever renders in the wrong one.
+func nextFixture(t *testing.T) (Plan, time.Time) {
+	t.Helper()
+	zone := time.FixedZone("MSK", 3*60*60)
+	now := time.Date(2026, 8, 3, 4, 45, 0, 0, zone)
+	var events []PlanEntry
+	for _, hhmm := range [][2]int{{5, 45}, {10, 0}, {14, 0}, {18, 30}, {21, 12}} {
+		events = append(events, PlanEntry{
+			At:   planAt(now, hhmm[0], hhmm[1]),
+			Text: fmt.Sprintf("событие %02d:%02d", hhmm[0], hhmm[1]),
+			Kind: PlanEvent,
+		})
+	}
+	return BuildPlan(nil, nil, events, nil, now), now
+}
+
+// "что дальше?" asked at 04:45 on a day with everything still ahead. The trim
+// removes nothing there, so before V-618 she read the whole day out loud.
+func TestPlanNextCapsWhatIsSpoken(t *testing.T) {
+	p, now := nextFixture(t)
+	got := p.Next(now, NextSpoken).FormatRU()
+	want := "дальше: 05:45 — событие 05:45; 10:00 — событие 10:00; " +
+		"14:00 — событие 14:00. и ещё 2 дела до конца дня."
+	if got != want {
+		t.Errorf("got  %q\nwant %q", got, want)
+	}
+	// No date: he asked what is next, not what day it is.
+	if strings.Contains(got, "03.08.2026") {
+		t.Errorf("rest-of-day answer stamps a date: %q", got)
+	}
+}
+
+// Nothing hidden means nothing claimed hidden.
+func TestPlanNextWithinTheCapSaysNoMore(t *testing.T) {
+	p, now := nextFixture(t)
+	got := p.Next(planAt(now, 15, 0), NextSpoken).FormatRU()
+	want := "дальше: 18:30 — событие 18:30; 21:12 — событие 21:12"
+	if got != want {
+		t.Errorf("got  %q\nwant %q", got, want)
+	}
+}
+
+// The whole-day question is not narrowed: same plan, no trim, no cap.
+func TestPlanWholeDayIsNotNarrowed(t *testing.T) {
+	p, _ := nextFixture(t)
+	got := p.FormatRU()
+	if n := strings.Count(got, "событие"); n != 5 {
+		t.Errorf("whole day read %d of 5 entries: %q", n, got)
+	}
+	if !strings.HasPrefix(got, "план на 03.08.2026: ") {
+		t.Errorf("whole day lost its date: %q", got)
+	}
+}
+
+// The empty case says the day is over rather than returning an empty sentence,
+// and it does not say the day was empty.
+func TestPlanNextEmptySaysSo(t *testing.T) {
+	p, now := nextFixture(t)
+	got := p.Next(planAt(now, 23, 30), NextSpoken).FormatRU()
+	if got != "на сегодня больше ничего не запланировано." {
+		t.Errorf("got %q", got)
+	}
+}
+
+// An entry at exactly the asking minute is what is happening, not what is next.
+func TestPlanNextIsStrictlyAfterNow(t *testing.T) {
+	p, now := nextFixture(t)
+	rest := p.Next(planAt(now, 5, 45), NextSpoken)
+	if len(rest.Items) != 3 || rest.Items[0].At.Hour() != 10 {
+		t.Errorf("got %+v", rest.Items)
+	}
+	if rest.More != 1 {
+		t.Errorf("More = %d, want 1", rest.More)
+	}
+}
+
 // The plan says what today still has not got done, and a closed window does not
 // make a skipped routine untrue. Evaluate reports Active only inside the
 // window, so keying the checklist line off it meant the one thing the plan can

internal/netaddr/netaddr.go

@@ -31,6 +31,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"time"
 
 	"golang.org/x/sys/unix"
@@ -154,31 +155,78 @@ func clientHandshake(c net.Conn, token string) error {
 // Listener wraps a net.Listener so Accept performs the token check for a tcp
 // seam. A connection that fails the check is closed and never surfaces, so
 // the protocol above this layer only ever sees authorized peers.
+//
+// A unix seam takes none of that machinery: Accept delegates straight to the
+// wrapped listener, which is what it did before the token existed.
 type Listener struct {
 	net.Listener
 	addr Addr
+
+	start     sync.Once
+	closeOnce sync.Once
+	conns     chan net.Conn
+	errc      chan error // buffered 1, re-armed so every Accept sees the error
+	done      chan struct{}
 }
 
 // Accept returns the next authorized connection. Unauthorized peers are
 // dropped and Accept keeps waiting: a bad token is a rejected stranger, not a
 // reason to stop serving.
+//
+// Each tcp handshake runs in its own goroutine rather than inline here. A peer
+// that connects and then says nothing holds its greeting open for
+// handshakeTimeout, and inline that peer stalls every other connection for
+// five seconds — one silent stranger was enough to freeze the seam.
 func (l *Listener) Accept() (net.Conn, error) {
+	if l.addr.IsUnix() {
+		return l.Listener.Accept()
+	}
+	l.start.Do(func() { go l.acceptLoop() })
+	select {
+	case c := <-l.conns:
+		return c, nil
+	case err := <-l.errc:
+		l.errc <- err
+		return nil, err
+	}
+}
+
+// acceptLoop takes connections off the wrapped listener and greets each one
+// concurrently. It ends on the first listener error, which every later Accept
+// then reports.
+func (l *Listener) acceptLoop() {
 	for {
 		c, err := l.Listener.Accept()
 		if err != nil {
-			return nil, err
+			select {
+			case l.errc <- err:
+			case <-l.done:
+			}
+			return
 		}
-		if l.addr.IsUnix() {
-			return c, nil
-		}
-		if err := serverHandshake(c, l.addr.Token); err != nil {
-			_ = c.Close()
-			continue
-		}
-		return c, nil
+		go l.greet(c)
 	}
 }
 
+func (l *Listener) greet(c net.Conn) {
+	if err := serverHandshake(c, l.addr.Token); err != nil {
+		_ = c.Close()
+		return
+	}
+	select {
+	case l.conns <- c:
+	case <-l.done:
+		_ = c.Close()
+	}
+}
+
+// Close stops the listener and releases any connection still waiting to be
+// handed to Accept.
+func (l *Listener) Close() error {
+	l.closeOnce.Do(func() { close(l.done) })
+	return l.Listener.Close()
+}
+
 // Addr reports the parsed seam address this listener was built from.
 func (l *Listener) SeamAddr() Addr { return l.addr }
 
@@ -236,7 +284,7 @@ func Listen(a Addr) (*Listener, error) {
 		if err != nil {
 			return nil, err
 		}
-		return &Listener{Listener: ln, addr: a}, nil
+		return wrap(ln, a), nil
 	}
 	if a.Token == "" {
 		return nil, fmt.Errorf("netaddr: listen %s: tcp seam requires a token", a)
@@ -245,7 +293,17 @@ func Listen(a Addr) (*Listener, error) {
 	if err != nil {
 		return nil, fmt.Errorf("netaddr: listen %s: %w", a, err)
 	}
-	return &Listener{Listener: ln, addr: a}, nil
+	return wrap(ln, a), nil
+}
+
+func wrap(ln net.Listener, a Addr) *Listener {
+	return &Listener{
+		Listener: ln,
+		addr:     a,
+		conns:    make(chan net.Conn),
+		errc:     make(chan error, 1),
+		done:     make(chan struct{}),
+	}
 }
 
 func listenUnix(path string) (net.Listener, error) {

internal/netaddr/netaddr_test.go

@@ -5,6 +5,7 @@ import (
 	"net"
 	"path/filepath"
 	"testing"
+	"time"
 )
 
 // A scheme-less address must stay unix. Every deploy in the tree writes a bare
@@ -140,6 +141,41 @@ func TestTCPUngreetedPeerDoesNotKillTheListener(t *testing.T) {
 	}
 }
 
+// A peer that connects and never speaks must not hold the seam. The greeting
+// it owes is bounded by handshakeTimeout, so serving it on the accept path
+// costs every later connection those five seconds.
+func TestTCPSilentPeerDoesNotStallTheSeam(t *testing.T) {
+	ln, addr := listenLoopback(t, "s3cret")
+	defer ln.Close()
+	go echoOnce(ln)
+
+	mute, err := net.Dial("tcp", addr.Address)
+	if err != nil {
+		t.Fatalf("mute dial: %v", err)
+	}
+	defer mute.Close()
+
+	done := make(chan string, 1)
+	go func() {
+		c, err := Dial(addr)
+		if err != nil {
+			done <- "dial: " + err.Error()
+			return
+		}
+		defer c.Close()
+		done <- roundTrip(t, c, "still here")
+	}()
+
+	select {
+	case got := <-done:
+		if got != "still here" {
+			t.Fatalf("got %q", got)
+		}
+	case <-time.After(handshakeTimeout / 2):
+		t.Fatal("a silent peer stalled the listener")
+	}
+}
+
 // A tcp seam with no token is a misconfiguration, and it must fail at bind
 // rather than serve the owner's turns to anyone who connects.
 func TestTCPListenRequiresToken(t *testing.T) {

internal/netscan/netscan.go

@@ -33,6 +33,7 @@ import (
 	"net/netip"
 	"os"
 	"sort"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -323,7 +324,7 @@ scan:
 			go func(addr string, port int) {
 				defer wg.Done()
 				defer func() { <-sem }()
-				if s.dial(ctx, net.JoinHostPort(addr, itoa(port)), s.cfg.Timeout) {
+				if s.dial(ctx, net.JoinHostPort(addr, strconv.Itoa(port)), s.cfg.Timeout) {
 					results <- result{addr: addr, ports: []int{port}}
 				}
 			}(addr, port)
@@ -371,8 +372,6 @@ scan:
 	return Result{Hosts: out, Truncated: truncated}, nil
 }
 
-func itoa(n int) string { return fmt.Sprintf("%d", n) }
-
 func dialTCP(ctx context.Context, addr string, timeout time.Duration) bool {
 	d := net.Dialer{Timeout: timeout}
 	ctx, cancel := context.WithTimeout(ctx, timeout)

internal/persona/persona.go

@@ -17,6 +17,8 @@ import (
 	"fmt"
 	"strings"
 	"time"
+
+	"github.com/kami/maven/internal/lexicon"
 )
 
 // Facts — the optional, deployment-specific half of the block. All fields may
@@ -34,12 +36,10 @@ type Facts struct {
 	Tools    bool // at least one shell act is on the allowlist
 }
 
-var ruWeekdays = [...]string{"воскресенье", "понедельник", "вторник", "среда", "четверг", "пятница", "суббота"}
-
-var ruMonths = [...]string{
-	"января", "февраля", "марта", "апреля", "мая", "июня",
-	"июля", "августа", "сентября", "октября", "ноября", "декабря",
-}
+// The weekday and month names are closed classes and live in internal/lexicon,
+// which indexes weekdays from Sunday the way time.Weekday does and months from
+// one. This file used to carry its own copies, making four copies of the twelve
+// months in the tree after cmd/mavend/ruwords.go gave up its own (Vikunja #525).
 
 // Block renders the context block for one turn. Russian even in front of the
 // English prompts: the rules it states are Russian grammar (ты/тебя, feminine
@@ -61,7 +61,7 @@ func (f Facts) Block(now time.Time) string {
 	}
 
 	b.WriteString(fmt.Sprintf("Сейчас: %s, %d %s %d, %02d:%02d (местное время).\n",
-		ruWeekdays[int(now.Weekday())], now.Day(), ruMonths[int(now.Month())-1], now.Year(),
+		lexicon.Weekday(int(now.Weekday())), now.Day(), lexicon.MonthGenitive(int(now.Month())), now.Year(),
 		now.Hour(), now.Minute()))
 
 	b.WriteString("Умеешь: " + strings.Join(f.can(), "; ") +

internal/phraser/failure_test.go

@@ -78,3 +78,36 @@ func TestEmptyKnowledgeAnswerIsAnError(t *testing.T) {
 		t.Errorf("error = %v; want it to name the empty response", err)
 	}
 }
+
+// The other two paths, which had no such guard. The evidence branch of
+// PhraseQuery and PhraseChat both returned ("", nil) off a server that produced
+// no tokens — an empty answer reported as a successful phrasing. The daemon's
+// callers check for the empty string and paper over it; the eval does not, and
+// scored a silent model as bad phrasing rather than as a failure.
+func TestEmptyAnswerIsAnErrorOnEveryPath(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(`{"choices":[{"message":{"content":""}}]}`))
+	}))
+	t.Cleanup(srv.Close)
+	p := NewLLMPhraserAt(srv.URL, Config{})
+
+	t.Run("evidence", func(t *testing.T) {
+		got, err := p.PhraseQuery(context.Background(), "сколько воды я выпил", []string{"два литра"})
+		if err == nil {
+			t.Fatal("an empty response scored as an answer")
+		}
+		if !isFallback(t, fbQuerySources, "два литра", got) {
+			t.Errorf("fallback text = %q, want a %q variant", got, fbQuerySources)
+		}
+	})
+	t.Run("chat", func(t *testing.T) {
+		got, err := p.PhraseChat(context.Background(), "как дела", nil)
+		if err == nil {
+			t.Fatal("an empty response scored as an answer")
+		}
+		if !isFallback(t, fbChat, "", got) {
+			t.Errorf("fallback text = %q, want a %q variant", got, fbChat)
+		}
+	})
+}

internal/phraser/llmphraser.go

@@ -299,6 +299,16 @@ func (p *LLMPhraser) PhraseQuery(ctx context.Context, utterance string, notes []
 	if text != "" {
 		return text, nil
 	}
+	if raw == "" {
+		// Same guard the knowledge branch above has had since it was written,
+		// and this branch did not: the server answered and the model wrote
+		// nothing, which returned ("", nil) — an empty answer reported as a
+		// successful phrasing. The daemon's callers happen to check for the
+		// empty string, so it read as a silent fallback there; the eval scored
+		// it as bad phrasing rather than as the failure it is, and nothing on
+		// either path logged that the model had produced no tokens.
+		return SourcesFallback(strings.Join(notes, "; ")), errEmptyResponse
+	}
 	return raw, nil
 }
 
@@ -375,7 +385,13 @@ func (p *LLMPhraser) PhraseChat(ctx context.Context, utterance string, history [
 	if i := strings.IndexByte(resp, '\n'); i >= 0 {
 		resp = resp[:i]
 	}
-	return strings.TrimSpace(resp), nil
+	if resp = strings.TrimSpace(resp); resp == "" {
+		// The model was up and wrote nothing. Same rule as PhraseQuery: the
+		// fallback keeps the turn alive and the failure stays visible, rather
+		// than ("", nil) telling the caller the chat path succeeded.
+		return ChatFallback(), fmt.Errorf("phrase chat: %w", errEmptyResponse)
+	}
+	return resp, nil
 }
 
 func (p *LLMPhraser) PhraseReminder(ctx context.Context, d loop.ReminderDecision) (delivery.PhrasedReminder, error) {
@@ -414,11 +430,9 @@ func (p *LLMPhraser) PhraseReminder(ctx context.Context, d loop.ReminderDecision
 	if mood == "" {
 		mood = "neutral"
 	}
-	summary := body
-	if len(summary) > 60 {
-		summary = summary[:57] + "..."
-	}
-	return delivery.PhrasedReminder{Decision: d, Body: body, Summary: summary, Mood: mood}, nil
+	return delivery.PhrasedReminder{
+		Decision: d, Body: body, Summary: reminderSummary(body), Mood: mood,
+	}, nil
 }
 
 func (p *LLMPhraser) chat(ctx context.Context, userPrompt string) (string, error) {

internal/phraser/persona_floor_test.go

@@ -0,0 +1,316 @@
+package phraser
+
+// The persona guard for the Go floor strings.
+//
+// internal/phraser/eval/fallbacks_test.go already scores everything Variants()
+// returns — that is the JSON decks. What it cannot see is the floor UNDER those
+// decks: the hardFloor/ackFloor/queryFloor/actFloor/confirmFloor maps and the
+// literals in nudge_llm.go, which are what she says when the JSON is unusable or
+// when the model is unreachable. Those are exactly the moments the model is not
+// doing the talking, so leaving them unscored left the persona unchecked when it
+// was most load-bearing (Vikunja #621).
+//
+// Two tests here, and the second one is the point:
+//
+//   - TestGoFloorPersona scores the floor corpus on the same checks.
+//   - TestGoFloorCoverage walks the package source with go/ast and fails on any
+//     Russian string literal that neither reached the corpus nor sits inside a
+//     declaration declared prompt-side. A hand-written list of strings would rot
+//     the first time somebody adds one; a hand-written list of PROMPT BUILDERS
+//     does not, because the default for a new literal is "must be scored".
+
+import (
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"io/fs"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+	"unicode"
+
+	"github.com/kami/maven/internal/loop"
+	"github.com/kami/maven/internal/phraser/eval"
+	"github.com/kami/maven/internal/store"
+)
+
+// personaChecks — the checks that apply to a floor line.
+//
+// The same three the non-goals section names (feminine self-reference, how she
+// addresses him, no pet names), plus lang: an English floor line is unusable out
+// loud. No hisgender, for the reason eval/fallbacks_test.go gives — her own
+// feminine verb near "тебе" is correct and that check reads it as addressing him
+// as a woman. No length, because a floor line composed from his own data has no
+// bounded length, and no ontopic/mood, which need a fixture case.
+var personaChecks = map[string]bool{
+	eval.CheckLang:     true,
+	eval.CheckFeminine: true,
+	eval.CheckAddress:  true,
+	eval.CheckCringe:   true,
+}
+
+var floorPlaceholderRE = regexp.MustCompile(`\{[a-z_]+\}`)
+
+// formatVerbRE — the fmt verbs a floor line is composed with, so the coverage
+// test compares the Russian either side of them and not the verb.
+var formatVerbRE = regexp.MustCompile(`%[+\-# 0-9.]*[a-zA-Z]`)
+
+// floorLine — one scored string and where it came from, so a failure names the
+// map or the function to go and edit.
+type floorLine struct {
+	origin string
+	text   string
+}
+
+// floorCorpus — every line the Go floor can produce. Maps are read whole, so a
+// new entry in one is scored without touching this file; the composing functions
+// are CALLED rather than scraped, so their glue text is scored in place.
+func floorCorpus() []floorLine {
+	var out []floorLine
+	add := func(origin, text string) {
+		if strings.TrimSpace(text) != "" {
+			out = append(out, floorLine{origin, text})
+		}
+	}
+	for name, m := range map[string]map[string]string{
+		"fallbacks.go hardFloor":      hardFloor,
+		"acks.go ackFloor":            ackFloor,
+		"query.go queryFloor":         queryFloor,
+		"acts.go actFloor":            actFloor,
+		"confirm.go confirmFloor":     confirmFloor,
+		"nudge_llm.go fallbackNudges": fallbackNudges,
+	} {
+		for key, text := range m {
+			add(name+"["+key+"]", text)
+		}
+	}
+
+	// fallbackNudge composes three of its four arms in Go. Drive every rule name
+	// the maps know, one it does not, and the down-services arm.
+	rules := map[string]bool{"": true, "unknown_rule": true}
+	for name := range fallbackNudges {
+		rules[name] = true
+	}
+	for name := range ruleTopics {
+		rules[name] = true
+	}
+	for name := range ruleKeywords {
+		rules[name] = true
+	}
+	for name := range rules {
+		c := loop.Candidate{}
+		c.Rule.Name = name
+		add(fmt.Sprintf("nudge_llm.go fallbackNudge(%q)", name), fallbackNudge(c))
+	}
+	// The keyword arm again, through a rule name shaped "family:keyword", which
+	// is where ruleKeyword's second branch lives.
+	c := loop.Candidate{}
+	c.Rule.Name = "custom:зарядку"
+	add("nudge_llm.go fallbackNudge(custom)", fallbackNudge(c))
+
+	// The keywords themselves. A rule that has both a keyword and a fallback
+	// line never reaches the keyword arm, but the map is edited as one thing and
+	// the next rule may have only the keyword, so score every value.
+	for rule, kw := range ruleKeywords {
+		add("nudge_llm.go ruleKeywords["+rule+"]", "Напоминаю: "+kw+".")
+	}
+
+	// The down-services arm, which needs a service actually reading down.
+	down := loop.Candidate{}
+	down.Rule.Name = "service_down"
+	down.State.Facts = map[string]store.Fact{
+		loop.ServiceDownPrefix + "gitea": {
+			Key:    loop.ServiceDownPrefix + "gitea",
+			Value:  `"down"`,
+			Source: loop.ServiceDownSource,
+			Ts:     time.Now(),
+		},
+	}
+	add("nudge_llm.go fallbackNudge(down services)", fallbackNudge(down))
+
+	// The spoken duration words. Both functions are pure and bounded, so scoring
+	// their whole range beats scraping the literals out of the switch.
+	for m := 0; m <= 60*30; m += 7 {
+		d := time.Duration(m) * time.Minute
+		add("nudge_llm.go ruDur", ruDur(d))
+		add("nudge_templates.go ruSinceWords", ruSinceWords(d))
+	}
+	for h := 0; h <= hoursSpoken; h++ {
+		add("nudge_templates.go hourPlural", hourPlural(h))
+		add("nudge_templates.go hourWord", hourWord(h))
+	}
+	return out
+}
+
+// TestGoFloorPersona scores every line the Go floor can say.
+func TestGoFloorPersona(t *testing.T) {
+	corpus := floorCorpus()
+	if len(corpus) == 0 {
+		t.Fatal("no floor lines — the corpus builder found nothing to score")
+	}
+	for _, line := range corpus {
+		// A placeholder stands for his own words and carries no persona.
+		body := floorPlaceholderRE.ReplaceAllString(line.text, "вода")
+		for _, r := range eval.RunChecks(eval.Case{}, body, "neutral") {
+			if personaChecks[r.Name] && !r.Pass {
+				t.Errorf("%s: %q fails %s: %s", line.origin, line.text, r.Name, r.Detail)
+			}
+		}
+	}
+}
+
+// promptDecls — declarations whose Russian is written FOR the model, not for
+// him. They are excluded by name, not by string, so adding a line inside one of
+// them stays excluded and adding a line anywhere else fails the coverage test.
+//
+// Every name here is asserted to still exist, so a rename fails loudly instead
+// of silently widening the exemption.
+var promptDecls = map[string]string{
+	"ReplySystemPrompt": "the system prompt for the reply model",
+	"replyContext":      "renders the decision FOR the model, never spoken",
+	"ruleTopics":        "situation descriptions fed to the nudge prompt",
+	"ruleTopic":         "same, plus the two prefixes it composes",
+	"buildNudgePrompt":  "the nudge prompt itself",
+	"chatUserMessage":   "the history block handed to the model",
+	"PhraseReminder":    "the reminder prompt; its reply is scored, its prompt is not",
+}
+
+// promptFiles — files whose whole job is prompt text. Asserted to exist, same
+// reason as promptDecls.
+var promptFiles = map[string]string{
+	"prompts.go": "every literal in it is a prompt",
+}
+
+func hasCyrillic(s string) bool {
+	for _, r := range s {
+		if unicode.Is(unicode.Cyrillic, r) {
+			return true
+		}
+	}
+	return false
+}
+
+// TestGoFloorCoverage — the guard that survives the next person.
+//
+// It reads the package source and requires every Russian string literal to be
+// one of two things: reachable in floorCorpus (so TestGoFloorPersona scored it),
+// or inside a declaration named above as prompt-side. There is no third answer
+// and no way to add a floor string that quietly gets neither.
+func TestGoFloorCoverage(t *testing.T) {
+	var scored []string
+	for _, line := range floorCorpus() {
+		scored = append(scored, line.text)
+	}
+	// A literal is covered when every Russian piece of it shows up in something
+	// the corpus scored. Pieces, not the whole string, because a format string
+	// ("%d ч") and a concatenation fragment ("Не отвечает: ") only ever reach him
+	// with the surrounding value filled in.
+	covered := func(lit string) bool {
+		for _, part := range formatVerbRE.Split(lit, -1) {
+			part = strings.TrimSpace(part)
+			if part == "" || !hasCyrillic(part) {
+				continue
+			}
+			found := false
+			for _, s := range scored {
+				if strings.Contains(s, part) {
+					found = true
+					break
+				}
+			}
+			if !found {
+				return false
+			}
+		}
+		return true
+	}
+
+	fset := token.NewFileSet()
+	pkgs, err := parser.ParseDir(fset, ".", func(fi fs.FileInfo) bool {
+		return !strings.HasSuffix(fi.Name(), "_test.go")
+	}, 0)
+	if err != nil {
+		t.Fatalf("parse package: %v", err)
+	}
+	pkg, ok := pkgs["phraser"]
+	if !ok {
+		t.Fatal("package phraser did not parse — the coverage guard cannot run")
+	}
+
+	seenDecl := map[string]bool{}
+	seenFile := map[string]bool{}
+	for path, file := range pkg.Files {
+		base := path[strings.LastIndexByte(path, '/')+1:]
+		if _, exempt := promptFiles[base]; exempt {
+			seenFile[base] = true
+			continue
+		}
+		for _, decl := range file.Decls {
+			names := declNames(decl)
+			skip := false
+			for _, n := range names {
+				if _, ok := promptDecls[n]; ok {
+					seenDecl[n] = true
+					skip = true
+				}
+			}
+			if skip {
+				continue
+			}
+			ast.Inspect(decl, func(n ast.Node) bool {
+				bl, ok := n.(*ast.BasicLit)
+				if !ok || bl.Kind != token.STRING {
+					return true
+				}
+				lit, err := strconv.Unquote(bl.Value)
+				if err != nil || !hasCyrillic(lit) {
+					return true
+				}
+				if !covered(lit) {
+					t.Errorf("%s: Russian literal %q is spoken by nothing the persona guard scores.\n"+
+						"Either reach it from floorCorpus in persona_floor_test.go, or — if it is written "+
+						"for the model rather than for him — name its declaration in promptDecls.",
+						fset.Position(bl.Pos()), lit)
+				}
+				return true
+			})
+		}
+	}
+	for name, why := range promptDecls {
+		if !seenDecl[name] {
+			t.Errorf("promptDecls names %q (%s) and no such declaration exists — "+
+				"a rename left the exemption open", name, why)
+		}
+	}
+	for base, why := range promptFiles {
+		if !seenFile[base] {
+			t.Errorf("promptFiles names %q (%s) and no such file exists", base, why)
+		}
+	}
+}
+
+// declNames — the names a top-level declaration binds, so a prompt-side var,
+// const or func can be matched whatever kind it is.
+func declNames(decl ast.Decl) []string {
+	switch d := decl.(type) {
+	case *ast.FuncDecl:
+		return []string{d.Name.Name}
+	case *ast.GenDecl:
+		var out []string
+		for _, spec := range d.Specs {
+			switch s := spec.(type) {
+			case *ast.ValueSpec:
+				for _, n := range s.Names {
+					out = append(out, n.Name)
+				}
+			case *ast.TypeSpec:
+				out = append(out, s.Name.Name)
+			}
+		}
+		return out
+	}
+	return nil
+}

internal/phraser/phraser.go

@@ -115,11 +115,32 @@ func (s *Stub) PhraseReminder(_ context.Context, d loop.ReminderDecision) (deliv
 	if text == "" {
 		text = "reminder"
 	}
-	summary := text
-	if len(summary) > 60 {
-		summary = summary[:57] + "..."
+	// Mood, for the same reason PhraseNudge sets it: the Stub is a production
+	// fallback, so it owes the output contract a value. This one was left at the
+	// zero value, which is not one of the five moods.
+	return delivery.PhrasedReminder{
+		Decision: d, Body: text, Summary: reminderSummary(text), Mood: "neutral",
+	}, nil
+}
+
+// summaryLimit — how much of a reminder goes to the away channels.
+const summaryLimit = 60
+
+// reminderSummary shortens a reminder body to the away-channel summary.
+//
+// Counted in runes. Both copies of this counted bytes — `len(s) > 60` and
+// `s[:57]` — and on a Russian reminder that is wrong twice. A Cyrillic letter is
+// two bytes, so the cut fell at about 28 letters rather than 60; and byte 57
+// lands inside a letter about half the time, so the summary ended in half a
+// rune. That is not cosmetic: Sendable.Summary is the text voicesink hands to
+// piper and the text the telegram sink posts, so the broken byte was spoken and
+// sent.
+func reminderSummary(body string) string {
+	r := []rune(body)
+	if len(r) <= summaryLimit {
+		return body
 	}
-	return delivery.PhrasedReminder{Decision: d, Body: text, Summary: summary}, nil
+	return string(r[:summaryLimit-3]) + "..."
 }
 
 // phraseNudge — the per-rule templates. each reads the context the predicate

internal/phraser/phraser_test.go

@@ -5,6 +5,7 @@ import (
 	"strings"
 	"testing"
 	"time"
+	"unicode/utf8"
 
 	"github.com/kami/maven/internal/delivery"
 	"github.com/kami/maven/internal/dialogue"
@@ -185,6 +186,34 @@ func TestPhraseReminderTruncatesLongSummary(t *testing.T) {
 	}
 }
 
+// The same truncation, in the language she actually speaks. The test above is
+// ASCII, which is what let the byte arithmetic stand: `len(s) > 60` and `s[:57]`
+// cut a Russian reminder at about 28 letters instead of 60, and landed inside a
+// letter about half the time. Summary is what voicesink hands to piper and what
+// the telegram sink posts, so half a rune was spoken and sent.
+func TestPhraseReminderSummaryCountsRunesNotBytes(t *testing.T) {
+	long := "позвонить маме и забрать посылку из пункта выдачи на соседней улице до восьми вечера"
+	rd := loop.ReminderDecision{
+		Reminder: store.Reminder{Payload: `{"text":"` + long + `"}`},
+		State:    loop.State{Now: time.Now().UTC()},
+	}
+	pr, _ := NewStub().PhraseReminder(context.Background(), rd)
+	if !utf8.ValidString(pr.Summary) {
+		t.Fatalf("summary is not valid UTF-8, it was cut mid-letter: %q", pr.Summary)
+	}
+	if n := utf8.RuneCountInString(pr.Summary); n > summaryLimit {
+		t.Fatalf("summary = %d runes, want at most %d: %q", n, summaryLimit, pr.Summary)
+	}
+	// The cut must be near the limit, not near half of it. A byte count would
+	// stop at 28 letters here.
+	if n := utf8.RuneCountInString(pr.Summary); n < summaryLimit-5 {
+		t.Fatalf("summary = %d runes, cut far too early — counted in bytes? %q", n, pr.Summary)
+	}
+	if pr.Mood == "" {
+		t.Error("Mood is empty; the Stub is a production fallback and owes the contract a mood")
+	}
+}
+
 func TestPhraseReminderNonJSONPayload(t *testing.T) {
 	// a payload that isn't JSON → the phraser falls back to the raw string.
 	rd := loop.ReminderDecision{

internal/router/calendar.go

@@ -35,16 +35,14 @@ var dayPlanWords = []string{
 // answer today and stamp it with today's date, which is a wrong answer where
 // falling through is only a terse one.
 //
-// The weekday names are here as a refusal, not as a feature. "какие планы на
-// понедельник?" carries no other-day token in the сегодня family and does carry
-// "планы", so the plan used to claim it and recite today.
+// A weekday is a refusal too, and it is not in this list: IsDayPlanQuery asks
+// WeekdayIndex, so every case of every name refuses rather than the nine forms
+// that used to be written out here (V-581). "какие планы на понедельник?"
+// carries no other-day token in the сегодня family and does carry "планы", so
+// the plan used to claim it and recite today.
 var otherDayWords = []string{
 	"завтра", "послезавтра", "вчера", "позавчера",
 	"tomorrow", "yesterday",
-	"понедельник", "вторник", "среду", "среда", "четверг", "пятницу", "пятница",
-	"субботу", "суббота", "воскресенье",
-	"понедельника", "вторника", "четверга", "пятницы", "субботы", "воскресенья",
-	"monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday",
 	"неделю", "неделя", "недели", "неделе",
 	"выходные", "выходных", "выходным",
 	"месяц", "месяца", "месяце",
@@ -69,6 +67,9 @@ func IsDayPlanQuery(text string) bool {
 	}
 	toks := planTokens(text)
 	for _, t := range toks {
+		if _, ok := WeekdayIndex(t); ok {
+			return false
+		}
 		for _, w := range otherDayWords {
 			if t == w {
 				return false

internal/router/dateparser.go

@@ -45,10 +45,10 @@ try:
     now = datetime.fromisoformat(sys.argv[2])
     # Pre-process: replace Russian time qualifiers with AM/PM.
     # Handles "9 утра", "10 часов утра", "3 часа дня" etc.
-    text = re.sub(r'(\d+)\s+(?:час(?:а|ов)?\s+)?утра\b', r'\1 am', text, flags=re.IGNORECASE)
-    text = re.sub(r'(\d+)\s+(?:час(?:а|ов)?\s+)?вечера\b', r'\1 pm', text, flags=re.IGNORECASE)
-    text = re.sub(r'(\d+)\s+(?:час(?:а|ов)?\s+)?дня\b', r'\1 pm', text, flags=re.IGNORECASE)
-    text = re.sub(r'(\d+)\s+(?:час(?:а|ов)?\s+)?ночи\b', r'\1 am', text, flags=re.IGNORECASE)
+    text = re.sub(r'(\d+)\s+(?:час(?:а|ов|у|ам)?\s+)?утра\b', r'\1 am', text, flags=re.IGNORECASE)
+    text = re.sub(r'(\d+)\s+(?:час(?:а|ов|у|ам)?\s+)?вечера\b', r'\1 pm', text, flags=re.IGNORECASE)
+    text = re.sub(r'(\d+)\s+(?:час(?:а|ов|у|ам)?\s+)?дня\b', r'\1 pm', text, flags=re.IGNORECASE)
+    text = re.sub(r'(\d+)\s+(?:час(?:а|ов|у|ам)?\s+)?ночи\b', r'\1 am', text, flags=re.IGNORECASE)
     # A bare hour after a preposition is dropped on the floor by dateparser:
     # "завтра в 7" resolves to tomorrow at the CURRENT clock, and "завтра в 7
     # часов" is read as seven hours from now. Only a qualifier (already an
@@ -56,8 +56,17 @@ try:
     # English "at 7" fails identically, so both prepositions are rewritten.
     # "на 9" is the same hour said with the other preposition, and it was not
     # read at all until V-579: "в 9" set the reminder and "на 9" did not.
-    text = re.sub(r'(?<![\w:])(в|во|на|at)\s+([01]?\d|2[0-3])(?:\s+час(?:а|ов)?)?(?![\d:.\w])',
-                  lambda m: '%s %02d:00' % (m.group(1), int(m.group(2))), text, flags=re.IGNORECASE)
+    # "к двум часам" is a third preposition and the dative that goes with it,
+    # and it was read as no time at all until V-609.
+    # The preposition is normalised as well as the hour (V-610). dateparser
+    # joins a day word to a clock through "в" and through no other Russian
+    # preposition, so "завтра к 03:00 pm" loses the clock and resolves to
+    # tomorrow at the CURRENT minute. "на" was silently losing it the same way.
+    def _at(m):
+        prep = 'at' if m.group(1).lower() in ('at', 'by') else 'в'
+        return '%s %02d:00' % (prep, int(m.group(2)))
+    text = re.sub(r'(?<![\w:])(в|во|на|к|ко|at|by)\s+([01]?\d|2[0-3])(?:\s+час(?:а|ов|у|ам)?)?(?![\d:.\w])',
+                  _at, text, flags=re.IGNORECASE)
     settings = {'PREFER_DATES_FROM': 'future', 'RELATIVE_BASE': now}
     # Two-step: search_dates finds the date substring in text,
     # parse() gets the time right (search_dates mishandles AM/PM).

internal/router/habit.go

@@ -27,26 +27,10 @@ var habitMarkers = []string{
 	"typically", "normally",
 }
 
-// weekdayWords — every form of a weekday name maven needs to recognise,
-// including the "по …ам" plural the question is usually phrased in.
-var weekdayWords = map[string]time.Weekday{
-	"понедельник": time.Monday, "понедельникам": time.Monday,
-	"вторник": time.Tuesday, "вторникам": time.Tuesday,
-	"среда": time.Wednesday, "среду": time.Wednesday, "средам": time.Wednesday,
-	"четверг": time.Thursday, "четвергам": time.Thursday,
-	"пятница": time.Friday, "пятницу": time.Friday, "пятницам": time.Friday,
-	"суббота": time.Saturday, "субботу": time.Saturday, "субботам": time.Saturday,
-	"воскресенье": time.Sunday, "воскресеньям": time.Sunday,
-	"воскресенья": time.Sunday, "воскресенью": time.Sunday,
-	"воскресеньем": time.Sunday, "воскресеньях": time.Sunday,
-	"monday": time.Monday, "mondays": time.Monday,
-	"tuesday": time.Tuesday, "tuesdays": time.Tuesday,
-	"wednesday": time.Wednesday, "wednesdays": time.Wednesday,
-	"thursday": time.Thursday, "thursdays": time.Thursday,
-	"friday": time.Friday, "fridays": time.Friday,
-	"saturday": time.Saturday, "saturdays": time.Saturday,
-	"sunday": time.Sunday, "sundays": time.Sunday,
-}
+// The weekday a habit question names comes from WeekdayIndex, not from a map
+// here. This file used to keep its own declension table, which had "воскресеньях"
+// and no "средах" — a list of forms is finished by whoever last thought of one,
+// and a dictionary is not (V-581).
 
 // weekendWords — the weekend as one unit. "что я обычно делаю по выходным?"
 // has a habit marker and names days, but no weekday name is in it, so it used
@@ -77,7 +61,7 @@ func ParseHabitQuery(text string) (HabitQuery, bool) {
 		return HabitQuery{}, false
 	}
 	for _, t := range toks {
-		if wd, ok := weekdayWords[t]; ok {
+		if wd, ok := WeekdayIndex(t); ok {
 			return HabitQuery{Weekday: wd, HasWeekday: true}, true
 		}
 		if weekendWords[t] {

internal/router/hourunit_test.go

@@ -0,0 +1,74 @@
+package router
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+// TestDativePluralHourIsAnHour — "напомни к двум часам позвонить маме" reached
+// the daemon with no time at all and she asked the open "Когда?", while "к трём"
+// one word over read fine (V-609). The word that lost it was "часам", the dative
+// plural of "час", which four separate hour sets in this package left out.
+func TestDativePluralHourIsAnHour(t *testing.T) {
+	const s = "напомни к двум часам позвонить маме"
+	if !MentionsTime(s) {
+		t.Errorf("MentionsTime(%q) = false; the sentence names two o'clock", s)
+	}
+	if !NamesAnHour(s) {
+		t.Errorf("NamesAnHour(%q) = false; the sentence names two o'clock", s)
+	}
+	if got, want := SpellOutDigits(s), "напомни к 2 часам позвонить маме"; got != want {
+		t.Errorf("SpellOutDigits(%q) = %q, want %q", s, got, want)
+	}
+	// The slot itself, which is what the daemon reads. It was empty, so
+	// whenGapOf named the hour missing and she asked "Когда?".
+	now := time.Date(2026, 8, 6, 3, 39, 0, 0, time.UTC)
+	ex := Extractor{Time: StubDateTimeParser{}}
+	got := ex.Extract(context.Background(), IntentReminder, s, now)
+	if !got.HasTime {
+		t.Fatalf("the hour was spoken, so the slot must be filled: %+v", got)
+	}
+	if h := got.Time.Hour(); h != 2 && h != 14 {
+		t.Errorf("fire time = %s, want two o'clock in one half of the day or the other", got.Time.Format("15:04"))
+	}
+}
+
+// TestHourUnitReachesEverySite — the four sets that read the hour noun now read
+// one lexicon key, so a form added there is a form all four know. "часам" is the
+// form that was missing from every one of them.
+func TestHourUnitReachesEverySite(t *testing.T) {
+	for _, w := range []string{"час", "часа", "часов", "часу", "часам"} {
+		if !numeralContext[w] {
+			t.Errorf("numeralContext is missing %q", w)
+		}
+		if !hourMarkers[w] {
+			t.Errorf("hourMarkers is missing %q", w)
+		}
+		if !timeMarkers[w] {
+			t.Errorf("timeMarkers is missing %q", w)
+		}
+		if _, ok := unitToDuration(2, w); !ok {
+			t.Errorf("unitToDuration does not know %q", w)
+		}
+	}
+}
+
+// TestMinuteUnitHasTheSameForms — the same defect one noun over: "минутам" was
+// missing everywhere "минут" and "минуты" were present.
+func TestMinuteUnitHasTheSameForms(t *testing.T) {
+	for _, w := range []string{"минут", "минуты", "минуту", "минутам"} {
+		if !numeralContext[w] {
+			t.Errorf("numeralContext is missing %q", w)
+		}
+		if !hourMarkers[w] {
+			t.Errorf("hourMarkers is missing %q", w)
+		}
+		if !timeMarkers[w] {
+			t.Errorf("timeMarkers is missing %q", w)
+		}
+		if _, ok := unitToDuration(20, w); !ok {
+			t.Errorf("unitToDuration does not know %q", w)
+		}
+	}
+}

internal/router/kpreposition_test.go

@@ -0,0 +1,172 @@
+package router
+
+import (
+	"context"
+	"os/exec"
+	"testing"
+	"time"
+)
+
+// probeNow is the clock the five sentences below were measured against on the
+// box at 03:53 on 2026-08-06, right after #252 deployed. Three of them wrote a
+// reminder for 03:53 itself, which is the current minute and not an hour anyone
+// said (V-610).
+var probeNow = time.Date(2026, 8, 6, 3, 53, 0, 0, time.Local)
+
+// kProbe — the five sentences, with what each must resolve to. The two that
+// already worked are here so that fixing "к" cannot cost "в".
+var kProbe = []struct {
+	text string
+	// day is the offset from probeNow's date, hour is the fire hour.
+	day     int
+	hour    int
+	whyItIs string
+}{
+	{
+		text:    "напомни завтра в три часа дня позвонить врачу",
+		day:     1,
+		hour:    15,
+		whyItIs: "в plus a spoken hour and a qualifier resolves, and did before #252",
+	},
+	{
+		text:    "напомни завтра в 15:00 позвонить врачу",
+		day:     1,
+		hour:    15,
+		whyItIs: "a written clock resolves, and did before #252",
+	},
+	{
+		text:    "напомни завтра к трём часам дня позвонить врачу",
+		day:     1,
+		hour:    15,
+		whyItIs: "к names the same hour в does, and wrote 03:53 after #252",
+	},
+	{
+		text:    "напомни сегодня к пяти часам вечера позвонить врачу",
+		day:     0,
+		hour:    17,
+		whyItIs: "the same defect on today and on the oblique пяти",
+	},
+	{
+		text:    "напомни завтра к трём часам позвонить врачу",
+		day:     1,
+		hour:    3,
+		whyItIs: "no qualifier, so the hour reads as spoken and the daemon asks which half",
+	},
+}
+
+// TestKPrepositionHourStub — the probe against the floor parser, which answers
+// on every box whether or not python is installed.
+func TestKPrepositionHourStub(t *testing.T) {
+	ex := Extractor{Time: StubDateTimeParser{}}
+	for _, c := range kProbe {
+		t.Run(c.text, func(t *testing.T) {
+			got := ex.Extract(context.Background(), IntentReminder, c.text, probeNow)
+			if !got.HasTime {
+				t.Fatalf("time slot empty: %s", c.whyItIs)
+			}
+			checkFire(t, got.Time, c.day, c.hour, c.whyItIs)
+		})
+	}
+}
+
+// TestKPrepositionHourPython — the same probe against the production parser.
+// Skips where python3 or dateparser is missing, as the rest of this package's
+// python tests do.
+func TestKPrepositionHourPython(t *testing.T) {
+	requirePython(t)
+	p := NewPythonDateParser()
+	ex := Extractor{Time: p}
+	for _, c := range kProbe {
+		t.Run(c.text, func(t *testing.T) {
+			got := ex.Extract(context.Background(), IntentReminder, c.text, probeNow)
+			if !got.HasTime {
+				t.Fatalf("time slot empty: %s", c.whyItIs)
+			}
+			checkFire(t, got.Time, c.day, c.hour, c.whyItIs)
+		})
+	}
+}
+
+func checkFire(t *testing.T, fire time.Time, dayOffset, hour int, why string) {
+	t.Helper()
+	if fire.Hour() != hour || fire.Minute() != 0 {
+		t.Errorf("fire = %s, want %02d:00 — %s", fire.Format("2006-01-02 15:04"), hour, why)
+	}
+	if fire.Minute() == probeNow.Minute() && fire.Hour() == probeNow.Hour() {
+		t.Errorf("fire = %s, which is the clock at the moment of the turn and not an hour he said", fire.Format("15:04"))
+	}
+	want := probeNow.AddDate(0, 0, dayOffset)
+	if fire.Year() != want.Year() || fire.Month() != want.Month() || fire.Day() != want.Day() {
+		t.Errorf("fire = %s, want the %s — %s", fire.Format("2006-01-02"), want.Format("2006-01-02"), why)
+	}
+}
+
+// TestUnresolvedHourLeavesTheSlotEmpty — the durable half. A parser that read
+// the day and took the minute off the clock must not fill the time slot, no
+// matter which preposition lost the hour. This is the whole class the "к" case
+// was one member of.
+func TestUnresolvedHourLeavesTheSlotEmpty(t *testing.T) {
+	ex := Extractor{Time: clockEchoParser{}}
+	for _, s := range []string{
+		"напомни завтра к трём часам дня позвонить врачу",
+		"напомни завтра в три часа дня позвонить врачу",
+		"напомни завтра на девять позвонить врачу",
+		"напомни сегодня к пяти часам вечера позвонить врачу",
+	} {
+		got := ex.Extract(context.Background(), IntentReminder, s, probeNow)
+		if got.HasTime {
+			t.Errorf("Extract(%q) filled the slot with %s, which is the current minute; she has to ask", s, got.Time.Format("15:04"))
+		}
+	}
+}
+
+// TestSpokenMinutesSurviveTheRefusal — the three shapes that name a minute of
+// their own, and an hour that happens to be the hour it is spoken in. Refusing
+// on the whole instant instead of on the minute would cost every one of these,
+// and ru-rem-006 in the routing fixture is the case that says so.
+func TestSpokenMinutesSurviveTheRefusal(t *testing.T) {
+	noon := time.Date(2026, 7, 30, 12, 0, 0, 0, time.UTC)
+	ex := Extractor{Time: StubDateTimeParser{}}
+	for _, c := range []struct {
+		text string
+		hour int
+		min  int
+	}{
+		{"напомни послезавтра в 12 забрать заказ", 12, 0},
+		{"разбуди меня в 6:30", 6, 30},
+		{"напомни в половине восьмого выпить таблетку", 7, 30},
+		{"напомни без четверти восемь выходить", 7, 45},
+	} {
+		got := ex.Extract(context.Background(), IntentReminder, c.text, noon)
+		if !got.HasTime {
+			t.Errorf("Extract(%q) left the slot empty; he said the time", c.text)
+			continue
+		}
+		if got.Time.Hour() != c.hour || got.Time.Minute() != c.min {
+			t.Errorf("Extract(%q) = %s, want %02d:%02d", c.text, got.Time.Format("15:04"), c.hour, c.min)
+		}
+	}
+}
+
+// TestIntervalKeepsTheCurrentMinute — an interval is measured from now and may
+// land on now's own minute, so the refusal above must not reach it.
+func TestIntervalKeepsTheCurrentMinute(t *testing.T) {
+	ex := Extractor{Time: StubDateTimeParser{}}
+	got := ex.Extract(context.Background(), IntentReminder, "напомни через час позвонить врачу", probeNow)
+	if !got.HasTime {
+		t.Fatal("через час names one instant and answers the hour and the day together")
+	}
+	if want := probeNow.Add(time.Hour); !got.Time.Equal(want) {
+		t.Errorf("fire = %s, want %s", got.Time.Format("15:04"), want.Format("15:04"))
+	}
+}
+
+func requirePython(t *testing.T) {
+	t.Helper()
+	if _, err := exec.LookPath("python3"); err != nil {
+		t.Skip("python3 not on PATH — skipping dateparser tests")
+	}
+	if err := exec.Command("python3", "-c", "import dateparser").Run(); err != nil {
+		t.Skip("python dateparser not installed — skipping dateparser tests")
+	}
+}

internal/router/numwords.go

@@ -34,12 +34,21 @@ func numeralDigit(word string) (string, bool) {
 // numeralContext — the words that make a numeral a time. A numeral is only
 // rewritten when one of these sits next to it, so "три яблока" in a note is
 // left alone and "в три часа" is not.
-var numeralContext = map[string]bool{
-	"в": true, "во": true, "к": true, "около": true, "на": true,
-	"часа": true, "часов": true, "час": true, "часу": true,
-	"утра": true, "вечера": true, "дня": true, "ночи": true,
-	"минут": true, "минуты": true, "минуту": true,
-	"at": true, "by": true,
+var numeralContext = buildNumeralContext()
+
+func buildNumeralContext() map[string]bool {
+	m := map[string]bool{
+		"в": true, "во": true, "к": true, "около": true, "на": true,
+		"утра": true, "вечера": true, "дня": true, "ночи": true,
+		"at": true, "by": true,
+	}
+	for _, w := range lexicon.HourUnits() {
+		m[w] = true
+	}
+	for _, w := range lexicon.MinuteUnits() {
+		m[w] = true
+	}
+	return m
 }
 
 // SpellOutDigits rewrites spoken numbers as digits so the date parsers see the

internal/router/slots.go

@@ -55,11 +55,12 @@ func (e Extractor) Extract(ctx context.Context, intent Intent, utterance string,
 	switch intent {
 	case IntentReminder:
 		if e.Time != nil {
-			// NamesAnHour is the gate, not the parser's ok (V-577, V-579). A
-			// sentence that names a day and no hour parses to that day at the
-			// current minute, and filling the slot with it invents the answer
-			// she asked for. Left empty, the daemon asks.
-			if t, ok, err := e.Time.Parse(ctx, utterance, now); err == nil && ok && NamesAnHour(utterance) {
+			// ResolvedTheHour is the gate, not the parser's ok (V-577, V-579,
+			// V-610). A sentence that names a day and no hour parses to that day
+			// at the current minute, and so does one whose hour the parser could
+			// not read. Filling the slot with either invents the answer she asked
+			// for. Left empty, the daemon asks.
+			if t, ok, err := e.Time.Parse(ctx, utterance, now); err == nil && ok && ResolvedTheHour(utterance, t) {
 				s.Time = t
 				s.HasTime = true
 			}
@@ -175,10 +176,14 @@ func afterWord(s, w string) string {
 	return ""
 }
 
-// hourPrepositions — the words a spoken hour sits behind. Three, and no more:
+// hourPrepositions — the words a spoken hour sits behind. Five, and no more:
 // the lexicon's frame set is much wider, and a word goes in here only when the
 // number after it is an hour of the day rather than a count of anything.
-var hourPrepositions = map[string]bool{"в": true, "во": true, "на": true}
+//
+// "к" and "ко" joined the three on V-609. "напомни к двум часам" named an hour
+// and parsed to nothing, so the reminder reached the daemon with no time and she
+// asked the open question about an hour he had just said.
+var hourPrepositions = map[string]bool{"в": true, "во": true, "на": true, "к": true, "ко": true}
 
 // StubDateTimeParser — a tiny relative/absolute parser standing in for
 // `dateparser` until the i18n module lands. Handles "in Nh"/"in Nm"/"in Ns" and
@@ -398,10 +403,18 @@ func leadingWordNumber(s string) (int, string, bool) {
 }
 
 func unitToDuration(n int, unit string) (time.Duration, bool) {
-	switch unit {
-	case "h", "hour", "hours", "hr", "hrs":
+	// The hour and the minute nouns are closed classes with one home in the
+	// lexicon, and the list here used to be short of the oblique forms (V-609).
+	if lexicon.IsHourUnit(unit) {
 		return time.Duration(n) * time.Hour, true
-	case "m", "min", "mins", "minute", "minutes":
+	}
+	if lexicon.IsMinuteUnit(unit) {
+		return time.Duration(n) * time.Minute, true
+	}
+	switch unit {
+	case "h", "hr", "hrs":
+		return time.Duration(n) * time.Hour, true
+	case "m", "min", "mins":
 		return time.Duration(n) * time.Minute, true
 	case "s", "sec", "secs", "second", "seconds":
 		return time.Duration(n) * time.Second, true
@@ -409,10 +422,6 @@ func unitToDuration(n int, unit string) (time.Duration, bool) {
 	case "day", "days":
 		return time.Duration(n) * 24 * time.Hour, true
 	// Russian units (inflected forms)
-	case "час", "часа", "часов":
-		return time.Duration(n) * time.Hour, true
-	case "минута", "минуты", "минут":
-		return time.Duration(n) * time.Minute, true
 	case "день", "дня", "дней":
 		return time.Duration(n) * 24 * time.Hour, true
 	case "неделя", "недели", "недель":

internal/router/timementions.go

@@ -3,6 +3,7 @@ package router
 import (
 	"strconv"
 	"strings"
+	"time"
 
 	"github.com/kami/maven/internal/lexicon"
 	"github.com/kami/maven/internal/morph"
@@ -118,6 +119,55 @@ func NamesAnHour(text string) bool {
 	return false
 }
 
+// ResolvedTheHour reports whether a parse read the hour the sentence names,
+// rather than inheriting the clock it was handed as its relative base.
+//
+// It is the second half of the gate NamesAnHour opens (V-610). NamesAnHour asks
+// whether an hour was spoken and cannot ask whether it was read, so a
+// preposition the parser half knew wrote a reminder at 03:53 for "напомни
+// завтра к трём часам дня" and confirmed it as if it were the hour he said. A
+// wrong instant she states as fact is worse than a question, because he stops
+// thinking about it.
+//
+// The tell is the minute. A spoken hour lands on the hour, and the only three
+// shapes that name a minute of their own are a written clock, a half hour and a
+// quarter to. A parse that came back with any other minute took it from the
+// clock it was handed, whatever hour it put in front of it. An interval is
+// exempt, because it is measured from now and lands wherever the arithmetic
+// says.
+//
+// Comparing the whole instant to now would be the obvious test and it is the
+// wrong one: "напомни послезавтра в 12" resolves to 12:00 and the fixture's
+// reference clock is 12:00, so an hour he did say would read as an hour nobody
+// did.
+func ResolvedTheHour(text string, t time.Time) bool {
+	if !NamesAnHour(text) {
+		return false
+	}
+	if NamesAnInterval(text) || t.Minute() == 0 {
+		return true
+	}
+	return namesTheMinute(text)
+}
+
+// namesTheMinute reports whether the sentence says which minute of the hour it
+// means, in any of the three ways it can.
+func namesTheMinute(text string) bool {
+	toks := strings.Fields(strings.ToLower(text))
+	for i, raw := range toks {
+		if isDigitClock(cleanWord(raw)) {
+			return true
+		}
+		if _, _, ok := halfPastAt(toks, i); ok {
+			return true
+		}
+		if _, _, _, ok := quarterToAt(toks, i); ok {
+			return true
+		}
+	}
+	return false
+}
+
 // NamesAnInterval reports whether the sentence measures the time from now
 // instead of naming it: "через час", "через 10 минут", "in 30 minutes".
 //
@@ -205,12 +255,16 @@ var hourMarkers = buildHourMarkers()
 func buildHourMarkers() map[string]bool {
 	m := map[string]bool{
 		"утра": true, "вечера": true, "дня": true, "ночи": true,
-		"часа": true, "часов": true, "час": true, "часу": true,
-		"минут": true, "минуты": true, "минуту": true,
 		"через": true, "спустя": true, "полчаса": true,
 		"полдень": true, "полночь": true,
 		"am": true, "pm": true, "noon": true, "midnight": true, "in": true,
 	}
+	for _, w := range lexicon.HourUnits() {
+		m[w] = true
+	}
+	for _, w := range lexicon.MinuteUnits() {
+		m[w] = true
+	}
 	for _, w := range lexicon.PartsOfDay() {
 		m[w] = true
 	}
@@ -234,16 +288,34 @@ func isMonth(tok string) bool {
 	return false
 }
 
-// isWeekday reports whether the token is a day of the week in any case. The
-// lexicon lists the nominative, and "в пятницу" is what a reminder says, so the
-// match is by lemma — grammar is morph's job, not a second word list.
-func isWeekday(tok string) bool {
-	for i := 0; i < 7; i++ {
-		if morph.SameWord(tok, lexicon.Weekday(i)) {
-			return true
+// WeekdayIndex reports which day of the week a token names, in any case and in
+// either language, or false when it names none.
+//
+// One matcher for the whole daemon (V-581). Four files used to keep a weekday
+// list of their own and each one was short in a different direction: the habit
+// map had "воскресеньях" but no "средах", the plan refusal had "среду" but not
+// "среде", and cmd/mavend matched the STEM "сред" with strings.Contains, so
+// "среди" and "средство" read as Wednesday. The lexicon lists the nominative,
+// every Russian case lemmatises to it, and only English needs its forms written
+// out — the vendored dictionary is Russian and leaves "mondays" alone.
+func WeekdayIndex(tok string) (time.Weekday, bool) {
+	t := strings.ToLower(strings.TrimSpace(tok))
+	if n, ok := lexicon.WeekdayEnglish(t); ok {
+		return time.Weekday(n), true
+	}
+	for i, name := range lexicon.Weekdays() {
+		if morph.SameWord(t, name) {
+			return time.Weekday(i), true
 		}
 	}
-	return false
+	return 0, false
+}
+
+// isWeekday reports whether the token is a day of the week, when the caller
+// does not need to know which one.
+func isWeekday(tok string) bool {
+	_, ok := WeekdayIndex(tok)
+	return ok
 }
 
 // timeMarkers — the words that name a time on their own: the qualifiers that
@@ -255,11 +327,15 @@ var timeMarkers = buildTimeMarkers()
 func buildTimeMarkers() map[string]bool {
 	m := map[string]bool{
 		"утра": true, "вечера": true, "дня": true, "ночи": true,
-		"часа": true, "часов": true, "час": true, "часу": true,
-		"минут": true, "минуты": true, "минуту": true,
 		"через": true, "полчаса": true, "сейчас": true,
 		"am": true, "pm": true, "noon": true, "midnight": true,
 	}
+	for _, w := range lexicon.HourUnits() {
+		m[w] = true
+	}
+	for _, w := range lexicon.MinuteUnits() {
+		m[w] = true
+	}
 	for _, w := range lexicon.PartsOfDay() {
 		m[w] = true
 	}

internal/router/timementions_test.go

@@ -93,8 +93,17 @@ func TestReminderSlotRefusesAnHourNobodySaid(t *testing.T) {
 	if got := ex.Extract(context.Background(), IntentReminder, "на завтра", now); got.HasTime {
 		t.Errorf("«на завтра» filled the time slot with %s, which is the clock", got.Time.Format("15:04"))
 	}
-	if got := ex.Extract(context.Background(), IntentReminder, "на 9", now); !got.HasTime {
-		t.Error("«на 9» names an hour and must still fill the slot")
+	// "на 9" names an hour, and a parser that answered with the clock did not
+	// read it (V-610). Naming one is necessary and reading it is what fills the
+	// slot, so this echo is refused too and the daemon asks.
+	if got := ex.Extract(context.Background(), IntentReminder, "на 9", now); got.HasTime {
+		t.Errorf("«на 9» took %s from the clock; the parser never read the nine", got.Time.Format("15:04"))
+	}
+	// A parser that does read it fills the slot, which is the other half of the
+	// same rule.
+	real := Extractor{Time: StubDateTimeParser{}}
+	if got := real.Extract(context.Background(), IntentReminder, "на 9", now); !got.HasTime || got.Time.Hour() != 9 {
+		t.Errorf("«на 9» must fill the slot with nine o'clock, got %+v", got)
 	}
 }
 

internal/router/weekday_test.go

@@ -0,0 +1,44 @@
+package router
+
+import (
+	"testing"
+	"time"
+)
+
+// TestWeekdayIndexReplacesFourLists — four files kept a weekday list of their
+// own and each was short in a different direction (V-581). The forms below are
+// the ones at least one of those lists missed, so they are the point of having
+// one matcher: the lexicon names the day and the dictionary answers the case.
+func TestWeekdayIndexReplacesFourLists(t *testing.T) {
+	for _, tc := range []struct {
+		word string
+		want time.Weekday
+	}{
+		{"понедельник", time.Monday},
+		{"понедельникам", time.Monday},
+		{"понедельником", time.Monday},
+		{"вторник", time.Tuesday},
+		{"среда", time.Wednesday},
+		{"среду", time.Wednesday},
+		{"среде", time.Wednesday},
+		{"средам", time.Wednesday},
+		{"четверга", time.Thursday},
+		{"пятницу", time.Friday},
+		{"субботам", time.Saturday},
+		{"воскресеньях", time.Sunday},
+		{"Воскресенье", time.Sunday},
+		{"monday", time.Monday},
+		{"Fridays", time.Friday},
+	} {
+		got, ok := WeekdayIndex(tc.word)
+		if !ok || got != tc.want {
+			t.Errorf("WeekdayIndex(%q) = %v, %v; want %v, true", tc.word, got, ok, tc.want)
+		}
+	}
+	// A stem match said yes to all of these. A word match says no.
+	for _, w := range []string{"среди", "средство", "средний", "среднем", "субботник", "", "через"} {
+		if _, ok := WeekdayIndex(w); ok {
+			t.Errorf("WeekdayIndex(%q) claimed a weekday", w)
+		}
+	}
+}

internal/rss/feed.go

@@ -173,8 +173,9 @@ var (
 )
 
 // PlainText strips markup and decodes entities — feed summaries are HTML, and
-// what reaches a note (and possibly the TTS) must be text. Exported because the
-// crawler's extractor needs exactly this on a bigger input.
+// what reaches a note (and possibly the TTS) must be text. Exported so a caller
+// holding raw feed markup can reduce it the same way; crawl/extract.go does the
+// bigger job on a whole document and does not go through here.
 func PlainText(s string) string {
 	s = scriptRE.ReplaceAllString(s, " ")
 	s = tagRE.ReplaceAllString(s, " ")

internal/rss/poller.go

@@ -1,6 +1,7 @@
 package rss
 
 import (
+	"bytes"
 	"context"
 	"fmt"
 	"log"
@@ -164,7 +165,9 @@ func (p *Poller) PollFeed(ctx context.Context, f FeedConfig, now time.Time) (int
 	if err != nil {
 		return 0, err
 	}
-	feed, err := Parse(strings.NewReader(string(body.Bytes)))
+	// bytes.NewReader and not strings.NewReader(string(…)): the latter copied a
+	// feed document that can run to a megabyte, for nothing.
+	feed, err := Parse(bytes.NewReader(body.Bytes))
 	if err != nil {
 		return 0, err
 	}

internal/say/summary.go

@@ -32,6 +32,12 @@ const (
 	PlanDay       = "plan_day"
 	PlanUncertain = "plan_uncertain"
 
+	// "что дальше?" — the next few entries, not the day. PlanNextMore is the
+	// same sentence when the cap hid something, so the count it states is the
+	// only signal that the day is not over after the last line read.
+	PlanNext     = "plan_next"
+	PlanNextMore = "plan_next_more"
+
 	TasksNone       = "tasks_none"
 	TasksFirst      = "tasks_first"
 	TasksCandidates = "tasks_candidates"
@@ -70,6 +76,7 @@ const (
 
 var summaryKeys = []string{
 	PlanRestEmpty, PlanDayEmpty, PlanDay, PlanUncertain,
+	PlanNext, PlanNextMore,
 	TasksNone, TasksFirst, TasksCandidates,
 	StallOverdue, StallSitting, StallUnconfirmed,
 	ReasonOverdue, ReasonOverdueDays, ReasonToday, ReasonTomorrow,
@@ -89,6 +96,8 @@ var summaryFloor = map[string]string{
 	PlanDayEmpty:  "на {date} ничего не запланировано.",
 	PlanDay:       "план на {date}: {items}",
 	PlanUncertain: "похоже, {line}",
+	PlanNext:      "дальше: {items}",
+	PlanNextMore:  "дальше: {items}. и ещё {n} {word} до конца дня.",
 
 	TasksNone:       "задач нет.",
 	TasksFirst:      "сначала: {items}",
@@ -139,9 +148,12 @@ func LoadSummaries(src rand.Source) (*Summaries, error) {
 	for _, req := range []struct{ key, ph string }{
 		{PlanDayEmpty, "{date}"}, {PlanDay, "{date}"}, {PlanDay, "{items}"},
 		{PlanUncertain, "{line}"},
+		{PlanNext, "{items}"},
+		{PlanNextMore, "{items}"}, {PlanNextMore, "{n}"}, {PlanNextMore, "{word}"},
 		{TasksFirst, "{items}"}, {TasksCandidates, "{items}"},
 		{StallOverdue, "{n}"}, {StallOverdue, "{word}"},
-		{StallSitting, "{n}"}, {StallSitting, "{days}"},
+		{StallSitting, "{n}"}, {StallSitting, "{word}"},
+		{StallSitting, "{days}"}, {StallSitting, "{dayword}"},
 		{StallUnconfirmed, "{n}"}, {StallUnconfirmed, "{word}"},
 		{ReasonOverdueDays, "{n}"}, {ReasonOverdueDays, "{word}"},
 		{ReasonInDays, "{n}"}, {ReasonInDays, "{word}"},

internal/say/summary_ru_v1.json

@@ -30,6 +30,14 @@
       "fixed": true,
       "variants": ["похоже, {line}"]
     },
+    "plan_next": {
+      "fixed": true,
+      "variants": ["дальше: {items}"]
+    },
+    "plan_next_more": {
+      "fixed": true,
+      "variants": ["дальше: {items}. и ещё {n} {word} до конца дня."]
+    },
 
     "tasks_none": {
       "fixed": true,

internal/speaker/recognizer.go

@@ -75,8 +75,8 @@ func (r *Recognizer) Identify(ctx context.Context, a audio.Audio) (Match, error)
 	if !a.Format.IsValid() {
 		return Match{}, fmt.Errorf("%w: %+v", ErrBadFormat, a.Format)
 	}
-	if seconds(a) < r.minSec {
-		return Match{}, fmt.Errorf("%w: %.1fs, need %.1fs", ErrTooShort, seconds(a), r.minSec)
+	if sec := seconds(a); sec < r.minSec {
+		return Match{}, fmt.Errorf("%w: %.1fs, need %.1fs", ErrTooShort, sec, r.minSec)
 	}
 	vec, err := r.embed(ctx, a)
 	if err != nil {

internal/store/ack.go

@@ -2,6 +2,7 @@ package store
 
 import (
 	"context"
+	"database/sql"
 	"fmt"
 	"time"
 )
@@ -38,16 +39,21 @@ func (s *Store) MarkSent(ctx context.Context, key string, ts time.Time) error {
 // send goes through RecordNudge, not MarkSent, so the first MarkSent comes on
 // the repeat path — LastSent may legitimately be zero until then).
 func (s *Store) LastSent(ctx context.Context, key string) (time.Time, error) {
-	var millis int64
+	// MAX over an empty set is one row holding NULL, not zero rows, so this
+	// scans into a NullInt64 — the same trap OldestPendingTelegram spells out.
+	// A bare int64 turned the ordinary "nothing sent yet" case into a scan
+	// error, and RepeatUnacked aborts its whole sweep on one, so the first
+	// repeat could never go out for any rule.
+	var millis sql.NullInt64
 	err := s.db.QueryRowContext(ctx,
 		`SELECT MAX(sent_at) FROM ack_sends WHERE rule = ?`, key).Scan(&millis)
 	if err != nil {
 		return time.Time{}, fmt.Errorf("last sent %s: %w", key, err)
 	}
-	if millis == 0 {
+	if !millis.Valid {
 		return time.Time{}, nil
 	}
-	return time.UnixMilli(millis).UTC(), nil
+	return time.UnixMilli(millis.Int64).UTC(), nil
 }
 
 // MarkAcked marks ALL pending telegram nudges for the rule as "acted" —
@@ -55,17 +61,15 @@ func (s *Store) LastSent(ctx context.Context, key string) (time.Time, error) {
 // alarm (voice acknowledgment, Telegram callback, etc.).
 func (s *Store) MarkAcked(ctx context.Context, key string) error {
 	now := time.Now()
-	res, err := s.db.ExecContext(ctx,
+	// No pending nudges is not an error — already acked or never sent — so the
+	// rows-affected count is not read at all: every outcome below this line is
+	// the same nil.
+	_, err := s.db.ExecContext(ctx,
 		`UPDATE nudges SET outcome = 'acted', outcome_ts = ?
 		  WHERE rule = ? AND channel = 'telegram' AND outcome = 'pending'`,
 		now.UnixMilli(), key)
 	if err != nil {
 		return fmt.Errorf("mark acked %s: %w", key, err)
 	}
-	n, _ := res.RowsAffected()
-	if n == 0 {
-		// no pending nudges — already acked or never sent; not an error.
-		return nil
-	}
 	return nil
 }

internal/store/ack_test.go

@@ -0,0 +1,60 @@
+package store
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+// TestLastSentOnEmptyTableIsZero pins the aggregate-over-nothing trap that
+// nudges.go's OldestPendingTelegram already documents: MAX over an empty set is
+// one row holding NULL, not zero rows. Scanning that into a bare int64 is an
+// error, and the doc on LastSent promises a zero time instead.
+//
+// It is not a cosmetic promise. ack_sends is written only by MarkSent, and
+// MarkSent is called only after a repeat has already gone out, so the first
+// repeat for every rule reads an empty table. delivery.Dispatcher.RepeatUnacked
+// aborts the whole sweep on that error, which means the repeat-til-ack loop can
+// never take its first step for any rule.
+func TestLastSentOnEmptyTableIsZero(t *testing.T) {
+	s := newTestStore(t)
+	ctx := context.Background()
+
+	last, err := s.LastSent(ctx, "service_down")
+	if err != nil {
+		t.Fatalf("last sent on an empty table must not error: %v", err)
+	}
+	if !last.IsZero() {
+		t.Fatalf("want the zero time before anything was sent, got %v", last)
+	}
+}
+
+// TestLastSentIsScopedToItsRule — a send for another rule must not answer for
+// this one, or the repeat interval is clocked off somebody else's alarm.
+func TestLastSentIsScopedToItsRule(t *testing.T) {
+	s := newTestStore(t)
+	ctx := context.Background()
+	at := time.UnixMilli(1_700_000_000_000).UTC()
+
+	if err := s.MarkSent(ctx, "other_rule", at); err != nil {
+		t.Fatalf("mark sent: %v", err)
+	}
+	last, err := s.LastSent(ctx, "service_down")
+	if err != nil {
+		t.Fatalf("last sent: %v", err)
+	}
+	if !last.IsZero() {
+		t.Fatalf("want zero for a rule with no sends, got %v", last)
+	}
+
+	if err := s.MarkSent(ctx, "service_down", at); err != nil {
+		t.Fatalf("mark sent: %v", err)
+	}
+	last, err = s.LastSent(ctx, "service_down")
+	if err != nil {
+		t.Fatalf("last sent: %v", err)
+	}
+	if !last.Equal(at) {
+		t.Fatalf("want %v, got %v", at, last)
+	}
+}

internal/store/backfill.go

@@ -2,7 +2,6 @@ package store
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"time"
 )
@@ -103,30 +102,16 @@ func (s *Store) ReembedAll(ctx context.Context, currentID string, embed EmbedFun
 		id, text, kind string
 	}
 	var vecs []vecRow
-	rows, err = tx.QueryContext(ctx, `SELECT id, meta FROM memory_vectors`)
+	memRows, err := allMemVectorMetas(ctx, tx)
 	if err != nil {
-		return res, fmt.Errorf("reembed: read memory vectors: %w", err)
+		return res, fmt.Errorf("reembed: %w", err)
 	}
-	for rows.Next() {
-		var id, metaJSON string
-		if err := rows.Scan(&id, &metaJSON); err != nil {
-			rows.Close()
-			return res, fmt.Errorf("reembed: memory row: %w", err)
-		}
-		meta := map[string]string{}
-		if err := json.Unmarshal([]byte(metaJSON), &meta); err != nil {
-			rows.Close()
-			return res, fmt.Errorf("reembed: meta for %q: %w", id, err)
-		}
-		if meta["text"] == "" {
+	for _, v := range memRows {
+		if v.Meta["text"] == "" {
 			res.NoText++
 			continue
 		}
-		vecs = append(vecs, vecRow{id: id, text: meta["text"], kind: meta["type"]})
-	}
-	rows.Close()
-	if err := rows.Err(); err != nil {
-		return res, fmt.Errorf("reembed: memory vectors: %w", err)
+		vecs = append(vecs, vecRow{id: v.ID, text: v.Meta["text"], kind: v.Meta["type"]})
 	}
 
 	for _, v := range vecs {

internal/store/digest.go

@@ -3,7 +3,9 @@ package store
 import (
 	"context"
 	"crypto/sha256"
+	"database/sql"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"time"
 )
@@ -44,19 +46,33 @@ func DigestBodyHash(rule, body string) string {
 }
 
 // EnqueueDigestEntry durably records a suppressed care candidate worth
-// resurfacing later. If a pending entry with the same rule+body already
+// resurfacing later. If a LIVE pending entry with the same rule+body already
 // exists, this is a no-op that returns the existing id and deduped=true —
 // the same suppressed nudge repeating across ticks must not pile up into
 // several copies of itself in the eventual bundle.
+//
+// "Live" carries the same expiry test PendingDigestEntries reads with, and for
+// the same reason: a row past its expires_ts is still status='pending' until
+// the sweep gets to it, and the tick enqueues before it sweeps. Deduping
+// against one meant reporting deduped=true against an entry that will never be
+// spoken — the caller drops the phrasing it just paid the LLM for and nothing
+// reaches the bundle. Not yet swept must not mean still deliverable on the
+// write side either.
 func (s *Store) EnqueueDigestEntry(ctx context.Context, rule string, severity int, body string, now, expiresAt time.Time) (id int64, deduped bool, err error) {
 	hash := DigestBodyHash(rule, body)
 	var existing int64
 	err = s.db.QueryRowContext(ctx,
-		`SELECT id FROM digest_entries WHERE status = ? AND rule = ? AND body_hash = ? LIMIT 1`,
-		DigestPending, rule, hash).Scan(&existing)
+		`SELECT id FROM digest_entries
+		  WHERE status = ? AND rule = ? AND body_hash = ? AND expires_ts > ? LIMIT 1`,
+		DigestPending, rule, hash, now.UnixMilli()).Scan(&existing)
 	if err == nil {
 		return existing, true, nil
 	}
+	if !errors.Is(err, sql.ErrNoRows) {
+		// A real read failure is not "nothing there". Inserting anyway would
+		// duplicate an entry whose existence we never established.
+		return 0, false, fmt.Errorf("enqueue digest entry: dedupe lookup: %w", err)
+	}
 
 	res, err := s.db.ExecContext(ctx,
 		`INSERT INTO digest_entries (rule, severity, body, body_hash, status, created_ts, expires_ts)

internal/store/digest_test.go

@@ -200,3 +200,46 @@ func TestDigestEntryDrainMarksDrainedNotDeleted(t *testing.T) {
 		}
 	}
 }
+
+// TestDigestEnqueueDoesNotDedupeAgainstAnExpiredEntry — an entry past its
+// expires_ts is still status='pending' until the sweep runs, and the tick
+// enqueues before it sweeps. Deduping against one reports deduped=true for a
+// row PendingDigestEntries will never hand back, so the suppressed nudge is
+// dropped instead of held: the entry says the thing was recorded when nothing
+// was.
+func TestDigestEnqueueDoesNotDedupeAgainstAnExpiredEntry(t *testing.T) {
+	s := newTestStore(t)
+	ctx := context.Background()
+	created := time.Now()
+	expiresAt := created.Add(time.Hour)
+
+	first, deduped, err := s.EnqueueDigestEntry(ctx, "break", 2, "ты долго не отдыхала", created, expiresAt)
+	if err != nil {
+		t.Fatalf("enqueue: %v", err)
+	}
+	if deduped {
+		t.Fatal("first enqueue must not report deduped")
+	}
+
+	// A tick after the expiry, with the sweep not yet run: the same suppressed
+	// nudge comes round again and must be recorded afresh.
+	after := expiresAt.Add(time.Minute)
+	second, deduped, err := s.EnqueueDigestEntry(ctx, "break", 2, "ты долго не отдыхала", after, after.Add(time.Hour))
+	if err != nil {
+		t.Fatalf("re-enqueue: %v", err)
+	}
+	if deduped {
+		t.Fatal("an expired entry must not swallow a fresh one")
+	}
+	if second == first {
+		t.Fatalf("want a new row, got the expired one back: id=%d", second)
+	}
+
+	entries, err := s.PendingDigestEntries(ctx, after)
+	if err != nil {
+		t.Fatalf("pending: %v", err)
+	}
+	if len(entries) != 1 || entries[0].ID != second {
+		t.Fatalf("want the fresh entry %d pending, got %+v", second, entries)
+	}
+}

internal/store/factvectors.go

@@ -64,9 +64,9 @@ func (s *Store) RepairFactVectors(ctx context.Context, embed EmbedFunc) (FactVec
 		return res, nil
 	}
 
-	rows, err := s.db.QueryContext(ctx, `SELECT id, meta FROM memory_vectors`)
+	memRows, err := allMemVectorMetas(ctx, s.db)
 	if err != nil {
-		return res, fmt.Errorf("repair fact vectors: read: %w", err)
+		return res, fmt.Errorf("repair fact vectors: %w", err)
 	}
 	type factVec struct {
 		id, key string
@@ -75,33 +75,19 @@ func (s *Store) RepairFactVectors(ctx context.Context, embed EmbedFunc) (FactVec
 	}
 	var vecs []factVec
 	newest := map[string]int64{} // key → newest ts seen for it
-	for rows.Next() {
-		var id, metaJSON string
-		if err := rows.Scan(&id, &metaJSON); err != nil {
-			rows.Close()
-			return res, fmt.Errorf("repair fact vectors: row: %w", err)
-		}
-		meta := map[string]string{}
-		if err := json.Unmarshal([]byte(metaJSON), &meta); err != nil {
-			rows.Close()
-			return res, fmt.Errorf("repair fact vectors: meta for %q: %w", id, err)
-		}
-		if meta["type"] != "fact" {
+	for _, v := range memRows {
+		if v.Meta["type"] != "fact" {
 			continue
 		}
-		key, ts, ok := splitFactVectorID(id)
+		key, ts, ok := splitFactVectorID(v.ID)
 		if !ok {
 			continue
 		}
-		vecs = append(vecs, factVec{id: id, key: key, meta: meta, ts: ts})
+		vecs = append(vecs, factVec{id: v.ID, key: key, meta: v.Meta, ts: ts})
 		if ts > newest[key] {
 			newest[key] = ts
 		}
 	}
-	rows.Close()
-	if err := rows.Err(); err != nil {
-		return res, fmt.Errorf("repair fact vectors: rows: %w", err)
-	}
 
 	for _, v := range vecs {
 		drop := v.ts < newest[v.key]

internal/store/memory.go

@@ -169,6 +169,49 @@ func (m *MemoryStore) DeletePrefix(ctx context.Context, prefix string) (int64, e
 	return n, nil
 }
 
+// memVectorRow is one memory_vectors row with its meta blob decoded — the
+// shape both ReembedAll (backfill.go) and RepairFactVectors (factvectors.go)
+// read the whole table as, before each decides what to do with a row on its
+// own terms (one keys off meta["text"], the other off meta["type"] and the
+// id's embedded key/timestamp). Query-then-scan was duplicated across the two
+// before this, id-for-id.
+type memVectorRow struct {
+	ID   string
+	Meta map[string]string
+}
+
+// queryContexter is the common surface *sql.DB and *sql.Tx share that
+// allMemVectorMetas needs. ReembedAll reads inside a transaction so its
+// migration is atomic; RepairFactVectors reads directly off the db handle.
+type queryContexter interface {
+	QueryContext(ctx context.Context, query string, args ...any) (*sql.Rows, error)
+}
+
+// allMemVectorMetas reads every memory_vectors row and decodes its meta blob.
+func allMemVectorMetas(ctx context.Context, q queryContexter) ([]memVectorRow, error) {
+	rows, err := q.QueryContext(ctx, `SELECT id, meta FROM memory_vectors`)
+	if err != nil {
+		return nil, fmt.Errorf("read memory vectors: %w", err)
+	}
+	defer rows.Close()
+	var out []memVectorRow
+	for rows.Next() {
+		var id, metaJSON string
+		if err := rows.Scan(&id, &metaJSON); err != nil {
+			return nil, fmt.Errorf("memory vector row: %w", err)
+		}
+		meta := map[string]string{}
+		if err := json.Unmarshal([]byte(metaJSON), &meta); err != nil {
+			return nil, fmt.Errorf("meta for %q: %w", id, err)
+		}
+		out = append(out, memVectorRow{ID: id, Meta: meta})
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("memory vectors: %w", err)
+	}
+	return out, nil
+}
+
 // escapeLike neutralises the LIKE wildcards in a literal prefix.
 func escapeLike(s string) string {
 	r := strings.NewReplacer(`\`, `\\`, `%`, `\%`, `_`, `\_`)

internal/store/proposed_routines.go

@@ -187,7 +187,10 @@ func (s *Store) AcceptProposedRoutine(ctx context.Context, id int64, ts time.Tim
 	if err != nil {
 		return fmt.Errorf("accept proposed routine: %w", err)
 	}
-	n, _ := res.RowsAffected()
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("accept proposed routine: rows affected: %w", err)
+	}
 	if n == 0 {
 		return fmt.Errorf("%w: id=%d not in 'proposed' status", ErrProposedRoutineNotFound, id)
 	}

internal/store/reminders.go

@@ -205,8 +205,30 @@ func (s *Store) ListReminders(ctx context.Context, n int) ([]Reminder, error) {
 
 // RescheduleReminder computes the next fire time for a recurring reminder and
 // updates next_fire_ts. Returns ErrReminderState if the reminder is not
-// recurring or not pending. If no more valid fire times exist, marks it fired.
+// recurring or not pending. If the schedule yields no further fire time at all,
+// marks it fired.
+//
+// Two things the first version got wrong, both fixed 06-08-2026 (V-616).
+//
+// The cron expression is a WALL CLOCK statement — "0 9 * * *" is nine in the
+// morning where the owner stands — but scanReminder hands back instants in UTC,
+// and robfig's Next walks the calendar in the location of the time it is given.
+// Computing from a UTC instant therefore produced the next 09:00 UTC, so the
+// second occurrence of a daily reminder landed one UTC offset late and stayed
+// there: 12:00 for a Moscow owner. Everything is converted to loc first, which
+// also makes the walk DST-correct — the schedule keeps its wall-clock hour
+// across a changeover instead of drifting an hour with the offset.
+//
+// And a missed occurrence used to KILL the reminder: any next fire earlier than
+// now marked it fired, so a daemon down overnight ended a daily standup forever.
+// Occurrences in the past are skipped instead, so the reminder rolls forward to
+// the first one strictly after now. Skipping and not replaying is deliberate:
+// the same no-backlog rule routine.DueAccepted follows.
 func (s *Store) RescheduleReminder(ctx context.Context, id int64, now time.Time) error {
+	return s.rescheduleReminderIn(ctx, id, now, time.Local)
+}
+
+func (s *Store) rescheduleReminderIn(ctx context.Context, id int64, now time.Time, loc *time.Location) error {
 	row := s.db.QueryRowContext(ctx, `
 		SELECT id, created_ts, fire_ts, next_fire_ts, payload, status, cron
 		  FROM reminders WHERE id = ?`, id)
@@ -225,8 +247,14 @@ func (s *Store) RescheduleReminder(ctx context.Context, id int64, now time.Time)
 	if err != nil {
 		return fmt.Errorf("parse cron %q: %w", r.Cron, err)
 	}
-	next := sched.Next(r.NextFireTs.Add(time.Minute))
-	if next.IsZero() || next.Before(now) {
+	// Next is strictly after the time it is given, so the last fire cannot be
+	// returned again and no fudge minute is needed. The bound stops a schedule
+	// that somehow yields a non-advancing time from spinning here.
+	next := sched.Next(r.NextFireTs.In(loc))
+	for i := 0; i < 4096 && !next.IsZero() && !next.After(now); i++ {
+		next = sched.Next(next)
+	}
+	if next.IsZero() || !next.After(now) {
 		_, err = s.db.ExecContext(ctx, "UPDATE reminders SET status = 'fired' WHERE id = ?", id)
 		return err
 	}

internal/store/reminders_reschedule_test.go

@@ -0,0 +1,104 @@
+package store
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+// A recurring reminder keeps its wall-clock hour in the owner's zone. The cron
+// walk used to run on the UTC instant scanReminder returns, so "0 9 * * *"
+// created for 09:00 Moscow rescheduled to 09:00 UTC — noon, and noon every day
+// after that (V-616).
+func TestRescheduleKeepsWallClockHour(t *testing.T) {
+	s := newTestStore(t)
+	ctx := context.Background()
+	msk := time.FixedZone("MSK", 3*60*60)
+
+	fire := time.Date(2026, 7, 1, 9, 0, 0, 0, msk)
+	id, err := s.CreateReminder(ctx, fire, `{"text":"стендап"}`, "0 9 * * *")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.rescheduleReminderIn(ctx, id, fire, msk); err != nil {
+		t.Fatalf("reschedule: %v", err)
+	}
+
+	want := time.Date(2026, 7, 2, 9, 0, 0, 0, msk)
+	got := nextFire(t, s, id)
+	if !got.Equal(want) {
+		t.Fatalf("next fire: want %s, got %s", want, got.In(msk))
+	}
+}
+
+// A daily reminder survives a daemon that was down for days. The past
+// occurrences are skipped, not replayed, and the reminder stays pending.
+func TestRescheduleRollsForwardAfterDowntime(t *testing.T) {
+	s := newTestStore(t)
+	ctx := context.Background()
+	msk := time.FixedZone("MSK", 3*60*60)
+
+	fire := time.Date(2026, 7, 1, 9, 0, 0, 0, msk)
+	id, err := s.CreateReminder(ctx, fire, `{"text":"стендап"}`, "0 9 * * *")
+	if err != nil {
+		t.Fatal(err)
+	}
+	// The box comes back three days later, mid-afternoon.
+	now := time.Date(2026, 7, 4, 15, 0, 0, 0, msk)
+	if err := s.rescheduleReminderIn(ctx, id, now, msk); err != nil {
+		t.Fatalf("reschedule: %v", err)
+	}
+
+	rs, err := s.ListReminders(ctx, 10)
+	if err != nil || len(rs) != 1 {
+		t.Fatalf("list: %d reminders, %v", len(rs), err)
+	}
+	if rs[0].Status != ReminderPending {
+		t.Fatalf("status: want %s, got %s — downtime killed the recurrence", ReminderPending, rs[0].Status)
+	}
+	want := time.Date(2026, 7, 5, 9, 0, 0, 0, msk)
+	if got := nextFire(t, s, id); !got.Equal(want) {
+		t.Fatalf("next fire: want %s, got %s", want, got.In(msk))
+	}
+	// And exactly one fire is owed, not a backlog of four.
+	due, err := s.DueReminders(ctx, want.Add(time.Second))
+	if err != nil || len(due) != 1 {
+		t.Fatalf("due after roll-forward: want 1, got %d (%v)", len(due), err)
+	}
+}
+
+// A daily 03:00 reminder does not drift across the spring-forward changeover:
+// the hour is wall clock, so the interval is 23 hours that day, not 24.
+func TestRescheduleAcrossDSTKeepsHour(t *testing.T) {
+	s := newTestStore(t)
+	ctx := context.Background()
+	berlin, err := time.LoadLocation("Europe/Berlin")
+	if err != nil {
+		t.Skipf("tzdata unavailable: %v", err)
+	}
+
+	fire := time.Date(2027, 3, 27, 3, 0, 0, 0, berlin) // CET, day before the change
+	id, err := s.CreateReminder(ctx, fire, `{"text":"бэкап"}`, "0 3 * * *")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.rescheduleReminderIn(ctx, id, fire, berlin); err != nil {
+		t.Fatalf("reschedule: %v", err)
+	}
+	got := nextFire(t, s, id).In(berlin)
+	if got.Hour() != 3 || got.Day() != 28 {
+		t.Fatalf("next fire: want 2027-03-28 03:00 local, got %s", got)
+	}
+	if d := got.Sub(fire); d != 23*time.Hour {
+		t.Fatalf("gap across spring forward: want 23h, got %s", d)
+	}
+}
+
+func nextFire(t *testing.T, s *Store, id int64) time.Time {
+	t.Helper()
+	var ms int64
+	if err := s.db.QueryRow("SELECT next_fire_ts FROM reminders WHERE id = ?", id).Scan(&ms); err != nil {
+		t.Fatalf("read next_fire_ts: %v", err)
+	}
+	return time.UnixMilli(ms).UTC()
+}

internal/tts/lexicon_test.go

@@ -23,6 +23,9 @@ func TestLexiconRewritesNames(t *testing.T) {
 		// Two names in a row share the space between them, which one pass
 		// would consume.
 		{"GPU GPU", "джи-пи-ю джи-пи-ю"},
+		// Two passes cover a run of any length, because the first pass takes
+		// every other name and leaves both boundaries of the ones it skipped.
+		{"GPU GPU GPU GPU", "джи-пи-ю джи-пи-ю джи-пи-ю джи-пи-ю"},
 		// Not a word boundary: a name inside a longer token is left alone.
 		{"vikunjaless", "vikunjaless"},
 		{"ничего не совпало", "ничего не совпало"},

internal/tts/tts.go

@@ -20,6 +20,7 @@ package tts
 
 import (
 	"context"
+	"encoding/binary"
 	"fmt"
 	"math"
 
@@ -50,17 +51,20 @@ func NewStub() *Stub { return &Stub{} }
 // silent no-op a bug could hide behind).
 func (s *Stub) Synthesize(_ context.Context, text string) (audio.Audio, error) {
 	const durMs = 200
-	const samples = 16000 * durMs / 1000 // 3200 samples @ 16k
-	pcm := make([]byte, samples*2)
+	// The rate is read off the canonical format rather than written again, so
+	// the tone stays in tune with the shape the seam declares.
+	rate := audio.PCM16kMono.SampleRate
+	bytesPerSample := audio.PCM16kMono.SampleBits / 8
+	samples := rate * durMs / 1000
+	pcm := make([]byte, samples*bytesPerSample)
 	freq := 220.0 // A3
 	if len(text) > 0 {
 		freq = 180.0 + float64(text[0]%6)*60 // 180..480 Hz band
 	}
 	for i := 0; i < samples; i++ {
-		t := float64(i) / 16000.0
+		t := float64(i) / float64(rate)
 		v := int16(12000 * math.Sin(2*math.Pi*freq*t))
-		pcm[i*2] = byte(v)
-		pcm[i*2+1] = byte(v >> 8)
+		binary.LittleEndian.PutUint16(pcm[i*2:], uint16(v))
 	}
 	return audio.Audio{Format: audio.PCM16kMono, Bytes: pcm}, nil
 }

internal/ttsnorm/ttsnorm.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	"github.com/kami/maven/internal/lexicon"
+	"github.com/kami/maven/internal/say"
 )
 
 // The month names are a closed class and live in internal/lexicon, 1-indexed,
@@ -32,7 +33,7 @@ func Speakable(s string) string {
 	})
 	s = reTime.ReplaceAllStringFunc(s, func(m string) string {
 		p := reTime.FindStringSubmatch(m)
-		return p[1] + " часов " + p[2] + " минут"
+		return spokenTime(mustInt(p[1]), mustInt(p[2]))
 	})
 	s = reDots.ReplaceAllStringFunc(s, func(m string) string {
 		return strings.Join(strings.Split(m, "."), " точка ")
@@ -46,6 +47,20 @@ func Speakable(s string) string {
 	return Pronounce(s)
 }
 
+// spokenTime reads a clock time the way it is said rather than the way it is
+// written. Two things the written form gets wrong out loud. The noun after a
+// numeral inflects, so 21:00 is "час" and 22:00 is "часа", where the old
+// rewrite said "часов" for every hour and "минут" for every minute. And a
+// leading zero is punctuation, not a word: 14:00 is "14 часов" and 9:05 is
+// "9 часов 5 минут", never "00 минут" or "05 минут".
+func spokenTime(h, m int) string {
+	out := strconv.Itoa(h) + " " + say.CountWord(h, "час", "часа", "часов")
+	if m == 0 {
+		return out
+	}
+	return out + " " + strconv.Itoa(m) + " " + say.CountWord(m, "минута", "минуты", "минут")
+}
+
 func spokenDate(dd, mm, yyyy string) string {
 	mi, _ := strconv.Atoi(mm)
 	if mi < 1 || mi > 12 {

internal/ttsnorm/ttsnorm_test.go

@@ -6,8 +6,11 @@ func TestSpeakable(t *testing.T) {
 	cases := []struct{ in, want string }{
 		{"напомню 10.07.2026", "напомню 10 июля 2026"},
 		{"срок 01.01", "срок 1 января"},
-		{"встреча в 14:00", "встреча в 14 часов 00 минут"},
-		{"в 9:05 подъём", "в 9 часов 05 минут подъём"},
+		{"встреча в 14:00", "встреча в 14 часов"},
+		{"в 9:05 подъём", "в 9 часов 5 минут подъём"},
+		{"в 21:00 отбой", "в 21 час отбой"},
+		{"в 22:02 отбой", "в 22 часа 2 минуты отбой"},
+		{"в 1:01 проснулся", "в 1 час 1 минута проснулся"},
 		{"это 3.2.1 версия", "это 3 точка 2 точка 1 версия"},
 		{"без чисел", "без чисел"},
 	}

internal/webauthn/webauthn.go

@@ -14,11 +14,13 @@ import (
 	"crypto/elliptic"
 	"crypto/rand"
 	"crypto/sha256"
+	"crypto/subtle"
 	"encoding/base64"
 	"encoding/binary"
 	"encoding/json"
 	"fmt"
 	"math/big"
+	"sync"
 	"time"
 )
 
@@ -56,8 +58,16 @@ type credentialAssertion struct {
 
 // RP — the relying party instance. Holds config and transient challenge state.
 // A single-user daemon has one RP.
+//
+// mavweb serves the four passkey endpoints from its HTTP handlers, so the two
+// challenge maps are reached concurrently even on a single-user box: a browser
+// retrying an assertion while another tab begins one is enough. A concurrent
+// map write is a fatal runtime error, not a recovered panic, so it would take
+// the whole daemon down from an endpoint that answers before any credential is
+// proven. Every read and write of regs and asserts is under mu.
 type RP struct {
 	cfg          Config
+	mu           sync.Mutex
 	regs         map[string]*credentialRegistration
 	asserts      map[string]*credentialAssertion
 	challengeTTL time.Duration
@@ -75,6 +85,13 @@ func NewRP(cfg Config) *RP {
 
 // CleanExpired removes challenges older than the TTL.
 func (rp *RP) CleanExpired() {
+	rp.mu.Lock()
+	defer rp.mu.Unlock()
+	rp.cleanExpired()
+}
+
+// cleanExpired is CleanExpired for a caller that already holds mu.
+func (rp *RP) cleanExpired() {
 	now := time.Now()
 	for k, r := range rp.regs {
 		if now.Sub(r.CreatedAt) > rp.challengeTTL {
@@ -97,12 +114,14 @@ func (rp *RP) CreationOptions(userID []byte, userName string) (map[string]any, s
 	}
 	challengeB64 := base64.RawURLEncoding.EncodeToString(challenge)
 
-	rp.CleanExpired()
+	rp.mu.Lock()
+	rp.cleanExpired()
 	rp.regs[challengeB64] = &credentialRegistration{
 		Challenge: challengeB64,
 		UserID:    userID,
 		CreatedAt: time.Now(),
 	}
+	rp.mu.Unlock()
 
 	return map[string]any{
 		"rp": map[string]string{
@@ -136,12 +155,10 @@ func (rp *RP) CreationOptions(userID []byte, userName string) (map[string]any, s
 
 // FinishRegistration parses the browser's response and stores the credential.
 func (rp *RP) FinishRegistration(save CredentialSaver, challengeB64 string, resp map[string]any) (string, error) {
-	rp.CleanExpired()
-	reg, ok := rp.regs[challengeB64]
+	reg, ok := rp.takeReg(challengeB64)
 	if !ok {
 		return "", fmt.Errorf("webauthn: unknown or expired challenge")
 	}
-	delete(rp.regs, challengeB64)
 
 	credID := rawString(resp, "id")
 	if credID == "" {
@@ -188,11 +205,13 @@ func (rp *RP) AssertionOptions() (map[string]any, string, error) {
 	}
 	challengeB64 := base64.RawURLEncoding.EncodeToString(challenge)
 
-	rp.CleanExpired()
+	rp.mu.Lock()
+	rp.cleanExpired()
 	rp.asserts[challengeB64] = &credentialAssertion{
 		Challenge: challengeB64,
 		CreatedAt: time.Now(),
 	}
+	rp.mu.Unlock()
 
 	return map[string]any{
 		"challenge":        challengeB64,
@@ -215,11 +234,9 @@ func (rp *RP) AssertionOptions() (map[string]any, string, error) {
 // FinishAssertion verifies the browser's assertion response and returns the
 // verified credential ID.
 func (rp *RP) FinishAssertion(lookup CredentialLookup, updateSignCount SignCountUpdater, challengeB64 string, resp map[string]any) (string, error) {
-	rp.CleanExpired()
-	if _, ok := rp.asserts[challengeB64]; !ok {
+	if !rp.takeAssert(challengeB64) {
 		return "", fmt.Errorf("webauthn: unknown or expired challenge")
 	}
-	delete(rp.asserts, challengeB64)
 
 	credID := rawString(resp, "id")
 	if credID == "" {
@@ -298,6 +315,34 @@ func (rp *RP) FinishAssertion(lookup CredentialLookup, updateSignCount SignCount
 	return credID, nil
 }
 
+// takeReg removes and returns the in-flight registration for challengeB64.
+// Taking under one lock is what makes a challenge single-use: looking it up
+// and deleting it separately lets two replays of the same response both find
+// it before either deletes.
+func (rp *RP) takeReg(challengeB64 string) (*credentialRegistration, bool) {
+	rp.mu.Lock()
+	defer rp.mu.Unlock()
+	rp.cleanExpired()
+	reg, ok := rp.regs[challengeB64]
+	if ok {
+		delete(rp.regs, challengeB64)
+	}
+	return reg, ok
+}
+
+// takeAssert removes the in-flight assertion for challengeB64 and reports
+// whether it was there. Single-use for the same reason takeReg is.
+func (rp *RP) takeAssert(challengeB64 string) bool {
+	rp.mu.Lock()
+	defer rp.mu.Unlock()
+	rp.cleanExpired()
+	if _, ok := rp.asserts[challengeB64]; !ok {
+		return false
+	}
+	delete(rp.asserts, challengeB64)
+	return true
+}
+
 func verifyClientDataBytes(clientDataJSON []byte, expectedType, expectedChallenge, expectedOrigin string) error {
 	var cdj struct {
 		Type      string `json:"type"`
@@ -310,7 +355,10 @@ func verifyClientDataBytes(clientDataJSON []byte, expectedType, expectedChalleng
 	if cdj.Type != expectedType {
 		return fmt.Errorf("webauthn: unexpected type %q", cdj.Type)
 	}
-	if cdj.Challenge != expectedChallenge {
+	// Constant time, because the challenge is the one secret in clientDataJSON:
+	// it is 32 bytes of crypto/rand the browser has to echo back, and a
+	// byte-at-a-time compare is the shape that leaks a guessed prefix.
+	if subtle.ConstantTimeCompare([]byte(cdj.Challenge), []byte(expectedChallenge)) != 1 {
 		return fmt.Errorf("webauthn: challenge mismatch")
 	}
 	if cdj.Origin != expectedOrigin {

internal/webauthn/webauthn_test.go

@@ -8,6 +8,7 @@ import (
 	"encoding/base64"
 	"encoding/binary"
 	"encoding/json"
+	"sync"
 	"testing"
 )
 
@@ -179,6 +180,53 @@ func TestRegisterAssertRoundTrip(t *testing.T) {
 	}
 }
 
+// The passkey endpoints are HTTP handlers, so two browsers beginning a
+// challenge at once reach the same RP. Under -race this fails on the bare maps
+// it used to keep, and in production a concurrent map write is fatal.
+func TestChallengeMapsAreConcurrencySafe(t *testing.T) {
+	rp := NewRP(Config{Origin: testOrigin, RPID: testRPID, RPName: "maven"})
+	lookup := func(string) ([]byte, int64, error) { return nil, 0, nil }
+	upd := func(string, int64) error { return nil }
+
+	var wg sync.WaitGroup
+	for i := 0; i < 16; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for j := 0; j < 32; j++ {
+				_, chal, err := rp.AssertionOptions()
+				if err != nil {
+					t.Error(err)
+					return
+				}
+				_, _ = rp.FinishAssertion(lookup, upd, chal, map[string]any{})
+				if _, _, err := rp.CreationOptions([]byte("u"), "user"); err != nil {
+					t.Error(err)
+					return
+				}
+				rp.CleanExpired()
+			}
+		}()
+	}
+	wg.Wait()
+}
+
+// A challenge is single-use: the second presentation of one already spent is
+// unknown, whichever goroutine gets there first.
+func TestAssertionChallengeIsSingleUse(t *testing.T) {
+	rp := NewRP(Config{Origin: testOrigin, RPID: testRPID, RPName: "maven"})
+	_, chal, err := rp.AssertionOptions()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !rp.takeAssert(chal) {
+		t.Fatal("first take of a fresh challenge failed")
+	}
+	if rp.takeAssert(chal) {
+		t.Fatal("a spent challenge was accepted twice")
+	}
+}
+
 // TestAssertRejectsWrongOrigin — a phished assertion from another origin fails.
 func TestAssertRejectsWrongOrigin(t *testing.T) {
 	err := verifyClientDataBytes(clientData("webauthn.get", "abc", "https://evil.test"), "webauthn.get", "abc", testOrigin)

internal/webfetch/webfetch.go

@@ -61,6 +61,14 @@ var (
 	ErrStatus    = errors.New("webfetch: non-2xx status")
 )
 
+// StatusError is a non-2xx reply, carrying the code. It unwraps to ErrStatus,
+// so errors.Is keeps working, and it exists so a caller can tell a 404 from a
+// 503 with errors.As instead of grepping the message for digits.
+type StatusError struct{ Code int }
+
+func (e *StatusError) Error() string { return fmt.Sprintf("webfetch: non-2xx status: %d", e.Code) }
+func (e *StatusError) Unwrap() error { return ErrStatus }
+
 // Config are the limits. Every zero value means "the default above", so
 // Config{} is safe; the only field that changes behaviour by being empty is
 // AllowHosts (empty ⇒ any public host that is not denied).
@@ -232,6 +240,13 @@ func (f *Fetcher) do(ctx context.Context, method, rawURL string, body []byte, hd
 	}
 	defer resp.Body.Close()
 
+	// Status first, body second. A server that answered 500 has no body worth
+	// reading, and reading it anyway cost up to MaxBytes off the wire and
+	// reported an oversized error page as ErrTooLarge, which names the wrong
+	// cause. The body is closed either way by the defer above.
+	if resp.StatusCode < 200 || resp.StatusCode > 299 {
+		return nil, &StatusError{Code: resp.StatusCode}
+	}
 	respBody, err := io.ReadAll(io.LimitReader(resp.Body, f.cfg.MaxBytes+1))
 	if err != nil {
 		return nil, err
@@ -239,9 +254,6 @@ func (f *Fetcher) do(ctx context.Context, method, rawURL string, body []byte, hd
 	if int64(len(respBody)) > f.cfg.MaxBytes {
 		return nil, fmt.Errorf("%w (%d bytes)", ErrTooLarge, f.cfg.MaxBytes)
 	}
-	if resp.StatusCode < 200 || resp.StatusCode > 299 {
-		return nil, fmt.Errorf("%w: %d", ErrStatus, resp.StatusCode)
-	}
 	out := &Response{
 		URL:         resp.Request.URL.String(),
 		Status:      resp.StatusCode,
@@ -307,8 +319,9 @@ func (f *Fetcher) waitTurn(ctx context.Context, host string) error {
 }
 
 // HostMatches reports whether host equals one of pats or is a subdomain of one.
-// Exported because the crawler applies the same rule to links it decides not to
-// follow, before it ever builds a request.
+// Exported so anything that wants to apply the same allow/deny rule to a link
+// before building a request reads it from here rather than reimplementing it.
+// Nothing outside this package calls it today.
 func HostMatches(host string, pats []string) bool {
 	host = strings.ToLower(strings.TrimSuffix(host, "."))
 	for _, p := range pats {

internal/webfetch/webfetch_test.go

@@ -1,6 +1,7 @@
 package webfetch
 
 import (
+	"bytes"
 	"context"
 	"errors"
 	"io"
@@ -212,6 +213,26 @@ func TestNon2xxIsAnError(t *testing.T) {
 	}
 }
 
+func TestNon2xxCarriesTheCodeAndBeatsTheSizeCap(t *testing.T) {
+	// A big error page used to be read in full and reported as ErrTooLarge,
+	// which names the size and hides the 503. The status is checked first now,
+	// and the code survives for a caller that has to tell 5xx from 404.
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusServiceUnavailable)
+		w.Write(bytes.Repeat([]byte("x"), 5000))
+	}))
+	defer srv.Close()
+	f := testFetcher(t, Config{MaxBytes: 100})
+	_, err := f.Get(context.Background(), srv.URL)
+	if !errors.Is(err, ErrStatus) || errors.Is(err, ErrTooLarge) {
+		t.Fatalf("error = %v, want ErrStatus and not ErrTooLarge", err)
+	}
+	var se *StatusError
+	if !errors.As(err, &se) || se.Code != http.StatusServiceUnavailable {
+		t.Fatalf("error = %v, want a StatusError carrying 503", err)
+	}
+}
+
 func TestUserAgentIsSent(t *testing.T) {
 	got := make(chan string, 1)
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

internal/worker/server.go

@@ -37,8 +37,9 @@ type Server struct {
 	addr netaddr.Addr
 	ln   net.Listener
 
-	wg   sync.WaitGroup
-	done chan struct{}
+	wg        sync.WaitGroup
+	done      chan struct{}
+	closeOnce sync.Once
 
 	// connCount — assigned per accepted conn, used in logs to distinguish
 	// concurrent connections. Monotonic; not load-bearing for correctness.
@@ -180,20 +181,23 @@ func (srv *Server) dispatch(ctx context.Context, req Request) (json.RawMessage,
 }
 
 // Close stops accepting and waits for in-flight connections to drain. The
-// socket file is removed so a restart can rebind cleanly. Idempotent.
+// socket file is removed so a restart can rebind cleanly.
+//
+// Idempotent, and safe from two goroutines at once. The check-then-close it
+// replaced let both callers see an open channel and the second close panicked,
+// so a shutdown racing a signal handler took the process down the one way a
+// clean shutdown is supposed to prevent.
 func (srv *Server) Close() error {
-	select {
-	case <-srv.done:
-		return nil
-	default:
+	var err error
+	srv.closeOnce.Do(func() {
 		close(srv.done)
-	}
-	if srv.ln == nil {
-		return nil
-	}
-	err := srv.ln.Close()
-	srv.wg.Wait()
-	netaddr.Cleanup(srv.addr)
+		if srv.ln == nil {
+			return
+		}
+		err = srv.ln.Close()
+		srv.wg.Wait()
+		netaddr.Cleanup(srv.addr)
+	})
 	return err
 }