Merge: an unrecognized act says so and lists nothing (#205)

Reciting the allowlist answered a question he did not ask. She says the command
is not one she knows, once, and parks nothing.

CLAUDE.md

@@ -91,10 +91,17 @@ protocol; the config in `deploy/mavend.json` (with `${VAR}` env expansion from g
 decision, not an oversight** (Vikunja #463, `docs/plans/17-where-the-voice-loop-runs.md`).
 homesrv has a microphone — it is a laptop — but it is in the wrong room, so a wake-word
 daemon there listens to nobody. They belong on a client machine where the owner is standing.
-`ipc.Dial` already takes `tcp://host:port?token=...` through the netaddr seam, so nothing
-needs building to allow it, but no such machine exists yet. **The consequence: the wake
-word and the VAD gate are covered by unit tests and by nothing else, and no amount of
-sitting at the box changes that.** Push-to-talk through `/dash` is what QA actually covers.
+
+**That machine is workpc** (owner's correction, 2026-08-05). This section used to say no
+such machine existed, which was written when the workstation was only a model host. It is
+where he sits most of the day and it has the microphone. `ipc.Dial` already takes
+`tcp://host:port?token=...` through the netaddr seam, so the two daemons need deploying,
+not building. V-515 is that deployment.
+
+Until they are deployed, **the wake word and the VAD gate are covered by unit tests and by
+nothing else**, and push-to-talk through `/dash` is what QA actually covers. Note that
+deploying them does not by itself prove a wake word: `mavwaked` gates on energy and has no
+keyword model (V-487), so the loop runs open until that lands.
 
 ## The ecosystem: Nexus, Praxis, Hexis
 

cmd/mavend/clarify.go

@@ -156,6 +156,11 @@ func (h *reactiveHandler) askClarify(ctx context.Context, dec router.Decision) (
 	if !ok {
 		return "", false
 	}
+	// An act she could not resolve is a refusal, not a question (Vikunja #556).
+	if slot == dialogue.SlotFn {
+		log.Printf("voice: clarify — act %q matched no capability; saying so instead of asking", dec.Utterance)
+		return actNotRecognized, true
+	}
 	h.clarifyStore.Put(dialogueIDOf(ctx), &dialogue.PendingQuestion{
 		Intent:      dialogue.Intent(dec.Intent),
 		Slots:       toDialogueSlots(dec.Slots),

cmd/mavend/clarify_test.go

@@ -231,34 +231,35 @@ func TestClarifyRestatedAnswerWins(t *testing.T) {
 	}
 }
 
-// TestClarifiedActOffAllowlistIsStillRefused — clarification fills in an
-// argument, it never grants authority.
-func TestClarifiedActOffAllowlistIsStillRefused(t *testing.T) {
+// TestActOffAllowlistIsStillRefused — naming a capability is not being granted
+// one. Since Vikunja #556 an unresolved act no longer parks a question, so this
+// goes through applyAction, which is the only way an act runs.
+func TestActOffAllowlistIsStillRefused(t *testing.T) {
 	ctx := context.Background()
 	h, st, _ := newClarifyHandler(t)
 	marker := filepath.Join(t.TempDir(), "not-allowed-ran")
+	if err := st.EnableTool(ctx, "uptime", []string{"true"}, false, "test", h.now()); err != nil {
+		t.Fatal(err)
+	}
 
-	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentAct, router.Slots{Text: "сделай это"}, "сделай это")); !asked {
-		t.Fatal("an act with no fn should be asked about")
-	}
-	reply, handled := h.resolveClarifyAnswer(ctx, "rm "+marker)
-	if !handled {
-		t.Fatal("the answer should be consumed")
-	}
+	reply := h.applyAction(ctx, router.Decision{
+		Utterance: "rm " + marker,
+		Intent:    router.IntentAct,
+		Slots:     router.Slots{Fn: "rm " + marker, HasFn: true},
+	})
 	if strings.Contains(reply, "готово") {
 		t.Fatalf("an act that is not on the allowlist must not report success: %q", reply)
 	}
 	if _, err := os.Stat(marker); !os.IsNotExist(err) {
 		t.Fatalf("a clarified act off the allowlist ran anyway: %v", err)
 	}
-	if tools, err := st.ListTools(ctx, "enabled"); err != nil || len(tools) != 0 {
-		t.Fatalf("clarify must not enable a tool: tools=%+v err=%v", tools, err)
+	if tools, err := st.ListTools(ctx, "enabled"); err != nil || len(tools) != 1 {
+		t.Fatalf("an act must not enable a tool: tools=%+v err=%v", tools, err)
 	}
 }
 
-// TestClarifiedDestructiveActStillNeedsConfirm — the confirm gate survives the
-// clarify path.
-func TestClarifiedDestructiveActStillNeedsConfirm(t *testing.T) {
+// TestDestructiveActStillNeedsConfirm — the confirm gate stands on the act path.
+func TestDestructiveActStillNeedsConfirm(t *testing.T) {
 	ctx := context.Background()
 	h, st, _ := newClarifyHandler(t)
 	marker := filepath.Join(t.TempDir(), "destructive-ran")
@@ -266,18 +267,16 @@ func TestClarifiedDestructiveActStillNeedsConfirm(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentAct, router.Slots{Text: "сделай это"}, "сделай это")); !asked {
-		t.Fatal("expected a question")
-	}
-	reply, handled := h.resolveClarifyAnswer(ctx, "delete_backups")
-	if !handled {
-		t.Fatal("the answer should be consumed")
-	}
+	reply := h.applyAction(ctx, router.Decision{
+		Utterance: "delete_backups",
+		Intent:    router.IntentAct,
+		Slots:     router.Slots{Fn: "delete_backups", HasFn: true},
+	})
 	if !strings.Contains(reply, "да") || h.pending == nil {
-		t.Fatalf("a clarified destructive act must still park a confirm: reply=%q pending=%+v", reply, h.pending)
+		t.Fatalf("a destructive act must park a confirm: reply=%q pending=%+v", reply, h.pending)
 	}
 	if _, err := os.Stat(marker); !os.IsNotExist(err) {
-		t.Fatalf("a clarified destructive act ran before confirmation: %v", err)
+		t.Fatalf("a destructive act ran before confirmation: %v", err)
 	}
 }
 
@@ -573,8 +572,10 @@ func TestClarifyStepsAsideForItsOwnRequest(t *testing.T) {
 	ctx := context.Background()
 	h, _, _ := newClarifyHandler(t)
 
-	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentAct, router.Slots{Text: "выключи свет в спальне"}, "выключи свет в спальне")); !asked {
-		t.Fatal("an act with no fn should be asked about")
+	// A reminder, not the act this bug was found on: since Vikunja #556 an act
+	// no longer parks anything, so it can no longer eat the turn after it.
+	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder, router.Slots{Text: "напомни позвонить маме"}, "напомни позвонить маме")); !asked {
+		t.Fatal("a reminder with no time should be asked about")
 	}
 	if reply, handled := h.resolveClarifyAnswer(ctx, "кто изобрёл телефон"); handled {
 		t.Fatalf("a world question must route as itself, got %q", reply)
@@ -620,3 +621,28 @@ func TestClarifyQuestionShapedAnswerThatFillsTheGapStillLands(t *testing.T) {
 		t.Fatalf("reminder was not created: reminders=%v err=%v", reminders, err)
 	}
 }
+
+// TestUnresolvedActSaysItDoesNotKnowTheCommand — Vikunja #556. "Что сделать?"
+// has no answer he can give, so an act that matched no capability is refused in
+// one line and nothing is parked. It does not recite what she can do instead.
+func TestUnresolvedActSaysItDoesNotKnowTheCommand(t *testing.T) {
+	ctx := context.Background()
+	h, st, _ := newClarifyHandler(t)
+	// Enabled tools change nothing here: this act matched none of them.
+	if err := st.EnableTool(ctx, "uptime", []string{"true"}, false, "test", h.now()); err != nil {
+		t.Fatal(err)
+	}
+
+	reply, spoken := h.askClarify(ctx, clarifyDec(router.IntentAct, router.Slots{Text: "выключи свет"}, "выключи свет"))
+	if !spoken || reply != actNotRecognized {
+		t.Fatalf("reply = %q spoken=%v, want %q", reply, spoken, actNotRecognized)
+	}
+	if strings.Contains(reply, "uptime") {
+		t.Errorf("reply = %q, want no list of capabilities he did not ask about", reply)
+	}
+	if h.clarifyStore.Get(voiceDialogueID, h.now()) != nil {
+		t.Error("nothing to ask about, so nothing may be parked")
+	}
+}
+
+

cmd/mavend/clarifytemplates.go

@@ -40,6 +40,9 @@ var clarifyQuestionVariants = map[dialogue.Slot][]string{
 		"Что именно отметить?",
 		"Назови, что записать — например, «выпил воды».",
 	},
+	// Not spoken since Vikunja #556: askClarify answers actNotRecognized for a
+	// missing capability rather than asking. Kept because clarifyQuestion still
+	// reports the gap, and a re-ask deck with a hole in it is harder to read.
 	dialogue.SlotFn: {
 		"Что сделать?",
 		"Какое действие выполнить?",
@@ -47,6 +50,17 @@ var clarifyQuestionVariants = map[dialogue.Slot][]string{
 	},
 }
 
+// actNotRecognized is what an act she cannot run gets (Vikunja #556).
+//
+// The deck used to ask "Что сделать?" instead. That question has no answer he
+// can give: he already said what he wanted, and nothing he repeats will match a
+// capability that is not there. So she asked, failed, asked again and gave up —
+// three turns spent on one refusal. She says it once now, and parks nothing.
+//
+// It does not recite the allowlist. A list of names he did not ask about is not
+// an answer to the thing he did ask about.
+const actNotRecognized = "Такую команду я не знаю."
+
 // clarifyQuestionFor picks the wording for this attempt. attempt is 1-based, as
 // PendingQuestion.Attempts counts it; anything past the list uses the last and
 // most explicit phrasing rather than wrapping round to the short one, because

docs/plans/17-where-the-voice-loop-runs.md

@@ -47,7 +47,13 @@ for.
 
 QA session 1 step 2 should say what it actually covers, which is push-to-talk through
 `/dash`. It should not read as though it covers the voice loop. The wake path is checked
-on the client machine or it is not checked, and today there is no client machine.
+on the client machine or it is not checked.
+
+**Correction, 2026-08-05.** This plan said there was no client machine. There is: workpc,
+where he sits most of the day and where the microphone is. The sentence was written when
+the workstation was only a model host. The verdict above is unchanged, and so is
+everything about the seam. What changes is the size of the remaining work: deploying two
+daemons and asking mavend to listen on TCP, not acquiring hardware.
 
 That is the honest state, and it is worse than the task suggests: this is not a
 configuration gap that a compose entry closes. Until a machine with a microphone runs

docs/qa.md

@@ -1,6 +1,6 @@
 # QA plan: checking Maven properly
 
-*Last verified: 2026-08-04 @ 8d816f4. Living doc: correct it in place, do not append.*
+*Last verified: 2026-08-05 @ 12667fd. Living doc: correct it in place, do not append.*
 
 Written 2026-08-01, after the 35-PR stack landed and the box came back up.
 Refreshed 2026-08-02 against the live list, after PRs #85-#90.
@@ -255,8 +255,13 @@ room — **463**, written up in `docs/plans/17-where-the-voice-loop-runs.md`.
 So the wake word and the VAD gate are covered by their unit tests and by
 nothing else, and no session at this box changes that. Checking them needs a
 machine with a microphone running both binaries against a TCP-listening mavend.
-`ipc.Dial` already speaks `tcp://host:port?token=...`, so the work is a machine
-and a config line, not protocol work. Until then, **287** can only be
+`ipc.Dial` already speaks `tcp://host:port?token=...`, so the work is not
+protocol work.
+
+That machine is workpc (owner's correction, 05-08-2026). This section used to
+call it a machine Maven does not have. That was written when the workstation
+was only a model host. So the remaining work is deploying two daemons and
+asking mavend to listen on TCP. Until that is done, **287** can only be
 half-answered, and step 2 above is push-to-talk, not the voice loop.
 
 **319's single-token bug is fixed** (01-08-2026). Single-word Russian utterances no longer come