Merge branch 'Check the digest before paying the phraser' (V-687)

cmd/mavweb/voiceproxy.go writes http.StatusMethodNotAllowed and
http.StatusServiceUnavailable now, so both ST1013 entries were left behind by
the mavweb work and make lint was failing on master before this branch. The
gate fails on a stale entry by design, so the deletion is not optional. The
accepted set is 16.

.gitignore

@@ -54,6 +54,10 @@ opencode.json
 # Test coverage output
 coverage.out
 
+# Python service/test bytecode.
+__pycache__/
+*.py[cod]
+
 # Agent worktrees and local agent state. The workflow itself is tracked: the
 # hooks, the skills and the prose dictionary are how a session behaves, so they
 # get reviewed like code. Everything else under .claude/ is scratch.

AGENTS.md

@@ -135,37 +135,41 @@ Russian recall — you may see many "clarify" responses).
 
 ## Qwen3 resident model for router + phraser
 
-The target daemon uses the locally trained Qwen3-1.7B checkpoint for both
-routing and phrasing. Training is Qwen3 Base → RU CPT → joint persona/router
-SFT → merged GGUF, and is still in flight (#122) — until it lands, the deployed
-resident model is stock **Qwen3.5-0.8B** (`Q4_K_M`), see `deploy/mavend.json`.
+The deployed resident model is stock **Qwen3-1.7B** (`UD-Q4_K_XL`), a Thinking
+variant at `n_ctx` 4096. `CLAUDE.md` carries the rule on which models qualify.
 Without a configured model, `StubPhraser` plus the classifier remain the
 deterministic floor.
 
-During training, use the runbook in
-`docs/plans/2026-07-18-qwen3-resident-training-eval.md`. After the decision gate
-and SFT pass, copy the merged GGUF into the mounted model directory and set:
+A locally trained Qwen3-1.7B checkpoint is still in flight (V-122). Training
+runs Qwen3 Base, then RU CPT, then joint persona and router SFT, then a merged
+GGUF. The
+runbook is `docs/plans/2026-07-18-qwen3-resident-training-eval.md`. After the
+decision gate and SFT pass, copy the merged GGUF into the mounted model
+directory and point `model_path` at it.
+
+**Configure in `deploy/mavend.json`.** This is the deployed `phraser` block:
 
 ```json
 "phraser": {
-  "model_path": "/opt/maven/models/llm/Qwen3-Maven-1.7B-Q8_0.gguf",
+  "model_path": "/opt/maven/models/llm/qwen3/Qwen3-1.7B-UD-Q4_K_XL.gguf",
   "bin_path": "llama-server",
   "n_gpu_layers": 99,
-  "n_ctx": 2048
+  "n_ctx": 4096,
+  "cache_ram_mib": 512,
+  "timeout": "60s"
 }
 ```
 
-**Configure in `deploy/mavend.json`** — the `phraser` block points at this
-model and the daemon spawns `llama-server` as a subprocess. The router and
-replier use the same llama-server via the shared `internal/llm` client.
+The daemon spawns `llama-server` as a subprocess. The router and replier reach
+that one server through the shared `internal/llm` client. Model files live in
+`/mnt/hdd1/llms`, bind-mounted over `models/llm/`, so a gguf sitting in the repo
+is loaded by nothing.
 
 Telegram tokens are read from `deploy/telegram.env` (gitignored), expanded
 via `${VAR}` in the JSON config.
 
-**Routing is Qwen-first** with classifier fallback. The LLM router runs
-after stage-0 (exact-match grammar) and before the classifier cascade. On any
-error or parse failure, the classifier handles the utterance — the turn never
-breaks on the model.
+The cascade order, and which stage may decline to the next, is in
+`docs/routing.md`. It is not restated here.
 
 ## Web UI conventions
 

CLAUDE.md

@@ -140,10 +140,11 @@ it is deliberate.** It guesses, so naming `SourceWorld` drops it. **Only a stage
 0 grammar may drop it** (owner's call, V-666). `queryWalk` reads
 `Decision.SourceAnchored` for the source marked `boundary: true` and no other.
 
-Judge a routing change against the classifier (76.0% intent, 36.4% destination)
-and the resident model (80.2% intent), since those always answer. The fixture
-has grown from 77 cases to 96, so a number compares only to another number on
-the same fixture.
+Judge a routing change against the classifier and the resident model, since
+those always answer. **Their scores live in `docs/routing.md`, never here.** A
+pair copied into this file goes stale silently. The fixture has changed size
+more than once, so a number compares only to another number on the same
+fixture.
 
 ## Language: model output and Russian
 

JOURNAL.md

@@ -0,0 +1,283 @@
+# Maven completion journal
+
+This journal tracks the autonomous completion goal started on 2026-08-13. It
+is an operational index, not a substitute for living subsystem documentation,
+dated evaluations, Vikunja tasks, or focused caveat entries.
+
+## 2026-08-13 — baseline and backlog reconstruction
+
+Goal: make Maven usable end to end with every current and planned feature
+wired, tested, and polished. Completion requires clean automated gates and
+successful sessions across local, degraded-ecosystem, and integrated modes.
+
+Initial observations:
+
+- `HEAD` is `2cf8b7e`, identical to both local and remote `master`, while the
+  checked-out branch is the stale `task/704-...` branch.
+- The worktree already contained staged documentation/evaluation changes,
+  staged transcript deletions, an unstaged `deploy/mavwaked.service` change,
+  and untracked `deploy/asoundrc`. These are pre-existing work and are being
+  preserved and validated before any commit.
+- The repository has no prior goal journal. Durable subsystem facts continue
+  to belong under `docs/`; unresolved limits continue to belong under
+  `docs/caveats/` with a task and revisit trigger.
+
+Work streams started:
+
+- Vikunja project 2: inventory every open task and recover acceptance criteria.
+- Repository: compare feature plans, caveats, routing/ecosystem contracts, and
+  implementation.
+- Verification: run build, race tests, simulator, analyzer gates, and inspect
+  skipped hardware/model evaluations separately.
+- Runtime: exercise the web, IPC, voice, model, and sibling-service paths with
+  real local dependencies where available and explicit degraded-mode probes
+  otherwise.
+
+References: `docs/workflow.md`, `docs/qa.md`, `docs/ecosystem.md`,
+`docs/routing.md`, `docs/caveats/CLAUDE.md`, and Vikunja Maven project 2.
+
+### Backlog correction
+
+The first Vikunja page was accidentally read without a `done: false` filter and
+mixed closed history into the working set. Re-querying all pages strictly open
+produced 127 records: 89 implementation-open, 20 shipped-but-QA-open, 12
+external/owner gates, and 6 duplicate or stale-open records. Closed tasks are
+used only as commit provenance; they are not work to redo. V-704 was the only
+open hanging task and was closed after its measured correction landed.
+
+### Model-aware baseline
+
+The ordinary `make test` passed but does not set `MAVEN_ONNX_LIB`, so model-aware
+tests can self-skip. The explicit ONNX boundary gate exposed V-702/V-703: the
+held-out `я рассказывал тебе про байкал?` was the sole miss at 28/29. A
+three-neighbour class score fixed the semantic collision without adding a word
+pattern or copying the held-out sentence. Boundary is now 29/29 and the adjacent
+topic gate remains 43/43. Measurement:
+`docs/evals/2026-08-13-personal-boundary-neighbourhood.md`.
+
+That narrow result was not accepted as the completion gate. A second agent
+wrote a balanced 72-case RU/EN matrix across remembered speech, possession,
+narrative, proper nouns, personal preambles, and advice/current questions. It
+contains no production seeds and no Baikal paraphrase. The top-three candidate
+scores only 61/72 (84.7%); top-two reaches 62/72, one-neighbour 56/72, and a
+whole-class centroid 54/72. V-702 therefore remains open while a principled
+classifier is developed against the independent matrix. The 29/29 measurement
+describes the narrow regression set, not general boundary quality.
+
+### Live delivery incident
+
+The five-service compose stack was running, but a due reminder was being
+re-phrased and retried through ntfy every tick. The sink returned HTTP 403 each
+time. Only secret names were inspected: the configured ntfy and workstation
+token variables were absent from the deployed environment file; no secret
+values were read into this journal. The durable outbox records each failed
+attempt, but the retry path has no backoff or alternate channel and spends the
+resident model again before every failure. This is active V-651 behavior, with
+the repeated-phrasing shape related to V-687.
+
+V-715 now owns the incident acceptance criteria. In the working tree, phrases,
+collapsed-group identity, attempts, and next-attempt time are durable; definite
+failure backs off from one minute to a capped hour; retries and restarts reuse
+the exact phrase; and away delivery tries ntfy then Telegram, stopping at the
+first success. The committed deployment explicitly disables the uncredentialed
+ntfy block. Independent review added a real occurrence key for collapsed
+bundles, suppresses crash-ambiguous attempts from automatic replay, classifies
+HTTP 401/403 as permanent, blocks permanently unreachable reminders visibly,
+and commits the successful outbox result plus every collapsed original in one
+SQLite transaction. The store, delivery, IPC, loop, config, and mavweb race
+suites pass. A live rebuild and one-time delivery of the existing backlog are
+still required before V-715 is closed.
+
+### Explicit integration enablement
+
+V-691's deployment boundary was audited against every `${VAR}` reference. The
+canonical `deploy/telegram.env.example` now names Telegram, ntfy, workstation
+model, workstation STT, Home Assistant, ambient, CW2, and database-key inputs.
+Enabled Telegram, ntfy, ambient, non-loopback workstation model, and
+non-loopback workstation STT paths refuse missing credentials; each arm has an
+explicit disabled state. The live config disables the currently uncredentialed
+ntfy and workstation-model arms while retaining the separately credentialed
+STT arm. CW2 also refuses a non-loopback bind without its token.
+
+Focused Go race suites, the Python CW2 startup contract, deploy-config drift
+test, secret-expanded config validation (values not printed), and
+`docker compose config --quiet` pass. The workpc is unreachable from this host,
+so installing the updated CW2 script there remains an external deployment step;
+the affected model arm is explicitly dark rather than ambiguously half-live.
+
+### Traceable web failures
+
+V-689 gives every mavweb response a server-generated request ID and routes
+every handler failure through one sanitized problem envelope. Stable error
+codes and the request ID reach the browser; the wrapped internal error reaches
+only the server log beside the same ID. Degraded inline panels use stable public
+text rather than backend paths or tokens, and direct ecosystem reads propagate
+the web request ID as their correlation ID. An AST guard prevents new production
+handlers from bypassing the contract with `http.Error`. The full mavweb race
+suite passes, including disclosure, untrusted-ID, log-join, and propagation
+tests.
+
+### Bounded external responses
+
+Three audit defects were repaired and committed directly to `master`:
+
+- V-608 (`d7e8804`): llama completion responses are capped at 1 MiB, including
+  the LAN workstation seam.
+- V-675 (`459fe7a`): remote STT requires nonblank text and an explicit finite
+  confidence in `[0,1]`, caps JSON at 64 KiB, and falls back to mavsttd on a
+  malformed HTTP 200.
+- V-676 (`7d0250a`): Open-Meteo geocoding and forecasts are bounded, required
+  fields are nullable/validated, and coordinates/weather values are range
+  checked so `{}` cannot become plausible zero-degree weather.
+
+Each focused race suite passed and each task was closed only after the commit.
+
+### Transport shutdown
+
+V-679 (`de61b75`) adds the listener's `done` channel to TCP `Accept`. A
+concurrent-close test holds a silent peer in handshake and proves an in-flight
+accept returns `net.ErrClosed`; the race test passed twenty consecutive runs.
+
+V-688 (`80b6068`, caveat retirement `a0e6643`) bounds the browser push-to-talk
+body at ten minutes of mono PCM and configures header, idle, and read limits on
+the web server. The unused `/ws` handler was removed instead of retaining a
+second unauthenticated streaming transport with no browser caller. Focused race
+tests prove the exact-size request succeeds and an oversized request returns
+HTTP 413.
+
+### Conversation continuity
+
+V-542 (`da9114b`) repairs the five-turn monitor conversation without changing
+single-turn intent classification. Exact user utterances are now persisted
+separately from normalized intent slots and retained in chronological order.
+An anaphoric query with live transcript context reaches the chat path, while
+non-anaphoric sources are unchanged and acts stay fail-closed. An explicit
+conversation opener extends the session lifetime through later fact/query/chat
+routes without suppressing the grounded fact write.
+
+The deterministic scenario now names the monitor in all four contextual
+replies, proves that the original raw turn reached `PhraseChat` four times,
+stores the fact once, and produces zero unsolicited sends across five turns and
+one tick. Focused race tests passed for `cmd/mavend`, `internal/dialogue`,
+`internal/router`, and `internal/lexicon`. Measurement:
+`docs/evals/2026-08-13-conversation-continuity.md`.
+
+### Personal-data boundary
+
+V-702 replaces the narrow nearest-neighbour privacy gate with a frozen,
+class-balanced logistic head over multilingual-e5-small. It introduces no
+lexical exception and leaves the decision threshold at 0.5. Historical
+regressions score 29/29 and the balanced 72-case RU/EN fixture scores 72/72.
+
+The first 24-case challenge found one private-configuration miss. That result
+was treated as model-selection data rather than advertised as independent
+proof. Shrinkage LDA and an LDA/logistic ensemble repaired it but regressed the
+72-case gate, so both were rejected. Increasing the logistic L2 coefficient
+from 0.0001 to 0.0003 repairs the miss while improving four-fold corpus
+cross-validation from 97/104 to 99/104 and whole-shape holdout from 91/104 to
+92/104. A fresh 24-case challenge written only after that head was frozen scores
+24/24 at minimum signed probability margin +0.1718. The original challenge is
+also 24/24 but its +0.0001 edge remains documented as a regression, not fresh
+evidence. Full measurement:
+`docs/evals/2026-08-13-personal-boundary-linear-head.md`.
+
+During the audit, running multiple ONNX-backed tests in one `go test` process
+showed that only the first initializes; later tests self-skip because the
+runtime is process-global. All V-702 figures were therefore rerun in separate
+processes. V-716 tracks fixing that harness gap rather than hiding it in this
+feature.
+
+### Forced dialogue and repair state
+
+V-573 closes all four repair seams exposed by the dialogue contract: a
+correction wins before a parked clarify answer; a repaired decision is checked
+for required slots before acting; a request completed through clarification is
+correctable; and declined or stale repairs do not prematurely spend the repair
+pointer. Same-intent corrections are handled explicitly without redoing the
+action, so their prose cannot route fresh and overwrite the retained pointer.
+
+The independent state audit found two deeper stack losses. A handled repair
+could leave an older question silently parked with its old TTL, and a repaired
+request needing clarification could overwrite—or, on completion, delete—the
+older flow. Repairs now suspend and audibly resume live questions, repaired
+questions push onto the bounded dialogue stack, and completion/cancellation
+pops only the active top before resuming the flow underneath.
+
+`MAVEN_DIALOGUE_NO_SKIP=1 go test -race ./cmd/mavend -run
+'^TestDialogueTraces$' -count=1` passes all 22 traces. The complete forced
+`cmd/mavend` race suite passes in 208.031s. The integrated race command over
+`cmd/mavend`, `internal/dialogue`, and all `internal/router` packages also
+passes (162.310s for mavend; every package green). Focused structural
+possession, repair-pointer, nested-stack, and repaired-clarify tests pass under
+the race detector.
+
+### ONNX test/runtime lifecycle
+
+V-716 found that each embedder constructor tried to initialize ONNX Runtime,
+while `Close` destroyed only its session. In one package process the first
+model-aware test ran and later tests converted “already initialized” into a
+green skip. The router now owns the process-global environment through
+reference-counted leases held by each embedder and routing-head session; the
+last owned lease performs cleanup, and close is idempotent.
+
+The router and mavend test packages hold a lease across their model gates.
+`make eval-router` additionally requires proof that both named aggregate gates
+actually executed. In one process the classifier baseline scored 72/96 and the
+routing heads 93/96; destination was 11/33 and 25/33 respectively, and ecosystem
+reach remained 28/30. The lifecycle reacquire test, focused race suite, full
+aggregate command, and portable no-runtime packages all pass. Measurement:
+`docs/evals/2026-08-13-onnx-runtime-lifecycle.md`.
+
+### Clarification exhaustion is fail-closed
+
+V-717 closes the terminal-policy hole found during the V-573 audit. A request
+with two required gaps could spend its only question on the first, fill that
+slot, and then reach `applyAction` with the second still absent. The attempt cap
+was accidentally acting as permission to execute a partial action.
+
+The resolver now rebuilds the pending action and re-runs the canonical
+`missingFor` schema after every filled gap. One remaining gap produces exactly
+one next question only while the shared `PendingAction.CanAsk` budget permits
+it. Exhaustion visibly gives up, removes only the active stack level, and makes
+no write or action. `finishRebuilt` repeats the same invariant at the execution
+boundary. Reminder time answers remain separate from the clean payload but are
+included in the schema decision used for validation.
+
+The original `TestClarifySecondGapRespectsTheAttemptCap` now asserts the exact
+give-up and zero reminders. New tests cover direct boundary refusal and a
+two-level stack where exhausting the top appends the surviving lower question
+to the same reply. The focused V-717 race cases pass in 4.529s; every clarify
+case plus all 22 forced dialogue traces pass under the race detector in
+26.202s; `internal/dialogue` passes under race in 2.293s. Routing contract:
+`docs/routing.md` section “Required slots and attempt exhaustion”.
+
+### A suppressed nudge is identified before it is phrased
+
+V-687 closes the phrase-before-dedupe hole in the digestion worker. The dedupe
+was reported by `EnqueueDigestEntry`, which runs after `PhraseNudge` has already
+been paid, and the `else if deduped { continue }` meant to skip the cost was the
+last statement in the loop body. Every tick that kept suppressing the same rule
+spent the resident model again, against the cache claim in the comment above it.
+
+The fix gives a rule a durable semantic identity instead of hashing its prose. A
+rule eligible for the digest declares `DigestIdentity`, a function of state
+beside its predicate; `loop.DigestCandidateFingerprint` frames the rule name and
+severity around it so two rules cannot alias on a shared fact. `BreakRule`
+anchors on the last completed break rather than on `desk_active`, which is
+freshness evidence the poller refreshes without the unmet need changing. A rule
+with no declared identity does not enter the digest, because inventing a generic
+state hash would either change every tick or ignore an input the rule reads.
+
+`tick_digest.go` now looks up `LiveDigestEntry` by rule and fingerprint before
+phrasing. Migration #26 adds `candidate_fingerprint` with a partial unique index
+over live pending rows; `EnqueueDigestEntry` expires a matching stale row and
+inserts inside one transaction, so sweep order is not part of correctness and a
+second caller cannot race the pre-phrase read into a duplicate. Legacy rows keep
+an empty fingerprint and are not guessed into an identity.
+
+Six tests cover the contract: one phrase call across three suppressed ticks,
+zero after a daemon restart, and two when the meaning changes, when the entry
+expires, and when it has been drained. `./cmd/mavend/ -run TestSuppressedCareDigest`
+passes under race in 4.626s, the digest store and loop cases in 4.123s and
+1.046s, and the three full packages in 264.076s, 64.496s and 4.280s. The caveat
+`docs/caveats/workers.md#nudges` and the `SA4006` baseline entry are deleted.

Makefile

@@ -16,7 +16,7 @@ PIPER_BIN     := $(shell pwd)/deps/piper/piper
 PIPER_MODEL   := $(shell pwd)/models/tts/ru_RU-irina-medium.onnx
 PIPER_ESPEAK  := $(shell pwd)/deps/piper/espeak-ng-data
 
-.PHONY: t audit simulate stt-fixtures test-stt-golden all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel deps-vuln vuln deps-lint lint deadcode analyze tidy eval-router eval-reach eval-recall eval-phrasing eval-models build-gpud
+.PHONY: t audit simulate stt-fixtures test-stt-golden test-cw2-config all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel deps-vuln vuln deps-lint lint deadcode analyze tidy eval-router eval-reach eval-recall eval-phrasing eval-models build-gpud
 
 all: build
 
@@ -188,7 +188,10 @@ simulate:
 	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
 		$(GO) test -v -count=1 -run TestSimulator ./cmd/mavend/
 
-test: fmt-check vet
+test-cw2-config:
+	python3 -m unittest discover -s deploy/cw2 -p 'test_*.py'
+
+test: fmt-check vet test-cw2-config
 	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
 		$(GO) test -race -coverprofile=coverage.out ./internal/... ./cmd/...
 
@@ -225,11 +228,15 @@ t:
 # Verbose so the report tables land in the terminal. MAVEN_ONNX_LIB points the
 # prod-representative baseline at the vendored runtime; override it or set it
 # empty to run only the deterministic hash ratchet. This is the measurement
-# Vikunja #319 compares before #320 flips the route decider.
+# Vikunja #319 compares before #320 flips the route decider. With a non-empty
+# runtime path the package must prove that at least two model gates executed;
+# a constructor skip after the first process-global initialization is a failure.
 MAVEN_ONNX_LIB ?= $(shell pwd)/deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so
 
 eval-router:
-	MAVEN_ONNX_LIB="$(MAVEN_ONNX_LIB)" $(GO) test -v -count=1 ./internal/router/eval/
+	MAVEN_ONNX_LIB="$(MAVEN_ONNX_LIB)" \
+	MAVEN_ONNX_REQUIRED_GATES="$(if $(MAVEN_ONNX_LIB),2,0)" \
+		$(GO) test -v -count=1 ./internal/router/eval/
 
 # eval-reach — score the held-out ecosystem reach fixture (internal/router/eval,
 # ru_ecosystem_v1.json). Answers "does a real Russian utterance actually arrive

cmd/labelgen/main.go

@@ -40,34 +40,19 @@ type label struct {
 	Labeled   bool   `json:"labeled"`
 }
 
-// grammars mirrors buildRouter's order in cmd/mavend/voicewire.go. Order is
-// load-bearing there and so it is here: the agenda rules must sit after the
-// clock rules, Praxis before the capture marker, the narrative rules last.
+// grammars is the daemon's canonical ordered stage-zero set. Label generation
+// must not maintain a second copy: that drift was the defect fixed by V-693.
 func grammars() []router.Grammar {
-	var g []router.Grammar
-	g = append(g, router.SystemTimeDateGrammars()...)
-	g = append(g, router.AgendaQueryGrammars()...)
-	g = append(g, router.FeedQueryGrammar())
-	g = append(g, router.TaskListGrammar())
-	g = append(g, router.ListGrammars()...)
-	g = append(g, router.ReminderGrammar())
-	g = append(g, router.PraxisGrammars()...)
-	g = append(g, router.TaskCaptureGrammar())
-	g = append(g, router.NarrativeQueryGrammars()...)
-	return g
+	return router.StageZeroGrammars(router.DefaultActMatcher{})
 }
 
 func match(gs []router.Grammar, utterance string) label {
 	out := label{Utterance: utterance}
 	for _, g := range gs {
-		m := g.Pattern.FindStringSubmatch(utterance)
-		if m == nil {
+		d, matched, ok := g.Evaluate(utterance)
+		if !matched || !ok {
 			continue
 		}
-		d, ok := g.Build(m)
-		if !ok {
-			continue // the rule saw its shape and declined it
-		}
 		out.Intent = string(d.Intent)
 		out.Grammar = g.Name
 		out.Key = d.Slots.Key

cmd/mavend/clarify.go

@@ -342,7 +342,7 @@ func (h *reactiveHandler) resolveClarifyAnswer(ctx context.Context, text string)
 
 	switch role {
 	case roleCancel:
-		h.clarifyStore.Delete(dialogueIDOf(ctx))
+		h.completeClarifyTop(ctx)
 		return clarifyCancelled, true
 	case roleSideQuery:
 		// He asked something of his own WITHOUT leaving the flow. The question
@@ -419,19 +419,6 @@ func (h *reactiveHandler) resolveClarifyAnswer(ctx context.Context, text string)
 	if stillOpen(q.Missing, whenTextOf(q), merged) {
 		return h.reaskOrGiveUp(ctx, q, merged, text, taken), true
 	}
-	h.clarifyStore.Delete(dialogueIDOf(ctx))
-
-	// One gap filled is not the same as a complete request. askClarify parks
-	// only the first gap, because one question per turn is the rule, but a
-	// reminder wants both a subject and a time. "напомни" with neither used to
-	// ask "О чём напомнить?", accept "позвонить маме", and then hand applyAction
-	// a reminder with no time, which answered "не получилось разобрать время
-	// напоминания." — an error for a request she never finished asking about.
-	// Re-enter the loop instead, one question at a time as before.
-	if reply, asked := h.askRemainingGap(ctx, q, intent, merged); asked {
-		return reply, true
-	}
-
 	// Rebuild the decision as if it had routed cleanly, then run it down the
 	// normal path. Clarify is deliberately false and the intent is unchanged:
 	// filling in an argument never grants authority, so the completed decision
@@ -443,7 +430,44 @@ func (h *reactiveHandler) resolveClarifyAnswer(ctx context.Context, text string)
 		Intent:    intent,
 		Slots:     applyDialogueSlots(answer, merged),
 	}
-	return h.finishClarified(ctx, dec), true
+	// Time answers stay out of dec.Utterance because it is also the reminder
+	// payload. The action schema still needs that evidence, so validate a copy
+	// carrying the full time exchange while executing the clean decision.
+	schemaDec := dec
+	schemaDec.Utterance = whenTextOf(q)
+
+	// One gap filled is not the same as a complete request. askClarify parks
+	// only the first gap, because one question per turn is the rule, but a
+	// reminder wants both a subject and a time. Re-enter the schema one question
+	// at a time. If the shared attempt budget is spent, askRemainingGap visibly
+	// gives up and removes this stack level; it must never turn an incomplete
+	// decision into permission to act (V-717).
+	if reply, handled := h.askRemainingGap(ctx, q, schemaDec); handled {
+		return reply, true
+	}
+	h.completeClarifyTop(ctx)
+	return h.finishClarified(ctx, dec, schemaDec), true
+}
+
+// completeClarifyTop finishes only the active question. A nested question can
+// sit above a flow that was suspended by a side request or repair; deleting the
+// dialogue id here erased both. If one survives underneath, restart its clock
+// from the moment it is spoken again and attach its question to this turn.
+func (h *reactiveHandler) completeClarifyTop(ctx context.Context) {
+	if h.clarifyStore == nil {
+		return
+	}
+	_, resumed := h.clarifyStore.CompleteTop(dialogueIDOf(ctx), h.now())
+	if resumed == nil || len(resumed.Missing) == 0 {
+		return
+	}
+	question, ok := clarifyResumedFor(resumed.Missing[0])
+	if !ok {
+		return
+	}
+	if rt := turnRouteFrom(ctx); rt != nil {
+		rt.resume = question
+	}
 }
 
 // noteDropped records that the parked request was let go this turn, so runTurn
@@ -487,7 +511,7 @@ func (h *reactiveHandler) noteSuspended(ctx context.Context, q *dialogue.Pending
 		return
 	}
 	if !q.CanResume() {
-		h.clarifyStore.Delete(dialogueIDOf(ctx))
+		h.completeClarifyTop(ctx)
 		h.noteDropped(ctx)
 		log.Printf("voice: clarify — letting the question about %s go: %d asides in a row, %d rides in all", q.Missing[0], q.Suspends, q.Rides)
 		return
@@ -520,26 +544,27 @@ func foldAnswerIntoUtterance(utterance, subject string) string {
 	return strings.TrimSpace(utterance) + " " + subject
 }
 
-// askRemainingGap re-parks the request when the answer closed one gap and
-// wantedSlots still names another. Returns ("", false) when the request is
-// complete, when there is no question for what is left, or when she is out of
-// attempts — in all three the caller runs the decision as it stands, which for
-// the out-of-attempts case is the old behaviour and is the right one: she has
-// already asked enough.
+// askRemainingGap re-parks the request when the answer closed one gap and the
+// action schema still names another. Returns ("", false) only when the request
+// is complete. A remaining gap is always handled here: one next question while
+// budget remains, otherwise an explicit give-up with no partial action (V-717).
 //
 // The attempt budget is shared with the re-ask path on purpose. A second gap
 // costs a question exactly like a second try at the first one does, so the cap
 // still bounds how many times she can speak before acting or letting go.
-func (h *reactiveHandler) askRemainingGap(ctx context.Context, q *dialogue.PendingQuestion, intent router.Intent, merged dialogue.Slots) (string, bool) {
-	remaining := stillMissingFor(intent, whenTextOf(q), merged)
+func (h *reactiveHandler) askRemainingGap(ctx context.Context, q *dialogue.PendingQuestion, dec router.Decision) (string, bool) {
+	remaining := missingFor(dec)
 	if len(remaining) == 0 {
 		return "", false
 	}
 	// Attempts+1 is the question she is about to ask, and the budget is shared
 	// with the re-ask path, so the second gap is worded like a second try.
-	question, ok := h.questionFor(remaining[0], q.Attempts+1, whenTextOf(q), merged, "")
+	merged := toDialogueSlots(dec.Slots)
+	question, ok := h.questionFor(remaining[0], q.Attempts+1, dec.Utterance, merged, "")
 	if !ok || !q.CanAsk() {
-		return "", false
+		h.completeClarifyTop(ctx)
+		log.Printf("voice: clarify — gave up with required gap %s still open after %d question(s); no action ran", remaining[0], q.Attempts)
+		return clarifyGaveUp, true
 	}
 	// Suspends is not carried, and by this point it is already zero: the answer
 	// path resets it (V-654). Left off the literal so the zero is stated where
@@ -561,7 +586,7 @@ func (h *reactiveHandler) askRemainingGap(ctx context.Context, q *dialogue.Pendi
 		MaxAttempts: q.MaxAttempts,
 		Rides:       q.Rides,
 	})
-	log.Printf("voice: clarify — one gap filled, still missing %s for intent=%s, asking again (attempt %d)", remaining[0], intent, q.Attempts+1)
+	log.Printf("voice: clarify — one gap filled, still missing %s for intent=%s, asking again (attempt %d)", remaining[0], dec.Intent, q.Attempts+1)
 	return question, true
 }
 
@@ -576,7 +601,7 @@ func (h *reactiveHandler) reaskOrGiveUp(ctx context.Context, q *dialogue.Pending
 		question, _ = h.questionFor(q.Missing[0], q.Attempts+1, whenTextOf(q), merged, taken)
 	}
 	if question == "" || !q.CanAsk() {
-		h.clarifyStore.Delete(dialogueIDOf(ctx))
+		h.completeClarifyTop(ctx)
 		log.Printf("voice: clarify — gave up on %v after %d question(s), answer was %q", q.Missing, q.Attempts, text)
 		return clarifyGaveUp
 	}
@@ -590,15 +615,48 @@ func (h *reactiveHandler) reaskOrGiveUp(ctx context.Context, q *dialogue.Pending
 	return question
 }
 
-// finishClarified runs a completed decision through the same steps a freshly
-// routed one takes: remember the turn, act, then phrase.
-func (h *reactiveHandler) finishClarified(ctx context.Context, dec router.Decision) string {
+// finishClarified completes a decision whose parked gaps were already checked
+// by resolveClarifyAnswer. It still records the turn for a later correction;
+// the old path made anything completed through dialogue uncorrectable (V-573).
+func (h *reactiveHandler) finishClarified(ctx context.Context, dec, schemaDec router.Decision) string {
+	return h.finishRebuilt(ctx, dec, schemaDec, false)
+}
+
+// finishRepaired validates a decision rebuilt from an older utterance. Unlike
+// resolveClarifyAnswer, repair has not passed the current slot gate, so it must
+// ask about any missing argument before acting (V-573).
+func (h *reactiveHandler) finishRepaired(ctx context.Context, dec router.Decision) string {
+	return h.finishRebuilt(ctx, dec, dec, true)
+}
+
+// finishRebuilt is the execution boundary for decisions reconstructed from
+// dialogue. schemaDec is the same action with all validation evidence present;
+// a clarified reminder includes the separately-held time answers there while
+// dec keeps the clean reminder payload. No rebuilt action crosses this boundary
+// while missingFor still names a required slot.
+func (h *reactiveHandler) finishRebuilt(ctx context.Context, dec, schemaDec router.Decision, ask bool) string {
+	missing := missingFor(schemaDec)
+	if ask && (schemaDec.Clarify || len(missing) > 0) {
+		if reply := h.hexisBeforeClarify(ctx, dec); reply != "" {
+			return reply
+		}
+		if question, asked := h.askClarify(ctx, dec); asked {
+			return question
+		}
+	}
+	if len(missing) > 0 {
+		log.Printf("voice: clarify — refusing incomplete rebuilt intent=%s with required gaps %v; no action ran", dec.Intent, missing)
+		return clarifyGaveUp
+	}
 	if h.dialogueSessions != nil {
 		now := h.now()
 		prev := h.dialogueSessions.Get(dialogueIDOf(ctx), now)
 		dec = followUpMerge(prev, dec, now)
 		h.rememberTurn(ctx, prev, dec, now)
 	}
+	if !dec.Clarify {
+		h.recordTurn(dec.Utterance, dec.Intent)
+	}
 	reply := h.applyAction(ctx, dec)
 	if reply == "" {
 		reply = h.replier.Reply(ctx, dec)
@@ -622,15 +680,23 @@ const maxCarriedHistory = 3
 func (h *reactiveHandler) rememberTurn(ctx context.Context, prev *dialogue.Session, dec router.Decision, now time.Time) {
 	var history []dialogue.Turn
 	if prev != nil {
-		history = append(history, sessionAsTurn(prev))
-		maxHist := len(prev.History)
-		if maxHist > maxCarriedHistory {
-			maxHist = maxCarriedHistory
+		// History is chronological. Keep the newest tail of the older history,
+		// then append the immediate prior turn. The previous implementation put
+		// the newest turn first while the type contract said newest-last, so the
+		// model read a conversation backwards.
+		from := len(prev.History) - maxCarriedHistory
+		if from < 0 {
+			from = 0
 		}
-		history = append(history, prev.History[:maxHist]...)
+		history = append(history, prev.History[from:]...)
+		history = append(history, sessionAsTurn(prev))
+	}
+	conversational := dec.Intent == router.IntentChat || opensConversation(dec.Utterance)
+	if prev != nil && (prev.Conversational || prev.Intent == dialogue.IntentChat) {
+		conversational = true
 	}
 	ttl := time.Duration(0) // use the store default (2 min)
-	if dec.Intent == router.IntentChat {
+	if conversational {
 		ttl = 15 * time.Minute // conversational turns should last longer
 	}
 	// A system or query turn often carries no Text slot at all — a stage-0
@@ -652,10 +718,12 @@ func (h *reactiveHandler) rememberTurn(ctx context.Context, prev *dialogue.Sessi
 		slots.Text = dec.Utterance
 	}
 	h.dialogueSessions.Put(dialogueIDOf(ctx), &dialogue.Session{
-		Intent:    dialogue.Intent(dec.Intent),
-		Slots:     slots,
-		Timestamp: now,
-		TTL:       ttl,
-		History:   history,
+		Intent:         dialogue.Intent(dec.Intent),
+		Slots:          slots,
+		Utterance:      dec.Utterance,
+		Conversational: conversational,
+		Timestamp:      now,
+		TTL:            ttl,
+		History:        history,
 	})
 }

cmd/mavend/clarify_test.go

@@ -394,25 +394,86 @@ func TestClarifyAsksAboutTheSecondGapToo(t *testing.T) {
 
 // TestClarifySecondGapRespectsTheAttemptCap — the second gap spends a question
 // out of the same budget, so it cannot turn a capped exchange into an endless
-// one. With one attempt allowed she acts on what she has instead of asking.
+// one. With one attempt allowed she gives up visibly and creates nothing: the
+// cap is a bound on dialogue, never a path around the action schema (V-717).
 func TestClarifySecondGapRespectsTheAttemptCap(t *testing.T) {
 	ctx := context.Background()
-	h, _, _ := newClarifyHandler(t)
+	h, st, _ := newClarifyHandler(t)
 	h.clarifyMaxAttempts = 1
 
 	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder, router.Slots{}, "напомни")); !asked {
 		t.Fatal("expected the subject question")
 	}
 	reply, handled := h.resolveClarifyAnswer(ctx, "позвонить маме")
-	if !handled {
-		t.Fatal("the answer must be consumed")
+	if !handled || reply != clarifyGaveUp {
+		t.Fatalf("out of attempts she must give up visibly, handled=%v reply=%q", handled, reply)
 	}
-	if reply == "Когда?" {
-		t.Fatal("out of attempts she must not ask a second question")
+	if isAnyClarifyQuestion(reply) {
+		t.Fatalf("out of attempts she must not ask another question: %q", reply)
 	}
 	if h.clarifyStore.Get(voiceDialogueID, h.now()) != nil {
 		t.Fatal("no question may stay armed past the cap")
 	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 0 {
+		t.Fatalf("an incomplete exhausted request created a reminder: reminders=%+v err=%v", reminders, err)
+	}
+}
+
+// Exhausting a nested top request removes only that request and makes the
+// lower flow audible again in the same reply. This is the multi-gap exhaustion
+// shape, not the ordinary failed-answer path covered in repair_test.go.
+func TestClarifySecondGapExhaustionResumesLowerFlow(t *testing.T) {
+	ctx := context.Background()
+	h, st, _ := newClarifyHandler(t)
+	older := &dialogue.PendingQuestion{
+		Intent: dialogue.IntentReminder,
+		Slots:  dialogue.Slots{Text: "позвонить маме"}, Missing: []dialogue.Slot{dialogue.SlotTime},
+		Utterance: "напомни позвонить маме", Asked: h.now(), TTL: clarifyTTL,
+		Attempts: 1, MaxAttempts: dialogue.DefaultMaxAttempts,
+	}
+	top := &dialogue.PendingQuestion{
+		Intent: dialogue.IntentReminder, Missing: []dialogue.Slot{dialogue.SlotText},
+		Utterance: "напомни", Asked: h.now(), TTL: clarifyTTL,
+		Attempts: 1, MaxAttempts: 1,
+	}
+	h.clarifyStore.Push(voiceDialogueID, older)
+	h.clarifyStore.Push(voiceDialogueID, top)
+
+	reply := h.runTurn(ctx, "купить хлеб", sourceText)
+	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
+	want := withResumed(clarifyGaveUp, resumed)
+	if reply != want {
+		t.Fatalf("reply=%q, want visible top give-up followed by resumed lower question %q", reply, want)
+	}
+	if depth := h.clarifyStore.Depth(voiceDialogueID); depth != 1 {
+		t.Fatalf("exhausting the top request left stack depth %d, want 1", depth)
+	}
+	if got := h.clarifyStore.Get(voiceDialogueID, h.now()); got != older {
+		t.Fatalf("resumed flow=%+v, want the older question", got)
+	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 0 {
+		t.Fatalf("nested exhaustion partially created a reminder: reminders=%+v err=%v", reminders, err)
+	}
+}
+
+// The rebuilt-action boundary repeats the schema invariant even though the
+// normal resolver checked it one branch earlier. A future dialogue caller must
+// not be able to bypass required slots by calling the completion wrapper.
+func TestFinishClarifiedRefusesIncompleteAction(t *testing.T) {
+	ctx := context.Background()
+	h, st, _ := newClarifyHandler(t)
+	dec := router.Decision{
+		Utterance: "напомни позвонить маме",
+		Stage:     2,
+		Intent:    router.IntentReminder,
+		Slots:     router.Slots{Text: "позвонить маме"},
+	}
+	if reply := h.finishClarified(ctx, dec, dec); reply != clarifyGaveUp {
+		t.Fatalf("incomplete rebuilt action reply=%q, want %q", reply, clarifyGaveUp)
+	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 0 {
+		t.Fatalf("rebuilt-action guard allowed a partial reminder: reminders=%+v err=%v", reminders, err)
+	}
 }
 
 // TestClarifyProseHoldsThePersona — these lines are hand-written Russian that

cmd/mavend/conversation_context_test.go

@@ -0,0 +1,111 @@
+package main
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/router"
+)
+
+func TestRememberTurnKeepsIntentIndependentTranscriptInSpeakingOrder(t *testing.T) {
+	now := time.Date(2026, 8, 13, 1, 0, 0, 0, time.UTC)
+	h := &reactiveHandler{
+		now:              func() time.Time { return now },
+		dialogueSessions: dialogue.NewSessionStore(time.Hour),
+	}
+	ctx := context.Background()
+	turns := []router.Decision{
+		{Intent: router.IntentFact, Utterance: "я купил новый монитор", Slots: router.Slots{Key: "purchase", Value: "новый монитор", HasKey: true}},
+		{Intent: router.IntentQuery, Utterance: "а он большой?", Slots: router.Slots{Text: "normalized query"}},
+		{Intent: router.IntentChat, Utterance: "кажется, я переплатил", Slots: router.Slots{Text: "normalized chat"}},
+		{Intent: router.IntentQuery, Utterance: "стоит его вернуть?", Slots: router.Slots{Text: "normalized return query"}},
+	}
+	for i, dec := range turns {
+		prev := h.dialogueSessions.Get(voiceDialogueID, now)
+		h.rememberTurn(ctx, prev, dec, now.Add(time.Duration(i)*time.Second))
+	}
+
+	got := h.dialogueSessions.Get(voiceDialogueID, now.Add(4*time.Second))
+	if got == nil {
+		t.Fatal("no dialogue session")
+	}
+	if got.Utterance != turns[3].Utterance {
+		t.Fatalf("current utterance = %q, want %q", got.Utterance, turns[3].Utterance)
+	}
+	want := []string{turns[0].Utterance, turns[1].Utterance, turns[2].Utterance}
+	if len(got.History) != len(want) {
+		t.Fatalf("history = %+v, want %d prior turns", got.History, len(want))
+	}
+	for i := range want {
+		if got.History[i].Text != want[i] {
+			t.Errorf("history[%d] = %q, want %q", i, got.History[i].Text, want[i])
+		}
+	}
+
+	// actionChat runs after rememberTurn. It must receive only prior turns;
+	// handing over the current turn here would duplicate the model's user input.
+	history := h.chatHistory(ctx)
+	if len(history) != len(want) {
+		t.Fatalf("chat history = %+v, want exactly the prior turns", history)
+	}
+	for _, turn := range history {
+		if turn.Text == got.Utterance {
+			t.Fatalf("current utterance was duplicated into chat history: %+v", history)
+		}
+	}
+}
+
+func TestSessionAsTurnReadsLegacySlotText(t *testing.T) {
+	legacy := &dialogue.Session{
+		Intent: dialogue.IntentQuery,
+		Slots:  dialogue.Slots{Text: "старый сохранённый вопрос"},
+	}
+	if got := sessionAsTurn(legacy).Text; got != legacy.Slots.Text {
+		t.Fatalf("legacy turn text = %q, want %q", got, legacy.Slots.Text)
+	}
+}
+
+func TestExplicitConversationOpenerKeepsCrossIntentSessionAlive(t *testing.T) {
+	now := time.Date(2026, 8, 13, 1, 0, 0, 0, time.UTC)
+	h := &reactiveHandler{
+		now:              func() time.Time { return now },
+		dialogueSessions: dialogue.NewSessionStore(2 * time.Minute),
+	}
+	ctx := context.Background()
+	h.rememberTurn(ctx, nil, router.Decision{
+		Intent: router.IntentFact, Utterance: "давай поболтаем: я купил новый монитор",
+		Slots: router.Slots{Key: "purchase", Value: "новый монитор", HasKey: true},
+	}, now)
+
+	later := now.Add(10 * time.Minute)
+	prev := h.dialogueSessions.Get(voiceDialogueID, later)
+	if prev == nil {
+		t.Fatal("explicit conversation expired at the ordinary two-minute TTL")
+	}
+	if !prev.Conversational || prev.TTL != 15*time.Minute {
+		t.Fatalf("conversation state = %+v, want conversational 15m session", prev)
+	}
+	got := followUpMerge(prev, router.Decision{
+		Intent: router.IntentQuery, Utterance: "а он большой?",
+	}, later)
+	if got.Intent != router.IntentChat {
+		t.Fatalf("anaphoric follow-up intent = %s, want chat", got.Intent)
+	}
+}
+
+func TestConversationOpenerDoesNotMatchAnotherDavaiCommand(t *testing.T) {
+	if opensConversation("давай запишем новый монитор") {
+		t.Fatal("an ordinary cooperative command opened a conversation")
+	}
+	for _, text := range []string{
+		"давай поговорим: я купил монитор",
+		"давайте пообщаемся",
+		"let's talk: I bought a monitor",
+	} {
+		if !opensConversation(text) {
+			t.Errorf("%q did not open a conversation", text)
+		}
+	}
+}

cmd/mavend/decisiontrace.go

@@ -31,8 +31,8 @@ import (
 // and nothing should: a missing name costs one line of the record, while a
 // check that walks the ladder would have to run the ladder.
 var preRouteLadder = []string{
-	"confirm", "clarify-answer", "quiet-toggle", "snooze", "ack", "repair",
-	"repair-negative", "ordinal",
+	"confirm", "repair", "repair-negative", "clarify-answer", "quiet-toggle",
+	"snooze", "ack", "ordinal",
 }
 
 // notePreRoute records one rung of that ladder and passes its verdict through

cmd/mavend/dialogue_contract_test.go

@@ -651,7 +651,7 @@ func dialogueTraces() []trace {
 			end: endState{},
 		},
 
-		// ---- rows below carry the CORRECT expectation and fail today ----
+		// ---- formerly failing interleavings; kept as permanent contracts ----
 
 		// The owner's own sentence from V-577 shape 2, in his words. It needs
 		// an engine that can route it: the hash embedder marks it note with
@@ -660,7 +660,6 @@ func dialogueTraces() []trace {
 		// floor's deterministic fact parser reads.
 		{
 			name: "a note stated mid-flow is stored, not dropped",
-			skip: "the offline floor cannot route «у меня новый ноутбук» confidently; needs the resident model",
 			turns: []turn{
 				{say: "напомни позвонить врачу", question: dialogue.SlotTime, attempt: 1,
 					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "врачу"}},
@@ -747,7 +746,6 @@ func dialogueTraces() []trace {
 		// written yet and is not this task's to invent.
 		{
 			name: "cancel: a parked question, then never mind",
-			skip: "V-560: a cancel is scored as a failed answer, not as a cancel",
 			turns: []turn{
 				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
 					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1}},
@@ -761,7 +759,6 @@ func dialogueTraces() []trace {
 		// scores "нет, это была заметка" as a bad time answer and asks again.
 		{
 			name: "correction while a question is parked",
-			skip: "V-560: clarify pre-empts the repair marker, so a correction cannot be spoken mid-flow",
 			turns: []turn{
 				{say: "добавь в задачи купить молоко", contains: []string{"купить молоко"}},
 				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
@@ -771,21 +768,17 @@ func dialogueTraces() []trace {
 			},
 			end: endState{tasks: []string{"купить молоко"}},
 		},
-		// A reminder said whole, in one breath, with the hour in it — and she
-		// asks when. ReminderGrammar (stage0.go) builds its slots by hand and
-		// never runs the extractor, so a stage-0 reminder carries no time
-		// whatever the sentence says, and the clarify gate reads the gap as
-		// real. It costs a turn on the commonest reminder shape there is.
-		//
-		// Hermetic despite the date parser: stage 0 calls no parser at all, so
-		// this fails the same way with or without python dateparser installed.
+		// Stage 0 has extracted the hour since V-572. The day remains genuinely
+		// absent, and V-579 deliberately refuses to invent it even when 11:00 is
+		// still ahead on today's clock. This stale skipped row used to expect a
+		// commit and contradicted every neighbouring time-contract row.
 		{
-			name: "a reminder said whole is not asked about",
-			skip: "V-562: a stage-0 decision never meets the extractor, so its slots are never validated",
+			name: "a stage-zero reminder keeps its hour and asks for the missing day",
 			turns: []turn{
-				{say: "напомни в 11:00 позвонить маме", contains: []string{"11:00"}, noQuestion: true},
+				{say: "напомни в 11:00 позвонить маме", question: dialogue.SlotTime, attempt: 1,
+					gap: whenNoDay, parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "маме"}},
 			},
-			end: endState{reminders: []reminderWant{{payload: "позвонить маме", fireAt: "2026-07-31 11:00"}}},
+			end: endState{},
 		},
 		// The same gap on the repair path. A correction redoes the request
 		// through finishClarified, which goes straight to applyAction — it never
@@ -795,7 +788,6 @@ func dialogueTraces() []trace {
 		// with no time.
 		{
 			name: "a correction that lands short asks rather than failing",
-			skip: "V-562: finishClarified skips the clarify gate, so a repaired decision is never checked for gaps",
 			turns: []turn{
 				{say: "добавь в задачи купить молоко", contains: []string{"купить молоко"}},
 				{say: "нет, это было напоминание", contains: []string{"поняла, это напоминание"},

cmd/mavend/digest_test.go

@@ -2,13 +2,26 @@ package main
 
 import (
 	"context"
+	"path/filepath"
 	"testing"
 	"time"
 
+	"github.com/kami/maven/internal/delivery"
 	"github.com/kami/maven/internal/loop"
+	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/store"
 )
 
+type nudgeCountingPhraser struct {
+	phraser.Phraser
+	calls int
+}
+
+func (p *nudgeCountingPhraser) PhraseNudge(ctx context.Context, c loop.Candidate) (delivery.PhrasedNudge, error) {
+	p.calls++
+	return p.Phraser.PhraseNudge(ctx, c)
+}
+
 // Vikunja #281 — the fourth delivery outcome: a care candidate the restraint
 // gate suppresses (quiet hours / away / calendar-busy) is not necessarily
 // lost. If it's worth resurfacing (loop.DigestEligible), it's durably held
@@ -38,7 +51,7 @@ func TestSuppressedCareDigestsAcrossQuietHours(t *testing.T) {
 	ctx := context.Background()
 	now := refNow()
 
-	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present}
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
 	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
 
 	entries, err := st.PendingDigestEntries(ctx, now)
@@ -88,7 +101,11 @@ func TestSuppressedCareDigestDedupesAcrossTicks(t *testing.T) {
 	now := refNow()
 
 	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present}
+	quiet.Facts = breakCandidateFacts(now, 1)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
 	for i := 0; i < 3; i++ {
+		quiet.Now = now.Add(time.Duration(i) * time.Minute)
 		tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now.Add(time.Duration(i)*time.Minute))
 	}
 
@@ -99,6 +116,154 @@ func TestSuppressedCareDigestDedupesAcrossTicks(t *testing.T) {
 	if len(entries) != 1 {
 		t.Fatalf("3 suppressions of the same nudge must collapse to 1 pending entry, got %d", len(entries))
 	}
+	if counting.calls != 1 {
+		t.Fatalf("3 suppressed ticks phrased %d times, want exactly 1", counting.calls)
+	}
+}
+
+func TestSuppressedCareDigestAcrossRealTicksDoesOnePhraseCall(t *testing.T) {
+	st := newTestStore(t)
+	ctx := context.Background()
+	now := refNow()
+	markPresent(t, st, ctx, now)
+	if _, err := st.SetValue(ctx, store.KindSelf, "break", "tap:test", "done", now.Add(-2*time.Hour)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.SetValue(ctx, store.KindConfig, "quiet_hours", "promote", true, now); err != nil {
+		t.Fatal(err)
+	}
+
+	tl := newTestTickLoop(t, st, &fakeSink{}, nil)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
+	for i := 0; i < 3; i++ {
+		tl.tick(ctx, now.Add(time.Duration(i)*30*time.Second))
+	}
+
+	if counting.calls != 1 {
+		t.Fatalf("3 complete suppressed ticks phrased %d times, want exactly 1", counting.calls)
+	}
+	entries, err := st.PendingDigestEntries(ctx, now.Add(time.Minute))
+	if err != nil || len(entries) != 1 {
+		t.Fatalf("complete ticks should retain one durable entry: entries=%+v err=%v", entries, err)
+	}
+}
+
+// TestSuppressedCareDigestDedupeSurvivesRestart proves V-687 at its actual
+// boundary: a fresh tickLoop has no memory of the first call, yet durable
+// candidate identity still prevents a second PhraseNudge.
+func TestSuppressedCareDigestDedupeSurvivesRestart(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "digest-restart.db")
+	ctx := context.Background()
+	now := refNow()
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 9)}
+
+	firstStore, err := store.Open(ctx, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	first := newTestTickLoop(t, firstStore, &fakeSink{}, nil)
+	firstPhraser := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	first.phraser = firstPhraser
+	first.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
+	if firstPhraser.calls != 1 {
+		t.Fatalf("first loop phrase calls = %d, want 1", firstPhraser.calls)
+	}
+	if err := firstStore.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	secondStore, err := store.Open(ctx, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = secondStore.Close() })
+	second := newTestTickLoop(t, secondStore, &fakeSink{}, nil)
+	secondPhraser := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	second.phraser = secondPhraser
+	quiet.Now = now.Add(time.Minute)
+	second.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, quiet.Now)
+	if secondPhraser.calls != 0 {
+		t.Fatalf("same candidate after restart phrased %d times, want 0", secondPhraser.calls)
+	}
+}
+
+func TestSuppressedCareDigestRephrasesWhenMeaningChanges(t *testing.T) {
+	st := newTestStore(t)
+	tl := newTestTickLoop(t, st, &fakeSink{}, nil)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
+	ctx := context.Background()
+	now := refNow()
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
+
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
+	quiet.Facts = breakCandidateFacts(now.Add(time.Minute), 2)
+	quiet.Now = now.Add(time.Minute)
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, quiet.Now)
+
+	if counting.calls != 2 {
+		t.Fatalf("two semantic occurrences phrased %d times, want 2", counting.calls)
+	}
+	entries, err := st.PendingDigestEntries(ctx, quiet.Now)
+	if err != nil || len(entries) != 2 {
+		t.Fatalf("changed meaning should create a second entry: entries=%+v err=%v", entries, err)
+	}
+}
+
+func TestSuppressedCareDigestRephrasesAfterExpiry(t *testing.T) {
+	st := newTestStore(t)
+	tl := newTestTickLoop(t, st, &fakeSink{}, nil)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
+	ctx := context.Background()
+	now := refNow()
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
+
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
+	// Deliberately do not run the expiry sweep. The pre-phrase lookup and
+	// enqueue path must agree that this occurrence is no longer live.
+	afterExpiry := now.Add(digestExpiry + time.Minute)
+	quiet.Now = afterExpiry
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, afterExpiry)
+
+	if counting.calls != 2 {
+		t.Fatalf("expired occurrence phrased %d times total, want 2", counting.calls)
+	}
+	entries, err := st.PendingDigestEntries(ctx, afterExpiry)
+	if err != nil || len(entries) != 1 || !entries[0].CreatedTs.Equal(afterExpiry) {
+		t.Fatalf("expired row was not replaced by one fresh row: entries=%+v err=%v", entries, err)
+	}
+}
+
+func TestSuppressedCareDigestRephrasesAfterDrain(t *testing.T) {
+	st := newTestStore(t)
+	sink := &fakeSink{}
+	tl := newTestTickLoop(t, st, sink, nil)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
+	ctx := context.Background()
+	now := refNow()
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
+
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
+	clearAt := now.Add(time.Minute)
+	tl.maybeDrainDigest(ctx, loop.State{Now: clearAt, Presence: store.Present}, clearAt)
+	quiet.Now = clearAt.Add(time.Minute)
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, quiet.Now)
+
+	if counting.calls != 2 {
+		t.Fatalf("same occurrence after drain phrased %d times, want 2", counting.calls)
+	}
+}
+
+func breakCandidateFacts(now time.Time, occurrenceID int64) map[string]store.Fact {
+	return map[string]store.Fact{
+		"break": {
+			ID: occurrenceID, Ts: now.Add(-2 * time.Hour), Kind: store.KindSelf,
+			Key: "break", Value: "done", Source: "tap:test", Confidence: 1,
+		},
+	}
 }
 
 // TestSuppressedCareDigestExpiresRatherThanDeliveringLate — an entry that
@@ -111,7 +276,7 @@ func TestSuppressedCareDigestExpiresRatherThanDeliveringLate(t *testing.T) {
 	ctx := context.Background()
 	now := refNow()
 
-	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present}
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
 	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
 
 	// well past digestExpiry (24h) before the suppression ever clears.

cmd/mavend/followup.go

@@ -5,6 +5,8 @@ import (
 	"time"
 
 	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/lexicon"
+	"github.com/kami/maven/internal/morph"
 	"github.com/kami/maven/internal/router"
 )
 
@@ -94,15 +96,18 @@ func applyDialogueSlots(base router.Slots, d dialogue.Slots) router.Slots {
 // anaphoraResolver is a shared instance for pronoun detection.
 var anaphoraResolver router.AnaphoraResolver
 
-// followUpMerge fills the current turn's missing slots from a prior
-// non-expired session — the multi-turn seam. It handles three cases:
+// followUpMerge carries the current conversation across a prior non-expired
+// session — the multi-turn seam. It handles four cases:
 //
 //  1. Same-intent: inherit missing slots via InheritSlots (existing behavior),
 //     except a reminder time the current sentence named and the parser missed.
-//  2. Cross-intent anaphora: if the current utterance contains a pronoun
+//  2. An anaphoric query becomes chat. A question whose subject lives in this
+//     conversation is answered from its transcript, not sent through unrelated
+//     note, web and encyclopedia sources as a context-free lookup.
+//  3. Cross-intent anaphora: if the current utterance contains a pronoun
 //     ("это" / "он" / "она" etc.) AND the prior session has a key, inherit
 //     the key for fact-lookup queries and reminder creation.
-//  3. Query after Fact: a query that references the prior fact's subject
+//  4. Query after Fact: a query that references the prior fact's subject
 //     inherits the key so the handler can do a fact-by-key lookup.
 //
 // A clarify turn resolves nothing, so it never inherits. InheritSlots only
@@ -112,6 +117,33 @@ func followUpMerge(prev *dialogue.Session, dec router.Decision, now time.Time) r
 		return dec
 	}
 
+	ref, isAnaphoric := anaphoraResolver.Resolve(dec.Utterance)
+	if dec.Intent == router.IntentQuery && isAnaphoric && ref != "mine" && sessionHasContext(prev) {
+		// The router correctly identified a question. What it cannot know from
+		// one utterance is that its subject is in the live dialogue. Chat is the
+		// only action path that receives that dialogue, so preserve the route's
+		// slots but answer it there. Clear query-only provenance: no query source
+		// was selected and an anchored destination must not survive an intent
+		// change the daemon made from state the router could not see.
+		dec.Intent = router.IntentChat
+		dec.Source = router.SourceUnknown
+		dec.SourceAnchored = false
+		// Keep a structured referent when the prior route had one. The chat
+		// phraser primarily reads the transcript, but the session must not lose
+		// the fact identity merely because one follow-up crossed an intent.
+		if !dec.Slots.HasKey && prev.Slots.HasKey {
+			dec.Slots.Key = prev.Slots.Key
+			dec.Slots.HasKey = true
+		}
+		if dec.Slots.Value == "" {
+			dec.Slots.Value = prev.Slots.Value
+		}
+		if !dec.Slots.HasTime && prev.Slots.HasTime {
+			dec.Slots.Time = prev.Slots.Time
+			dec.Slots.HasTime = true
+		}
+	}
+
 	// Case 1: same-intent inheritance (existing).
 	if prev.Intent == dialogue.Intent(dec.Intent) {
 		// A reminder that named an hour nobody could read must not borrow the
@@ -133,9 +165,8 @@ func followUpMerge(prev *dialogue.Session, dec router.Decision, now time.Time) r
 		return dec
 	}
 
-	// Cases 2 & 3: cross-intent anaphora + query-after-fact.
+	// Cases 3 & 4: cross-intent anaphora + query-after-fact.
 	// A query after a fact may reference the fact's subject by pronoun.
-	_, isAnaphoric := anaphoraResolver.Resolve(dec.Utterance)
 	if !isAnaphoric && !dec.Slots.HasKey {
 		// No anaphora and no explicit key — this is a truly new topic.
 		return dec
@@ -161,3 +192,49 @@ func followUpMerge(prev *dialogue.Session, dec router.Decision, now time.Time) r
 
 	return dec
 }
+
+// sessionHasContext distinguishes a live transcript from a session that only
+// carries timing/candidate bookkeeping. The raw utterance is the primary
+// source. The slot fallback keeps sessions persisted by older binaries useful
+// after an upgrade: those blobs have no Utterance field, but may still carry
+// the exact turn in Text or a structured fact key/value.
+func sessionHasContext(s *dialogue.Session) bool {
+	if s == nil {
+		return false
+	}
+	return s.Utterance != "" || s.Slots.Text != "" || s.Slots.HasKey || s.Slots.Value != ""
+}
+
+// opensConversation recognises an explicit cooperative opener without making
+// it a competing route. The substantive clause after the colon may still be a
+// fact worth storing; this function only chooses the session's lifetime.
+//
+// The marker is grammatical and closed (Russian давай/давайте, English let's),
+// and the action vocabulary lives in lexicon rather than a substring pattern.
+// A bare chat route needs none of this — rememberTurn marks it conversational
+// from its intent. This catches the compound shape whose fact clause otherwise
+// hides the opener from the single-intent router.
+func opensConversation(text string) bool {
+	tokens := quietTokens(text)
+	if len(tokens) < 2 {
+		return false
+	}
+	from := 1
+	switch {
+	case tokens[0] == "давай" || tokens[0] == "давайте":
+	case tokens[0] == "lets":
+	case len(tokens) >= 3 && tokens[0] == "let" && tokens[1] == "s":
+		from = 2
+	default:
+		return false
+	}
+	verbs := lexicon.ConversationVerbs()
+	for _, token := range tokens[from:] {
+		for _, verb := range verbs {
+			if token == verb || morph.SameWord(token, verb) {
+				return true
+			}
+		}
+	}
+	return false
+}

cmd/mavend/followup_test.go

@@ -138,6 +138,7 @@ func TestFollowUpMerge(t *testing.T) {
 		prior := &dialogue.Session{
 			Intent:    dialogue.IntentFact,
 			Slots:     dialogue.Slots{Key: "water", HasKey: true},
+			Utterance: "я выпил воду",
 			Timestamp: base,
 			TTL:       2 * time.Minute,
 		}
@@ -152,6 +153,72 @@ func TestFollowUpMerge(t *testing.T) {
 		if got.Slots.Key != "water" {
 			t.Errorf("query after fact: got key=%q, want water", got.Slots.Key)
 		}
+		if got.Intent != router.IntentChat {
+			t.Errorf("anaphoric query intent = %s, want chat with dialogue context", got.Intent)
+		}
+	})
+
+	t.Run("anaphoric query after unkeyed query uses raw dialogue context", func(t *testing.T) {
+		prior := &dialogue.Session{
+			Intent:    dialogue.IntentQuery,
+			Slots:     dialogue.Slots{Text: "кто изобрёл телефон?"},
+			Utterance: "кто изобрёл телефон?",
+			Timestamp: base,
+			TTL:       2 * time.Minute,
+		}
+		cur := router.Decision{
+			Intent:         router.IntentQuery,
+			Utterance:      "а когда он это сделал?",
+			Source:         router.SourceWorld,
+			SourceAnchored: true,
+		}
+		got := followUpMerge(prior, cur, base.Add(30*time.Second))
+		if got.Intent != router.IntentChat {
+			t.Fatalf("intent = %s, want chat", got.Intent)
+		}
+		if got.Source != router.SourceUnknown || got.SourceAnchored {
+			t.Errorf("query-only source survived contextual chat: source=%s anchored=%v", got.Source, got.SourceAnchored)
+		}
+	})
+
+	t.Run("anaphora without a usable prior session stays routed", func(t *testing.T) {
+		prior := &dialogue.Session{
+			Intent:    dialogue.IntentQuery,
+			Timestamp: base,
+			TTL:       2 * time.Minute,
+		}
+		cur := router.Decision{Intent: router.IntentQuery, Utterance: "что это?"}
+		got := followUpMerge(prior, cur, base.Add(30*time.Second))
+		if got.Intent != router.IntentQuery {
+			t.Errorf("empty session changed intent to %s", got.Intent)
+		}
+	})
+
+	t.Run("possessive determiner does not turn an explicit query into chat", func(t *testing.T) {
+		prior := &dialogue.Session{
+			Intent: dialogue.IntentChat, Utterance: "привет",
+			Timestamp: base, TTL: 2 * time.Minute,
+		}
+		cur := router.Decision{Intent: router.IntentQuery, Utterance: "где мой телефон?"}
+		got := followUpMerge(prior, cur, base.Add(30*time.Second))
+		if got.Intent != router.IntentQuery {
+			t.Errorf("explicit possessive query changed intent to %s", got.Intent)
+		}
+	})
+
+	t.Run("anaphoric act is never widened into chat", func(t *testing.T) {
+		prior := &dialogue.Session{
+			Intent: dialogue.IntentChat, Utterance: "сервер homesrv",
+			Timestamp: base, TTL: 2 * time.Minute,
+		}
+		cur := router.Decision{Intent: router.IntentAct, Utterance: "выключи его"}
+		got := followUpMerge(prior, cur, base.Add(30*time.Second))
+		if got.Intent != router.IntentAct {
+			t.Errorf("act intent changed to %s", got.Intent)
+		}
+		if got.Slots.HasFn {
+			t.Error("anaphora invented an executable function")
+		}
 	})
 
 	t.Run("query after fact without anaphora does not inherit", func(t *testing.T) {

cmd/mavend/main.go

@@ -559,7 +559,7 @@ func run(args []string) error {
 func personaFacts(cfg *config.Config) persona.Facts {
 	f := persona.Facts{
 		// Telegram lives outside the voice block, so it counts either way.
-		Telegram: cfg.Telegram != nil && cfg.Telegram.BotToken != "" && cfg.Telegram.ChatID != "",
+		Telegram: cfg.Telegram != nil && !cfg.Telegram.Disabled && cfg.Telegram.BotToken != "" && cfg.Telegram.ChatID != "",
 	}
 	if cfg.Voice == nil {
 		return f
@@ -678,16 +678,12 @@ func wireGatherer(st *store.Store, cfg *config.Config, rules []loop.Rule) *loop.
 // reconciled to "unknown" here, before the tick loop resumes sending, so
 // nothing auto-resends into that ambiguity.
 func wireDispatcher(st *store.Store, cfg *config.Config, voiceW *voiceWiring) (*delivery.Dispatcher, error) {
-	var ntfy delivery.Sink
-	if cfg.Ntfy != nil {
-		s, err := ntfysink.New(*cfg.Ntfy)
-		if err != nil {
-			return nil, fmt.Errorf("wire ntfy sink: %w", err)
-		}
-		ntfy = s
+	ntfy, err := wireNtfySink(cfg.Ntfy)
+	if err != nil {
+		return nil, err
 	}
 	var telegram delivery.Sink
-	if cfg.Telegram != nil {
+	if cfg.Telegram != nil && !cfg.Telegram.Disabled {
 		s, err := telegramsink.New(*cfg.Telegram)
 		if err != nil {
 			return nil, fmt.Errorf("wire telegram sink: %w", err)
@@ -712,6 +708,22 @@ func wireDispatcher(st *store.Store, cfg *config.Config, voiceW *voiceWiring) (*
 	}), nil
 }
 
+// wireNtfySink keeps an optional reach optional without ever turning a missing
+// secret into anonymous publishing. A block is live unless it says disabled;
+// therefore an expanded-empty token in a live block fails startup instead of
+// spending days in a permanent 403 retry loop. Disabled is an explicit
+// operator choice and lets another away reach take over.
+func wireNtfySink(cfg *ntfysink.Config) (delivery.Sink, error) {
+	if cfg == nil || cfg.Disabled {
+		return nil, nil
+	}
+	sink, err := ntfysink.New(*cfg)
+	if err != nil {
+		return nil, fmt.Errorf("wire ntfy sink: %w", err)
+	}
+	return sink, nil
+}
+
 // wireTickLoop reads the loop's three intervals and its schedules out of the
 // config, so the two boot paths cannot disagree about them.
 func wireTickLoop(st *store.Store, gatherer *loop.Gatherer, dispatcher *delivery.Dispatcher, phr phraser.Phraser, rules []loop.Rule, cfg *config.Config) *tickLoop {

cmd/mavend/ntfy_wiring_test.go

@@ -0,0 +1,35 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/kami/maven/internal/delivery/ntfysink"
+)
+
+func TestWireNtfySinkRejectsMissingCredentialWhenEnabled(t *testing.T) {
+	_, err := wireNtfySink(&ntfysink.Config{
+		BaseURL: "https://ntfy.example", Topic: "maven",
+	})
+	if err == nil {
+		t.Fatal("expanded-empty credential did not fail an enabled reach")
+	}
+}
+
+func TestWireNtfySinkLeavesExplicitlyDisabledReachDark(t *testing.T) {
+	sink, err := wireNtfySink(&ntfysink.Config{
+		Disabled: true, BaseURL: "https://ntfy.example", Topic: "maven",
+	})
+	if err != nil {
+		t.Fatalf("wireNtfySink: %v", err)
+	}
+	if sink != nil {
+		t.Fatal("disabled reach built a live sink")
+	}
+}
+
+func TestWireNtfySinkRejectsMalformedEnabledConfig(t *testing.T) {
+	_, err := wireNtfySink(&ntfysink.Config{Token: "token", Topic: "maven"})
+	if err == nil {
+		t.Fatal("malformed enabled config did not fail wiring")
+	}
+}

cmd/mavend/onnx_testmain_test.go

@@ -0,0 +1,36 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/kami/maven/internal/router"
+)
+
+// TestMain holds one ONNX Runtime lease across the model-aware topic and
+// personal-boundary gates. Each test still owns and closes its model session;
+// the process-global environment is released only after the final test.
+func TestMain(m *testing.M) {
+	var lease *router.ONNXRuntimeLease
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib != "" {
+		if _, err := os.Stat(lib); err == nil {
+			var acquireErr error
+			lease, acquireErr = router.AcquireONNXRuntime(lib)
+			if acquireErr != nil {
+				fmt.Fprintf(os.Stderr, "initialize shared ONNX test runtime: %v\n", acquireErr)
+				os.Exit(2)
+			}
+		}
+	}
+
+	code := m.Run()
+	if lease != nil {
+		if err := lease.Close(); err != nil {
+			fmt.Fprintf(os.Stderr, "ONNX test runtime cleanup: %v\n", err)
+			code = 1
+		}
+	}
+	os.Exit(code)
+}

cmd/mavend/personalboundary.go

@@ -2,6 +2,8 @@ package main
 
 import (
 	"context"
+	"encoding/base64"
+	"encoding/binary"
 	"log"
 	"math"
 	"sync"
@@ -23,31 +25,40 @@ import (
 // every utterance the list misses is one that reaches the world. It also drifts
 // silently — a missing verb looks exactly like no bug.
 //
-// So the boundary asks the embedder instead. Two frozen seed sets — questions
-// about him, questions about the world — are embedded once, and the turn's own
-// query vector, already computed by queryEmbed upstream, is scored against
-// both. Nearest side wins. Word order, verb form and unseen phrasing stop
-// mattering, which is exactly what a lexicon could not do.
+// So the boundary asks the embedder instead. A frozen bilingual corpus is
+// embedded at model-fit time, then a class-balanced logistic head is fitted
+// over those vectors. The head learns a direction in semantic space instead
+// of choosing whichever single example happens to share the most words. That
+// matters for a public noun inside a private question and for advice about an
+// owned object: nearest-neighbour scoring confuses both, while a trained head
+// combines the evidence across the whole sentence.
 //
-// Measured 03-08-2026 against multilingual-e5-small on 19 held-out utterances,
-// none of them a seed: 19 right (TestONNXPersonalBoundary). A 20th, "as i said,
-// what is the population of india", missed by +0.008 during the first pass and
-// is a world seed now, which is why it is not in the held-out set. True
-// positives clear the world side by +0.014 to +0.089 and the nearest true
-// negative sits at -0.005, so the gate is the sign of the difference and
-// nothing tighter: the margins are too thin to justify a threshold, and the
-// asymmetry favours claiming anyway. A false claim costs one honest "не знаю";
-// a false pass sends his life to an upstream engine.
+// The corpus covers six sentence shapes on both sides: remembered speech,
+// possession, narrative, first-person preambles, current advice/information,
+// and public proper nouns. Training weights each class equally, so the larger
+// world corpus cannot move the prior merely by containing more examples. A
+// small L2 term makes the solution stable; its value and the fixed optimiser
+// are measured by model-backed cross-validation, not adjusted at runtime.
 //
-// The embedder is the one model CLAUDE.md pins to homesrv permanently, and it
-// is what makes this affordable: no llama-server call, no network, one cosine
-// per seed against a vector the turn already has.
+// This linear head measures 29/29 on the historical regression suite and
+// 72/72 on the separate stratified fixture (V-702, 13-08-2026). The gate is
+// still probability 0.5: a false claim costs one honest "не знаю", while a
+// false pass can send his life to an upstream engine.
+//
+// The embedder is the one model CLAUDE.md pins to homesrv permanently. Its head
+// is fitted and verified by the model-backed gate, then frozen into the binary;
+// inference is one dot product against a vector the turn already has. Unknown
+// embedding spaces fit their own head once per process instead of applying
+// foreign weights. Neither path calls llama-server or the network.
 
-// personalSeeds — questions about him. Frozen: they are scoring data, so
-// editing one moves the boundary and must be re-measured, not eyeballed. Cover
-// both classes the boundary owns, possession and first-person speech, in both
-// languages.
+// personalSeeds and worldSeeds are the frozen training corpus for the linear
+// boundary head. Editing either changes a model, not a phrase list: every edit
+// therefore needs the model-backed regression, stratified evaluation and
+// training-corpus cross-validation. The examples describe where an answer can
+// come from, in both languages. None is a special case copied from an eval.
 var personalSeeds = []string{
+	// The original compact corpus. It remains here both as training signal and
+	// as provenance for the regressions that introduced the semantic boundary.
 	"что я говорил про это",
 	"я тебе рассказывал об этом?",
 	"что я записал про врача",
@@ -56,21 +67,79 @@ var personalSeeds = []string{
 	"когда моя встреча",
 	"what did i say about this",
 	"did i mention this to you",
+
+	// Remembered speech.
+	"какой адрес я тебе сообщал?",
+	"что я говорил о своём самочувствии?",
+	"какое решение по ремонту я озвучил?",
+	"что я обещал сделать после отпуска?",
+	"what reason did I give for declining the offer?",
+	"did I tell you where I grew up?",
+	"which restaurant did I say I wanted to visit?",
+	"what explanation did I give for missing the meeting?",
+
+	// Stored attributes of his possessions and records.
+	"где лежит мой договор аренды?",
+	"когда заканчивается моя подписка на спортзал?",
+	"какой размер у моей запасной куртки?",
+	"до какой даты действует мой пропуск?",
+	"какой размер у моего велосипедного шлема?",
+	"where is my vehicle registration document?",
+	"when is my museum membership renewal?",
+	"what number is on my travel insurance policy?",
+	"which shelf did I put my tax folder on?",
+	"what size is my waterproof coat?",
+
+	// Narratives that only his memories or records can supply.
+	"собери по моим записям рассказ о поездке в Самару",
+	"напомни, как прошёл мой первый урок вождения",
+	"восстанови из дневника, как я искал первую квартиру",
+	"перескажи по моим словам, как прошла встреча выпускников",
+	"summarize my account of moving into this apartment",
+	"tell me what happened during my first week at the new job",
+	"recreate the story of my graduation from my journal",
+	"piece together my account of adopting the dog",
+
+	// First-person framing around a private answer.
+	"возвращаясь к нашей беседе, какой банк я выбрал?",
+	"кажется, я уже говорил: на какую дату записался к врачу?",
+	"если мы это обсуждали, какую школу вождения я предпочёл?",
+	"напомню наш разговор: когда я решил менять работу?",
+	"as I mentioned before, which contractor did I hire?",
+	"coming back to our chat, what date did I book the inspection for?",
+	"if we covered this already, which course did I enroll in?",
+	"back to what I told you: where did I plan to stay in Oslo?",
+
+	// Current information that lives only in his records.
+	"какой счёт мне нужно оплатить на этой неделе?",
+	"сколько часов я работал в прошлом месяце?",
+	"какую процедуру мастер советовал выполнить утром?",
+	"какая из моих заявок всё ещё не закрыта?",
+	"which appointment do I have tomorrow morning?",
+	"how many kilometres did I run last week?",
+	"what maintenance did the mechanic tell me to schedule?",
+	"which item on my project list is overdue?",
+
+	// Public names inside questions that still require his records.
+	"какую цитату из Набокова я сохранил?",
+	"когда у меня созвон с Ириной Петровой?",
+	"что я думал о романе Умберто Эко?",
+	"какую оценку я дал выставке Айвазовского?",
+	"какую фотографию Эрмитажа я отметил для печати?",
+	"what did I note down after Margaret Hamilton's lecture?",
+	"when is my booking at the Royal Albert Hall?",
+	"which Nina Simone song did I call my favourite?",
+	"what opinion did I share about Zadie Smith's new novel?",
+	"what reminder did I attach to the Jira migration?",
 }
 
-// worldSeeds — questions the world can answer, including the two shapes that
-// look personal and are not: a first-person preamble on a world question ("как
-// я говорил, ..."), and first person without possession ("что я могу
-// посмотреть вечером"). Refusing those is the opposite mistake and the older
-// comment on personalMarkers already named it.
 var worldSeeds = []string{
+	// The original compact corpus, retained as above.
 	"почему небо синее",
 	"какая столица франции",
 	"как сварить борщ",
 	"кто написал эту книгу",
 	"what is the capital of france",
-	"how do i boil an egg",
-	"как я говорил, почему небо синее",
 	"as i said, why is the sky blue",
 	"as i said, what is the population of india",
 	"что я могу посмотреть вечером",
@@ -103,21 +172,89 @@ var worldSeeds = []string{
 	"расскажи про древний рим",
 	"объясни как работает двигатель",
 	"tell me about the roman empire",
+
+	// Speech and reports by somebody other than the owner.
+	"что Александр Пушкин писал о Москве?",
+	"как учёные объясняли исчезновение динозавров?",
+	"что Менделеев говорил о будущем химии?",
+	"какие выводы сделал Амундсен после экспедиции?",
+	"what did Virginia Woolf write about fiction?",
+	"how did researchers describe the Tunguska event?",
+	"what did witnesses report after the Lisbon earthquake?",
+	"which ideas did Ada Lovelace describe in her notes?",
+
+	// General advice about an owned object. Ownership supplies context, but an
+	// outside source can still supply the answer.
+	"как починить мой скрипящий стул?",
+	"почему мой роутер теряет соединение?",
+	"чем очистить мой велосипед от ржавчины?",
+	"какой бензин подходит для моего генератора?",
+	"какой чехол подобрать для моего планшета?",
+	"как защитить мой деревянный стол от влаги?",
+	"how do I remove a stain from my jacket?",
+	"why is my freezer building up ice?",
+	"which oil should I use in my lawn mower?",
+	"what detergent is safe for my washing machine?",
+	"which replacement blade should I buy for my circular saw?",
+	"how can I keep my garden tools from rusting?",
+
+	// Public narratives.
+	"расскажи историю строительства Транссибирской магистрали",
+	"опиши, как развивалась письменность",
+	"объясни, как появился периодический закон",
+	"опиши первую успешную зимовку в Антарктиде",
+	"tell the story of the discovery of penicillin",
+	"describe how the first transatlantic cable was laid",
+	"explain how the Olympic Games were revived",
+	"describe the expedition that first reached the South Pole",
+
+	// First-person framing around a public answer.
+	"как я уже спрашивал, почему звёзды мерцают?",
+	"повторю свой вопрос: как образуются коралловые рифы?",
+	"возможно, я повторяюсь: когда возвели собор Святого Петра?",
+	"я мог уже спрашивать: из чего делают фарфор?",
+	"as I asked earlier, why do leaves change colour?",
+	"to repeat my question, how are fjords formed?",
+	"I might be asking twice, when was Angkor Wat constructed?",
+	"I may have asked before, what causes bioluminescence?",
+
+	// Public current information and generally applicable advice.
+	"какие поезда сегодня идут из Москвы в Тверь?",
+	"как правильно хранить чугунную сковороду?",
+	"какие выставки проходят в Петербурге в этом месяце?",
+	"какой сейчас уровень воды в Волге?",
+	"what is the latest supported version of Ubuntu?",
+	"how should I prepare a wooden deck for winter?",
+	"which film festivals are taking place this season?",
+	"what is the current exchange rate for the Norwegian krone?",
+
+	// Public facts about named people, places and organisations.
+	"кто такая Софья Ковалевская?",
+	"когда была основана компания Nintendo?",
+	"чем прославился архитектор Фрэнк Ллойд Райт?",
+	"где находится музей Прадо?",
+	"who was James Baldwin?",
+	"what is the city of Petra known for?",
+	"when was the composer Philip Glass born?",
+	"where is the Uffizi Gallery located?",
 }
 
-// personalBoundary holds the embedded seeds. Zero value is usable and means
-// "not loaded yet"; a handler built without an embedder never loads and the
-// boundary falls back to personalMarkers.
+// personalBoundary holds the frozen or locally fitted head and, when fitting
+// was necessary, its embedded corpus. Zero value is usable and means "not
+// loaded yet"; a handler built without an embedder never loads and the boundary
+// falls back to personalMarkers.
 type personalBoundary struct {
 	once     sync.Once
 	personal [][]float32
 	world    [][]float32
+	head     personalBoundaryLinearHead
 	loaded   bool
 }
 
-// load embeds both seed sets, once per process. Seeds are embedded on the QUERY
-// side, like the utterance they are compared with — a question against a
-// question. Mixing sides would measure the e5 prefix, not the meaning.
+// load selects the pinned frozen head or embeds and fits the seed sets once per
+// process for another embedding space. Seeds are embedded on the QUERY side,
+// like the utterance they classify. Mixing sides would measure the e5 prefix,
+// not the meaning.
 func (b *personalBoundary) load(ctx context.Context, emb router.Embedder) {
 	b.once.Do(func() {
 		if emb == nil {
@@ -135,30 +272,149 @@ func (b *personalBoundary) load(ctx context.Context, emb router.Embedder) {
 			}
 			return out
 		}
+		// The deployed e5-small head is fitted offline from the corpus below and
+		// checked back against it by TestONNXPersonalBoundaryFrozenHead. Loading
+		// it directly keeps the first personal query from embedding 132 examples.
+		if router.EmbedderID(emb) == personalBoundaryHeadModelID {
+			head, ok := frozenPersonalBoundaryHead()
+			if ok && len(head.weights) == emb.Dim() {
+				b.head, b.loaded = head, true
+				return
+			}
+			log.Printf("voice: frozen personal boundary head is corrupt; rebuilding from its corpus")
+		}
+
 		p, w := embedAll(personalSeeds), embedAll(worldSeeds)
 		if p == nil || w == nil {
 			return
 		}
-		b.personal, b.world, b.loaded = p, w, true
+		epochs := personalBoundaryTrainingEpochs
+		if router.EmbedderID(emb) == personalBoundaryHashModelID {
+			epochs = personalBoundaryHashTrainingEpochs
+		}
+		head, ok := trainPersonalBoundaryLinearHeadEpochs(p, w, epochs)
+		if !ok {
+			log.Printf("voice: personal boundary training examples have inconsistent dimensions; falling back to possession markers")
+			return
+		}
+		b.personal, b.world, b.head, b.loaded = p, w, head, true
 	})
 }
 
-// score returns the best similarity to each side. ok is false when the seeds
-// are not loaded, which is the caller's signal to use the markers instead.
-func (b *personalBoundary) score(vec []float32) (personal, world float64, ok bool) {
-	if !b.loaded || len(vec) == 0 {
-		return 0, 0, false
+const (
+	personalBoundaryTrainingEpochs = 5000
+	personalBoundaryLearningRate   = 10.0
+	personalBoundaryL2             = 0.0003
+)
+
+const personalBoundaryHeadModelID = "model_quantized@384/tok2"
+
+const personalBoundaryHashModelID = "hash@1024"
+
+const personalBoundaryHeadWeights = "a3q5vmod2L7msrs+1RE8Pp5HDEBlv609AC9cvzm4D0CL7Fc/FU9cvxLmAMA638c/BgDBP6Is1r7PzBO/6MVAPsmEWT6XowjAouT0v8jMN79d2Sk+7XLlPX2akD+lmKi/q922vvLSFcBb0ma/cN3QP27zBMDl45i/iuE0P4KIJb+7dua+gTePP5unVz9H3q29Sxsev7YJe7+SvoQ+r6jyPxW2DL8sMQc/+iExQM5y8D/qJSZAtFyKP3PbyD8OK0dAHD+0v056qj4AbOS+AFHzP1KPeT9+cqu/aMIQv9wCqL8WbYe/xED1vu7pHMCPlxe/ZUGLPqFoDb8GPQ6/XE6cvqPVi7xKdr0/CE1PP4dPrj6TxoK+KokGP7xxu73h6DW/Lw8APsjd1D43aci/ZBMoQPyy8D8G6w/AMT1tPSEUU7/Sp+c+sjpRvyfl2L4KDs8/q/Ibv3urHj/+7ls/yxjaP8WS8jy8cd6+BO+4P/IcJkBTEPo/q2VGvqvsUD9anuk8UiO/PSw707+5+oY+zBpHP6e+UT4qaEe/zqjGvypN1j45TFY+nZ36v9rP8L9bmyE/Rn8UwONI0D5Yhs6/InCYv4kGgz/LNXO/rhK+Pu2Qdz/W8ijAdi3hv5qT5D9383k8Ir2wP0MRD0AxCCQ/0CUDP5kWoz+TQjdAOxI0vSbxDb/xj54/N/G6v86Ixr932Lk/jQ2jvqn2nr9y3JC96jDDPsyPlj9q/OQ/cOcCQJ+15z9747s/8Zh8PoS4oL0GKma/lfuPv/Clgb9GPKW+2OR3vimzAUBVYxXARcw0vynpsr/IUqe/bsUhv5kwWcCZtnE/fr87vjvfdr4mHis/xMpzvn20HL4SHFu/1DFXvVgOg76GXEq/pB2QP2u6e71q7w0+7F3APlte1j9YKXK/1cljPkFx0L/CndS9b4CeP4BIvj/fP5Q99jbZvL1h778WhC0/pNhov4+x1r+lYeE/9Y6gP9gtqr75dIe/wGiKv4q56D10ckY+UuvDvoIUnz/3TVM/moHcP6FkUz6//pY+FYhcwFEkD8B2a2c9mC+UP/ZeTb5FgIq+rgEOvylj8D9dvx8/OngmPyiplT9oiLy/AJwswKOJdL+i8/m9GPNfvyyWk77jVPC/0u+IPpx/Fz/QdvG/Ag9gP41l2rxmXUo/hdL0vx1XX0BUp+w9hmYyPk21dT6UJmK/zajGP7gBSD0FqoXAkis4P7kehz94wNa//nfZvxA0Fz8b9ze/IETPv3xEb76BG8k/SpyVP9xkEUC2/jlAcv8/wKKxU75E0xM+9BItPzlQKr6S0wdAMa39v0GKA8AMB3G/IeKvvyTZkz+es62/UEYTP3j+lj4SRM+/Dbfgvupdsj/wcUbAbjqRv/WV/r5WRaO/iB67P3/UyD8AK5Q+LzvJPsjPPL/fwkS/atd9P56MHz9CIJu9ugjgvp7J2D8otQC/YYoowKGEFD4eMVC/xy3UP2UEND9nU0i/ol4GQJuwfb+xeaa/B3IjwDK6Gz8dVv8/2wbLPlUo6j+FDCk/4Q/VP/J8JkCYVd0/gMS/P9Bwhj9R94a9M0Mjv/hKdL8cl6Y/lD73vwgior9+56Q/YI+1v9Wd0j8ltAjAmD5dP56Hnb+rdrA+gn2jP0bFA7/lkZU/tK6VP63ItT5Oi7O+YjfUv5iUzT+n5H8/zXMpvjefvj67z66/GA71Pj2h2T5bXxW/EyfLP1LZxr/B758/iCd2v0jnoT8twoG/oAO9vjpYDr61q6I+AEVFv1OP2b1VQpO/5FYdP5vgaz/4Lbm9CMCjvhbWlL9pYQk/1l5hPjCTYj8dtiJATXjavb6SlL7rp0E/cMBgP9UIXLwVYXC+rFS2v9yeFUD88JBAbwWcvt7s1D/bsuU/BCv0PzSdQEA7l36/FULEvmxlo79jjzc+gFvav1vptb/YjkS/Zo76vqK+3j+qvqi/qyfpPj1BLj+ehSzA4Z8nPyS/1b8kz5a9NIuZv31beL/k0oXAXFO/P8cCh8BSPzS+N7agvhjPUD6/G24/GIP0PYlNOsAFe6q+"
+
+// HashEmbedder is a deterministic offline floor. Its 1024-dimensional head is
+// trained on first use instead of embedded here because the binary form is
+// still tiny but not meaningful as a production quality claim. The floor's
+// optimizer uses fewer steps: the hash vectors are sparse and converge long
+// before the semantic head, keeping an unconfigured box responsive.
+const personalBoundaryHashTrainingEpochs = 400
+
+type personalBoundaryLinearHead struct {
+	weights []float64
+	bias    float64
+}
+
+func frozenPersonalBoundaryHead() (personalBoundaryLinearHead, bool) {
+	raw, err := base64.StdEncoding.DecodeString(personalBoundaryHeadWeights)
+	if err != nil || len(raw)%4 != 0 {
+		return personalBoundaryLinearHead{}, false
 	}
-	best := func(seeds [][]float32) float64 {
-		m := -1.0
-		for _, s := range seeds {
-			if c := cosine(vec, s); c > m {
-				m = c
+	weights := make([]float64, len(raw)/4)
+	for i := range weights {
+		weights[i] = float64(math.Float32frombits(binary.LittleEndian.Uint32(raw[4*i:])))
+	}
+	return personalBoundaryLinearHead{weights: weights, bias: -3.122734201373742}, true
+}
+
+// trainPersonalBoundaryLinearHead fits binary logistic regression with full
+// batch gradient descent. Each side contributes total weight 0.5 regardless
+// of its number of examples. The optimiser is intentionally tiny and local:
+// the embedder supplies all learned language knowledge; this only learns one
+// separating hyperplane over its 384-dimensional vectors.
+func trainPersonalBoundaryLinearHead(personal, world [][]float32) (personalBoundaryLinearHead, bool) {
+	return trainPersonalBoundaryLinearHeadEpochs(personal, world, personalBoundaryTrainingEpochs)
+}
+
+func trainPersonalBoundaryLinearHeadEpochs(personal, world [][]float32, epochs int) (personalBoundaryLinearHead, bool) {
+	if len(personal) == 0 || len(world) == 0 || len(personal[0]) == 0 {
+		return personalBoundaryLinearHead{}, false
+	}
+	dim := len(personal[0])
+	for _, vectors := range [][][]float32{personal, world} {
+		for _, vector := range vectors {
+			if len(vector) != dim {
+				return personalBoundaryLinearHead{}, false
 			}
 		}
-		return m
 	}
-	return best(b.personal), best(b.world), true
+
+	head := personalBoundaryLinearHead{weights: make([]float64, dim)}
+	personalWeight := 0.5 / float64(len(personal))
+	worldWeight := 0.5 / float64(len(world))
+	for epoch := 0; epoch < epochs; epoch++ {
+		gradient := make([]float64, dim)
+		biasGradient := 0.0
+		accumulate := func(vectors [][]float32, target, sampleWeight float64) {
+			for _, vector := range vectors {
+				probability := logistic(head.logit(vector))
+				error := (probability - target) * sampleWeight
+				biasGradient += error
+				for i, value := range vector {
+					gradient[i] += error * float64(value)
+				}
+			}
+		}
+		accumulate(personal, 1, personalWeight)
+		accumulate(world, 0, worldWeight)
+
+		step := personalBoundaryLearningRate / (1 + float64(epoch)/1000)
+		for i := range head.weights {
+			head.weights[i] -= step * (gradient[i] + personalBoundaryL2*head.weights[i])
+		}
+		head.bias -= step * biasGradient
+	}
+	return head, true
+}
+
+func (h personalBoundaryLinearHead) logit(vec []float32) float64 {
+	if len(vec) != len(h.weights) {
+		return 0
+	}
+	score := h.bias
+	for i, value := range vec {
+		score += h.weights[i] * float64(value)
+	}
+	return score
+}
+
+func logistic(value float64) float64 {
+	if value >= 0 {
+		return 1 / (1 + math.Exp(-value))
+	}
+	exp := math.Exp(value)
+	return exp / (1 + exp)
+}
+
+// score returns complementary class probabilities. ok is false when the
+// corpus is not loaded or the query vector belongs to another embedding
+// space, which is the caller's signal to use the offline marker floor.
+func (b *personalBoundary) score(vec []float32) (personal, world float64, ok bool) {
+	if !b.loaded || len(vec) != len(b.head.weights) {
+		return 0, 0, false
+	}
+	personal = logistic(b.head.logit(vec))
+	return personal, 1 - personal, true
 }
 
 // cosine — same math as internal/router and internal/memory, small enough that

cmd/mavend/personalboundary_eval_test.go

@@ -0,0 +1,405 @@
+package main
+
+import (
+	"context"
+	_ "embed"
+	"encoding/json"
+	"math"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+	"unicode"
+
+	"github.com/kami/maven/internal/router"
+)
+
+// This fixture is intentionally separate from personalboundary_test.go. The
+// small regression table there explains individual fixes; this matrix measures
+// the boundary as a classifier and prevents a repaired sentence shape from
+// standing in for language and subject coverage.
+//
+//go:embed testdata/personal_boundary_v1.json
+var personalBoundaryFixtureJSON []byte
+
+type personalBoundaryEvalCase struct {
+	ID        string `json:"id"`
+	Utterance string `json:"utterance"`
+	Lang      string `json:"lang"`
+	Want      string `json:"want"`
+	Stratum   string `json:"stratum"`
+}
+
+type personalBoundaryEvalFixture struct {
+	SchemaVersion int                        `json:"schema_version"`
+	Name          string                     `json:"name"`
+	Notes         []string                   `json:"notes"`
+	Cases         []personalBoundaryEvalCase `json:"cases"`
+}
+
+var personalBoundaryEvalStrata = []string{
+	"remembered_speech",
+	"possession",
+	"narrative",
+	"first_person_preamble",
+	"advice_current_info",
+	"public_proper_nouns",
+}
+
+func loadPersonalBoundaryEvalFixture(t *testing.T) personalBoundaryEvalFixture {
+	t.Helper()
+	var fixture personalBoundaryEvalFixture
+	if err := json.Unmarshal(personalBoundaryFixtureJSON, &fixture); err != nil {
+		t.Fatalf("parse personal boundary fixture: %v", err)
+	}
+	if fixture.SchemaVersion != 1 {
+		t.Fatalf("personal boundary fixture schema_version = %d, want 1", fixture.SchemaVersion)
+	}
+	if fixture.Name != "personal_boundary_v1" {
+		t.Fatalf("personal boundary fixture name = %q, want personal_boundary_v1", fixture.Name)
+	}
+	return fixture
+}
+
+// TestPersonalBoundaryEvalFixture enforces the sampling contract separately
+// from the model measurement. It runs in ordinary CI even when ONNX Runtime is
+// absent, so a fixture edit cannot silently unbalance a language, side or
+// sentence shape, or turn a production seed into a held-out case.
+func TestPersonalBoundaryEvalFixture(t *testing.T) {
+	fixture := loadPersonalBoundaryEvalFixture(t)
+	const wantPerCell = 3
+	const wantTotal = 6 * 2 * 2 * wantPerCell
+	if len(fixture.Cases) != wantTotal {
+		t.Errorf("fixture has %d cases, want %d", len(fixture.Cases), wantTotal)
+	}
+
+	validStrata := make(map[string]bool, len(personalBoundaryEvalStrata))
+	for _, stratum := range personalBoundaryEvalStrata {
+		validStrata[stratum] = true
+	}
+	seedSource := make(map[string]string, len(personalSeeds)+len(worldSeeds))
+	for _, seed := range personalSeeds {
+		seedSource[normalizePersonalBoundaryEval(seed)] = "personalSeeds"
+	}
+	for _, seed := range worldSeeds {
+		seedSource[normalizePersonalBoundaryEval(seed)] = "worldSeeds"
+	}
+
+	seenID := make(map[string]bool, len(fixture.Cases))
+	seenUtterance := make(map[string]string, len(fixture.Cases))
+	cells := make(map[string]int)
+	for _, c := range fixture.Cases {
+		if strings.TrimSpace(c.ID) == "" || seenID[c.ID] {
+			t.Errorf("case %q: empty or duplicate id", c.ID)
+		}
+		seenID[c.ID] = true
+		if c.Lang != "ru" && c.Lang != "en" {
+			t.Errorf("%s: lang = %q, want ru|en", c.ID, c.Lang)
+		}
+		if c.Want != "personal" && c.Want != "world" {
+			t.Errorf("%s: want = %q, want personal|world", c.ID, c.Want)
+		}
+		if !validStrata[c.Stratum] {
+			t.Errorf("%s: stratum = %q, not one of the six declared strata", c.ID, c.Stratum)
+		}
+
+		normalized := normalizePersonalBoundaryEval(c.Utterance)
+		if normalized == "" {
+			t.Errorf("%s: empty utterance", c.ID)
+		}
+		if previous, ok := seenUtterance[normalized]; ok {
+			t.Errorf("%s: utterance duplicates %s after normalization", c.ID, previous)
+		}
+		seenUtterance[normalized] = c.ID
+		if source, ok := seedSource[normalized]; ok {
+			t.Errorf("%s: %q is verbatim in %s, so it is not held out", c.ID, c.Utterance, source)
+		}
+		// The original failure names Baikal. Replacing that sentence's verb or
+		// punctuation would measure an exception, not the boundary. This corpus
+		// instead varies people, places, products and events.
+		if strings.Contains(normalized, "байкал") || strings.Contains(normalized, "baikal") {
+			t.Errorf("%s: the stratified fixture must not copy the Baikal regression", c.ID)
+		}
+		cells[c.Stratum+"/"+c.Lang+"/"+c.Want]++
+	}
+
+	for _, stratum := range personalBoundaryEvalStrata {
+		for _, lang := range []string{"ru", "en"} {
+			for _, want := range []string{"personal", "world"} {
+				cell := stratum + "/" + lang + "/" + want
+				if got := cells[cell]; got != wantPerCell {
+					t.Errorf("fixture cell %s has %d cases, want %d", cell, got, wantPerCell)
+				}
+			}
+		}
+	}
+}
+
+// normalizePersonalBoundaryEval compares content rather than typography:
+// case, punctuation and repeated whitespace cannot disguise a copied seed or
+// duplicate case. This is fixture hygiene only; it does not participate in the
+// production boundary.
+func normalizePersonalBoundaryEval(s string) string {
+	var b strings.Builder
+	space := true
+	for _, r := range strings.ToLower(s) {
+		if unicode.IsLetter(r) || unicode.IsNumber(r) {
+			b.WriteRune(r)
+			space = false
+			continue
+		}
+		if !space {
+			b.WriteByte(' ')
+			space = true
+		}
+	}
+	return strings.TrimSpace(b.String())
+}
+
+type personalBoundaryEvalStat struct {
+	Correct int
+	Total   int
+}
+
+type personalBoundaryEvalReport struct {
+	Name            string
+	Correct         int
+	Total           int
+	MinimumMargin   float64
+	ByStratum       map[string]personalBoundaryEvalStat
+	ByLanguage      map[string]personalBoundaryEvalStat
+	ByExpectedClass map[string]personalBoundaryEvalStat
+	ByCell          map[string]personalBoundaryEvalStat
+}
+
+func newPersonalBoundaryEvalReport(name string) *personalBoundaryEvalReport {
+	return &personalBoundaryEvalReport{
+		Name:            name,
+		MinimumMargin:   math.Inf(1),
+		ByStratum:       make(map[string]personalBoundaryEvalStat),
+		ByLanguage:      make(map[string]personalBoundaryEvalStat),
+		ByExpectedClass: make(map[string]personalBoundaryEvalStat),
+		ByCell:          make(map[string]personalBoundaryEvalStat),
+	}
+}
+
+func (r *personalBoundaryEvalReport) add(c personalBoundaryEvalCase, gotPersonal bool, personal, world float64) {
+	wantPersonal := c.Want == "personal"
+	correct := gotPersonal == wantPersonal
+	r.Total++
+	if correct {
+		r.Correct++
+	}
+	signedMargin := personal - world
+	if !wantPersonal {
+		signedMargin = -signedMargin
+	}
+	if signedMargin < r.MinimumMargin {
+		r.MinimumMargin = signedMargin
+	}
+	add := func(stats map[string]personalBoundaryEvalStat, key string) {
+		stat := stats[key]
+		stat.Total++
+		if correct {
+			stat.Correct++
+		}
+		stats[key] = stat
+	}
+	add(r.ByStratum, c.Stratum)
+	add(r.ByLanguage, c.Lang)
+	add(r.ByExpectedClass, c.Want)
+	add(r.ByCell, c.Stratum+"/"+c.Lang+"/"+c.Want)
+}
+
+// TestONNXPersonalBoundaryStratified scores the model homesrv actually runs.
+// Production is read from personalBoundary.score; top1, top2, top3 and a
+// whole-class centroid are diagnostics over the same embedded seeds. Today
+// production and top3 coincide, but keeping them separate means a later scoring
+// experiment can be compared without rewriting this evaluation or putting its
+// candidate math in runtime code. The privacy boundary is a hard contract, so
+// every production miss is a test failure rather than an accuracy target to
+// average away.
+func TestONNXPersonalBoundaryStratified(t *testing.T) {
+	if os.Getenv("MAVEN_EVAL_PERSONAL_BOUNDARY") == "" {
+		t.Skip("set MAVEN_EVAL_PERSONAL_BOUNDARY=1 to run the deliberately strict V-702 matrix")
+	}
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	modelDir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	model := filepath.Join(modelDir, "model_quantized.onnx")
+	tokenizer := filepath.Join(modelDir, "tokenizer.json")
+	for _, path := range []string{lib, model, tokenizer} {
+		if _, err := os.Stat(path); err != nil {
+			t.Skipf("personal boundary eval dependency %s unavailable: %v", path, err)
+		}
+	}
+
+	embedder, err := router.NewONNXEmbedder(model, tokenizer, lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer embedder.Close()
+
+	ctx := context.Background()
+	boundary := &personalBoundary{}
+	boundary.load(ctx, embedder)
+	if !boundary.loaded {
+		t.Fatal("personal boundary seeds did not load with a working embedder")
+	}
+	// Production loads its model-ID-pinned frozen head and deliberately skips
+	// the 132 corpus embeddings on a user's first query. This test still needs
+	// those vectors for the historical top-k/centroid diagnostics, so build
+	// them here without putting that latency back in runtime code.
+	embedCorpus := func(values []string) [][]float32 {
+		vectors := make([][]float32, len(values))
+		for i, value := range values {
+			vector, err := router.EmbedQuery(ctx, embedder, value)
+			if err != nil {
+				t.Fatalf("embed diagnostic corpus %q: %v", value, err)
+			}
+			vectors[i] = vector
+		}
+		return vectors
+	}
+	boundary.personal = embedCorpus(personalSeeds)
+	boundary.world = embedCorpus(worldSeeds)
+	personalCentroid := personalBoundaryEvalCentroid(boundary.personal)
+	worldCentroid := personalBoundaryEvalCentroid(boundary.world)
+	if len(personalCentroid) == 0 || len(worldCentroid) == 0 {
+		t.Fatal("personal boundary seed vectors do not share a dimension")
+	}
+
+	type candidate struct {
+		name  string
+		score func([]float32) (float64, float64)
+	}
+	candidates := []candidate{
+		{name: "production", score: func(vec []float32) (float64, float64) {
+			personal, world, ok := boundary.score(vec)
+			if !ok {
+				t.Fatal("loaded personal boundary declined to score")
+			}
+			return personal, world
+		}},
+		{name: "top1", score: func(vec []float32) (float64, float64) {
+			return meanNearest(vec, boundary.personal, 1), meanNearest(vec, boundary.world, 1)
+		}},
+		{name: "top2", score: func(vec []float32) (float64, float64) {
+			return meanNearest(vec, boundary.personal, 2), meanNearest(vec, boundary.world, 2)
+		}},
+		{name: "top3", score: func(vec []float32) (float64, float64) {
+			return meanNearest(vec, boundary.personal, 3), meanNearest(vec, boundary.world, 3)
+		}},
+		{name: "centroid", score: func(vec []float32) (float64, float64) {
+			return cosine(vec, personalCentroid), cosine(vec, worldCentroid)
+		}},
+	}
+	reports := make(map[string]*personalBoundaryEvalReport, len(candidates))
+	for _, candidate := range candidates {
+		reports[candidate.name] = newPersonalBoundaryEvalReport(candidate.name)
+	}
+
+	fixture := loadPersonalBoundaryEvalFixture(t)
+	for _, c := range fixture.Cases {
+		vec, err := router.EmbedQuery(ctx, embedder, c.Utterance)
+		if err != nil {
+			t.Fatalf("%s: embed %q: %v", c.ID, c.Utterance, err)
+		}
+		for _, candidate := range candidates {
+			personal, world := candidate.score(vec)
+			gotPersonal := personal > world
+			reports[candidate.name].add(c, gotPersonal, personal, world)
+			if candidate.name == "production" && gotPersonal != (c.Want == "personal") {
+				t.Errorf("%s [%s/%s]: got %s, want %s (personal %.4f world %.4f delta %+.4f): %q",
+					c.ID, c.Lang, c.Stratum, boundaryEvalSide(gotPersonal), c.Want,
+					personal, world, personal-world, c.Utterance)
+			}
+		}
+	}
+
+	for _, candidate := range candidates {
+		report := reports[candidate.name]
+		t.Logf("candidate %-15s %2d/%d (%.1f%%), minimum signed margin %+.4f",
+			report.Name, report.Correct, report.Total,
+			100*float64(report.Correct)/float64(report.Total), report.MinimumMargin)
+	}
+	production := reports["production"]
+	for _, lang := range []string{"ru", "en"} {
+		stat := production.ByLanguage[lang]
+		t.Logf("production language %-2s %2d/%d", lang, stat.Correct, stat.Total)
+	}
+	for _, side := range []string{"personal", "world"} {
+		stat := production.ByExpectedClass[side]
+		t.Logf("production expected %-8s %2d/%d", side, stat.Correct, stat.Total)
+	}
+	strata := append([]string(nil), personalBoundaryEvalStrata...)
+	sort.Strings(strata)
+	for _, stratum := range strata {
+		stat := production.ByStratum[stratum]
+		ruPersonal := production.ByCell[stratum+"/ru/personal"]
+		ruWorld := production.ByCell[stratum+"/ru/world"]
+		enPersonal := production.ByCell[stratum+"/en/personal"]
+		enWorld := production.ByCell[stratum+"/en/world"]
+		t.Logf("production stratum %-21s %2d/%d | ru personal %d/%d world %d/%d | en personal %d/%d world %d/%d",
+			stratum, stat.Correct, stat.Total,
+			ruPersonal.Correct, ruPersonal.Total, ruWorld.Correct, ruWorld.Total,
+			enPersonal.Correct, enPersonal.Total, enWorld.Correct, enWorld.Total)
+	}
+}
+
+func personalBoundaryEvalCentroid(vectors [][]float32) []float32 {
+	if len(vectors) == 0 {
+		return nil
+	}
+	centroid := make([]float32, len(vectors[0]))
+	for _, vector := range vectors {
+		if len(vector) != len(centroid) {
+			return nil
+		}
+		for i, value := range vector {
+			centroid[i] += value
+		}
+	}
+	for i := range centroid {
+		centroid[i] /= float32(len(vectors))
+	}
+	return centroid
+}
+
+func boundaryEvalSide(personal bool) string {
+	if personal {
+		return "personal"
+	}
+	return "world"
+}
+
+// meanNearest is an evaluation baseline retained beside the strict fixture;
+// production uses the linear head in personalboundary.go.
+func meanNearest(vec []float32, seeds [][]float32, k int) float64 {
+	if len(seeds) == 0 || k <= 0 {
+		return -1
+	}
+	if k > len(seeds) {
+		k = len(seeds)
+	}
+	top := make([]float64, k)
+	for i := range top {
+		top[i] = -1
+	}
+	for _, seed := range seeds {
+		candidate := cosine(vec, seed)
+		for i := range top {
+			if candidate > top[i] {
+				candidate, top[i] = top[i], candidate
+			}
+		}
+	}
+	var sum float64
+	for _, similarity := range top {
+		sum += similarity
+	}
+	return sum / float64(k)
+}

cmd/mavend/personalboundary_test.go

@@ -2,13 +2,213 @@ package main
 
 import (
 	"context"
+	"math"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/kami/maven/internal/router"
 )
 
+func TestPersonalBoundaryLinearHeadSeparatesSemanticDirections(t *testing.T) {
+	personal := [][]float32{{1, 0}, {0.9, 0.1}, {0.8, -0.1}}
+	world := [][]float32{{-1, 0}, {-0.9, 0.1}, {-0.8, -0.1}}
+	head, ok := trainPersonalBoundaryLinearHead(personal, world)
+	if !ok {
+		t.Fatal("valid training vectors were rejected")
+	}
+	b := personalBoundary{personal: personal, world: world, head: head, loaded: true}
+	for _, tc := range []struct {
+		vector   []float32
+		personal bool
+	}{
+		{vector: []float32{0.75, 0.2}, personal: true},
+		{vector: []float32{-0.75, 0.2}, personal: false},
+	} {
+		personalScore, worldScore, ok := b.score(tc.vector)
+		if !ok {
+			t.Fatal("loaded boundary did not score")
+		}
+		if got := personalScore > worldScore; got != tc.personal {
+			t.Fatalf("vector %v classified personal=%v (scores %.4f/%.4f), want %v",
+				tc.vector, got, personalScore, worldScore, tc.personal)
+		}
+		if math.Abs(personalScore+worldScore-1) > 1e-12 {
+			t.Fatalf("scores %.8f and %.8f are not complementary probabilities", personalScore, worldScore)
+		}
+	}
+}
+
+func TestPersonalBoundaryTrainingBalancesClasses(t *testing.T) {
+	personal := [][]float32{{1, 0}, {0.8, 0.2}}
+	world := [][]float32{{-1, 0}}
+	oneWorld, ok := trainPersonalBoundaryLinearHead(personal, world)
+	if !ok {
+		t.Fatal("valid training vectors were rejected")
+	}
+	repeatedWorld := make([][]float32, 12)
+	for i := range repeatedWorld {
+		repeatedWorld[i] = world[0]
+	}
+	twelveWorld, ok := trainPersonalBoundaryLinearHead(personal, repeatedWorld)
+	if !ok {
+		t.Fatal("valid repeated training vectors were rejected")
+	}
+	if math.Abs(oneWorld.bias-twelveWorld.bias) > 1e-10 {
+		t.Fatalf("duplicating one class moved bias from %.12f to %.12f", oneWorld.bias, twelveWorld.bias)
+	}
+	for i := range oneWorld.weights {
+		if math.Abs(oneWorld.weights[i]-twelveWorld.weights[i]) > 1e-10 {
+			t.Fatalf("duplicating one class moved weight %d from %.12f to %.12f",
+				i, oneWorld.weights[i], twelveWorld.weights[i])
+		}
+	}
+}
+
+func TestPersonalBoundaryTrainingRejectsMixedDimensions(t *testing.T) {
+	if _, ok := trainPersonalBoundaryLinearHead(
+		[][]float32{{1, 0}},
+		[][]float32{{-1, 0, 0}},
+	); ok {
+		t.Fatal("mixed embedding dimensions were accepted")
+	}
+}
+
+// The corpus is grouped by sentence shape in personalboundary.go. This test
+// leaves one entire shape out of training at a time, then requires the linear
+// head to classify the omitted examples from the semantics learned from the
+// other shapes. It is ordinary deterministic CI: the small axis vectors stand
+// in for frozen embedding directions, so the test proves the training code
+// generalises across groups rather than memorising one row at a time.
+func TestPersonalBoundaryLinearHeadLeaveOneShapeOut(t *testing.T) {
+	type example struct {
+		vector []float32
+		shape  int
+		want   bool
+	}
+	const shapeCount = 6
+	examples := make([]example, 0, shapeCount*4)
+	for shape := 0; shape < shapeCount; shape++ {
+		for variant := 0; variant < 2; variant++ {
+			personal := make([]float32, shapeCount+1)
+			world := make([]float32, shapeCount+1)
+			personal[0], world[0] = 1, -1
+			personal[shape+1] = float32(0.1 * float64(variant+1))
+			world[shape+1] = float32(-0.1 * float64(variant+1))
+			examples = append(examples,
+				example{vector: personal, shape: shape, want: true},
+				example{vector: world, shape: shape, want: false},
+			)
+		}
+	}
+
+	for omitted := 0; omitted < shapeCount; omitted++ {
+		var personal, world [][]float32
+		for _, example := range examples {
+			if example.shape == omitted {
+				continue
+			}
+			if example.want {
+				personal = append(personal, example.vector)
+			} else {
+				world = append(world, example.vector)
+			}
+		}
+		head, ok := trainPersonalBoundaryLinearHead(personal, world)
+		if !ok {
+			t.Fatalf("fold %d rejected valid vectors", omitted)
+		}
+		for _, example := range examples {
+			if example.shape != omitted {
+				continue
+			}
+			if got := head.logit(example.vector) > 0; got != example.want {
+				t.Errorf("fold %d classified %v as personal=%v, want %v", omitted, example.vector, got, example.want)
+			}
+		}
+	}
+}
+
+func TestPersonalBoundaryTrainingCorpusIsIndependent(t *testing.T) {
+	// The strict stratified fixture already enforces this for its 72 rows. The
+	// historical regression table lives here, so protect it here too: a future
+	// seed addition must not copy a regression sentence into training.
+	training := make(map[string]bool, len(personalSeeds)+len(worldSeeds))
+	for _, seed := range append(append([]string(nil), personalSeeds...), worldSeeds...) {
+		training[normalizePersonalBoundaryTraining(seed)] = true
+	}
+	for _, regression := range []string{
+		"что я говорил про бэкапы?",
+		"что я сказал вчера про отпуск",
+		"я писал что-нибудь про сервер",
+		"я упоминал про конференцию?",
+		"что я отмечал по поводу переезда",
+		"я рассказывал тебе про новую работу?",
+		"во сколько у меня встреча",
+		"когда мой следующий отпуск",
+		"what did i say about backups",
+		"did i tell you about the doctor",
+		"как я говорил, почему небо синее",
+		"как уже я говорил, какая столица франции",
+		"почему трава зелёная",
+		"столица франции",
+		"как мне сварить борщ",
+		"что мне посмотреть вечером",
+		"я хочу узнать про рим",
+		"кто такой гагарин",
+		"how do i boil an egg",
+		"во сколько закат сегодня",
+		"когда сегодня заканчивается концерт",
+		"во сколько завтра открывается аптека",
+		"какой сегодня праздник",
+		"что интересного произошло сегодня в мире",
+		"кто выиграл вчера матч",
+		"расскажи про эверест",
+		"расскажи про войну 1812 года",
+		"объясни что такое инфляция",
+		"я рассказывал тебе про байкал?",
+	} {
+		if training[normalizePersonalBoundaryTraining(regression)] {
+			t.Errorf("regression utterance leaked into training: %q", regression)
+		}
+	}
+}
+
+func TestPersonalBoundaryFrozenHeadDecodes(t *testing.T) {
+	head, ok := frozenPersonalBoundaryHead()
+	if !ok {
+		t.Fatal("frozen head did not decode")
+	}
+	if len(head.weights) != 384 {
+		t.Fatalf("frozen head has %d weights, want 384", len(head.weights))
+	}
+}
+
+func TestPersonalBoundaryHashFloorLatency(t *testing.T) {
+	b := &personalBoundary{}
+	embedder := router.NewHashEmbedder(1024)
+	query, err := router.EmbedQuery(context.Background(), embedder, "когда моя встреча")
+	if err != nil {
+		t.Fatal(err)
+	}
+	started := time.Now()
+	b.load(context.Background(), embedder)
+	if _, _, ok := b.score(query); !ok {
+		t.Fatal("hash-floor boundary declined to score")
+	}
+	elapsed := time.Since(started)
+	t.Logf("hash-floor corpus fit+score: %s", elapsed)
+	if elapsed > 2*time.Second {
+		t.Errorf("hash-floor boundary took %s, exceeds 2s local floor ceiling", elapsed)
+	}
+}
+
+func normalizePersonalBoundaryTraining(value string) string {
+	return strings.Join(strings.Fields(strings.ToLower(value)), " ")
+}
+
 // A handler with no embedder never loads the seeds, so the boundary falls back
 // to the possession markers. That is the offline floor and it must keep working
 // — an embedder that fails to load must not open the boundary.
@@ -113,3 +313,419 @@ func TestONNXPersonalBoundary(t *testing.T) {
 	}
 	t.Logf("personal boundary: %d/%d held-out utterances correct", len(cases)-wrong, len(cases))
 }
+
+func TestONNXPersonalBoundaryFourFold(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+	ctx := context.Background()
+	embedAll := func(values []string) [][]float32 {
+		vectors := make([][]float32, len(values))
+		for i, value := range values {
+			vector, err := router.EmbedQuery(ctx, emb, value)
+			if err != nil {
+				t.Fatalf("embed %q: %v", value, err)
+			}
+			vectors[i] = vector
+		}
+		return vectors
+	}
+	personalVectors := embedAll(personalSeeds)
+	worldVectors := embedAll(worldSeeds)
+
+	type group struct {
+		name                         string
+		personalStart, personalCount int
+		worldStart, worldCount       int
+	}
+	groups := []group{
+		{name: "remembered_speech", personalStart: 8, personalCount: 8, worldStart: 20, worldCount: 8},
+		{name: "possession", personalStart: 16, personalCount: 10, worldStart: 28, worldCount: 12},
+		{name: "narrative", personalStart: 26, personalCount: 8, worldStart: 40, worldCount: 8},
+		{name: "first_person_preamble", personalStart: 34, personalCount: 8, worldStart: 48, worldCount: 8},
+		{name: "advice_current_info", personalStart: 42, personalCount: 8, worldStart: 56, worldCount: 8},
+		{name: "public_proper_nouns", personalStart: 50, personalCount: 10, worldStart: 64, worldCount: 8},
+	}
+
+	const foldCount = 4
+	aggregateCorrect, aggregateTotal := 0, 0
+	for omittedFold := 0; omittedFold < foldCount; omittedFold++ {
+		trainingPersonal := append([][]float32(nil), personalVectors[:8]...)
+		trainingWorld := append([][]float32(nil), worldVectors[:20]...)
+		var heldPersonal, heldWorld [][]float32
+		partition := func(vectors [][]float32, start, count int, training, held *[][]float32) {
+			for relative, vector := range vectors[start : start+count] {
+				if relative%foldCount == omittedFold {
+					*held = append(*held, vector)
+				} else {
+					*training = append(*training, vector)
+				}
+			}
+		}
+		for _, group := range groups {
+			partition(personalVectors, group.personalStart, group.personalCount, &trainingPersonal, &heldPersonal)
+			partition(worldVectors, group.worldStart, group.worldCount, &trainingWorld, &heldWorld)
+		}
+		head, ok := trainPersonalBoundaryLinearHead(
+			trainingPersonal,
+			trainingWorld,
+		)
+		if !ok {
+			t.Fatalf("fold %d: valid training fold rejected", omittedFold)
+		}
+		correct, total := 0, 0
+		for _, vector := range heldPersonal {
+			total++
+			if head.logit(vector) > 0 {
+				correct++
+			}
+		}
+		for _, vector := range heldWorld {
+			total++
+			if head.logit(vector) <= 0 {
+				correct++
+			}
+		}
+		t.Logf("fold %d: %d/%d held-out training examples", omittedFold+1, correct, total)
+		aggregateCorrect += correct
+		aggregateTotal += total
+	}
+	t.Logf("four-fold aggregate: %d/%d", aggregateCorrect, aggregateTotal)
+	if aggregateCorrect < 99 {
+		t.Errorf("four-fold aggregate %d/%d, want at least 99/104", aggregateCorrect, aggregateTotal)
+	}
+}
+
+func TestONNXPersonalBoundarySemanticGroupHoldout(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+	ctx := context.Background()
+	embedAll := func(values []string) [][]float32 {
+		vectors := make([][]float32, len(values))
+		for i, value := range values {
+			vector, err := router.EmbedQuery(ctx, emb, value)
+			if err != nil {
+				t.Fatalf("embed %q: %v", value, err)
+			}
+			vectors[i] = vector
+		}
+		return vectors
+	}
+	personalVectors := embedAll(personalSeeds)
+	worldVectors := embedAll(worldSeeds)
+
+	type group struct {
+		name                         string
+		personalStart, personalCount int
+		worldStart, worldCount       int
+	}
+	groups := []group{
+		{name: "remembered_speech", personalStart: 8, personalCount: 8, worldStart: 20, worldCount: 8},
+		{name: "possession", personalStart: 16, personalCount: 10, worldStart: 28, worldCount: 12},
+		{name: "narrative", personalStart: 26, personalCount: 8, worldStart: 40, worldCount: 8},
+		{name: "first_person_preamble", personalStart: 34, personalCount: 8, worldStart: 48, worldCount: 8},
+		{name: "advice_current_info", personalStart: 42, personalCount: 8, worldStart: 56, worldCount: 8},
+		{name: "public_proper_nouns", personalStart: 50, personalCount: 10, worldStart: 64, worldCount: 8},
+	}
+
+	aggregateCorrect, aggregateTotal := 0, 0
+	for _, omitted := range groups {
+		excluding := func(vectors [][]float32, start, count int) [][]float32 {
+			result := make([][]float32, 0, len(vectors)-count)
+			result = append(result, vectors[:start]...)
+			return append(result, vectors[start+count:]...)
+		}
+		head, ok := trainPersonalBoundaryLinearHead(
+			excluding(personalVectors, omitted.personalStart, omitted.personalCount),
+			excluding(worldVectors, omitted.worldStart, omitted.worldCount),
+		)
+		if !ok {
+			t.Fatalf("%s: valid training fold rejected", omitted.name)
+		}
+		correct, total := 0, 0
+		for _, vector := range personalVectors[omitted.personalStart : omitted.personalStart+omitted.personalCount] {
+			total++
+			if head.logit(vector) > 0 {
+				correct++
+			}
+		}
+		for _, vector := range worldVectors[omitted.worldStart : omitted.worldStart+omitted.worldCount] {
+			total++
+			if head.logit(vector) <= 0 {
+				correct++
+			}
+		}
+		t.Logf("leave %-21s out: %d/%d", omitted.name, correct, total)
+		aggregateCorrect += correct
+		aggregateTotal += total
+		// Whole-shape holdout is an honest diagnostic, not a 100% release gate:
+		// some shapes (notably private-vs-general possession) define a distinct
+		// semantic ambiguity. The separately authored challenge set remains the
+		// strict generalisation gate.
+	}
+	if aggregateCorrect < 92 {
+		t.Errorf("whole-shape aggregate %d/%d, want at least 92/104", aggregateCorrect, aggregateTotal)
+	}
+}
+
+// This challenge set was originally authored after the six-shape training
+// corpus and the 72-case matrix were frozen. Its sole miss then informed the
+// regularisation comparison, so it is now a strict regression gate rather than
+// independent evidence. It remains outside the production corpus.
+func TestONNXPersonalBoundaryChallenge(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+
+	cases := []struct {
+		utterance string
+		personal  bool
+	}{
+		{"какой пароль приложения я задал для почтового клиента?", true},
+		{"на каком порту я решил поднять тестовый сервис?", true},
+		{"какую причину я указал, когда отменил бронь?", true},
+		{"где в гараже я сложил зимние шины?", true},
+		{"какой сериал я бросил после второго сезона?", true},
+		{"о чём мы договорились с Олегом на прошлой неделе?", true},
+		{"почему мой монитор мерцает при частоте 144 герца?", false},
+		{"подойдёт ли кабель Thunderbolt 3 к разъёму USB4?", false},
+		{"как вывести запах дыма из моей куртки?", false},
+		{"что означают кольца на флаге Олимпиады?", false},
+		{"почему после дождя на асфальте видна радуга?", false},
+		{"какой формат файлов поддерживает Kindle Paperwhite?", false},
+		{"which SSH key did I install on the build server?", true},
+		{"what spending limit did I set for the travel card?", true},
+		{"where did I store the spare apartment fob?", true},
+		{"which objection did I raise during the design review?", true},
+		{"what route did I plan for the Sunday hike?", true},
+		{"when did I promise Maya I would send the draft?", true},
+		{"why does my mechanical keyboard sometimes chatter?", false},
+		{"can my USB-C charger safely power a Steam Deck?", false},
+		{"how do I stop condensation inside my camera lens?", false},
+		{"what caused the Tacoma Narrows Bridge to collapse?", false},
+		{"why are some auroras red instead of green?", false},
+		{"which codecs does the current Firefox release support?", false},
+	}
+
+	b := &personalBoundary{}
+	b.load(context.Background(), emb)
+	correct := 0
+	minimumMargin := math.Inf(1)
+	for _, testCase := range cases {
+		vector, err := router.EmbedQuery(context.Background(), emb, testCase.utterance)
+		if err != nil {
+			t.Fatalf("embed %q: %v", testCase.utterance, err)
+		}
+		personal, world, ok := b.score(vector)
+		if !ok {
+			t.Fatal("loaded boundary declined to score")
+		}
+		got := personal > world
+		signedMargin := personal - world
+		if !testCase.personal {
+			signedMargin = -signedMargin
+		}
+		if signedMargin < minimumMargin {
+			minimumMargin = signedMargin
+		}
+		if got == testCase.personal {
+			correct++
+		} else {
+			t.Logf("miss %q: personal=%v want %v (%.4f/%.4f)", testCase.utterance, got, testCase.personal, personal, world)
+		}
+	}
+	t.Logf("regularisation challenge: %d/%d, minimum signed margin %+.4f", correct, len(cases), minimumMargin)
+	if correct != len(cases) {
+		t.Errorf("regularisation challenge %d/%d, want every case correct", correct, len(cases))
+	}
+}
+
+// TestONNXPersonalBoundaryPostRetuneChallenge was authored only after the L2
+// coefficient and frozen head had been selected using corpus cross-validation.
+// It deliberately returns to private configuration, commitments and stored
+// choices with new objects, and contrasts them with public technical facts,
+// compatibility and maintenance. No result from this table may be used to
+// tune the current head; a miss is evidence for the next independently
+// evaluated model revision.
+func TestONNXPersonalBoundaryPostRetuneChallenge(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+
+	cases := []struct {
+		utterance string
+		personal  bool
+	}{
+		{"какое имя я выбрал для гостевой сети Wi-Fi?", true},
+		{"на какой день я перенёс техосмотр машины?", true},
+		{"какую сумму мы с Мариной согласовали за ремонт кухни?", true},
+		{"где я сохранил резервные коды от GitHub?", true},
+		{"какой из макетов визитки я одобрил?", true},
+		{"что я решил делать со страховкой перед поездкой?", true},
+		{"какой диапазон частот использует Wi-Fi 6E?", false},
+		{"почему OLED-экраны со временем выгорают?", false},
+		{"можно ли подключить монитор DisplayPort к Thunderbolt 4?", false},
+		{"чем безопасно чистить замшевые ботинки?", false},
+		{"когда появился протокол WebSocket?", false},
+		{"почему соль ускоряет таяние льда?", false},
+		{"which hostname did I assign to the home NAS?", true},
+		{"what date did I move the annual checkup to?", true},
+		{"where did I save the recovery phrase for the hardware wallet?", true},
+		{"which catering quote did we accept for the party?", true},
+		{"what did I decide about renewing the domain?", true},
+		{"which paint sample did I approve for the hallway?", true},
+		{"does Wi-Fi 7 work with older wireless clients?", false},
+		{"why can an SSD slow down when it is nearly full?", false},
+		{"how should suede shoes be cleaned?", false},
+		{"when was the WebSocket protocol standardized?", false},
+		{"what does a hardware-wallet recovery phrase do?", false},
+		{"why does road salt damage concrete?", false},
+	}
+
+	b := &personalBoundary{}
+	b.load(context.Background(), emb)
+	correct := 0
+	minimumMargin := math.Inf(1)
+	for _, testCase := range cases {
+		vector, err := router.EmbedQuery(context.Background(), emb, testCase.utterance)
+		if err != nil {
+			t.Fatalf("embed %q: %v", testCase.utterance, err)
+		}
+		personal, world, ok := b.score(vector)
+		if !ok {
+			t.Fatal("loaded boundary declined to score")
+		}
+		got := personal > world
+		signedMargin := personal - world
+		if !testCase.personal {
+			signedMargin = -signedMargin
+		}
+		if signedMargin < minimumMargin {
+			minimumMargin = signedMargin
+		}
+		if got == testCase.personal {
+			correct++
+		} else {
+			t.Logf("miss %q: personal=%v want %v (%.4f/%.4f)", testCase.utterance, got, testCase.personal, personal, world)
+		}
+	}
+	t.Logf("post-retune challenge: %d/%d, minimum signed margin %+.4f", correct, len(cases), minimumMargin)
+	if correct != len(cases) {
+		t.Errorf("post-retune challenge %d/%d, want every case correct", correct, len(cases))
+	}
+}
+
+func TestONNXPersonalBoundaryLatency(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+	ctx := context.Background()
+	query, err := router.EmbedQuery(ctx, emb, "что я решил насчёт переезда?")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	b := &personalBoundary{}
+	coldStart := time.Now()
+	b.load(ctx, emb)
+	if _, _, ok := b.score(query); !ok {
+		t.Fatal("loaded boundary declined to score")
+	}
+	cold := time.Since(coldStart)
+
+	const iterations = 100000
+	steadyStart := time.Now()
+	for i := 0; i < iterations; i++ {
+		if _, _, ok := b.score(query); !ok {
+			t.Fatal("loaded boundary declined to score")
+		}
+	}
+	steady := time.Since(steadyStart) / iterations
+	t.Logf("boundary cold load+train+score: %s; steady score: %s/op", cold, steady)
+	// This is a user-visible first-turn path. Keep a generous ceiling to avoid
+	// noisy CI while making an accidental per-turn training/load regression
+	// unmistakable.
+	if cold > 5*time.Second {
+		t.Errorf("cold boundary load %s exceeds 5s local usability ceiling", cold)
+	}
+	if steady > 100*time.Microsecond {
+		t.Errorf("steady boundary score %s exceeds 100µs ceiling", steady)
+	}
+}
+
+func TestONNXPersonalBoundaryFrozenHeadMatchesCorpusFit(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+	ctx := context.Background()
+	embedAll := func(values []string) [][]float32 {
+		vectors := make([][]float32, len(values))
+		for i, value := range values {
+			vector, err := router.EmbedQuery(ctx, emb, value)
+			if err != nil {
+				t.Fatalf("embed %q: %v", value, err)
+			}
+			vectors[i] = vector
+		}
+		return vectors
+	}
+	fitted, ok := trainPersonalBoundaryLinearHead(embedAll(personalSeeds), embedAll(worldSeeds))
+	if !ok {
+		t.Fatal("corpus fit failed")
+	}
+	frozen, ok := frozenPersonalBoundaryHead()
+	if !ok {
+		t.Fatal("frozen head did not decode")
+	}
+	if math.Abs(fitted.bias-frozen.bias) > 1e-9 {
+		t.Fatalf("frozen bias %.12f != fitted %.12f", frozen.bias, fitted.bias)
+	}
+	for i := range fitted.weights {
+		if math.Abs(fitted.weights[i]-frozen.weights[i]) > 5e-7 {
+			t.Fatalf("frozen weight %d %.12f != fitted %.12f", i, frozen.weights[i], fitted.weights[i])
+		}
+	}
+}

cmd/mavend/repair.go

@@ -172,14 +172,57 @@ func (h *reactiveHandler) stampLastTurn(utterance string, traceID int64) {
 	h.lastRouted.traceID = traceID
 }
 
-func (h *reactiveHandler) takeLastTurn() *routedTurn {
+// takeLastTurnIf atomically claims the previous acted turn only when the
+// caller can actually handle it. A declined repair must not spend the pointer:
+// "нет, это заметка" may name the intent Maven already chose and be followed
+// immediately by the real correction. The older read-then-clear helper lost
+// the original before checking either that case or the repair window (V-573).
+func (h *reactiveHandler) takeLastTurnIf(accept func(*routedTurn) bool) *routedTurn {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	last := h.lastRouted
-	// Taken, not read: one utterance is corrected once. Saying "нет, не так"
-	// twice would otherwise redo the same request twice.
+	if h.lastRouted == nil || !accept(h.lastRouted) {
+		return nil
+	}
+	last := *h.lastRouted
+	// A handled correction is still spent once. Returning a copy prevents a
+	// later trace stamp from mutating the evidence after this resolver owns it.
 	h.lastRouted = nil
-	return last
+	return &last
+}
+
+// takeTargetedRepair atomically distinguishes the three outcomes a targeted
+// correction needs. A recent, differently-routed turn is claimed and spent; a
+// recent turn already carrying that intent is retained and reported as
+// already-correct; everything else declines. Treating the second case as a
+// generic decline lets runTurn route the correction words as a fresh turn and
+// record them over the very pointer this helper was meant to preserve.
+func (h *reactiveHandler) takeTargetedRepair(now time.Time, corrected router.Intent) (last *routedTurn, already bool) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.lastRouted == nil || now.Sub(h.lastRouted.at) > repairWindow {
+		return nil, false
+	}
+	if h.lastRouted.intent == corrected {
+		return nil, true
+	}
+	copy := *h.lastRouted
+	h.lastRouted = nil
+	return &copy, false
+}
+
+// suspendClarifyForRepair makes a correction an aside to any question already
+// parked in this dialogue. It is called only after a repair has actually found
+// a target, so an ordinary utterance that merely resembles one changes no
+// dialogue state. If the redo itself needs a question, askClarify sees the
+// suspended flag and pushes that question instead of overwriting the older
+// request.
+func (h *reactiveHandler) suspendClarifyForRepair(ctx context.Context) {
+	if h.clarifyStore == nil {
+		return
+	}
+	if q := h.clarifyStore.Get(dialogueIDOf(ctx), h.now()); q != nil {
+		h.noteSuspended(ctx, q)
+	}
 }
 
 // resolveUntargetedRepair handles the cheap half of a spoken correction: he says
@@ -199,15 +242,16 @@ func (h *reactiveHandler) resolveUntargetedRepair(ctx context.Context, text stri
 	if !isRepairNegative(text) {
 		return "", false
 	}
-	last := h.takeLastTurn()
-	if last == nil || h.now().Sub(last.at) > repairWindow {
-		return "", false
-	}
-	if last.traceID == 0 {
+	now := h.now()
+	last := h.takeLastTurnIf(func(last *routedTurn) bool {
+		return now.Sub(last.at) <= repairWindow && last.traceID != 0
+	})
+	if last == nil {
 		// No row to point at, so there is no label to write and nothing this
 		// resolver can do. Routing the words normally is the honest outcome.
 		return "", false
 	}
+	h.suspendClarifyForRepair(ctx)
 	h.labelCorrection(ctx, last, "")
 	log.Printf("voice: repair — %q marked wrong, no target given", last.utterance)
 	return phraser.A(phraser.RepairNoted, nil), true
@@ -239,16 +283,20 @@ func (h *reactiveHandler) resolveRepair(ctx context.Context, text string) (strin
 	if !ok || h.router == nil {
 		return "", false
 	}
-	last := h.takeLastTurn()
-	if last == nil || h.now().Sub(last.at) > repairWindow {
-		return "", false
-	}
-	if last.intent == corrected {
-		// She already did what he is asking for. Correcting the classifier
-		// here would teach it the label it produced, and redoing the request
-		// would file it twice.
+	last, already := h.takeTargetedRepair(h.now(), corrected)
+	if already {
+		// This is still a correction turn, not slot material and not a fresh note.
+		// Say why nothing ran, retain the original pointer, and keep any parked
+		// question audible for the next breath.
+		h.suspendClarifyForRepair(ctx)
+		return "это уже " + say + " — ничего не переделываю.", true
+	}
+	if last == nil {
+		// Nothing recent to correct. Routing the words normally is the honest
+		// outcome; an expired pointer cannot become usable again.
 		return "", false
 	}
+	h.suspendClarifyForRepair(ctx)
 	learned := true
 	if err := h.router.CorrectMisroute(ctx, last.utterance, corrected); err != nil {
 		// The redo is still worth doing: he asked for something and it did not
@@ -271,7 +319,7 @@ func (h *reactiveHandler) resolveRepair(ctx context.Context, text string) (strin
 	if dec.Slots.Text == "" && corrected != router.IntentReminder {
 		dec.Slots.Text = last.utterance
 	}
-	return repairLine(say, learned) + " " + h.finishClarified(ctx, dec), true
+	return repairLine(say, learned) + " " + h.finishRepaired(ctx, dec), true
 }
 
 // repairLine — what she says before redoing it, so the correction is visible

cmd/mavend/repair_test.go

@@ -6,6 +6,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/kami/maven/internal/dialogue"
 	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/store"
 )
@@ -93,7 +94,7 @@ func TestRepairNeedsARecentTurnToPointAt(t *testing.T) {
 }
 
 func TestRepairIsSpentOnce(t *testing.T) {
-	h, _, _ := newClarifyHandler(t)
+	h, st, _ := newClarifyHandler(t)
 	emb := router.NewHashEmbedder(256)
 	h.recall.embedder = emb
 	h.router = router.New(router.Config{Classifier: router.NewClassifier(emb), Extractor: h.extractor})
@@ -103,8 +104,17 @@ func TestRepairIsSpentOnce(t *testing.T) {
 	if _, handled := h.resolveRepair(ctx, "нет, это заметка"); !handled {
 		t.Fatal("the first correction was not handled")
 	}
-	if _, handled := h.resolveRepair(ctx, "нет, это заметка"); handled {
-		t.Error("the same turn was corrected twice")
+	before, err := st.RecentNotes(ctx, 10)
+	if err != nil || len(before) != 1 {
+		t.Fatalf("first repair notes=%+v err=%v", before, err)
+	}
+	reply, handled := h.resolveRepair(ctx, "нет, это заметка")
+	if !handled || !strings.Contains(reply, "уже") {
+		t.Fatalf("the repeated correction was not acknowledged as already applied: handled=%v reply=%q", handled, reply)
+	}
+	after, err := st.RecentNotes(ctx, 10)
+	if err != nil || len(after) != 1 {
+		t.Fatalf("the same turn was redone twice: notes=%+v err=%v", after, err)
 	}
 }
 
@@ -114,8 +124,119 @@ func TestRepairPassesWhenSheAlreadyDidThat(t *testing.T) {
 	h, _, _ := newClarifyHandler(t)
 	h.router = router.New(router.Config{Classifier: router.NewClassifier(router.NewHashEmbedder(256))})
 	h.recordTurn("купить хлеб", router.IntentNote)
+	reply, handled := h.resolveRepair(context.Background(), "нет, это заметка")
+	if !handled || !strings.Contains(reply, "уже") {
+		t.Fatalf("a redundant correction must be acknowledged without redoing it: handled=%v reply=%q", handled, reply)
+	}
+	// Acknowledging the redundant target must not spend the original. If this
+	// resolver declines instead, runTurn routes the correction as a fresh turn
+	// and recordTurn overwrites the pointer even though takeLastTurn retained it.
+	if _, handled := h.resolveRepair(context.Background(), "нет, это факт"); !handled {
+		t.Error("a redundant same-intent repair spent the original turn")
+	}
+}
+
+func TestRepairResumesQuestionParkedAfterTheCorrectedTurn(t *testing.T) {
+	h, _, _ := newClarifyHandler(t)
+	emb := router.NewHashEmbedder(256)
+	h.recall.embedder = emb
+	h.router = router.New(router.Config{Classifier: router.NewClassifier(emb), Extractor: h.extractor})
+	ctx := context.Background()
+
+	h.recordTurn("купить хлеб", router.IntentFact)
+	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder,
+		router.Slots{Text: "позвонить маме"}, "напомни позвонить маме")); !asked {
+		t.Fatal("expected a parked reminder question")
+	}
+
+	reply := h.runTurn(ctx, "нет, это был вопрос", sourceText)
+	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
+	if !strings.HasSuffix(reply, resumed) {
+		t.Fatalf("the correction hid the still-live question: reply=%q want suffix=%q", reply, resumed)
+	}
+	q := h.clarifyStore.Get(voiceDialogueID, h.now())
+	if q == nil {
+		t.Fatal("the correction dropped the parked question")
+	}
+	if q.Attempts != 1 || q.Suspends != 1 {
+		t.Fatalf("the correction spent a retry instead of suspending the question: %+v", q)
+	}
+}
+
+func TestRepairedClarifyCompletesWithoutDroppingTheOlderQuestion(t *testing.T) {
+	h, st, _ := newClarifyHandler(t)
+	emb := router.NewHashEmbedder(256)
+	h.recall.embedder = emb
+	h.router = router.New(router.Config{Classifier: router.NewClassifier(emb), Extractor: h.extractor})
+	ctx := context.Background()
+
+	h.recordTurn("купить хлеб", router.IntentFact)
+	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder,
+		router.Slots{Text: "позвонить маме"}, "напомни позвонить маме")); !asked {
+		t.Fatal("expected the older reminder question")
+	}
+
+	if reply := h.runTurn(ctx, "нет, это было напоминание", sourceText); !strings.Contains(reply, "Когда") {
+		t.Fatalf("the repaired reminder did not ask for its missing time: %q", reply)
+	}
+	if depth := h.clarifyStore.Depth(voiceDialogueID); depth != 2 {
+		t.Fatalf("the repaired question overwrote the older one: depth=%d want=2", depth)
+	}
+
+	reply := h.runTurn(ctx, "сегодня в 15:00", sourceText)
+	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
+	if !strings.HasSuffix(reply, resumed) {
+		t.Fatalf("completing the repaired request did not resume the older one: reply=%q", reply)
+	}
+	q := h.clarifyStore.Get(voiceDialogueID, h.now())
+	if q == nil || !strings.Contains(q.Utterance, "маме") {
+		t.Fatalf("the older question was lost after the top one completed: %+v", q)
+	}
+	reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour))
+	if err != nil || len(reminders) != 1 || !strings.Contains(reminders[0].Payload, "хлеб") {
+		t.Fatalf("the repaired reminder did not land exactly once: reminders=%+v err=%v", reminders, err)
+	}
+}
+
+func TestRepairedClarifyGiveUpKeepsTheOlderQuestion(t *testing.T) {
+	h, _, _ := newClarifyHandler(t)
+	ctx := context.Background()
+	older := &dialogue.PendingQuestion{
+		Intent: dialogue.IntentReminder, Missing: []dialogue.Slot{dialogue.SlotTime},
+		Utterance: "напомни позвонить маме", Asked: h.now(), TTL: clarifyTTL,
+	}
+	top := &dialogue.PendingQuestion{
+		Intent: dialogue.IntentReminder, Missing: []dialogue.Slot{dialogue.SlotTime},
+		Utterance: "напомни купить хлеб", Asked: h.now(), TTL: clarifyTTL,
+		Attempts: dialogue.DefaultMaxAttempts, MaxAttempts: dialogue.DefaultMaxAttempts,
+	}
+	h.clarifyStore.Push(voiceDialogueID, older)
+	h.clarifyStore.Push(voiceDialogueID, top)
+
+	if reply := h.reaskOrGiveUp(ctx, top, top.Slots, "не знаю", ""); reply != clarifyGaveUp {
+		t.Fatalf("reply=%q, want the explicit give-up line", reply)
+	}
+	if depth := h.clarifyStore.Depth(voiceDialogueID); depth != 1 {
+		t.Fatalf("giving up on the top request erased the older flow: depth=%d", depth)
+	}
+	q := h.clarifyStore.Get(voiceDialogueID, h.now())
+	if q != older {
+		t.Fatalf("survivor=%+v, want the older parked question", q)
+	}
+}
+
+func TestStaleRepairDoesNotSpendTheOriginal(t *testing.T) {
+	h, _, now := newClarifyHandler(t)
+	h.router = router.New(router.Config{Classifier: router.NewClassifier(router.NewHashEmbedder(256))})
+	h.recordTurn("купить хлеб", router.IntentFact)
+	*now = now.Add(repairWindow + time.Minute)
 	if _, handled := h.resolveRepair(context.Background(), "нет, это заметка"); handled {
-		t.Error("a correction to the intent she already used was handled")
+		t.Fatal("a stale correction was handled")
+	}
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.lastRouted == nil || h.lastRouted.utterance != "купить хлеб" {
+		t.Fatal("a stale declined correction spent the original turn")
 	}
 }
 

cmd/mavend/simulator_test.go

@@ -127,10 +127,14 @@ type toolRow struct {
 // Route and Reply are separate because the same model serves both contracts
 // (CLAUDE.md, "LLM output contract"): a grammar-constrained call is a routing
 // call and gets Route, an unconstrained one is a phrasing call and gets Reply.
+// HistoryContains makes a chat reply conditional on the transcript the daemon
+// supplied. It prevents a canned answer from making a continuity scenario pass
+// while the referent is still absent from the model input.
 type scriptEntry struct {
-	Match string `json:"match"`
-	Route string `json:"route,omitempty"`
-	Reply string `json:"reply,omitempty"`
+	Match           string   `json:"match"`
+	Route           string   `json:"route,omitempty"`
+	Reply           string   `json:"reply,omitempty"`
+	HistoryContains []string `json:"history_contains,omitempty"`
 }
 
 // step — one scripted moment. At is "HH:MM" or "HH:MM:SS", interpreted in the
@@ -369,7 +373,7 @@ type scriptedPhraser struct {
 // matches scriptedLLM: actionChat logs it and falls back to ChatFallback(), so a
 // scenario that never meant to assert on a chat reply behaves exactly as it did
 // before, and one that DID means to is told its script has a hole.
-func (p *scriptedPhraser) PhraseChat(_ context.Context, utterance string, _ []dialogue.Turn) (string, error) {
+func (p *scriptedPhraser) PhraseChat(_ context.Context, utterance string, history []dialogue.Turn) (string, error) {
 	for _, e := range p.entries {
 		if e.Reply == "" {
 			continue
@@ -377,6 +381,19 @@ func (p *scriptedPhraser) PhraseChat(_ context.Context, utterance string, _ []di
 		if e.Match != "" && !strings.Contains(strings.ToLower(utterance), strings.ToLower(e.Match)) {
 			continue
 		}
+		for _, want := range e.HistoryContains {
+			found := false
+			for _, turn := range history {
+				if containsFold(turn.Text, want) {
+					found = true
+					break
+				}
+			}
+			if !found {
+				return "", fmt.Errorf("simulator: chat history for %q does not contain %q: %+v",
+					truncateRunes(utterance, 60), want, history)
+			}
+		}
 		return chatReplyText(e.Reply), nil
 	}
 	return "", fmt.Errorf("simulator: no scripted chat reply for %q", truncateRunes(utterance, 60))

cmd/mavend/telegramintake.go

@@ -25,7 +25,7 @@ import (
 // already failed the boot in wireDispatcher for the same config, so a second
 // hard failure would only lose that message.
 func wireTelegramIntake(ctx context.Context, wg *sync.WaitGroup, api ipc.CoreAPI, cfg *config.Config) {
-	if cfg == nil || cfg.Telegram == nil || !cfg.Telegram.Intake || api == nil {
+	if cfg == nil || cfg.Telegram == nil || cfg.Telegram.Disabled || !cfg.Telegram.Intake || api == nil {
 		return
 	}
 	sink, err := telegramsink.New(*cfg.Telegram)

cmd/mavend/testdata/personal_boundary_v1.json

@@ -0,0 +1,521 @@
+{
+  "schema_version": 1,
+  "name": "personal_boundary_v1",
+  "notes": [
+    "Held-out personal-boundary fixture for V-702. Cases are not production seeds and the fixture test enforces that after case folding and punctuation removal.",
+    "The matrix is balanced: three cases for every stratum × language × expected side cell (6 × 2 × 2 × 3 = 72).",
+    "Personal means that only the owner's local data can answer. World means that an outside knowledge source can answer even when the wording uses first person or possession.",
+    "Public subjects are deliberately varied. No case repeats the Baikal regression or changes only its place name."
+  ],
+  "cases": [
+    {
+      "id": "pb-ru-remembered-personal-01",
+      "utterance": "что я раньше говорил насчёт бессонницы?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-personal-02",
+      "utterance": "помнишь, какие причины увольнения я называл?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-personal-03",
+      "utterance": "упоминал ли я, куда хочу переехать?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-world-01",
+      "utterance": "что Чехов говорил о краткости?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-world-02",
+      "utterance": "какие причины кризиса называли экономисты?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-world-03",
+      "utterance": "что свидетели рассказывали об извержении Кракатау?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-personal-01",
+      "utterance": "what was it I told you about changing careers?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-personal-02",
+      "utterance": "have I ever mentioned where I studied?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-personal-03",
+      "utterance": "do you remember which camera I said I preferred?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-world-01",
+      "utterance": "what did Marie Curie write about radium?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-world-02",
+      "utterance": "which causes of inflation do economists usually mention?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-world-03",
+      "utterance": "what did the Apollo astronauts report about lunar dust?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+
+    {
+      "id": "pb-ru-possession-personal-01",
+      "utterance": "какой номер у моего страхового полиса?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-personal-02",
+      "utterance": "где я оставил свои запасные ключи?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-personal-03",
+      "utterance": "до какого числа действует мой абонемент?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-world-01",
+      "utterance": "как убрать царапину с моего стола?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-world-02",
+      "utterance": "почему у меня запотевают окна зимой?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-world-03",
+      "utterance": "чем зарядить мой телефон в поездке?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-personal-01",
+      "utterance": "when does my library card expire?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-personal-02",
+      "utterance": "where did I put my passport copy?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-personal-03",
+      "utterance": "what size are my hiking boots?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-world-01",
+      "utterance": "how can I descale my kettle safely?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-world-02",
+      "utterance": "why does my laptop fan get loud under load?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-world-03",
+      "utterance": "which adapter should I use for my phone abroad?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "possession"
+    },
+
+    {
+      "id": "pb-ru-narrative-personal-01",
+      "utterance": "напомни историю о том, как я познакомился с Антоном",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-personal-02",
+      "utterance": "расскажи, что со мной случилось в первый день на новой работе",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-personal-03",
+      "utterance": "восстанови по моим заметкам историю поездки в Казань",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-world-01",
+      "utterance": "опиши восхождение на Эверест",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-world-02",
+      "utterance": "расскажи историю создания языка Rust",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-world-03",
+      "utterance": "объясни, как возникли кольца Сатурна",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-personal-01",
+      "utterance": "retell the story of how I met Lena from what I told you",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-personal-02",
+      "utterance": "walk me through what happened on my first day at university",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-personal-03",
+      "utterance": "reconstruct my Prague trip from my notes",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-world-01",
+      "utterance": "tell me the story of the first Moon landing",
+      "lang": "en",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-world-02",
+      "utterance": "describe how the printing press spread through Europe",
+      "lang": "en",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-world-03",
+      "utterance": "explain how the Panama Canal was built",
+      "lang": "en",
+      "want": "world",
+      "stratum": "narrative"
+    },
+
+    {
+      "id": "pb-ru-preamble-personal-01",
+      "utterance": "если помнишь наш разговор, что я решил насчёт переезда?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-personal-02",
+      "utterance": "как я уже упоминал, когда мне продлевать страховку?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-personal-03",
+      "utterance": "возвращаясь к тому, что я рассказывал, какую модель велосипеда я выбрал?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-world-01",
+      "utterance": "как я уже говорил, почему самолёты оставляют белый след?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-world-02",
+      "utterance": "возвращаясь к моему вопросу, из чего состоит базальт?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-world-03",
+      "utterance": "я, возможно, повторяюсь, но когда построили Колизей?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-personal-01",
+      "utterance": "as I mentioned earlier, which dentist did I choose?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-personal-02",
+      "utterance": "coming back to what I told you, when am I taking leave?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-personal-03",
+      "utterance": "I may have said this already, which Linux distro did I settle on?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-world-01",
+      "utterance": "as I was saying, why do tides happen?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-world-02",
+      "utterance": "coming back to my question, how are auroras formed?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-world-03",
+      "utterance": "I may be repeating myself, when was Machu Picchu built?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+
+    {
+      "id": "pb-ru-advice-personal-01",
+      "utterance": "что из моих дел нужно закончить до пятницы?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-personal-02",
+      "utterance": "какое лекарство врач велел мне принимать утром?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-personal-03",
+      "utterance": "сколько денег я потратил на продукты в этом месяце?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-world-01",
+      "utterance": "как безопасно заменить розетку?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-world-02",
+      "utterance": "какая сейчас версия Debian stable?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-world-03",
+      "utterance": "что сегодня происходит на мировых рынках?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-personal-01",
+      "utterance": "which of my tasks is due before Friday?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-personal-02",
+      "utterance": "what dosage did my doctor tell me to take at breakfast?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-personal-03",
+      "utterance": "how much did I spend on groceries this month?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-world-01",
+      "utterance": "how should I clean a cast-iron pan?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-world-02",
+      "utterance": "what is the current stable release of PostgreSQL?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-world-03",
+      "utterance": "which major elections are happening this month?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+
+    {
+      "id": "pb-ru-proper-personal-01",
+      "utterance": "что я записал после доклада Линуса Торвальдса?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-personal-02",
+      "utterance": "какое мнение я высказал о фильмах Куросавы?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-personal-03",
+      "utterance": "когда у меня билеты на концерт Земфиры?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-world-01",
+      "utterance": "кто такой Алан Тьюринг?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-world-02",
+      "utterance": "чем известна Фрида Кало?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-world-03",
+      "utterance": "когда родился Юрий Гагарин?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-personal-01",
+      "utterance": "what notes did I make after Grace Hopper's talk?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-personal-02",
+      "utterance": "which David Bowie album did I say I liked most?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-personal-03",
+      "utterance": "when are my tickets for the Radiohead show?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-world-01",
+      "utterance": "who was Katherine Johnson?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-world-02",
+      "utterance": "what is Antoni Gaudí famous for?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-world-03",
+      "utterance": "when was Nelson Mandela born?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    }
+  ]
+}

cmd/mavend/testdata/scenarios/conversation_anaphora.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "name": "conversation_anaphora",
-  "description": "Five consecutive Russian turns about one object, replayed from the run that found V-542 on the box on 05-08-2026. He names a monitor, then asks four questions that all say \"он\" and never name it again.\n\nThis scenario exists because the shape had nowhere to fail. The routing fixture scores one utterance at a time, so a conversation that breaks on its second turn cannot lose a point there, and V-44 step 2 could only be verified by hand. That is item 3 of V-542.\n\nFour of the five replies below are WRONG, and the assertions pin them anyway. Read them as the recorded defect rather than the contract: she has the last four turns in front of her and never once names the thing he is asking about. Every wrong assertion is marked in its step note with what it must become. When V-542 lands, those flip and the ones marked correct do not move.\n\nWhat the four assert is that the reply LACKS \"монитор\". Absence is the defect itself: she is answering a question about a thing she wrote down two minutes ago and cannot name it. It also survives the fallback picker, which matters on the three query turns — they refuse from internal/phraser/fallbacks_ru_v1.json, four variants deep, and the same scenario returned \"тут я пас.\" one run and \"не знаю, честно.\" the next, so a string assertion there would pin the picker rather than the daemon.\n\nTurn 4 asserts its text as well, because that turn goes through the chat path and the chat path is now scriptable. scriptedPhraser in simulator_test.go answers PhraseChat from the same script entries the router reads (V-542 item 4); before it, the simulator wired phraser.NewStub() and no scenario could say what she SAYS on a chat turn at all.\n\nThe routes are scripted exactly as the box produced them, because the failure is not the model's. Turn 1 went to fact despite \"давай поболтаем\", every question after it went to query, and turn 4 went to chat. A scripted route is what lets this scenario pin the daemon's half without a llama-server in the loop.",
+  "description": "Five consecutive Russian turns about one object, replayed from the run that found V-542 on the box on 05-08-2026. He names a monitor once, then refers to it by pronoun or ellipsis for four turns.\n\nThe router decisions stay exactly as the box produced them: fact, query, query, chat, query. That is intentional. Routing sees one utterance; dialogue continuity owns what earlier turns make it mean. A grounded fact inside an explicit conversational opener is still stored, while its exact utterance also enters the transcript. Anaphoric queries are answered through chat with that transcript instead of walking note and world sources without their referent.\n\nEvery scripted chat answer below is conditional on history containing the original monitor turn. A canned reply therefore cannot make this scenario pass if session capture, cross-intent merge, history ordering or PhraseChat wiring loses the referent. The visible assertions require the answer to name the monitor, and the final tick remains the not-a-nag control.",
   "start": "2026-08-05T14:00:00+03:00",
   "script": [
     {
@@ -11,20 +11,27 @@
     },
     {
       "match": "он большой",
-      "route": "[{\"intent\":\"query\",\"text\":\"а он большой?\"}]"
+      "route": "[{\"intent\":\"query\",\"text\":\"а он большой?\"}]",
+      "reply": "{\"response\":\"Ты про новый монитор; диагональ ты пока не называл.\",\"mood\":\"neutral\"}",
+      "history_contains": ["купил новый монитор"]
     },
     {
       "match": "сколько он примерно стоит",
-      "route": "[{\"intent\":\"query\",\"text\":\"сколько он примерно стоит по-твоему?\"}]"
+      "route": "[{\"intent\":\"query\",\"text\":\"сколько он примерно стоит по-твоему?\"}]",
+      "reply": "{\"response\":\"Новый монитор без модели и диагонали я честно не оценю.\",\"mood\":\"thinking\"}",
+      "history_contains": ["купил новый монитор"]
     },
     {
       "match": "переплатил",
       "route": "[{\"intent\":\"chat\",\"text\":\"мне кажется я переплатил\"}]",
-      "reply": "{\"response\":\"я не знаю, о каком именно устройстве ты говоришь.\",\"mood\":\"neutral\"}"
+      "reply": "{\"response\":\"Про новый монитор поняла; цену лучше сравнить по точной модели.\",\"mood\":\"thinking\"}",
+      "history_contains": ["купил новый монитор"]
     },
     {
       "match": "стоит его вернуть",
-      "route": "[{\"intent\":\"query\",\"text\":\"стоит его вернуть?\"}]"
+      "route": "[{\"intent\":\"query\",\"text\":\"стоит его вернуть?\"}]",
+      "reply": "{\"response\":\"Новый монитор стоит вернуть, если сравнение подтвердит переплату или он тебе не подходит.\",\"mood\":\"neutral\"}",
+      "history_contains": ["купил новый монитор"]
     },
     {
       "match": "",
@@ -35,43 +42,42 @@
   "steps": [
     {
       "at": "14:00",
-      "note": "CORRECT, and it is the first half of the defect. \"давай поболтаем\" is an explicit request to converse and the turn is filed as a fact anyway. Storing what he said is not wrong on its own — he did buy a monitor — but the object then lives in the fact store and never enters the transcript PhraseChat reads. That is V-542 decision 2: either the marker claims the turn at stage 0, or it means nothing and comes out of the fixture.",
+      "note": "A substantive statement inside an explicit conversational opener remains a grounded fact, and the exact same utterance becomes dialogue context. Conversation is session state, not a competing storage intent.",
       "say": "давай поболтаем: я вчера купил новый монитор",
       "expect_events": ["purchase"],
       "expect_no_send": true
     },
     {
       "at": "14:01",
-      "note": "WRONG. \"он\" is the monitor from one turn ago, and she says she has no record of it. followUpMerge inherits prev.Slots.Key, and a query turn asking about a pronoun has no key to merge, so the question reaches the query sources naked and the notes source answers the only way it can. Must become: an answer about the monitor, or a route to chat where the transcript is.",
+      "note": "The query route cannot see earlier turns. The dialogue merge sees the anaphora and answers through chat with the transcript, which names the monitor.",
       "say": "а он большой?",
-      "expect_reply_lacks": ["монитор"],
+      "expect_reply_contains": ["монитор"],
       "expect_no_send": true
     },
     {
       "at": "14:02",
-      "note": "WRONG, and it rules out one explanation. This is not the previous turn failing to stick — it is the same wall a second time, two turns from where the monitor was named. Nothing accumulates across query turns.",
+      "note": "The referent survives a second routed-query boundary; the previous contextual turn did not replace the transcript anchor.",
       "say": "сколько он примерно стоит по-твоему?",
-      "expect_reply_lacks": ["монитор"],
+      "expect_reply_contains": ["монитор"],
       "expect_no_send": true
     },
     {
       "at": "14:03",
-      "note": "WRONG, and it is the same wall from the other side. This turn routed chat, so it HAD the history that Session.History holds, and it asks which device he means anyway — because turn 1's object went to the fact store rather than the transcript. So a source reading the conversation is not sufficient on its own; decision 1 has to say which store the referent comes from. This is the one step whose text is pinned: the reply is scripted and reaches PhraseChat, so it is the box's own words rather than a fallback pick. Must become: a reply that names the monitor.",
+      "note": "A native chat route reads the same cross-intent transcript, in chronological order, without receiving the current utterance twice.",
       "say": "мне кажется я переплатил",
-      "expect_reply_contains": ["о каком именно устройстве"],
-      "expect_reply_lacks": ["монитор"],
+      "expect_reply_contains": ["монитор"],
       "expect_no_send": true
     },
     {
       "at": "14:04",
-      "note": "WRONG. The fifth turn is the one that shows the cost. A returns question about a purchase two minutes old is answered with \"не нашла у тебя такой записи\", which is wrong in kind rather than merely unhelpful: the record exists, she wrote it herself at 14:00 under the key purchase.",
+      "note": "The fifth turn proves the oldest retained turn still supplies the referent after fact, query and chat crossings.",
       "say": "стоит его вернуть?",
-      "expect_reply_lacks": ["монитор"],
+      "expect_reply_contains": ["монитор"],
       "expect_no_send": true
     },
     {
       "at": "14:05",
-      "note": "CORRECT, and it is the control. Nothing in five conversational turns was sent at him unprompted, and a tick with him mid-conversation stays silent. Whatever V-542 changes must not change this.",
+      "note": "Control: session continuity is reactive state only. A tick during the conversation sends nothing unprompted.",
       "tick": true,
       "expect_no_send": true
     }

cmd/mavend/tick.go

@@ -10,11 +10,13 @@ package main
 
 import (
 	"context"
+	"crypto/sha256"
 	"errors"
 	"fmt"
 	"log"
 	"os"
 	"path/filepath"
+	"sort"
 	"sync"
 	"time"
 
@@ -226,18 +228,11 @@ func (t *tickLoop) tick(ctx context.Context, now time.Time) {
 	// detectPatterns below for how idempotence and dismissal are respected.
 	t.detectPatterns(ctx, now, state)
 
-	// reminders: gate-bypassing class. fired once, marked after a successful
-	// delivery.  a failed send leaves the reminder pending — the next tick
-	// re-gathers and re-attempts.
+	// reminders: gate-bypassing class. The presentation and retry clock live on
+	// the reminder occurrence, so a transport outage neither spends the model
+	// every tick nor changes what the reminder says after a restart.
 	for _, d := range loop.RemindDecisions(state, due) {
-		pr, err := t.phraser.PhraseReminder(ctx, d)
-		if err != nil {
-			log.Printf("tick: phrase reminder %d: %v", d.Reminder.ID, err)
-			continue
-		}
-		if _, err := t.dispatcher.DispatchReminder(ctx, pr, now); err != nil {
-			log.Printf("tick: dispatch reminder %d: %v", d.Reminder.ID, err)
-		}
+		t.deliverReminder(ctx, d, now)
 	}
 
 	// sev4-away repeats: re-send un-acked telegram nudges per repeatInterval.
@@ -263,6 +258,125 @@ func (t *tickLoop) tick(ctx context.Context, now time.Time) {
 	}
 }
 
+// deliverReminder advances one due reminder (or collapsed bundle) through the
+// durable delivery state. A phrase is cached before the first external send;
+// every definite failure advances the persisted bounded backoff.
+func (t *tickLoop) deliverReminder(ctx context.Context, d loop.ReminderDecision, now time.Time) {
+	originals := reminderOriginals(d.Reminder)
+	pr, cached := cachedReminderPhrase(d, originals)
+	if !cached {
+		var err error
+		pr, err = t.phraser.PhraseReminder(ctx, d)
+		if err == nil && pr.Body == "" {
+			err = errors.New("phraser returned an empty reminder body")
+		}
+		if err != nil {
+			log.Printf("tick: phrase reminder %d: %v", d.Reminder.ID, err)
+			t.scheduleReminderRetry(ctx, originals, now)
+			return
+		}
+		if pr.Mood == "" {
+			pr.Mood = "neutral"
+		}
+		group := reminderDeliveryGroup(originals)
+		if err := t.store.CacheReminderPhrase(
+			ctx, originals, group, pr.Body, pr.Summary, pr.Mood,
+		); err != nil {
+			// A cancellation or another completion can win while phrasing. Do
+			// not send a presentation that no longer owns every original.
+			log.Printf("tick: cache reminder %d phrase: %v", d.Reminder.ID, err)
+			return
+		}
+		// The store now owns the phrase, but this tick's value predates that
+		// write. Stamp the exact persisted occurrence identity onto the value
+		// handed to the dispatcher so its outbox row can suppress an ambiguous
+		// crash for both a real reminder and a synthetic collapsed bundle.
+		for i := range originals {
+			originals[i].DeliveryGroup = group
+			originals[i].PhraseBody = pr.Body
+			originals[i].PhraseSummary = pr.Summary
+			originals[i].PhraseMood = pr.Mood
+		}
+		if d.Reminder.ID == 0 {
+			d.Reminder.Collapsed = originals
+		} else {
+			d.Reminder = originals[0]
+		}
+	}
+	// A phraser is not allowed to substitute the reminder decision. In
+	// particular, the durable group stamped above must reach the outbox.
+	pr.Decision = d
+
+	if _, err := t.dispatcher.DispatchReminder(ctx, pr, now); err != nil {
+		log.Printf("tick: dispatch reminder %d: %v", d.Reminder.ID, err)
+		t.scheduleReminderRetry(ctx, originals, now)
+	}
+}
+
+func (t *tickLoop) scheduleReminderRetry(ctx context.Context, originals []store.Reminder, now time.Time) {
+	if err := t.store.ScheduleReminderRetry(ctx, originals, now); err != nil {
+		log.Printf("tick: schedule reminder retry: %v", err)
+	}
+}
+
+// reminderOriginals converts the synthetic ID=0 bundle back to real store
+// rows. Keeping this in one helper makes it impossible to accidentally persist
+// retry state against reminder zero.
+func reminderOriginals(r store.Reminder) []store.Reminder {
+	if r.ID == 0 {
+		return append([]store.Reminder(nil), r.Collapsed...)
+	}
+	return []store.Reminder{r}
+}
+
+// cachedReminderPhrase reconstructs a PhrasedReminder only when every original
+// agrees on one persisted group and presentation. That agreement is what lets
+// a collapsed bundle survive a restart without being re-phrased.
+func cachedReminderPhrase(d loop.ReminderDecision, originals []store.Reminder) (delivery.PhrasedReminder, bool) {
+	if len(originals) == 0 || !originals[0].HasDeliveryPhrase() {
+		return delivery.PhrasedReminder{}, false
+	}
+	first := originals[0]
+	for _, r := range originals[1:] {
+		if !r.HasDeliveryPhrase() ||
+			r.DeliveryGroup != first.DeliveryGroup ||
+			r.PhraseBody != first.PhraseBody ||
+			r.PhraseSummary != first.PhraseSummary ||
+			r.PhraseMood != first.PhraseMood {
+			return delivery.PhrasedReminder{}, false
+		}
+	}
+	mood := first.PhraseMood
+	if mood == "" {
+		mood = "neutral"
+	}
+	return delivery.PhrasedReminder{
+		Decision: d,
+		Body:     first.PhraseBody,
+		Summary:  first.PhraseSummary,
+		Mood:     mood,
+	}, true
+}
+
+// reminderDeliveryGroup deterministically names one occurrence or collapsed
+// set. The next-fire instant is part of the identity so a recurring reminder's
+// later occurrence can never inherit the previous occurrence's phrase.
+func reminderDeliveryGroup(originals []store.Reminder) string {
+	ordered := append([]store.Reminder(nil), originals...)
+	sort.Slice(ordered, func(i, j int) bool {
+		if ordered[i].ID == ordered[j].ID {
+			return ordered[i].NextFireTs.Before(ordered[j].NextFireTs)
+		}
+		return ordered[i].ID < ordered[j].ID
+	})
+	h := sha256.New()
+	for _, r := range ordered {
+		_, _ = fmt.Fprintf(h, "%d:%d;", r.ID, r.NextFireTs.UnixMilli())
+	}
+	sum := h.Sum(nil)
+	return fmt.Sprintf("reminder:%x", sum[:12])
+}
+
 // savePresence writes back the bucket GatherState just resolved.
 //
 // It lives here and not in GatherState because that method holds a read-only

cmd/mavend/tick_digest.go

@@ -125,12 +125,10 @@ const maxDigestSpokenItems = 3
 
 // enqueueSuppressedDigest scans this tick's trace for care candidates the
 // gate blocked for a genuine restraint reason and durably records the
-// digest-eligible ones (loop.DigestEligible). Phrasing happens once, here,
-// at enqueue time — not re-derived at drain time — the same way queueNudge
-// phrases once and caches, so a rule suppressed for hours isn't re-prompting
-// the LLM every tick it stays blocked (EnqueueDigestEntry's rule+body dedupe
-// makes repeat calls here harmless, but skipping the phrase call entirely
-// when a pending entry already exists avoids the LLM round-trip too).
+// digest-eligible ones (loop.DigestEligible). Before phrasing, the candidate's
+// rule-owned semantic fingerprint is checked against the durable queue. This
+// is intentionally not a prose hash or an in-memory cache: phrasing may vary,
+// and the first tick after a restart owes the same zero-model-work behavior.
 func (t *tickLoop) enqueueSuppressedDigest(ctx context.Context, trace *loop.TickTrace, state loop.State, now time.Time) {
 	if trace == nil {
 		return
@@ -142,7 +140,24 @@ func (t *tickLoop) enqueueSuppressedDigest(ctx context.Context, trace *loop.Tick
 		if !loop.DigestEligible(tr.Severity, tr.GateBlockedBy) {
 			continue
 		}
-		rule := loop.Rule{Name: tr.RuleName, Severity: tr.Severity}
+		rule, ok := t.ruleNamed(tr.RuleName)
+		if !ok {
+			log.Printf("tick: digest candidate %s has no configured rule", tr.RuleName)
+			continue
+		}
+		fingerprint, ok := loop.DigestCandidateFingerprint(rule, state)
+		if !ok {
+			log.Printf("tick: digest candidate %s has no semantic identity", tr.RuleName)
+			continue
+		}
+		if _, live, err := t.store.LiveDigestEntry(ctx, tr.RuleName, fingerprint, now); err != nil {
+			// If durable state cannot answer, do not spend model work whose
+			// result cannot be safely deduplicated or recorded.
+			log.Printf("tick: check digest candidate %s: %v", tr.RuleName, err)
+			continue
+		} else if live {
+			continue
+		}
 		cand := loop.Candidate{Rule: rule, Severity: tr.Severity, State: state}
 		pn, err := t.phraser.PhraseNudge(ctx, cand)
 		if err != nil {
@@ -150,15 +165,21 @@ func (t *tickLoop) enqueueSuppressedDigest(ctx context.Context, trace *loop.Tick
 			continue
 		}
 		expires := now.Add(digestExpiry)
-		if _, deduped, err := t.store.EnqueueDigestEntry(ctx, tr.RuleName, int(tr.Severity), pn.Body, now, expires); err != nil {
+		if _, _, err := t.store.EnqueueDigestEntry(ctx, tr.RuleName, fingerprint, int(tr.Severity), pn.Body, now, expires); err != nil {
 			log.Printf("tick: enqueue digest entry %s: %v", tr.RuleName, err)
-		} else if deduped {
-			// same suppressed nudge already pending — nothing new to say.
-			continue
 		}
 	}
 }
 
+func (t *tickLoop) ruleNamed(name string) (loop.Rule, bool) {
+	for _, rule := range t.rules {
+		if rule.Name == name {
+			return rule, true
+		}
+	}
+	return loop.Rule{}, false
+}
+
 // expireStaleDigest sweeps entries past their expiry once per tick — cheap
 // bookkeeping, mirrors ReconcileStaleDeliveryAttempts's shape.
 func (t *tickLoop) expireStaleDigest(ctx context.Context, now time.Time) {

cmd/mavend/tick_reminder_delivery_test.go

@@ -0,0 +1,170 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/delivery"
+	"github.com/kami/maven/internal/loop"
+	"github.com/kami/maven/internal/phraser"
+	"github.com/kami/maven/internal/store"
+)
+
+type reminderCountingPhraser struct {
+	phraser.Phraser
+	calls   int
+	body    string
+	summary string
+	mood    string
+}
+
+func (p *reminderCountingPhraser) PhraseReminder(_ context.Context, d loop.ReminderDecision) (delivery.PhrasedReminder, error) {
+	p.calls++
+	return delivery.PhrasedReminder{
+		Decision: d,
+		Body:     p.body,
+		Summary:  p.summary,
+		Mood:     p.mood,
+	}, nil
+}
+
+type reminderFailSink struct {
+	sends int
+}
+
+func (s *reminderFailSink) Send(_ context.Context, _ delivery.Sendable) error {
+	s.sends++
+	return errors.New("transport unavailable")
+}
+
+func newReminderDeliveryLoop(t *testing.T, st *store.Store, sink delivery.Sink, p phraser.Phraser) *tickLoop {
+	t.Helper()
+	rules := loop.DefaultRules()
+	return newTickLoop(
+		st,
+		loop.NewGatherer(st, rules),
+		delivery.NewDispatcher(delivery.Config{
+			Voice: sink, Ntfy: sink, Telegram: sink,
+			Nudges: st, Reminders: st, Outbox: st,
+		}),
+		p,
+		rules,
+		time.Second,
+		5*time.Minute,
+		0,
+		nil, nil, nil, nil,
+	)
+}
+
+func TestTickReminderRetryUsesPersistedPhraseAfterRestart(t *testing.T) {
+	st := newTestStore(t)
+	ctx := context.Background()
+	now := refNow()
+	if _, err := st.CreateReminder(ctx, now.Add(-time.Minute), `{"text":"позвонить маме"}`, ""); err != nil {
+		t.Fatal(err)
+	}
+
+	fail := &reminderFailSink{}
+	firstPhraser := &reminderCountingPhraser{
+		Phraser: phraser.NewStub(), body: "Не забудь позвонить маме.",
+		summary: "Позвонить маме", mood: "warm",
+	}
+	tl := newReminderDeliveryLoop(t, st, fail, firstPhraser)
+	tl.tick(ctx, now)
+	if firstPhraser.calls != 1 {
+		t.Fatalf("first tick phrased %d times, want 1", firstPhraser.calls)
+	}
+	rows, err := st.ListReminders(ctx, 1)
+	if err != nil || len(rows) != 1 {
+		t.Fatalf("list = %d, err=%v", len(rows), err)
+	}
+	if !rows[0].HasDeliveryPhrase() || rows[0].DeliveryAttempts != 1 {
+		t.Fatalf("failed delivery state was not persisted: %+v", rows[0])
+	}
+	if want := now.Add(store.ReminderRetryBase); !rows[0].NextAttemptTs.Equal(want) {
+		t.Fatalf("next attempt = %s, want %s", rows[0].NextAttemptTs, want)
+	}
+
+	// A normal tick inside the wait does no transport work and no model work.
+	sendsAfterFirst := fail.sends
+	tl.tick(ctx, now.Add(30*time.Second))
+	if firstPhraser.calls != 1 || fail.sends != sendsAfterFirst {
+		t.Fatalf("retry wait did work: phrase calls=%d, sends=%d (was %d)", firstPhraser.calls, fail.sends, sendsAfterFirst)
+	}
+
+	// Constructing a new loop is the daemon-restart boundary. Its phraser would
+	// say something different if called; the stored phrase must win instead.
+	success := &fakeSink{}
+	afterRestart := &reminderCountingPhraser{
+		Phraser: phraser.NewStub(), body: "WRONG NEW PHRASE", summary: "WRONG", mood: "neutral",
+	}
+	restarted := newReminderDeliveryLoop(t, st, success, afterRestart)
+	restarted.tick(ctx, now.Add(store.ReminderRetryBase))
+	if afterRestart.calls != 0 {
+		t.Fatalf("restart re-phrased the reminder %d times", afterRestart.calls)
+	}
+	if len(success.sends) != 1 {
+		t.Fatalf("retry sends = %d, want 1", len(success.sends))
+	}
+	if got := success.sends[0].Body; got != "Позвонить маме" {
+		t.Fatalf("away retry body = %q, want persisted summary", got)
+	}
+	rows, err = st.ListReminders(ctx, 1)
+	if err != nil || rows[0].Status != store.ReminderFired {
+		t.Fatalf("successful retry did not fire reminder: rows=%+v err=%v", rows, err)
+	}
+}
+
+func TestTickCollapsedReminderRetriesOnePhraseAndCompletesOriginals(t *testing.T) {
+	st := newTestStore(t)
+	ctx := context.Background()
+	now := refNow()
+	for _, text := range []string{"полить цветы", "записаться к врачу"} {
+		if _, err := st.CreateReminder(ctx, now.Add(-time.Minute), text, ""); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	fail := &reminderFailSink{}
+	firstPhraser := &reminderCountingPhraser{
+		Phraser: phraser.NewStub(), body: "У тебя два напоминания.",
+		summary: "Два напоминания", mood: "neutral",
+	}
+	newReminderDeliveryLoop(t, st, fail, firstPhraser).tick(ctx, now)
+	if firstPhraser.calls != 1 {
+		t.Fatalf("collapsed bundle phrased %d times, want 1", firstPhraser.calls)
+	}
+	rows, err := st.ListReminders(ctx, 10)
+	if err != nil || len(rows) != 2 {
+		t.Fatalf("list = %d, err=%v", len(rows), err)
+	}
+	for _, r := range rows {
+		if r.DeliveryGroup == "" || r.DeliveryGroup != rows[0].DeliveryGroup ||
+			r.PhraseBody != "У тебя два напоминания." || r.DeliveryAttempts != 1 {
+			t.Fatalf("collapsed original lost shared state: %+v", r)
+		}
+	}
+
+	success := &fakeSink{}
+	afterRestart := &reminderCountingPhraser{
+		Phraser: phraser.NewStub(), body: "WRONG", summary: "WRONG", mood: "neutral",
+	}
+	newReminderDeliveryLoop(t, st, success, afterRestart).tick(ctx, now.Add(store.ReminderRetryBase))
+	if afterRestart.calls != 0 {
+		t.Fatalf("collapsed retry re-phrased %d times", afterRestart.calls)
+	}
+	if len(success.sends) != 1 || success.sends[0].ReminderID != 0 {
+		t.Fatalf("collapsed retry sends = %+v, want one synthetic delivery", success.sends)
+	}
+	rows, err = st.ListReminders(ctx, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range rows {
+		if r.Status != store.ReminderFired {
+			t.Fatalf("collapsed original %d status = %q, want fired", r.ID, r.Status)
+		}
+	}
+}

cmd/mavend/voice.go

@@ -260,8 +260,9 @@ const (
 )
 
 // runTurn — the reactive turn pipeline shared by the voice and text entry
-// points: expired-clarify notice → confirm answer → clarify answer → quiet
-// toggle → route → dialogue merge → clarify question → action → replier.
+// points: expired-clarify notice → confirm answer → explicit correction →
+// clarify answer → quiet toggle → route → dialogue merge → clarify question →
+// action → replier.
 // Takes the already-transcribed utterance, returns the reply text; the voice
 // path wraps it in stt/tts, the text path returns it as-is.
 //
@@ -290,6 +291,14 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	now := h.now()
 	rt := h.newTurnRoute(text, now)
 	ctx = withTurnRoute(ctx, rt)
+	// A resolver may suspend an older clarify flow even when it handles this
+	// turn itself. Finalise that state at one choke point so early returns from
+	// confirm/repair/clarify cannot leave a live question parked without saying
+	// it again, or silently drop one when the suspension bound is reached.
+	defer func() {
+		reply = withNotice(rt.dropped, reply)
+		reply = withResumed(reply, rt.resume)
+	}()
 
 	// 1. expired clarify — a question was parked but its TTL ran out, so the
 	// request behind it is gone. Say that out loud (see clarify.go) and carry
@@ -310,7 +319,23 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 3. clarify answer — if she asked a live question last turn, this
+	// 3. spoken correction — an explicit "нет, это был вопрос" names both the
+	// prior mistake and its replacement. It is narrower evidence than a parked
+	// question merely being present, so it gets first refusal. Otherwise the
+	// clarify resolver treats the correction as a bad slot value and spends a
+	// retry on a turn that was never an answer (V-573).
+	if reply, handled := h.resolveRepair(ctx, text); notePreRoute(ctx, "repair", handled) {
+		return withNotice(expiredNotice, reply)
+	}
+
+	// 3b. The same correction without a target — "нет, не так". It cannot redo
+	// the turn, but it can durably label the previous decision as wrong. Like a
+	// targeted repair, it is not an answer to a parked slot question.
+	if reply, handled := h.resolveUntargetedRepair(ctx, text); notePreRoute(ctx, "repair-negative", handled) {
+		return withNotice(expiredNotice, reply)
+	}
+
+	// 4. clarify answer — if she asked a live question last turn, this
 	// utterance is its answer, not a fresh command. After the confirm check: a
 	// y/n gate is armed by her own prompt and is the narrower claim on the
 	// utterance.
@@ -321,20 +346,10 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	if reply, handled := h.resolveClarifyAnswer(ctx, text); notePreRoute(ctx, "clarify-answer", handled) {
 		return withNotice(expiredNotice, reply)
 	}
-	// It did not claim the turn. If it let a parked request go to get out of the
-	// way, that has to be said in front of whatever these words are answered
-	// with — carried on the same notice, so every exit below keeps it.
-	expiredNotice = withNotice(expiredNotice, rt.dropped)
+	// It did not claim the turn. Any drop notice or resumed question recorded on
+	// rt is attached by the turn finaliser above, including on an early return.
 
-	// 3b. and if it SUSPENDED a request instead of letting it go, the question
-	// comes back on the end of whatever these words are answered with (Vikunja
-	// #561). A deferred append rather than a call at each exit: there are eight
-	// returns between here and the replier, and the flow has to survive all of
-	// them — one that forgot would be a request parked for ever, waiting for an
-	// answer to a question he never heard asked.
-	defer func() { reply = withResumed(reply, rt.resume) }()
-
-	// 4. quiet-hours toggle — keyword match, not classifier-dependent.
+	// 5. quiet-hours toggle — keyword match, not classifier-dependent.
 	// "тихий режим" / "quiet on" would route through the classifier
 	// unreliably (it's a command, not a free-form query), so we match it
 	// before routing. Same pattern as the confirm turn above.
@@ -342,7 +357,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 4b. spoken snooze — "не сейчас" / "потом" answers the nudge she just
+	// 5b. spoken snooze — "не сейчас" / "потом" answers the nudge she just
 	// sent. Only handled when a pending nudge is actually inside the window
 	// (snooze.go); otherwise the words route normally, because "потом" is an
 	// ordinary word and eating every one of them would break real sentences.
@@ -350,30 +365,14 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 4c. spoken ack — "готово" closes that same nudge as `acted`. Only the
+	// 5c. spoken ack — "готово" closes that same nudge as `acted`. Only the
 	// contentless form is intercepted here; "выпил воды" keeps routing and
 	// closes the nudge after its fact lands (ackFromFact, step 8b).
 	if reply, handled := h.resolveAck(ctx, text, src); notePreRoute(ctx, "ack", handled) {
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 4d. spoken correction — "нет, это была заметка" points at the previous
-	// turn and names what it should have been (repair.go). Before routing,
-	// like the confirm and clarify turns: routing the correction as a fresh
-	// utterance files the correction itself instead of fixing anything.
-	if reply, handled := h.resolveRepair(ctx, text); notePreRoute(ctx, "repair", handled) {
-		return withNotice(expiredNotice, reply)
-	}
-
-	// 4d-ii. and the same correction without a target — "нет, не так" (V-636).
-	// After the targeted one, which is the narrower claim: an utterance that
-	// names an intent is answered by redoing the request, and this rung only
-	// gets the ones that name nothing.
-	if reply, handled := h.resolveUntargetedRepair(ctx, text); notePreRoute(ctx, "repair-negative", handled) {
-		return withNotice(expiredNotice, reply)
-	}
-
-	// 4e. ordinal selection — "второй", "первую сделал" pick from the list she
+	// 5d. ordinal selection — "второй", "первую сделал" pick from the list she
 	// just read (ordinal.go). Before routing, and only when a list is actually
 	// bound to the session: with nothing offered, "второй" is an ordinary word
 	// and keeps routing.
@@ -381,7 +380,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 5. route. An elliptical follow-up — "а завтра?" — is answered from the
+	// 6. route. An elliptical follow-up — "а завтра?" — is answered from the
 	// previous turn instead (continuation.go): the intent is the part it is
 	// missing, so no amount of routing recovers it, and the model's guess
 	// costs seconds to obtain and is close to a coin flip. Everything else
@@ -398,7 +397,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	}
 	log.Printf("voice: route result: intent=%s slots=%+v", dec.Intent, dec.Slots)
 
-	// 6. dialogue — fill this turn's missing slots from a prior same-intent
+	// 7. dialogue — fill this turn's missing slots from a prior same-intent
 	// turn (follow-ups like «напомни завтра» → «…позвонить маме»), then remember
 	// this turn for the next follow-up. Only same-intent, non-expired, non-
 	// clarify turns carry (see followUpMerge). Best-effort: nil store ⇒ skipped.
@@ -416,7 +415,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		}
 	}
 
-	// 7. clarify — something she needs is missing. If one named thing is missing,
+	// 8. clarify — something she needs is missing. If one named thing is missing,
 	// ask about it and park the request (clarify.go); otherwise the replier's
 	// canned reply stands.
 	//
@@ -443,7 +442,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		h.recordTurn(text, dec.Intent)
 	}
 
-	// 8. action — execute the decision's intent. errors here surface as
+	// 9. action — execute the decision's intent. errors here surface as
 	// short reply text (the user wants to know the action didn't land);
 	// the round-trip stays alive.
 	replyText := h.applyAction(ctx, dec)
@@ -452,11 +451,11 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	// intent has no chain and no scoreboard, so the handler is the winner.
 	noteTerminal(ctx, "action-handler", dec.Intent, "")
 
-	// 8b. a fact that answers a live nudge closes it as `acted` (ack.go).
+	// 9b. a fact that answers a live nudge closes it as `acted` (ack.go).
 	// Silent: the fact reply stands, she does not congratulate him for it.
 	h.ackFromFact(ctx, dec)
 
-	// 9. replier — phrase the reply across the router decision.
+	// 10. replier — phrase the reply across the router decision.
 	if replyText == "" {
 		replyText = h.replier.Reply(ctx, dec)
 	}
@@ -555,10 +554,17 @@ func (h *reactiveHandler) replySystem(ctx context.Context, dec router.Decision)
 // history lists. Shared by chatHistory and rememberTurn (clarify.go) so the
 // same session is described the same way in both places.
 func sessionAsTurn(s *dialogue.Session) dialogue.Turn {
+	text := s.Utterance
+	if text == "" {
+		// Compatibility with a session blob written before Utterance became a
+		// first-class field. Slots.Text was the old transcript by convention
+		// for query/chat/system turns, and is still better than dropping it.
+		text = s.Slots.Text
+	}
 	return dialogue.Turn{
 		Intent: s.Intent,
 		Slots:  s.Slots,
-		Text:   s.Slots.Text,
+		Text:   text,
 	}
 }
 
@@ -574,11 +580,12 @@ func (h *reactiveHandler) chatHistory(ctx context.Context) []dialogue.Turn {
 	if prev == nil {
 		return nil
 	}
-	// History already includes the immediate prior turn (set by the dialogue
-	// merge in runTurn's step 6, above), plus up to 3 more from deeper history.
-	out := make([]dialogue.Turn, 0, 1+len(prev.History))
-	out = append(out, sessionAsTurn(prev))
-	out = append(out, prev.History...)
+	// rememberTurn runs before the action so query handlers can bind candidate
+	// lists to the current session. Therefore prev is the CURRENT turn here;
+	// its History is precisely the prior transcript. Adding sessionAsTurn(prev)
+	// would hand the model the current utterance twice.
+	out := make([]dialogue.Turn, len(prev.History))
+	copy(out, prev.History)
 	return out
 }
 

cmd/mavend/voicewire.go

@@ -377,19 +377,19 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 // degraded mode, so the seam is nil and the cascade routes with the classifier.
 func modelSeam(cfg *config.Config, resident *llm.Client) (router.Completer, *llm.Pair) {
 	if resident == nil {
-		if cfg.Workstation != nil {
+		if cfg.Workstation != nil && !cfg.Workstation.ModelDisabled {
 			log.Printf("voice: a workstation is configured but there is no resident model to floor it with — ignoring the block")
 		}
 		return nil, nil
 	}
-	if cfg.Workstation == nil {
+	if cfg.Workstation == nil || cfg.Workstation.ModelDisabled {
 		return resident, nil
 	}
 	ws := cfg.Workstation
 	remote := llm.New(ws.URL, time.Duration(ws.Timeout))
 	remote.SetToken(ws.Token)
 	if ws.Token == "" {
-		log.Printf("voice: no workstation.token — mavgpud refuses an unauthenticated request, so this reads as a card that is always busy")
+		log.Printf("voice: unauthenticated workstation model endpoint is loopback-only")
 	}
 	pair := llm.NewPair(
 		remote,
@@ -434,7 +434,7 @@ func sttSeam(cfg *config.Config, floor stt.Transcriber) (stt.Transcriber, *stt.P
 	)
 	pair.Start(context.Background())
 	if s.Token == "" {
-		log.Print("voice: the workstation transcriber has no token, so anything on the LAN can post audio to it")
+		log.Print("voice: unauthenticated workstation transcriber endpoint is loopback-only")
 	}
 	log.Printf("voice: workstation transcriber at %s, probed every %s, mavsttd as the floor",
 		s.URL, time.Duration(s.Probe))

cmd/mavweb/ambient.go

@@ -4,6 +4,7 @@ import (
 	"crypto/subtle"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"log"
 	"net/http"
@@ -51,34 +52,41 @@ type ambientResp struct {
 // never registered, so it is treated as a hard failure here too.
 func handleAmbient(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, token string) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
 	if token == "" {
-		http.Error(w, "ambient ingest disabled (no -ambient-token)", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemIntegrationOff,
+			"ambient ingest disabled (no -ambient-token)", nil)
 		return
 	}
 	if !ambientAuthorized(r, token) {
-		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		writeProblem(w, r, http.StatusUnauthorized, problemUnauthorized,
+			"unauthorized", nil)
 		return
 	}
 	if core == nil {
-		http.Error(w, "ambient ingest disabled (no -core)", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemCoreUnavailable,
+			"ambient ingest disabled (no -core)", nil)
 		return
 	}
 
 	var n calendar.Notification
 	body, err := io.ReadAll(io.LimitReader(r.Body, ambientMaxBody))
 	if err != nil {
-		http.Error(w, "read failed", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"read failed", fmt.Errorf("read ambient request: %w", err))
 		return
 	}
 	if err := json.Unmarshal(body, &n); err != nil {
-		http.Error(w, "bad json", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"bad json", fmt.Errorf("decode ambient request: %w", err))
 		return
 	}
 	if n.Posted.IsZero() {
-		writeAmbient(w, http.StatusBadRequest, ambientResp{Reason: "posted_at is required"})
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"posted_at is required", nil)
 		return
 	}
 
@@ -99,8 +107,8 @@ func handleAmbient(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, tok
 		writeAmbient(w, http.StatusOK, ambientResp{Stored: false, Key: key, Reason: "unchanged"})
 		return
 	} else if err != nil && !errors.Is(err, ipc.ErrNoFact) {
-		log.Printf("ambient: read %s: %v", key, err)
-		http.Error(w, "read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"read failed", fmt.Errorf("read ambient fact %q: %w", key, err))
 		return
 	}
 
@@ -116,8 +124,8 @@ func handleAmbient(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, tok
 		Source:     calendar.SourceAmbient,
 		Confidence: calendar.AmbientConfidence,
 	}); err != nil {
-		log.Printf("ambient: write %s: %v", key, err)
-		http.Error(w, "write failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreWriteFailed,
+			"write failed", fmt.Errorf("write ambient fact %q: %w", key, err))
 		return
 	}
 	log.Printf("ambient: %s=%s (%s, pkg=%s)", key, val, calendar.SourceAmbient, n.Package)

cmd/mavweb/ambient_test.go

@@ -16,6 +16,18 @@ import (
 
 const ambientTestToken = "s3cret"
 
+func TestValidateAmbientConfig(t *testing.T) {
+	if err := validateAmbientConfig(false, ""); err != nil {
+		t.Fatalf("explicitly disabled ambient config: %v", err)
+	}
+	if err := validateAmbientConfig(true, ""); err == nil {
+		t.Fatal("enabled ambient ingest accepted an empty token")
+	}
+	if err := validateAmbientConfig(true, ambientTestToken); err != nil {
+		t.Fatalf("enabled authenticated ambient config: %v", err)
+	}
+}
+
 // ambientCore adds provenance-scoped reads to fakeCore, which the dedupe path
 // needs.
 type ambientCore struct {

cmd/mavweb/chat.go

@@ -3,7 +3,7 @@ package main
 import (
 	_ "embed"
 	"errors"
-	"log"
+	"fmt"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -47,7 +47,7 @@ var correctionTargets = []router.Intent{
 
 // handleChatPage renders the chat conversation page.
 func handleChatPage(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "chat") {
+	if !requireCore(w, r, core, "chat") {
 		return
 	}
 	msgs := []chatMsg{}
@@ -83,13 +83,14 @@ func handleChatPage(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 // denies, which is the point of that flag.
 func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !requireCore(w, core, "chat") {
+	if !requireCore(w, r, core, "chat") {
 		return
 	}
-	if !stepUpGate(w, session, requireStepUp) {
+	if !stepUpGate(w, r, session, requireStepUp) {
 		return
 	}
 	text := strings.TrimSpace(r.FormValue("text"))
@@ -105,8 +106,8 @@ func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, ses
 	// which is right for a single-owner box.
 	reply, err := core.Chat(r.Context(), "web", text)
 	if err != nil {
-		log.Printf("chat api: %v", err)
-		http.Redirect(w, r, "/chat", http.StatusSeeOther)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreChangeFailed,
+			"chat failed", fmt.Errorf("run web chat turn: %w", err))
 		return
 	}
 	// The claiming query source rides back on the redirect so the page can show
@@ -138,36 +139,40 @@ func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, ses
 // id could otherwise mislabel turns he never corrected.
 func handleCorrectAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !requireCore(w, core, "correct") {
+	if !requireCore(w, r, core, "correct") {
 		return
 	}
-	if !stepUpGate(w, session, requireStepUp) {
+	if !stepUpGate(w, r, session, requireStepUp) {
 		return
 	}
 	id, err := strconv.ParseInt(strings.TrimSpace(r.FormValue("trace_id")), 10, 64)
 	if err != nil || id <= 0 {
-		http.Error(w, "trace_id required", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"trace_id required", err)
 		return
 	}
 	shouldBe := strings.TrimSpace(r.FormValue("should_be"))
 	// Only one of the seven, or nothing. Free text here would put an unroutable
 	// label in the one table V-632 fits prototypes from.
 	if shouldBe != "" && !isCorrectionTarget(shouldBe) {
-		http.Error(w, "should_be must be one of the seven intents", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"should_be must be one of the seven intents", nil)
 		return
 	}
 	if err := core.CorrectTurn(r.Context(), id, shouldBe); err != nil {
-		log.Printf("correct turn %d: %v", id, err)
 		// A turn past the retention bound is gone, and saying so is different
 		// from saying the write broke.
 		if errors.Is(err, ipc.ErrNoSuchTrace) {
-			http.Error(w, "that turn is no longer stored", http.StatusNotFound)
+			writeProblem(w, r, http.StatusNotFound, problemResourceNotFound,
+				"that turn is no longer stored", fmt.Errorf("correct turn %d: %w", id, err))
 			return
 		}
-		http.Error(w, "correction failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreChangeFailed,
+			"correction failed", fmt.Errorf("correct turn %d: %w", id, err))
 		return
 	}
 	stamp := shouldBe

cmd/mavweb/ecosystem.go

@@ -33,17 +33,29 @@ func getEco(ctx context.Context, base, path string, out any) string {
 	}
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, base+path, nil)
 	if err != nil {
-		return err.Error()
+		log.Printf("ecosystem panel request_id=%s build %q: %v", requestIDFromContext(ctx), path, err)
+		return "invalid endpoint"
+	}
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("X-Requested-By", "mavweb")
+	// These are direct browser-surface reads rather than an action initiated in
+	// mavend, so the HTTP request ID is the natural correlation root. Calls that
+	// pass through core mint their action correlation inside mavend instead.
+	if id := requestIDFromContext(ctx); id != "" {
+		req.Header.Set("X-Correlation-ID", id)
 	}
 	resp, err := ecoClient.Do(req)
 	if err != nil {
+		log.Printf("ecosystem panel request_id=%s GET %s: %v", requestIDFromContext(ctx), path, err)
 		return "unreachable"
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != 200 {
+		log.Printf("ecosystem panel request_id=%s GET %s: HTTP %d", requestIDFromContext(ctx), path, resp.StatusCode)
 		return fmt.Sprintf("http %d", resp.StatusCode)
 	}
 	if err := json.NewDecoder(resp.Body).Decode(out); err != nil {
+		log.Printf("ecosystem panel request_id=%s decode %s: %v", requestIDFromContext(ctx), path, err)
 		return "bad json"
 	}
 	return ""
@@ -111,7 +123,7 @@ func handleEcosystem(w http.ResponseWriter, r *http.Request, urls ecoURLs, core
 	if core == nil {
 		d.Calls.Err = "not configured"
 	} else if rows, err := core.RecentEcosystemTraces(ctx, 50); err != nil {
-		log.Printf("ecosystem traces: %v", err)
+		log.Printf("ecosystem traces request_id=%s: %v", requestIDFromContext(ctx), err)
 		d.Calls.Err = "core read failed"
 	} else {
 		d.Calls.Rows = rows

cmd/mavweb/events_test.go

@@ -75,8 +75,13 @@ func TestEventsPageReportsAReadFailure(t *testing.T) {
 		t.Fatalf("status = %d, want 200 with the error rendered", w.Code)
 	}
 	body := w.Body.String()
-	if !strings.Contains(body, "journal unavailable") || !strings.Contains(body, "core is down") {
-		t.Errorf("page did not report the read failure: %s", body)
+	if !strings.Contains(body, "intake journal unavailable") ||
+		!strings.Contains(body, string(problemCoreReadFailed)) ||
+		!strings.Contains(body, "request ") {
+		t.Errorf("page did not report a traceable, sanitized read failure: %s", body)
+	}
+	if strings.Contains(body, "core is down") {
+		t.Errorf("page disclosed the internal read error: %s", body)
 	}
 	if strings.Contains(body, "nothing has arrived yet") {
 		t.Error("a failed read rendered as an empty journal")

cmd/mavweb/facts.go

@@ -3,6 +3,7 @@ package main
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"log"
 	"net/http"
 	"strings"
@@ -32,16 +33,18 @@ var presenceSignals = map[string]string{
 // is a marker. Only allowlisted keys are accepted (see presenceSignals).
 func handleSignal(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !requireCore(w, core, "presence ingest") {
+	if !requireCore(w, r, core, "presence ingest") {
 		return
 	}
 	key := r.URL.Query().Get("key")
 	source, ok := presenceSignals[key]
 	if !ok {
-		http.Error(w, "unknown signal key", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"unknown signal key", nil)
 		return
 	}
 	// kind=env: an observation about the device/surface, NOT a self-fact — a
@@ -56,8 +59,8 @@ func handleSignal(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 		Source:     source,
 		Confidence: 1.0,
 	}); err != nil {
-		log.Printf("signal %s: %v", key, err)
-		http.Error(w, "write failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreWriteFailed,
+			"write failed", fmt.Errorf("write presence signal %q: %w", key, err))
 		return
 	}
 	w.WriteHeader(http.StatusNoContent)
@@ -65,29 +68,32 @@ func handleSignal(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 
 func handleRevert(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !requireCore(w, core, "revert") {
+	if !requireCore(w, r, core, "revert") {
 		return
 	}
-	if !stepUpGate(w, session, requireStepUp) {
+	if !stepUpGate(w, r, session, requireStepUp) {
 		return
 	}
 
 	key := strings.TrimSpace(r.FormValue("key"))
 	if key == "" {
-		http.Error(w, "key required", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"key required", nil)
 		return
 	}
 	newID, err := core.RevertFact(r.Context(), key)
 	if err != nil {
-		log.Printf("revert %q: %v", key, err)
 		if errors.Is(err, ipc.ErrNoFact) {
-			http.Error(w, "no fact to revert", http.StatusNotFound)
+			writeProblem(w, r, http.StatusNotFound, problemResourceNotFound,
+				"no fact to revert", fmt.Errorf("revert fact %q: %w", key, err))
 			return
 		}
-		http.Error(w, "revert failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreChangeFailed,
+			"revert failed", fmt.Errorf("revert fact %q: %w", key, err))
 		return
 	}
 	log.Printf("reverted fact for key=%s, new_id=%d", key, newID)

cmd/mavweb/handlers_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -1218,7 +1219,7 @@ func TestHandleTools_GET_MCPUnavailable(t *testing.T) {
 
 // --- voice-path step-up gate (Vikunja #317) ---
 //
-// POST /api/ptt and GET /ws proxy audio into mavend's voice port, which runs
+// POST /api/ptt proxies audio into mavend's voice port, which runs
 // the same router, LLM and act path as POST /api/chat. They used to be
 // ungated on the grounds that the voice port is only reachable inside the
 // deploy, but mavweb is the thing proxying into it from outside. Speaking
@@ -1269,29 +1270,31 @@ func TestHandlePTT_FailOpenByDefault(t *testing.T) {
 	}
 }
 
-func TestHandleWS_RequireStepUp_FailsClosed(t *testing.T) {
+type endlessByteReader struct{}
+
+func (endlessByteReader) Read(p []byte) (int, error) {
+	for i := range p {
+		p[i] = 'x'
+	}
+	return len(p), nil
+}
+
+func TestHandlePTT_RejectsOversizeAudioBeforeDial(t *testing.T) {
+	req := httptest.NewRequest(http.MethodPost, "/api/ptt", nil)
+	req.Body = io.NopCloser(io.LimitReader(endlessByteReader{}, maxPTTAudioBytes+1))
+	req.ContentLength = maxPTTAudioBytes + 1
 	rr := httptest.NewRecorder()
-	handleWS(rr, httptest.NewRequest(http.MethodGet, "/ws", nil), unreachableVoice, nil, true)
-	if rr.Code != http.StatusForbidden {
-		t.Fatalf("status = %d, want 403; body=%s", rr.Code, rr.Body.String())
+	handlePTT(rr, req, unreachableVoice, nil, false)
+	if rr.Code != http.StatusRequestEntityTooLarge {
+		t.Fatalf("status = %d, want 413; body=%s", rr.Code, rr.Body.String())
 	}
 }
 
-func TestHandleWS_UnassertedSession_Denied(t *testing.T) {
-	rr := httptest.NewRecorder()
-	handleWS(rr, httptest.NewRequest(http.MethodGet, "/ws", nil), unreachableVoice, webauthn.NewPasskeySession(5*time.Minute), false)
-	if rr.Code != http.StatusForbidden {
-		t.Fatalf("status = %d, want 403; body=%s", rr.Code, rr.Body.String())
-	}
-}
-
-// Past the gate the handshake itself fails (httptest's recorder cannot be
-// hijacked), which is not a 403. That is all this asserts: the gate let it by.
-func TestHandleWS_AssertedSession_PassesGate(t *testing.T) {
-	rr := httptest.NewRecorder()
-	handleWS(rr, httptest.NewRequest(http.MethodGet, "/ws", nil), unreachableVoice, stepUpSession(), true)
-	if rr.Code == http.StatusForbidden {
-		t.Fatalf("status = 403 on an asserted session; body=%s", rr.Body.String())
+func TestMavwebHTTPServerHasTransportLimits(t *testing.T) {
+	srv := mavwebHTTPServer("127.0.0.1:0", http.NewServeMux())
+	if srv.ReadHeaderTimeout != mavwebReadHeaderTimeout || srv.ReadTimeout != mavwebReadTimeout ||
+		srv.IdleTimeout != mavwebIdleTimeout || srv.MaxHeaderBytes != mavwebMaxHeaderBytes {
+		t.Fatalf("server transport limits are incomplete: %+v", srv)
 	}
 }
 

cmd/mavweb/main.go

@@ -41,16 +41,21 @@ func main() {
 	coreSock := flag.String("core", "", "mavend IPC socket path for presence-signal ingest (empty = disabled)")
 	pkOrigin := flag.String("webauthn-origin", "", "WebAuthn origin URL (e.g. https://maven.kvmx.ru)")
 	pkRPID := flag.String("webauthn-rpid", "", "WebAuthn RP ID (e.g. maven.kvmx.ru)")
-	requireStepUp := flag.Bool("require-stepup", false, "fail closed on step-up-gated actions (POST /tools, /routines, /models, /api/revert, /api/chat, /api/ptt and GET /ws) when WebAuthn step-up cannot be asserted; default false preserves the historical fail-open behaviour")
+	requireStepUp := flag.Bool("require-stepup", false, "fail closed on step-up-gated actions (POST /tools, /routines, /models, /api/revert, /api/chat and /api/ptt) when WebAuthn step-up cannot be asserted; default false preserves the historical fail-open behaviour")
 	pkFile := flag.String("passkey-file", "./passkeys.json", "path to WebAuthn credential store (JSON)")
 	nexusURL := flag.String("nexus", "", "Nexus base URL for the /ecosystem panel (empty = not configured)")
 	praxisURL := flag.String("praxis", "", "Praxis base URL for the /ecosystem panel (empty = not configured)")
 	hexisURL := flag.String("hexis", "", "Hexis base URL for the /ecosystem panel (empty = not configured)")
 	// Shared secret for POST /api/ambient, the notification-relay ingest that
 	// reads the work calendar as a signal instead of holding a work credential
-	// (see ambient.go). Empty ⇒ the route is not registered at all.
-	ambientToken := flag.String("ambient-token", "", "shared secret for POST /api/ambient notification ingest (empty = ingest disabled, route not registered)")
+	// (see ambient.go). Enabling and authenticating are separate on purpose: an
+	// expanded-empty secret cannot silently turn a live integration off.
+	ambientEnabled := flag.Bool("ambient-enabled", false, "enable POST /api/ambient notification ingest (requires -ambient-token)")
+	ambientToken := flag.String("ambient-token", "", "shared secret for POST /api/ambient notification ingest")
 	flag.Parse()
+	if err := validateAmbientConfig(*ambientEnabled, *ambientToken); err != nil {
+		log.Fatal(err)
+	}
 
 	var core ipc.CoreAPI
 	// swapConn — a second connection, for /models and nothing else. A model swap
@@ -129,9 +134,9 @@ func main() {
 		w.Write([]byte(*ntfyWS))
 	})
 	mux.HandleFunc("/api/signal", corePage(handleSignal))
-	// Off unless configured: no token, no route — an unconfigured ingest is not
-	// a 503 waiting to be probed, it does not exist.
-	if *ambientToken != "" {
+	// Off unless explicitly enabled: a dark ingest has no route at all, while an
+	// enabled ingest with no token was rejected before the server was built.
+	if *ambientEnabled {
 		mux.HandleFunc("/api/ambient", func(w http.ResponseWriter, r *http.Request) {
 			handleAmbient(w, r, core, *ambientToken)
 		})
@@ -194,7 +199,6 @@ func main() {
 	//   POST /api/chat   step-up  — reaches the router, LLM and the act path
 	//   POST /api/ptt    step-up  — audio into runTurn, so the same router,
 	//                               LLM and act path as /api/chat
-	//   GET  /ws         step-up  — same, streamed
 	//   POST /api/signal none     — appends a presence fact, no argv, no act
 	//   POST /api/ambient shared secret — notification relay, constant-time
 	//                               token compare, poster is a phone service
@@ -203,7 +207,7 @@ func main() {
 	// "step-up" means stepUpOK: asserted passkey when WebAuthn is configured,
 	// otherwise fail-open unless -require-stepup, which denies.
 	//
-	// /api/ptt and /ws used to be ungated, justified by mavend's voice port
+	// /api/ptt used to be ungated, justified by mavend's voice port
 	// being reachable only inside the deploy. That argument does not hold:
 	// mavweb is the thing proxying into it from outside. Speaking "выключи
 	// свет" is not a smaller act than typing it (Vikunja #317).
@@ -232,14 +236,11 @@ func main() {
 	mux.HandleFunc("/models", func(w http.ResponseWriter, r *http.Request) {
 		handleModels(w, r, core, swapConn, stepUpSession, *requireStepUp)
 	})
-	mux.HandleFunc("/ws", func(w http.ResponseWriter, r *http.Request) {
-		handleWS(w, r, *voiceAddr, stepUpSession, *requireStepUp)
-	})
 	mux.HandleFunc("/api/ptt", func(w http.ResponseWriter, r *http.Request) {
 		handlePTT(w, r, *voiceAddr, stepUpSession, *requireStepUp)
 	})
 
-	srv := &http.Server{Addr: *addr, Handler: mux}
+	srv := mavwebHTTPServer(*addr, mux)
 
 	go func() {
 		sig := make(chan os.Signal, 1)
@@ -255,6 +256,13 @@ func main() {
 	}
 }
 
+func validateAmbientConfig(enabled bool, token string) error {
+	if enabled && token == "" {
+		return errors.New("mavweb: ambient ingest is enabled but -ambient-token is empty")
+	}
+	return nil
+}
+
 // logUnguardedSurfaces names, at startup, what step-up would have covered had
 // WebAuthn been configured. One surface per line: these are read in a terminal
 // at the moment someone is deciding whether the box is safe to expose.
@@ -266,7 +274,6 @@ func logUnguardedSurfaces(requireStepUp bool) {
 		"POST /api/revert   voids the latest fact for a key",
 		"POST /api/chat     reaches the router, the LLM and, through applyAction, the act path",
 		"POST /api/ptt      the same, from audio",
-		"GET  /ws           the same, streamed",
 	}
 	if requireStepUp {
 		log.Printf("SECURITY: step-up verification is DISABLED (-webauthn-origin/-webauthn-rpid unset) and -require-stepup is set. These surfaces will be DENIED (403):")
@@ -282,3 +289,21 @@ func logUnguardedSurfaces(requireStepUp bool) {
 		log.Printf("SECURITY: they rest on the transport-level auth in front of mavweb (wg+nginx+auth). Do NOT expose -addr on a public interface. Set -webauthn-origin and -webauthn-rpid to require passkey step-up, or pass -require-stepup to fail closed instead.")
 	}
 }
+
+const (
+	mavwebReadHeaderTimeout = 10 * time.Second
+	mavwebReadTimeout       = 2 * time.Minute
+	mavwebIdleTimeout       = 2 * time.Minute
+	mavwebMaxHeaderBytes    = 32 << 10
+)
+
+func mavwebHTTPServer(addr string, handler http.Handler) *http.Server {
+	return &http.Server{
+		Addr:              addr,
+		Handler:           withRequestID(handler),
+		ReadHeaderTimeout: mavwebReadHeaderTimeout,
+		ReadTimeout:       mavwebReadTimeout,
+		IdleTimeout:       mavwebIdleTimeout,
+		MaxHeaderBytes:    mavwebMaxHeaderBytes,
+	}
+}

cmd/mavweb/models.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	_ "embed"
 	"errors"
+	"fmt"
 	"log"
 	"net/http"
 	"strconv"
@@ -57,7 +58,8 @@ type modelsPage struct {
 // the reply. On its own connection the swap only blocks the swap.
 func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swapConn modelController, session *webauthn.PasskeySession, requireStepUp bool) {
 	if core == nil {
-		http.Error(w, "models disabled (no -core)", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemCoreUnavailable,
+			"models disabled (no -core)", nil)
 		return
 	}
 	mc, ok := swapConn, swapConn != nil
@@ -65,7 +67,8 @@ func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swap
 		mc, ok = core.(modelController)
 	}
 	if !ok {
-		http.Error(w, "models unavailable: core connection does not support model swap", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemModelsUnavailable,
+			"models unavailable: core connection does not support model swap", nil)
 		return
 	}
 	ctx := r.Context()
@@ -73,12 +76,14 @@ func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swap
 
 	if r.Method == http.MethodPost {
 		if !stepUpOK(session, requireStepUp) {
-			http.Error(w, "step-up required: assert a passkey first", http.StatusForbidden)
+			writeProblem(w, r, http.StatusForbidden, problemStepUpRequired,
+				"step-up required: assert a passkey first", nil)
 			return
 		}
 		path := strings.TrimSpace(r.FormValue("model_path"))
 		if path == "" {
-			http.Error(w, "model_path required", http.StatusBadRequest)
+			writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+				"model_path required", nil)
 			return
 		}
 		// Only the path comes off the form. n_ctx and n_gpu_layers are load
@@ -93,20 +98,26 @@ func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swap
 			page.Msg = "loaded " + res.Model + " (" + strconv.FormatInt(res.TookMs, 10) + "ms)"
 			log.Printf("models: swapped to %s (%s) in %dms", res.ModelPath, res.Model, res.TookMs)
 		case errors.Is(err, ipc.ErrForbidden):
-			http.Error(w, "refused: that model is not in phraser.swap_models, or step-up was not asserted", http.StatusForbidden)
+			writeProblem(w, r, http.StatusForbidden, problemModelsForbidden,
+				"refused: that model is not in phraser.swap_models, or step-up was not asserted",
+				fmt.Errorf("swap model %q: %w", path, err))
 			return
 		case errors.Is(err, ipc.ErrUnknownMethod):
-			http.Error(w, "swap not configured on this core", http.StatusServiceUnavailable)
+			writeProblem(w, r, http.StatusServiceUnavailable, problemModelsUnavailable,
+				"swap not configured on this core", fmt.Errorf("swap model %q: %w", path, err))
 			return
 		case res.NoBackend:
-			page.Err = "swap failed AND the rollback failed — no model is loaded. She is answering from templates and routing on the classifier. Try loading a model again; a restart is not needed."
-			log.Printf("models: swap to %s failed and the rollback failed, no model loaded: %v", path, err)
+			page.Err = inlineProblem(r, problemModelsUnavailable,
+				"swap failed AND the rollback failed — no model is loaded. She is answering from templates and routing on the classifier. Try loading a model again; a restart is not needed.",
+				fmt.Errorf("swap model %q and rollback: %w", path, err))
 		case res.RolledBack:
-			page.Err = "swap failed, rolled back to " + res.Model + " — she is still answering, with the old model"
-			log.Printf("models: swap to %s failed, rolled back: %v", path, err)
+			page.Err = inlineProblem(r, problemModelsUnavailable,
+				"swap failed, rolled back to "+res.Model+" — she is still answering, with the old model",
+				fmt.Errorf("swap model %q, rolled back to %q: %w", path, res.Model, err))
 		default:
-			page.Err = "swap failed: " + err.Error()
-			log.Printf("models: swap to %s failed: %v", path, err)
+			page.Err = inlineProblem(r, problemModelsUnavailable,
+				"swap failed; the current model state is shown below",
+				fmt.Errorf("swap model %q: %w", path, err))
 		}
 	}
 
@@ -115,8 +126,8 @@ func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swap
 		if errors.Is(err, ipc.ErrUnknownMethod) {
 			page.Off = true
 		} else {
-			log.Printf("models: status: %v", err)
-			http.Error(w, "core read failed", http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+				"core read failed", fmt.Errorf("read model status: %w", err))
 			return
 		}
 	}

cmd/mavweb/models_test.go

@@ -149,6 +149,27 @@ type errBrokenModel struct{}
 
 func (errBrokenModel) Error() string { return "llm: server did not start" }
 
+type errPrivateModel struct{}
+
+func (errPrivateModel) Error() string { return "exec /private/llama-server: token rejected" }
+
+func TestModels_SwapFailureIsSanitizedAndTraceable(t *testing.T) {
+	core := &fakeModelCore{
+		swapErr: errPrivateModel{},
+		status:  ipc.ModelStatusResp{Model: "qwen3", ModelPath: "/m/old.gguf"},
+	}
+	w := modelsPOST(t, core, nil, false, "/m/cpt.gguf")
+	body := w.Body.String()
+	for _, want := range []string{"swap failed", string(problemModelsUnavailable), "request "} {
+		if !strings.Contains(body, want) {
+			t.Errorf("sanitized model error missing %q:\n%s", want, body)
+		}
+	}
+	if strings.Contains(body, "/private/llama-server") || strings.Contains(body, "token rejected") {
+		t.Errorf("model page disclosed the backend error:\n%s", body)
+	}
+}
+
 func TestModels_TotalFailureDoesNotSaySheIsStillAnswering(t *testing.T) {
 	// The load failed and so did the rollback: nothing is loaded. The page used
 	// to branch on RolledBack first and render "rolled back to  — she is still

cmd/mavweb/notifications.go

@@ -2,7 +2,7 @@ package main
 
 import (
 	_ "embed"
-	"log"
+	"fmt"
 	"net/http"
 	"strconv"
 
@@ -48,14 +48,14 @@ func deliveryRows(as []ipc.DeliveryAttempt) []deliveryRow {
 }
 
 func handleNotifications(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "notifications") {
+	if !requireCore(w, r, core, "notifications") {
 		return
 	}
 	ctx := r.Context()
 	nudges, err := core.RecentNudges(ctx, 50)
 	if err != nil {
-		log.Printf("notifications: %v", err)
-		http.Error(w, "notifications error: "+err.Error(), http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"notifications unavailable", fmt.Errorf("read recent nudges: %w", err))
 		return
 	}
 	// The outbox, on the page that already answers "what did she send".
@@ -66,7 +66,8 @@ func handleNotifications(w http.ResponseWriter, r *http.Request, core ipc.CoreAP
 	if err != nil {
 		// The nudge list is still worth showing, so this is a note on the page
 		// rather than a dead page.
-		log.Printf("notifications: delivery attempts: %v", err)
+		logProblem(r, http.StatusOK, problemCoreReadFailed,
+			"delivery attempts unavailable", fmt.Errorf("read delivery attempts: %w", err))
 	}
 	renderPage(w, notificationsTmpl, map[string]any{
 		"Nudges":   nudges,

cmd/mavweb/pages.go

@@ -3,8 +3,8 @@ package main
 import (
 	"cmp"
 	_ "embed"
+	"fmt"
 	"html/template"
-	"log"
 	"net/http"
 	"strings"
 	"time"
@@ -73,7 +73,7 @@ var voiceTmpl = parsePage("voice", voiceHTML, nil)
 var ecosystemTmpl = parsePage("ecosystem", ecosystemHTML, nil)
 
 func handleDash(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "dash") {
+	if !requireCore(w, r, core, "dash") {
 		return
 	}
 	ctx := r.Context()
@@ -82,8 +82,8 @@ func handleDash(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	nudges, err3 := core.RecentNudges(ctx, 50)
 	notes, err4 := core.RecentNotes(ctx, 50)
 	if err := cmp.Or(err1, err2, err3, err4); err != nil {
-		log.Printf("dash: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("read dashboard: %w", err))
 		return
 	}
 	renderPage(w, dashTmpl, struct {
@@ -95,13 +95,13 @@ func handleDash(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 }
 
 func handleHistory(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "history") {
+	if !requireCore(w, r, core, "history") {
 		return
 	}
 	facts, err := core.RecentFacts(r.Context(), 200)
 	if err != nil {
-		log.Printf("history: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("read fact history: %w", err))
 		return
 	}
 	renderPage(w, historyTmpl, struct {
@@ -110,13 +110,13 @@ func handleHistory(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 }
 
 func handleTrace(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "trace") {
+	if !requireCore(w, r, core, "trace") {
 		return
 	}
 	trace, err := core.TickTrace(r.Context())
 	if err != nil {
-		log.Printf("trace: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("read tick trace: %w", err))
 		return
 	}
 	// The turn records share this page rather than getting one of their own
@@ -127,7 +127,8 @@ func handleTrace(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	// deploy.
 	turns, err := core.TurnDecisions(r.Context(), 25)
 	if err != nil {
-		log.Printf("trace: turn decisions: %v", err)
+		logProblem(r, http.StatusOK, problemCoreReadFailed,
+			"turn decisions unavailable", fmt.Errorf("read turn decisions: %w", err))
 	}
 	renderPage(w, traceTmpl, traceData{Tick: trace, Turns: turns})
 }
@@ -149,14 +150,14 @@ type morningView struct {
 }
 
 func handleMorning(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "morning") {
+	if !requireCore(w, r, core, "morning") {
 		return
 	}
 	ctx := r.Context()
 	status, err := core.MorningStatus(ctx)
 	if err != nil {
-		log.Printf("morning: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("read morning status: %w", err))
 		return
 	}
 	view := morningView{Routines: status}
@@ -165,8 +166,8 @@ func handleMorning(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	// down with it — the page degrades to what it had before.
 	plan, err := core.DayPlan(ctx)
 	if err != nil {
-		log.Printf("morning: day plan: %v", err)
-		view.PlanErr = err.Error()
+		view.PlanErr = inlineProblem(r, problemCoreReadFailed,
+			"day plan unavailable", fmt.Errorf("read day plan: %w", err))
 	} else {
 		view.Plan = &plan
 	}
@@ -186,14 +187,14 @@ type eventsView struct {
 const eventsPageLimit = 200
 
 func handleEvents(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "intake journal") {
+	if !requireCore(w, r, core, "intake journal") {
 		return
 	}
 	var view eventsView
 	evs, err := core.RecentEvents(r.Context(), eventsPageLimit)
 	if err != nil {
-		log.Printf("events: %v", err)
-		view.Err = err.Error()
+		view.Err = inlineProblem(r, problemCoreReadFailed,
+			"intake journal unavailable", fmt.Errorf("read intake journal: %w", err))
 	} else {
 		view.Events = evs
 	}

cmd/mavweb/problems.go

@@ -0,0 +1,118 @@
+package main
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+)
+
+// problemCode is the stable, low-cardinality name a client can key on. The
+// request ID identifies one occurrence; the code identifies the class of
+// failure without exposing the wrapped implementation error.
+type problemCode string
+
+const (
+	problemMethodNotAllowed  problemCode = "request.method_not_allowed"
+	problemInvalidRequest    problemCode = "request.invalid"
+	problemPayloadTooLarge   problemCode = "request.payload_too_large"
+	problemUnauthorized      problemCode = "auth.unauthorized"
+	problemStepUpRequired    problemCode = "auth.step_up_required"
+	problemResourceNotFound  problemCode = "resource.not_found"
+	problemIntegrationOff    problemCode = "integration.disabled"
+	problemCoreUnavailable   problemCode = "core.unavailable"
+	problemCoreReadFailed    problemCode = "core.read_failed"
+	problemCoreWriteFailed   problemCode = "core.write_failed"
+	problemCoreChangeFailed  problemCode = "core.change_failed"
+	problemToolsChange       problemCode = "tools.change_failed"
+	problemRoutinesChange    problemCode = "routines.change_failed"
+	problemModelsUnavailable problemCode = "models.unavailable"
+	problemModelsForbidden   problemCode = "models.forbidden"
+	problemWebAuthnBegin     problemCode = "webauthn.begin_failed"
+	problemWebAuthnFinish    problemCode = "webauthn.finish_failed"
+	problemWebAuthnStepUp    problemCode = "webauthn.step_up_failed"
+	problemVoiceUnavailable  problemCode = "voice.unavailable"
+	problemVoiceTransport    problemCode = "voice.transport_failed"
+	problemVoiceResponse     problemCode = "voice.response_failed"
+)
+
+type requestIDKey struct{}
+
+// problemLogger is separate from the package-wide logger so the contract test
+// can capture exactly one problem line without redirecting unrelated output.
+var problemLogger = log.New(os.Stderr, "", log.LstdFlags)
+
+// problemResponse is the one non-success envelope returned by mavweb. Error is
+// deliberately a public message, never err.Error(). Code is stable across
+// occurrences; request_id joins this answer to the full server-side log line.
+type problemResponse struct {
+	Error     string      `json:"error"`
+	Code      problemCode `json:"code"`
+	RequestID string      `json:"request_id"`
+}
+
+// withRequestID mints the request identifier at the HTTP boundary. A caller's
+// X-Request-ID is ignored: accepting it would let an untrusted client forge a
+// link to another request's logs. The generated ID is also returned on success,
+// which lets an operator start from any surprising response, not errors alone.
+func withRequestID(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		id := rand.Text()
+		w.Header().Set("X-Request-ID", id)
+		ctx := context.WithValue(r.Context(), requestIDKey{}, id)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func requestIDFromContext(ctx context.Context) string {
+	id, _ := ctx.Value(requestIDKey{}).(string)
+	return id
+}
+
+func problemRequestID(r *http.Request) string {
+	id := requestIDFromContext(r.Context())
+	if id == "" {
+		id = rand.Text()
+	}
+	return id
+}
+
+func logProblem(r *http.Request, status int, code problemCode, public string, err error) string {
+	id := problemRequestID(r)
+	if err == nil {
+		err = errors.New(public)
+	}
+	problemLogger.Printf("mavweb problem request_id=%s code=%s status=%d method=%s path=%q: %v",
+		id, code, status, r.Method, r.URL.Path, err)
+	return id
+}
+
+// inlineProblem preserves a useful partial page when one panel fails, while
+// applying the same disclosure and correlation rules as an HTTP problem.
+func inlineProblem(r *http.Request, code problemCode, public string, err error) string {
+	id := logProblem(r, http.StatusOK, code, public, err)
+	return fmt.Sprintf("%s (code %s, request %s)", public, code, id)
+}
+
+// writeProblem is the only mavweb HTTP error writer. The wrapped error is
+// logged in full and only the explicit public message, stable code and request
+// ID cross the HTTP boundary.
+func writeProblem(w http.ResponseWriter, r *http.Request, status int, code problemCode, public string, err error) {
+	// Unit-level handlers and embedders may call a handler without installing
+	// the server middleware. They still get the same traceable contract.
+	id := logProblem(r, status, code, public, err)
+	w.Header().Set("X-Request-ID", id)
+
+	w.Header().Set("Content-Type", "application/problem+json; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(status)
+	// A failed client connection leaves nowhere useful to report an encoder
+	// error; the full problem is already in the server log before this write.
+	_ = json.NewEncoder(w).Encode(problemResponse{
+		Error: public, Code: code, RequestID: id,
+	})
+}

cmd/mavweb/problems_test.go

@@ -0,0 +1,135 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"io"
+	"log"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestWriteProblemSanitizesAndCorrelates(t *testing.T) {
+	var logs bytes.Buffer
+	old := problemLogger
+	problemLogger = logForTest(&logs)
+	t.Cleanup(func() { problemLogger = old })
+
+	const id = "TESTREQUESTID"
+	r := httptest.NewRequest(http.MethodPost, "/tools", nil)
+	r = r.WithContext(context.WithValue(r.Context(), requestIDKey{}, id))
+	w := httptest.NewRecorder()
+	internal := errors.New("dial unix /run/private/mavend.sock: bearer secret-token")
+	writeProblem(w, r, http.StatusBadGateway, problemToolsChange, "enable failed", internal)
+
+	if w.Code != http.StatusBadGateway {
+		t.Fatalf("status = %d, want 502", w.Code)
+	}
+	if got := w.Header().Get("X-Request-ID"); got != id {
+		t.Fatalf("X-Request-ID = %q, want %q", got, id)
+	}
+	if got := w.Header().Get("Content-Type"); !strings.HasPrefix(got, "application/problem+json") {
+		t.Fatalf("Content-Type = %q", got)
+	}
+	var got problemResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatalf("decode problem: %v", err)
+	}
+	if got.Error != "enable failed" || got.Code != problemToolsChange || got.RequestID != id {
+		t.Fatalf("problem = %+v", got)
+	}
+	if strings.Contains(w.Body.String(), "private") || strings.Contains(w.Body.String(), "secret-token") {
+		t.Fatalf("HTTP response disclosed the wrapped error: %s", w.Body.String())
+	}
+	for _, want := range []string{id, string(problemToolsChange), internal.Error()} {
+		if !strings.Contains(logs.String(), want) {
+			t.Errorf("server log missing %q: %s", want, logs.String())
+		}
+	}
+}
+
+func TestRequestIDMiddlewareMintsAndIgnoresCallerID(t *testing.T) {
+	var seen string
+	h := withRequestID(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		seen = requestIDFromContext(r.Context())
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	r := httptest.NewRequest(http.MethodGet, "/api/ping", nil)
+	r.Header.Set("X-Request-ID", "caller-chosen")
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+
+	if seen == "" || seen == "caller-chosen" {
+		t.Fatalf("request ID = %q; want a server-generated value", seen)
+	}
+	if got := w.Header().Get("X-Request-ID"); got != seen {
+		t.Fatalf("response request ID = %q, context ID = %q", got, seen)
+	}
+}
+
+func TestEcosystemPanelPropagatesRequestID(t *testing.T) {
+	const id = "WEBREQUESTCORRELATION"
+	var correlation, requester string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		correlation = r.Header.Get("X-Correlation-ID")
+		requester = r.Header.Get("X-Requested-By")
+		_, _ = io.WriteString(w, `[]`)
+	}))
+	defer srv.Close()
+	ctx := context.WithValue(context.Background(), requestIDKey{}, id)
+	var rows []ecoEntity
+	if got := getEco(ctx, srv.URL, "/entities", &rows); got != "" {
+		t.Fatalf("getEco error = %q", got)
+	}
+	if correlation != id || requester != "mavweb" {
+		t.Fatalf("correlation = %q, requester = %q", correlation, requester)
+	}
+}
+
+// The contract is architectural, not a convention people must remember. Keep
+// a syntax-level guard so a new handler cannot bypass writeProblem by adding
+// another http.Error call.
+func TestProductionHandlersUseOneProblemWriter(t *testing.T) {
+	entries, err := os.ReadDir(".")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, entry := range entries {
+		name := entry.Name()
+		if entry.IsDir() || !strings.HasSuffix(name, ".go") || strings.HasSuffix(name, "_test.go") {
+			continue
+		}
+		file, err := parser.ParseFile(token.NewFileSet(), filepath.Clean(name), nil, 0)
+		if err != nil {
+			t.Fatalf("parse %s: %v", name, err)
+		}
+		ast.Inspect(file, func(n ast.Node) bool {
+			call, ok := n.(*ast.CallExpr)
+			if !ok {
+				return true
+			}
+			sel, ok := call.Fun.(*ast.SelectorExpr)
+			if !ok || sel.Sel.Name != "Error" {
+				return true
+			}
+			pkg, ok := sel.X.(*ast.Ident)
+			if ok && pkg.Name == "http" {
+				t.Errorf("%s contains http.Error; use writeProblem", name)
+			}
+			return true
+		})
+	}
+}
+
+func logForTest(w io.Writer) *log.Logger {
+	return log.New(w, "", 0)
+}

cmd/mavweb/reminders.go

@@ -3,7 +3,7 @@ package main
 import (
 	_ "embed"
 	"encoding/json"
-	"log"
+	"fmt"
 	"net/http"
 	"strings"
 
@@ -26,6 +26,7 @@ type reminderRow struct {
 	Created string
 	Fires   string
 	Status  string
+	Detail  string
 	Text    string
 }
 
@@ -50,10 +51,19 @@ func reminderText(payload string) string {
 func reminderRows(rs []ipc.Reminder) []reminderRow {
 	out := make([]reminderRow, 0, len(rs))
 	for _, r := range rs {
+		status := r.Status
+		detail := ""
+		if !r.DeliveryBlockedTs.IsZero() {
+			status = "blocked"
+			detail = r.DeliveryBlockedError
+		} else if r.DeliveryAttempts > 0 && !r.NextAttemptTs.IsZero() {
+			detail = "retry " + r.NextAttemptTs.Local().Format("02 Jan 15:04")
+		}
 		out = append(out, reminderRow{
 			Created: r.CreatedTs.Local().Format("02 Jan 15:04"),
 			Fires:   r.FireTs.Local().Format("02 Jan 15:04"),
-			Status:  r.Status,
+			Status:  status,
+			Detail:  detail,
 			Text:    reminderText(r.Payload),
 		})
 	}
@@ -61,13 +71,13 @@ func reminderRows(rs []ipc.Reminder) []reminderRow {
 }
 
 func handleReminders(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "reminders") {
+	if !requireCore(w, r, core, "reminders") {
 		return
 	}
 	reminders, err := core.ListReminders(r.Context(), 50)
 	if err != nil {
-		log.Printf("reminders: %v", err)
-		http.Error(w, "reminders error: "+err.Error(), http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"reminders unavailable", fmt.Errorf("list reminders: %w", err))
 		return
 	}
 	renderPage(w, remindersTmpl, map[string]any{"Reminders": reminderRows(reminders)})

cmd/mavweb/reminders.html

@@ -5,7 +5,7 @@
 {{range .Reminders}}<tr>
 <td class=hint>{{.Created}}</td>
 <td>{{.Fires}}</td>
-<td><span class="badge {{.Status}}">{{.Status}}</span></td>
+<td><span class="badge {{.Status}}">{{.Status}}</span>{{if .Detail}}<div class=hint>{{.Detail}}</div>{{end}}</td>
 <td class=text-max>{{.Text}}</td>
 </tr>{{end}}</table></div>
 {{else}}<div class=empty>

cmd/mavweb/reminders_test.go

@@ -31,6 +31,19 @@ func TestReminderRowsUnwrapAndLocalise(t *testing.T) {
 	}
 }
 
+func TestReminderRowsExposeBlockedDelivery(t *testing.T) {
+	blocked := time.Date(2026, 8, 13, 8, 0, 0, 0, time.UTC)
+	rows := reminderRows([]ipc.Reminder{{
+		Status:               "pending",
+		Payload:              `{"text":"позвонить врачу"}`,
+		DeliveryBlockedTs:    blocked,
+		DeliveryBlockedError: "ntfy credentials rejected",
+	}})
+	if len(rows) != 1 || rows[0].Status != "blocked" || rows[0].Detail != "ntfy credentials rejected" {
+		t.Fatalf("blocked reminder is not visible: %+v", rows)
+	}
+}
+
 // A payload that is not the envelope is his own words, so it is shown as it is.
 func TestReminderTextKeepsPlainPayload(t *testing.T) {
 	for _, tc := range []struct{ in, want string }{

cmd/mavweb/routines.go

@@ -5,7 +5,6 @@ import (
 	_ "embed"
 	"errors"
 	"fmt"
-	"log"
 	"net/http"
 	"strconv"
 	"strings"
@@ -41,7 +40,7 @@ type routineView struct {
 // gated — it only ever removes a reason to speak, so the worst a weaker caller
 // can do is make maven quieter.
 func handleRoutines(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
-	if !requireCore(w, core, "routines") {
+	if !requireCore(w, r, core, "routines") {
 		return
 	}
 	ctx := r.Context()
@@ -54,8 +53,8 @@ func handleRoutines(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, se
 	}
 	proposed, err := core.ListProposedRoutines(ctx)
 	if err != nil {
-		log.Printf("routines: list: %v", err)
-		http.Error(w, "routines error: "+err.Error(), http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"routines unavailable", fmt.Errorf("list proposed routines: %w", err))
 		return
 	}
 	renderPage(w, routinesTmpl, struct {
@@ -76,44 +75,45 @@ func applyRoutinePost(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI,
 	// already the step-up-gated surface for this table, and a second gated
 	// surface is a second thing to get wrong.
 	if action == "seed" {
-		if !stepUpGate(w, session, requireStepUp) {
+		if !stepUpGate(w, r, session, requireStepUp) {
 			return "", false
 		}
 		out, err := seedRoutineEvent(ctx, core, r)
 		if err != nil {
-			log.Printf("routines: seed: %v", err)
-			http.Error(w, "seed failed: "+err.Error(), http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemRoutinesChange,
+				"seed failed", fmt.Errorf("seed routine event: %w", err))
 			return "", false
 		}
 		return out, true
 	}
 
-	idStr := r.FormValue("id")
-	var rid int64
-	if n, _ := fmt.Sscanf(idStr, "%d", &rid); n != 1 {
-		http.Error(w, "invalid id", http.StatusBadRequest)
+	rid, err := strconv.ParseInt(strings.TrimSpace(r.FormValue("id")), 10, 64)
+	if err != nil || rid <= 0 {
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"invalid id", err)
 		return "", false
 	}
 	switch action {
 	case "accept":
-		if !stepUpGate(w, session, requireStepUp) {
+		if !stepUpGate(w, r, session, requireStepUp) {
 			return "", false
 		}
 		if err := acceptRoutine(ctx, core, rid); err != nil {
-			log.Printf("routines: accept %d: %v", rid, err)
-			http.Error(w, "accept failed: "+err.Error(), http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemRoutinesChange,
+				"accept failed", fmt.Errorf("accept routine %d: %w", rid, err))
 			return "", false
 		}
 		return "accepted routine — maven will remind you", true
 	case "dismiss":
 		if err := core.DismissProposedRoutine(ctx, rid); err != nil {
-			log.Printf("routines: dismiss %d: %v", rid, err)
-			http.Error(w, "dismiss failed: "+err.Error(), http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemRoutinesChange,
+				"dismiss failed", fmt.Errorf("dismiss routine %d: %w", rid, err))
 			return "", false
 		}
 		return "dismissed routine", true
 	default:
-		http.Error(w, "unknown action", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"unknown action", nil)
 		return "", false
 	}
 }

cmd/mavweb/shell.go

@@ -159,9 +159,10 @@ func renderPage(w http.ResponseWriter, t *template.Template, data any) {
 // requireCore answers whether the surface has a core to read. mavweb runs
 // without -core (voice-only), and every page that needs mavend says so with a
 // 503 naming itself rather than a blank error.
-func requireCore(w http.ResponseWriter, core ipc.CoreAPI, surface string) bool {
+func requireCore(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, surface string) bool {
 	if core == nil {
-		http.Error(w, surface+" disabled (no -core)", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemCoreUnavailable,
+			surface+" disabled (no -core)", nil)
 		return false
 	}
 	return true
@@ -169,11 +170,12 @@ func requireCore(w http.ResponseWriter, core ipc.CoreAPI, surface string) bool {
 
 // stepUpGate reports whether the caller may proceed through the AuthStepUp
 // gate, writing the 403 itself when it may not. See stepUpOK for the policy.
-func stepUpGate(w http.ResponseWriter, session *webauthn.PasskeySession, requireStepUp bool) bool {
+func stepUpGate(w http.ResponseWriter, r *http.Request, session *webauthn.PasskeySession, requireStepUp bool) bool {
 	if stepUpOK(session, requireStepUp) {
 		return true
 	}
-	http.Error(w, "step-up required: assert a passkey first", http.StatusForbidden)
+	writeProblem(w, r, http.StatusForbidden, problemStepUpRequired,
+		"step-up required: assert a passkey first", nil)
 	return false
 }
 

cmd/mavweb/tasks.go

@@ -5,7 +5,6 @@ import (
 	_ "embed"
 	"errors"
 	"fmt"
-	"log"
 	"net/http"
 	"strconv"
 	"strings"
@@ -88,7 +87,7 @@ func rowOf(t ipc.Task) taskRow {
 // from something she read into work he owns. That review step is why derived
 // tasks are captured as candidates in the first place.
 func handleTasks(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "tasks") {
+	if !requireCore(w, r, core, "tasks") {
 		return
 	}
 	ctx := r.Context()
@@ -97,15 +96,14 @@ func handleTasks(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 		var err error
 		msg, err = applyTaskPost(ctx, core, r)
 		if err != nil {
-			log.Printf("tasks: %v", err)
-			errMsg = err.Error()
+			errMsg = inlineProblem(r, problemCoreChangeFailed, taskPublicMessage(err), err)
 		}
 	}
 
 	all, err := core.ListTasks(ctx, "")
 	if err != nil {
-		log.Printf("tasks: list: %v", err)
-		http.Error(w, "tasks error: "+err.Error(), http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"tasks unavailable", fmt.Errorf("list tasks: %w", err))
 		return
 	}
 	// Live rows are ordered by the same ranker the spoken list uses, so the page
@@ -162,6 +160,39 @@ func handleTasks(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	}{msg, errMsg, tasks.Stalls(live, now()), cands, open, resolved, resolvedTotal > len(resolved)})
 }
 
+// taskInputError is a form/domain refusal safe to show back to the owner. IPC,
+// storage and transport errors never use this type and therefore receive the
+// generic task failure text plus a request reference.
+type taskInputError struct{ message string }
+
+func (e *taskInputError) Error() string { return e.message }
+
+func taskInput(message string) error { return &taskInputError{message: message} }
+
+func taskInputf(format string, args ...any) error {
+	return &taskInputError{message: fmt.Sprintf(format, args...)}
+}
+
+type taskPartialError struct {
+	public string
+	err    error
+}
+
+func (e *taskPartialError) Error() string { return e.public + ": " + e.err.Error() }
+func (e *taskPartialError) Unwrap() error { return e.err }
+
+func taskPublicMessage(err error) string {
+	var input *taskInputError
+	if errors.As(err, &input) {
+		return input.message
+	}
+	var partial *taskPartialError
+	if errors.As(err, &partial) {
+		return partial.public
+	}
+	return "task update failed"
+}
+
 // applyTaskPost performs one write and returns the message to show. A bad
 // request returns an error, which the page renders inline rather than as a
 // bare 400 — this is a form surface, not an API.
@@ -170,7 +201,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 	if action == "add" {
 		text := strings.TrimSpace(r.FormValue("text"))
 		if text == "" {
-			return "", errors.New("empty task text")
+			return "", taskInput("empty task text")
 		}
 		req := ipc.CaptureTaskReq{Text: text, Source: "tap:web", Status: "open", Ts: now()}
 		wgt, err := formWeight(r)
@@ -198,7 +229,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 
 	id, err := strconv.ParseInt(r.FormValue("id"), 10, 64)
 	if err != nil {
-		return "", errors.New("invalid id")
+		return "", taskInput("invalid id")
 	}
 
 	if action == "promote" {
@@ -214,7 +245,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 		// is not editable here: that ladder is one-way and has its own buttons.
 		text := strings.TrimSpace(r.FormValue("text"))
 		if text == "" {
-			return "", errors.New("empty task text")
+			return "", taskInput("empty task text")
 		}
 		wgt, err := formWeight(r)
 		if err != nil {
@@ -230,9 +261,9 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 		case errors.Is(err, ipc.ErrTaskDuplicate):
 			// Naming the collision instead of merging: two live rows carry two
 			// provenances, and picking one is not the page's call.
-			return "", errors.New("another open task already says this — drop one of the two")
+			return "", taskInput("another open task already says this — drop one of the two")
 		case errors.Is(err, ipc.ErrTaskResolved):
-			return "", errors.New("a resolved task keeps the text it was finished under")
+			return "", taskInput("a resolved task keeps the text it was finished under")
 		default:
 			return "", err
 		}
@@ -247,7 +278,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 	case "drop":
 		status, msg = "dropped", "dropped task"
 	default:
-		return "", fmt.Errorf("unknown action %q", action)
+		return "", taskInputf("unknown action %q", action)
 	}
 	if err := core.SetTaskStatus(ctx, id, status, now(), "tap:web"); err != nil {
 		return "", statusWriteErr(err)
@@ -257,7 +288,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 
 // errNoDoneWhen — the refusal has to name what is missing, or the button looks
 // broken. The field it asks for arrives with the intake form (Vikunja #511).
-var errNoDoneWhen = errors.New("write a definition of done before confirming this candidate")
+var errNoDoneWhen = taskInput("write a definition of done before confirming this candidate")
 
 // statusWriteErr translates a SetTaskStatus failure into what the page says.
 func statusWriteErr(err error) error {
@@ -281,11 +312,11 @@ func statusWriteErr(err error) error {
 func promoteCandidate(ctx context.Context, core ipc.CoreAPI, r *http.Request, id int64) (string, error) {
 	doneWhen := strings.TrimSpace(r.FormValue("done_when"))
 	if doneWhen == "" {
-		return "", errors.New("write a definition of done — what has to be true for this to be finished")
+		return "", taskInput("write a definition of done — what has to be true for this to be finished")
 	}
 	text := strings.TrimSpace(r.FormValue("text"))
 	if text == "" {
-		return "", errors.New("empty task text")
+		return "", taskInput("empty task text")
 	}
 	due, err := formDue(r, now())
 	if err != nil {
@@ -326,7 +357,7 @@ func promoteCandidate(ctx context.Context, core ipc.CoreAPI, r *http.Request, id
 	if _, err := core.CreateReminder(ctx, fire, text, ""); err != nil {
 		// The task IS promoted; only the reminder failed. Saying "confirmed"
 		// and nothing else would leave him expecting a nudge that will not come.
-		return "", fmt.Errorf("confirmed, but the reminder did not save: %w", err)
+		return "", &taskPartialError{public: "task confirmed, but the reminder did not save", err: err}
 	}
 	return "confirmed, and maven will remind you that morning", nil
 }
@@ -343,15 +374,15 @@ func resolveBlocker(ctx context.Context, core ipc.CoreAPI, field string) (string
 	ref, err := core.ResolveEntity(ctx, name, []string{"person"})
 	switch {
 	case errors.Is(err, ipc.ErrNotImplemented):
-		return "", errors.New("no identity service here, so blocked-on cannot be stored — leave it empty")
+		return "", taskInput("no identity service here, so blocked-on cannot be stored — leave it empty")
 	case errors.Is(err, ipc.ErrNoEntity):
-		return "", fmt.Errorf("nexus does not know %q", name)
+		return "", taskInputf("nexus does not know %q", name)
 	case err != nil:
 		return "", fmt.Errorf("resolving %q: %w", name, err)
 	case ref.Ambiguous:
 		// Asking, not picking: a task blocked on the wrong person is a
 		// mistake nobody can see afterwards.
-		return "", fmt.Errorf("%q matches %s — say which", name, strings.Join(ref.Candidates, ", "))
+		return "", taskInputf("%q matches %s — say which", name, strings.Join(ref.Candidates, ", "))
 	}
 	return ref.ID, nil
 }
@@ -366,7 +397,7 @@ func formWeight(r *http.Request) (int, error) {
 	}
 	wgt, err := strconv.Atoi(v)
 	if err != nil || wgt < 0 {
-		return 0, fmt.Errorf("bad weight %q", v)
+		return 0, taskInputf("bad weight %q", v)
 	}
 	if wgt > tasks.MaxWeight {
 		wgt = tasks.MaxWeight
@@ -383,7 +414,7 @@ func formDue(r *http.Request, now time.Time) (*time.Time, error) {
 	}
 	due, err := time.ParseInLocation("2006-01-02", d, now.Location())
 	if err != nil {
-		return nil, fmt.Errorf("bad due date %q", d)
+		return nil, taskInputf("bad due date %q", d)
 	}
 	return &due, nil
 }

cmd/mavweb/tasks_test.go

@@ -191,6 +191,24 @@ func TestHandleTasksRejectsBadPost(t *testing.T) {
 	}
 }
 
+func TestHandleTasksSanitizesCoreWriteFailure(t *testing.T) {
+	core := &fakeTaskCore{captureErr: fmt.Errorf("sqlite /private/maven.db: key material rejected")}
+	form := url.Values{"action": {"add"}, "text": {"что-то"}}
+	req := httptest.NewRequest(http.MethodPost, "/tasks", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec := httptest.NewRecorder()
+	handleTasks(rec, req, core)
+	body := rec.Body.String()
+	for _, want := range []string{"task update failed", string(problemCoreChangeFailed), "request "} {
+		if !strings.Contains(body, want) {
+			t.Errorf("sanitized task error missing %q: %s", want, body)
+		}
+	}
+	if strings.Contains(body, "/private/maven.db") || strings.Contains(body, "key material") {
+		t.Errorf("task page disclosed the core error: %s", body)
+	}
+}
+
 func TestHandleTasksNoCore(t *testing.T) {
 	rec := httptest.NewRecorder()
 	handleTasks(rec, httptest.NewRequest(http.MethodGet, "/tasks", nil), nil)

cmd/mavweb/tools.go

@@ -3,8 +3,8 @@ package main
 import (
 	"cmp"
 	_ "embed"
+	"fmt"
 	"html/template"
-	"log"
 	"net/http"
 	"strings"
 	"time"
@@ -32,13 +32,13 @@ var toolsTmpl = parsePage("tools", toolsHTML, template.FuncMap{
 // shell-word parsing; the box owner controls this input, quote a wrapper script
 // if an arg needs spaces).
 func handleTools(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
-	if !requireCore(w, core, "tools") {
+	if !requireCore(w, r, core, "tools") {
 		return
 	}
 	ctx := r.Context()
 	var msg string
 	if r.Method == http.MethodPost {
-		if !stepUpGate(w, session, requireStepUp) {
+		if !stepUpGate(w, r, session, requireStepUp) {
 			return
 		}
 		action := r.FormValue("action")
@@ -49,54 +49,59 @@ func handleTools(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, sessi
 			cmd := strings.Fields(r.FormValue("cmd"))
 			destructive := r.FormValue("destructive") != ""
 			if name == "" || len(cmd) == 0 {
-				http.Error(w, "name and cmd required", http.StatusBadRequest)
+				writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+					"name and cmd required", nil)
 				return
 			}
 			if err := core.EnableTool(ctx, name, cmd, destructive, scope, time.Now()); err != nil {
-				log.Printf("tools: enable %q: %v", name, err)
-				http.Error(w, "enable failed: "+err.Error(), http.StatusBadGateway)
+				writeProblem(w, r, http.StatusBadGateway, problemToolsChange,
+					"enable failed", fmt.Errorf("enable tool %q: %w", name, err))
 				return
 			}
 			msg = "enabled " + name
 		case "disable":
 			if name == "" {
-				http.Error(w, "name required", http.StatusBadRequest)
+				writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+					"name required", nil)
 				return
 			}
 			if err := core.DisableTool(ctx, name); err != nil {
-				log.Printf("tools: disable %q: %v", name, err)
-				http.Error(w, "disable failed: "+err.Error(), http.StatusBadGateway)
+				writeProblem(w, r, http.StatusBadGateway, problemToolsChange,
+					"disable failed", fmt.Errorf("disable tool %q: %w", name, err))
 				return
 			}
 			msg = "disabled " + name
 		case "dismiss":
 			if name == "" {
-				http.Error(w, "name required", http.StatusBadRequest)
+				writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+					"name required", nil)
 				return
 			}
 			if err := core.DeleteTool(ctx, name); err != nil {
-				log.Printf("tools: dismiss %q: %v", name, err)
-				http.Error(w, "dismiss failed: "+err.Error(), http.StatusBadGateway)
+				writeProblem(w, r, http.StatusBadGateway, problemToolsChange,
+					"dismiss failed", fmt.Errorf("dismiss tool %q: %w", name, err))
 				return
 			}
 			msg = "dismissed " + name
 		default:
-			http.Error(w, "unknown action", http.StatusBadRequest)
+			writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+				"unknown action", nil)
 			return
 		}
 	}
 	proposed, err1 := core.ListTools(ctx, "proposed")
 	enabled, err2 := core.ListTools(ctx, "enabled")
 	if err := cmp.Or(err1, err2); err != nil {
-		log.Printf("tools: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("list tools: %w", err))
 		return
 	}
 	// MCP is off by default and an older core may not know the method at all,
 	// so a failure here renders an empty section rather than breaking the page.
 	servers, err := core.MCPServers(ctx)
 	if err != nil {
-		log.Printf("tools: mcp servers: %v", err)
+		logProblem(r, http.StatusOK, problemCoreReadFailed,
+			"MCP server status unavailable", fmt.Errorf("read MCP server status: %w", err))
 		servers = nil
 	}
 	// Enabled rows are shown grouped by capability domain (Vikunja #452). A

cmd/mavweb/voiceproxy.go

@@ -1,9 +1,9 @@
 package main
 
 import (
-	"context"
 	"encoding/binary"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -12,22 +12,26 @@ import (
 	"net/url"
 	"time"
 
-	"github.com/coder/websocket"
 	"github.com/kami/maven/internal/audio"
 	"github.com/kami/maven/internal/voice"
 	"github.com/kami/maven/internal/webauthn"
 )
 
-// The two proxies onto mavend's voice port: GET /ws streams turns over a
-// websocket, POST /api/ptt does one turn over plain HTTP. Both carry the same
-// step-up gate, because speaking an act is not a smaller act than typing one
-// (Vikunja #317). The length-prefixed framing they share is at the bottom.
+// POST /api/ptt proxies one turn onto mavend's voice port. It carries the same
+// step-up gate as typed chat, because speaking an act is not a smaller act than
+// typing one (Vikunja #317). The length-prefixed voice framing is at the bottom.
 
 // maxFrame caps a single voice frame in either direction.
 const maxFrame = 64 << 20
 
-// pushToTalk builds the one request either proxy sends. Surface is
-// SurfacePCClient for both: the browser is standing in for the PC client.
+// maxPTTAudioBytes is ten minutes of canonical 16 kHz mono int16 PCM. A PTT
+// turn should be seconds, but the generous cap preserves long dictation while
+// keeping both the HTTP allocation and the base64-expanded voice frame bounded.
+// Meeting capture has its own streaming/blob path and does not use this route.
+const maxPTTAudioBytes int64 = 10 * 60 * 16000 * 2
+
+// pushToTalk builds the request the HTTP proxy sends. SurfacePCClient records
+// that the browser is standing in for the PC client.
 func pushToTalk(pcm []byte) voice.Request {
 	return voice.Request{
 		ID:     uint64(time.Now().UnixNano()),
@@ -40,95 +44,30 @@ func pushToTalk(pcm []byte) voice.Request {
 	}
 }
 
-func handleWS(w http.ResponseWriter, r *http.Request, voiceAddr string, session *webauthn.PasskeySession, requireStepUp bool) {
-	if !stepUpGate(w, session, requireStepUp) {
-		return
-	}
-	conn, err := websocket.Accept(w, r, &websocket.AcceptOptions{
-		OriginPatterns: []string{"*"},
-	})
-	if err != nil {
-		log.Printf("ws accept: %v", err)
-		return
-	}
-	defer conn.Close(websocket.StatusNormalClosure, "bye")
-
-	ctx := r.Context()
-
-	var d net.Dialer
-	tc, err := d.DialContext(ctx, "tcp", voiceAddr)
-	if err != nil {
-		log.Printf("dial voice: %v", err)
-		writeWSErr(conn, ctx, "voice unavailable")
-		return
-	}
-	defer tc.Close()
-
-	for {
-		_, msg, err := conn.Read(ctx)
-		if err != nil {
-			log.Printf("ws read: %v", err)
-			return
-		}
-		if len(msg) < 4 {
-			log.Printf("ws msg too short (%d bytes)", len(msg))
-			continue
-		}
-
-		log.Printf("ws got %d bytes from client", len(msg))
-		req := pushToTalk(msg)
-		if err := writeFrame(tc, &req); err != nil {
-			log.Printf("write voice req: %v", err)
-			return
-		}
-
-		// Read frames until we get the matching Response (handling any interleaved Pushes)
-		for {
-			resp, push, err := readOneFrame(tc)
-			if err != nil {
-				log.Printf("read voice: %v", err)
-				return
-			}
-			if push != nil {
-				data, _ := json.Marshal(push)
-				conn.Write(ctx, websocket.MessageText, data)
-				continue
-			}
-			if resp.Error != nil {
-				writeWSErr(conn, ctx, resp.Error.Message)
-				break
-			}
-			var pttResp voice.PushToTalkResp
-			if err := json.Unmarshal(resp.Result, &pttResp); err != nil {
-				log.Printf("unmarshal resp: %v", err)
-				break
-			}
-			if pttResp.ReplyText != "" {
-				conn.Write(ctx, websocket.MessageText, []byte(pttResp.ReplyText))
-			}
-			if len(pttResp.ReplyAudio.Bytes) > 0 {
-				conn.Write(ctx, websocket.MessageBinary, pttResp.ReplyAudio.Bytes)
-			}
-			break
-		}
-	}
-}
-
 func handlePTT(w http.ResponseWriter, r *http.Request, voiceAddr string, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", 405)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !stepUpGate(w, session, requireStepUp) {
+	if !stepUpGate(w, r, session, requireStepUp) {
 		return
 	}
-	body, err := io.ReadAll(r.Body)
+	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, maxPTTAudioBytes))
 	if err != nil {
-		http.Error(w, err.Error(), 400)
+		var tooLarge *http.MaxBytesError
+		if errors.As(err, &tooLarge) {
+			writeProblem(w, r, http.StatusRequestEntityTooLarge, problemPayloadTooLarge,
+				"audio exceeds the ten-minute PTT limit", err)
+			return
+		}
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"read audio", fmt.Errorf("read PTT audio: %w", err))
 		return
 	}
 	if len(body) < 4 {
-		http.Error(w, "too short", 400)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"audio too short", nil)
 		return
 	}
 
@@ -137,36 +76,38 @@ func handlePTT(w http.ResponseWriter, r *http.Request, voiceAddr string, session
 	var d net.Dialer
 	tc, err := d.DialContext(r.Context(), "tcp", voiceAddr)
 	if err != nil {
-		log.Printf("ptt dial voice: %v", err)
-		http.Error(w, "voice unavailable", 503)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemVoiceUnavailable,
+			"voice unavailable", fmt.Errorf("dial voice service: %w", err))
 		return
 	}
 	defer tc.Close()
 
 	req := pushToTalk(body)
 	if err := writeFrame(tc, &req); err != nil {
-		log.Printf("ptt write: %v", err)
-		http.Error(w, err.Error(), 500)
+		writeProblem(w, r, http.StatusBadGateway, problemVoiceTransport,
+			"voice request failed", fmt.Errorf("write voice request: %w", err))
 		return
 	}
 
 	for {
 		resp, push, err := readOneFrame(tc)
 		if err != nil {
-			log.Printf("ptt read: %v", err)
-			http.Error(w, err.Error(), 500)
+			writeProblem(w, r, http.StatusBadGateway, problemVoiceTransport,
+				"voice response failed", fmt.Errorf("read voice response: %w", err))
 			return
 		}
 		if push != nil {
 			continue
 		}
 		if resp.Error != nil {
-			http.Error(w, resp.Error.Message, 500)
+			writeProblem(w, r, http.StatusBadGateway, problemVoiceResponse,
+				"voice turn failed", fmt.Errorf("voice RPC error: %s", resp.Error.Message))
 			return
 		}
 		var pttResp voice.PushToTalkResp
 		if err := json.Unmarshal(resp.Result, &pttResp); err != nil {
-			http.Error(w, err.Error(), 500)
+			writeProblem(w, r, http.StatusBadGateway, problemVoiceResponse,
+				"voice response failed", fmt.Errorf("decode voice response: %w", err))
 			return
 		}
 		w.Header().Set("Content-Type", "audio/l16;rate=16000;channels=1")
@@ -182,10 +123,6 @@ func handlePTT(w http.ResponseWriter, r *http.Request, voiceAddr string, session
 	}
 }
 
-func writeWSErr(conn *websocket.Conn, ctx context.Context, msg string) {
-	conn.Write(ctx, websocket.MessageText, []byte(`{"error":"`+msg+`"}`))
-}
-
 func writeFrame(w io.Writer, v any) error {
 	body, err := json.Marshal(v)
 	if err != nil {

cmd/mavweb/webauthn.go

@@ -92,8 +92,8 @@ var passkeyTmpl = parsePage("passkey", passkeyPageHTML, nil)
 func (h *PasskeyHandle) RegisterBegin(w http.ResponseWriter, r *http.Request) {
 	opts, challenge, err := h.rp.CreationOptions([]byte("maven-user"), "maven user")
 	if err != nil {
-		log.Printf("webauthn: register begin: %v", err)
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		writeProblem(w, r, http.StatusInternalServerError, problemWebAuthnBegin,
+			"passkey registration could not start", fmt.Errorf("webauthn register begin: %w", err))
 		return
 	}
 	w.Header().Set("Content-Type", "application/json")
@@ -102,7 +102,8 @@ func (h *PasskeyHandle) RegisterBegin(w http.ResponseWriter, r *http.Request) {
 
 func (h *PasskeyHandle) RegisterFinish(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
 	var body struct {
@@ -110,7 +111,8 @@ func (h *PasskeyHandle) RegisterFinish(w http.ResponseWriter, r *http.Request) {
 		Credential map[string]any `json:"credential"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		http.Error(w, "bad request: "+err.Error(), http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"invalid registration request", fmt.Errorf("decode webauthn registration: %w", err))
 		return
 	}
 	save := func(id string, publicKey []byte, _ []byte, _ string) error {
@@ -118,8 +120,8 @@ func (h *PasskeyHandle) RegisterFinish(w http.ResponseWriter, r *http.Request) {
 	}
 	credID, err := h.rp.FinishRegistration(save, body.Challenge, body.Credential)
 	if err != nil {
-		log.Printf("webauthn: register finish: %v", err)
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemWebAuthnFinish,
+			"passkey registration failed", fmt.Errorf("webauthn register finish: %w", err))
 		return
 	}
 	log.Printf("webauthn: registered credential %s", credID)
@@ -140,8 +142,8 @@ func (h *PasskeyHandle) RegisterFinish(w http.ResponseWriter, r *http.Request) {
 func (h *PasskeyHandle) AssertBegin(w http.ResponseWriter, r *http.Request) {
 	opts, challenge, err := h.rp.AssertionOptions()
 	if err != nil {
-		log.Printf("webauthn: assert begin: %v", err)
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		writeProblem(w, r, http.StatusInternalServerError, problemWebAuthnBegin,
+			"passkey assertion could not start", fmt.Errorf("webauthn assert begin: %w", err))
 		return
 	}
 	w.Header().Set("Content-Type", "application/json")
@@ -150,7 +152,8 @@ func (h *PasskeyHandle) AssertBegin(w http.ResponseWriter, r *http.Request) {
 
 func (h *PasskeyHandle) AssertFinish(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
 	var body struct {
@@ -176,7 +179,8 @@ func (h *PasskeyHandle) AssertFinish(w http.ResponseWriter, r *http.Request) {
 		Explicit bool `json:"explicit"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		http.Error(w, "bad request: "+err.Error(), http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"invalid assertion request", fmt.Errorf("decode webauthn assertion: %w", err))
 		return
 	}
 
@@ -189,8 +193,8 @@ func (h *PasskeyHandle) AssertFinish(w http.ResponseWriter, r *http.Request) {
 
 	credID, err := h.rp.FinishAssertion(lookup, update, body.Challenge, body.Credential)
 	if err != nil {
-		log.Printf("webauthn: assert finish: %v", err)
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemWebAuthnFinish,
+			"passkey assertion failed", fmt.Errorf("webauthn assert finish: %w", err))
 		return
 	}
 
@@ -201,8 +205,8 @@ func (h *PasskeyHandle) AssertFinish(w http.ResponseWriter, r *http.Request) {
 		ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
 		defer cancel()
 		if err := h.assertFn.AssertStepUp(ctx); err != nil {
-			log.Printf("webauthn: assert step-up: %v", err)
-			http.Error(w, "step-up assertion failed", http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemWebAuthnStepUp,
+				"step-up assertion failed", fmt.Errorf("assert step-up in core: %w", err))
 			return
 		}
 	}

deploy/README.md

@@ -11,6 +11,11 @@ dir and read-only models.
 cp deploy/db_key.env.example deploy/db_key.env
 printf 'MAVEN_DB_KEY=%s\n' "$(openssl rand 32 | base64 -w0)" > deploy/db_key.env
 
+# 1b. review the complete secret inventory. Copy homesrv values to
+# deploy/telegram.env, ambient enable/token values to .env, and workpc values
+# to the destinations named in the example. Live blocks reject empty secrets.
+cp deploy/telegram.env.example deploy/telegram.env
+
 # 2. build + start
 docker compose build
 docker compose up -d

deploy/asoundrc

@@ -0,0 +1,27 @@
+# mavmic — the Scarlett Solo 4th Gen microphone alone, for mavwaked.
+#
+# The card's USB capture stream is 4 channels, not 2:
+#
+#   ch1  PCM 01 <- DSP 1 <- Analogue 1   the line/instrument jack
+#   ch2  PCM 02 <- DSP 2 <- Analogue 2   the XLR microphone
+#   ch3  PCM 03 <- Mix C  <- PCM 1       loopback of workstation playback, L
+#   ch4  PCM 04 <- Mix D  <- PCM 2       loopback of workstation playback, R
+#
+# plughw asks ALSA for mono and gets a downmix of all four, so half of what
+# mavwaked scored was whatever the workstation was playing, at unity gain and
+# untouched by the front-panel gain knob. Measured 2026-08-09 with the gain at
+# 0 and a show playing: ch1 rms 0.00000, ch2 0.00002, ch3 0.08834, ch4 0.09045.
+#
+# Air and 48V are named for Line In 2, and both belong to a microphone preamp,
+# so Analogue 2 is the XLR input on this card and Analogue 1 is the jack.
+#
+# This takes slave channel 1 and nothing else. It does not change the card, so
+# the loopback stays available to everything else on the box.
+pcm.mavmic {
+    type plug
+    slave {
+        pcm "hw:CARD=Gen,DEV=0"
+        channels 4
+    }
+    ttable.0.1 1
+}

deploy/cw2/serve.py

@@ -20,6 +20,7 @@ every stutter on the way there.
 """
 
 import hmac
+import ipaddress
 import json
 import logging
 import os
@@ -71,6 +72,18 @@ def authorised(headers):
     return hmac.compare_digest(got, "Bearer " + TOKEN)
 
 
+def validate_listener_auth(host, token):
+    """Refuse a network listener without its bearer boundary."""
+    try:
+        loopback = ipaddress.ip_address(host).is_loopback
+    except ValueError:
+        loopback = host.casefold() == "localhost"
+    if not loopback and not token.strip():
+        raise ValueError(
+            f"CW2_TOKEN is required while CW2_HOST={host!r} is reachable from the network"
+        )
+
+
 class Handler(BaseHTTPRequestHandler):
     protocol_version = "HTTP/1.1"
 
@@ -142,8 +155,10 @@ class Handler(BaseHTTPRequestHandler):
 
 
 def main():
-    if not TOKEN:
-        log.warning("no CW2_TOKEN set: anything on the LAN can post audio here")
+    try:
+        validate_listener_auth(HOST, TOKEN)
+    except ValueError as exc:
+        raise SystemExit(str(exc)) from exc
     # Bind before loading, so a restart answers 503 rather than refusing the
     # connection. Both make Maven fall back, but only one of them says why.
     srv = ThreadingHTTPServer((HOST, PORT), Handler)

deploy/cw2/test_serve.py

@@ -0,0 +1,24 @@
+import unittest
+
+import serve
+
+
+class ListenerAuthTest(unittest.TestCase):
+    def test_network_listener_requires_token(self):
+        for host in ("0.0.0.0", "192.168.1.105", "::"):
+            for token in ("", "   "):
+                with self.subTest(host=host, token=token):
+                    with self.assertRaises(ValueError):
+                        serve.validate_listener_auth(host, token)
+
+    def test_loopback_listener_may_be_explicitly_unauthenticated(self):
+        for host in ("127.0.0.1", "::1", "localhost"):
+            with self.subTest(host=host):
+                serve.validate_listener_auth(host, "")
+
+    def test_network_listener_accepts_token(self):
+        serve.validate_listener_auth("0.0.0.0", "secret")
+
+
+if __name__ == "__main__":
+    unittest.main()

deploy/mavend.json

@@ -31,14 +31,14 @@
     "rule — three things in series that have each failed once, and when they do",
     "a sev4 nudge has nowhere to go. ntfy shares none of them: it is reached",
     "directly, no relay.",
-    "It is not only a spare. The routing table sends sev3-away and away",
-    "reminders here and NOWHERE else, so with this block absent those two",
-    "routes hit a nil sink and vanish without a log or an outbox row.",
+    "It is the preferred away reach. Reminders fall back to Telegram in order,",
+    "and every missing reach is recorded in the outbox rather than disappearing.",
     "The credential is an ntfy access token, scoped write-only to this one",
     "topic, so a popped sink can push to it and cannot read it back. Set it in",
     "deploy/telegram.env beside the telegram secrets; that file is gitignored."
   ],
   "ntfy": {
+    "disabled": true,
     "base_url": "https://ntfy.kvmx.ru",
     "topic": "maven",
     "token": "${NTFY_TOKEN}"
@@ -76,7 +76,9 @@
     "resident model without saying so. Deleting this block restores exactly",
     "the behaviour homesrv had before it existed.",
     "Addressed by LAN address, not container name: mavgpud runs on another",
-    "machine and there is no shared docker network to name it on."
+    "machine and there is no shared docker network to name it on.",
+    "model_disabled keeps only this model arm dark until MAVEN_GPU_TOKEN is",
+    "provisioned; the independently authenticated STT arm below stays live."
   ],
   "//workstation.stt": [
     "CrisperWhisper 2.0 turbo on the same machine, a second service on port",
@@ -93,6 +95,7 @@
     "The token is what stops anything on the LAN posting audio to that port."
   ],
   "workstation": {
+    "model_disabled": true,
     "url": "http://192.168.1.105:8080",
     "token": "${MAVEN_GPU_TOKEN}",
     "probe": "15s",

deploy/mavwaked.service

@@ -32,6 +32,7 @@
 # means out of this unit's own journal, never by guessing.
 #
 #   install: cp to ~/.config/systemd/user/ on workpc
+#            cp ../deploy/asoundrc to ~/.asoundrc on workpc
 #            systemctl --user enable --now mavwaked.service
 
 [Unit]
@@ -46,22 +47,30 @@ After=maven-voice-tunnel.service
 # it returns RMS 0.00004 with its capture switch on and its ALSA volume at the
 # full 496 of 496. That silence is in the hardware, so no flag reaches it.
 #
-# Named CARD=Gen and not card 4, because a USB card number moves when
-# something else is replugged and this daemon must not change ears quietly.
+# mavmic and not plughw:CARD=Gen,DEV=0. deploy/asoundrc defines mavmic and
+# carries the whole reason: the card's capture stream is 4 channels, and two of
+# them are a unity-gain loopback of everything the workstation plays. plughw
+# downmixes all four, so a TV show woke her with the gain knob at 0. Install
+# that file as ~/.asoundrc on workpc or this device does not resolve.
+#
+# Named CARD=Gen inside mavmic and not card 4, because a USB card number moves
+# when something else is replugged and this daemon must not change ears quietly.
 # Not "default" either: that follows whatever pipewire last decided.
 #
-# plughw and not hw. mavwaked asks arecord for 16kHz mono, which is what the
-# whole pipeline is canonical in. Neither microphone offers it, so bare hw
-# dies on "Channels count non available" before a frame is read. plughw puts
-# ALSA's downmix and resampler in front. Any replacement wants the same.
+# mavmic is a plug device and not hw. mavwaked asks arecord for 16kHz mono,
+# which is what the whole pipeline is canonical in. Neither microphone offers
+# it, so bare hw dies on "Channels count non available" before a frame is read.
+# Any replacement wants ALSA's resampler in front the same way.
 #
-# The Scarlett measured RMS 0.003 against 0.14 on the onboard input, so its
-# front-panel gain is the thing to raise if she mishears. That is a knob, not
-# a control ALSA exposes. The two loud devices, the onboard ALC897 and the
-# camera, both clip at peak 1.0 and are worse candidates, not better ones.
+# The mic is on the XLR, which is Analogue 2 on this card and not Analogue 1:
+# Air and 48V are both named for Line In 2 and both belong to a mic preamp.
+# Measured 2026-08-09 through mavmic at 16kHz mono, gain up: rms 0.01826 peak
+# 0.09290 spoken, against a 0.00031 preamp floor, and 0.00002 for the whole
+# stream with a show playing. Front-panel gain is still the thing to raise if
+# she mishears, and it is a knob, not a control ALSA exposes.
 Environment=LD_LIBRARY_PATH=%h/.local/lib
 ExecStart=%h/.local/bin/mavwaked \
-  -device plughw:CARD=Gen,DEV=0 \
+  -device mavmic \
   -addr 127.0.0.1:9100 \
   -lang ru \
   -vad-model %h/.local/share/maven/models/silero_vad.onnx \

deploy/telegram.env.example

@@ -16,6 +16,34 @@ NTFY_TOKEN=
 # the card. Any long random string; mint one with:
 #   openssl rand -hex 32
 # The same value goes in a file on workpc, named by token_file in
-# deploy/mavgpud.json. Unset here and every workstation turn falls back to the
-# resident model, because mavgpud answers 401 and Maven reads that as down.
+# deploy/mavgpud.json. Empty is valid only while workstation.model_disabled is
+# true; enabling the LAN model arm without it fails Maven's config validation.
 MAVEN_GPU_TOKEN=
+
+# Bearer token used by Maven when it sends audio to the workstation's
+# CrisperWhisper service. The matching CW2_TOKEN is installed on workpc; these
+# two values must be identical. Leaving both unset is only safe while that
+# remote STT service is bound to loopback or its STT block is disabled.
+MAVEN_STT_TOKEN=
+
+# Home Assistant is currently explicitly disabled in deploy/mavend.json. Keep
+# this name in the canonical inventory so enabling that block cannot turn into
+# a valid-looking configuration with an expanded-empty token.
+HA_TOKEN=
+
+# docker compose reads these from the repository-root `.env`, before it starts
+# containers; they are listed here even though their destination differs so
+# this remains the complete deployment inventory. Copy both lines to `.env`.
+# Enabling with an empty token fails startup; false is the explicit dark state.
+# MAVEN_AMBIENT_ENABLED=false
+# MAVEN_AMBIENT_TOKEN=
+
+# Workstation-side counterpart to MAVEN_STT_TOKEN. Install this line in the
+# EnvironmentFile named by deploy/mavgpud.service (currently
+# %h/Programs/cw2-service/cw2.env), not in homesrv's telegram.env.
+# CW2_TOKEN=
+
+# The encrypted database key has its own narrowly mounted file,
+# deploy/db_key.env, and its own generator in deploy/README.md. It is named
+# here so an operator auditing this one inventory sees every deployed secret.
+# MAVEN_DB_KEY=

docker-compose.yml

@@ -97,15 +97,17 @@ services:
     <<: *image
     # voice.bind is 0.0.0.0:9100 in deploy/mavend.json so mavweb can reach it
     # cross-container. Verified 2026-07-06.
-    # -ambient-token turns on POST /api/ambient (Vikunja #126): the phone posts
-    # notification text, mavweb keeps only a meeting time. Empty ⇒ no route at
-    # all, which is what a missing MAVEN_AMBIENT_TOKEN gives. The value comes
-    # from the gitignored .env docker compose reads for interpolation, NOT from
-    # an env_file — flags are interpolated before any service env exists.
+    # -ambient-enabled turns on POST /api/ambient (Vikunja #126): the phone posts
+    # notification text, mavweb keeps only a meeting time. The explicit enabled
+    # flag prevents an unset token from looking like an intentional dark state.
+    # Both values come from the gitignored .env docker compose reads for
+    # interpolation, NOT from an env_file — flags are interpolated before any
+    # service env exists.
     # Weakness worth naming: mavweb takes this as a flag, so it is visible in
     # `ps` inside this container, unlike the zenmoney and IMAP secrets which are
     # read from files.
     command: ["mavweb", "-addr", ":9201", "-voice", "mavend:9100", "-core", "/run/maven/mavend.sock",
+              "-ambient-enabled=${MAVEN_AMBIENT_ENABLED:-false}",
               "-ambient-token", "${MAVEN_AMBIENT_TOKEN:-}",
               "-nexus", "http://nexus:9740", "-praxis", "http://praxis:8989", "-hexis", "http://hexis:9741"]
     depends_on: [mavend]

docs/CLAUDE.md

@@ -8,9 +8,9 @@ The tier is the path, so staleness is visible from the filename.
 | path | holds | lifetime |
 | --- | --- | --- |
 | `docs/*.md` | living. One file per subsystem: the reasoning, corrected in place. Each carries `Last verified: <date> @ <sha>`. | until it is wrong |
-| `docs/evals/` | dated measurements, one file per measurement. **Never edited after the day.** A newer number is a new file. | forever |
+| `docs/evals/` | dated measurements, one file per measurement. **Never edited after the day.** A newer number is a new file. Indexed in `docs/evals/CLAUDE.md`, which marks each one live or superseded. | forever |
 | `docs/caveats/` | known limits, one entry per limit, each with a task id and a revisit trigger. Indexed in `docs/caveats/CLAUDE.md`. | until fixed, then deleted |
-| `docs/plans/` | the plan for one piece of work, frozen once it starts | until the work lands |
+| `docs/plans/` | the plan for one piece of work, frozen once it starts. Indexed in `docs/plans/CLAUDE.md`. | until the work lands |
 | `docs/archive/` | dead. Read by nobody by default. | forever |
 
 ## Rules for this directory

docs/caveats/CLAUDE.md

@@ -22,29 +22,25 @@ caveat is the pointer between them plus the trigger.
 
 Every entry below came from the 2026-08-10 deep audit
 (`docs/evals/2026-08-10-repo-audit.md`), except the last, which came from wiring
-the gate the audit asked for. Five of the twenty findings are fixed and have no
+the gate the audit asked for. Twelve of the twenty findings are fixed and have no
 entry. The unauthenticated mavgpud proxy was V-673. The 20 reachable advisories
 in the toolchain and `x/text` were V-682. The missing analyzers were V-694, and
-what they now report is the baseline entry under V-701. The two unguarded
+what they now report is the baseline entry under V-701. The invalid STT and
+weather responses were V-675/V-676, the stuck TCP close was V-679, and the
+unbounded PTT path was V-688. The two unguarded
 invariants were V-692 and V-693, and their guards are described in
-`docs/routing.md`.
+`docs/routing.md`. The complete secret inventory and fail-closed integration
+validation were V-691. The atomic reminder transition was V-678. The traceable,
+sanitized mavweb problem contract was V-689.
 
 | limit | severity |
 | --- | --- |
 | [Anyone past the proxy can enroll a passkey](security.md#enrollment) | high |
 | [Passkey credentials are rewritten in place](security.md#credentials) | medium |
-| [An empty STT transcript reads as a successful one](external-inputs.md#stt) | medium |
-| [Open-Meteo's empty body becomes 0°C](external-inputs.md#weather) | medium |
 | [Dialogue persistence errors are swallowed](storage.md#dialogue) | medium |
-| [The reminder transition is a lost update](storage.md#reminders) | medium |
 | [A recall miss scans two whole tables](storage.md#recall) | medium |
-| [Closing a TCP listener can strand Accept](transport.md#accept) | medium |
-| [PTT reads an unbounded body](transport.md#ptt) | medium |
-| [mavweb errors cannot be traced](transport.md#errors) | medium |
 | [Fact enrichment is a 20-call serial waterfall](workers.md#enrichment) | medium |
-| [A suppressed nudge is phrased anyway](workers.md#nudges) | medium |
 | [Committed absolute paths pin the build to this box](config.md#paths) | medium |
-| [The env example omits deployed variables](config.md#secrets) | medium |
 | [The analyzers pass against a baseline, not zero](dependencies.md#baseline) | medium |
 | [Domain packages depend on store and IPC types](layering.md#dtos) | low |
 | [Eleven symbols are unreachable](layering.md#deadcode) | low |

docs/caveats/config.md

@@ -8,14 +8,3 @@ workstation model and Python paths. Vendoring hides the `go.mod` problem for an
 ordinary build. `-mod=mod`, `go mod tidy` and a fresh checkout all fail.
 Revisit when: anyone clones this repo elsewhere, or a `tidy` is needed.
 Workaround: build only from this checkout, with the vendor directory.
-
-## The env example omits deployed variables [#691] {#secrets}
-
-Costs: a fresh deploy can lose remote speech-to-text or ambient authentication
-and run on fallback behaviour with an apparently valid config. Three variables
-are referenced and undocumented: `MAVEN_STT_TOKEN`, `MAVEN_AMBIENT_TOKEN` and
-`CW2_TOKEN`. V-673 added `MAVEN_GPU_TOKEN` to the example.
-It is not silent. The loader logs which variables were unset and says whatever
-they configure is off. What is missing is a startup failure.
-Revisit when: the box is redeployed from scratch, or a new secret is added.
-Workaround: read that log line at startup.

docs/caveats/dependencies.md

@@ -3,10 +3,10 @@
 ## The analyzers pass against a baseline, not against zero [#701] {#baseline}
 
 Costs: `make lint` and `make deadcode` are wired and green (V-694), but green
-means "nothing new since 2026-08-11". The accepted set is 19 staticcheck
+means "nothing new since 2026-08-11". The accepted set is 16 staticcheck
 findings and 13 unreachable symbols, listed with a reason each in
 `scripts/analyzers/*.baseline`. Three of the unreachable symbols must stay:
-[layering.md](layering.md#deadcode). One accepted staticcheck finding is V-687.
+[layering.md](layering.md#deadcode).
 Revisit when: V-701 sweeps the baseline, or a fix deletes an entry. The gate
 fails on an entry whose finding is gone, so the deletion is not optional.
 Workaround: none needed. Reachability claims are checkable now. Read the

docs/caveats/external-inputs.md

@@ -1,20 +0,0 @@
-# External inputs
-
-What arrives from a service Maven does not run, and what happens when it
-arrives malformed. The shared shape: a JSON decode into value fields cannot
-tell "absent" from "zero", so a degraded response becomes a confident answer.
-
-## An empty STT transcript reads as a successful one [#675] {#stt}
-
-Costs: one dropped voice turn per malformed 200 from workpc. The mavsttd floor
-is never asked, because `stt.Pair` falls back on a non-nil error alone.
-Revisit when: CW2 returns a 200 with no text. Sooner if a proxy is put between
-homesrv and port 8081.
-Workaround: none. It is silent by design and the fallback is never spoken.
-
-## Open-Meteo's empty body becomes 0°C [#676] {#weather}
-
-Costs: he is told the weather is clear and 0°C when the service answered
-nothing. Distinct from V-589, which covered the HTTP status and not the body.
-Revisit when: a weather answer is reported as wrong, or the geocoder changes.
-Workaround: none.

docs/caveats/storage.md

@@ -11,14 +11,6 @@ Revisit when: a restart is reported as losing context. Sooner if a turn starts
 reading dialogue rows back to him.
 Workaround: none. The failure is invisible from outside.
 
-## The reminder transition is a lost update [#678] {#reminders}
-
-Costs: a concurrent fire and cancel both succeed and the last writer wins.
-Medium today because cancellation has no surface. High the moment V-622 adds
-one, and V-622 does not describe this invariant.
-Revisit when: V-622 starts, whichever comes first.
-Workaround: none, but the window is small while nothing can cancel.
-
 ## A recall miss scans two whole tables [#681] {#recall}
 
 Costs: every missed recall reads all of `memory_vectors` and then decodes and

docs/caveats/transport.md

@@ -1,34 +0,0 @@
-# Transport
-
-The HTTP and socket seams. What a client can do to them, and what a shutdown
-can do to us.
-
-## Closing a TCP listener can strand Accept [#679] {#accept}
-
-Costs: during close, both `errc` and `done` are ready in `acceptLoop`'s select.
-Go picks uniformly. So roughly one close in two leaves a waiting `Accept`
-blocked forever on a TCP seam. Unix sockets are unaffected.
-Revisit when: a daemon is seen hanging on shutdown, or before any new TCP
-listener is added.
-Workaround: the process usually exits anyway, which hides it.
-
-## PTT reads an unbounded body [#688] {#ptt}
-
-Costs: `handlePTT` does an unlimited `io.ReadAll`, and mavweb sets no header or
-idle timeouts. A client can force unbounded allocation or hold a connection
-open. mavgpud's half of this was fixed in V-673.
-Revisit when: mavweb is reachable from anything but the tunnel.
-Workaround: mavweb is not LAN-exposed today.
-
-`/ws` rides along with this entry. It never calls `SetReadLimit`, so the
-dependency default of 32,768 bytes applies, about a second of audio. Nothing
-reaches it: the browser posts PCM to `/api/ptt`, and only `handlers_test.go`
-opens `/ws`. It gets a caller and a real limit, or it gets deleted.
-
-## mavweb errors cannot be traced [#689] {#errors}
-
-Costs: some handlers return the raw internal error, which discloses internals.
-Others return a generic one with no identifier, which cannot be joined to its
-log line. There is no request-id middleware to join them.
-Revisit when: a reported UI failure cannot be found in the log.
-Workaround: read the log by timestamp.

docs/caveats/workers.md

@@ -1,6 +1,6 @@
 # Background workers
 
-Both entries are a tick doing expensive work it did not need to do.
+The entry is a tick doing expensive work it did not need to do.
 
 ## Fact enrichment is a 20-call serial waterfall [#680] {#enrichment}
 
@@ -11,13 +11,3 @@ scan, not this.
 Revisit when: Nexus gets slow, or when a batch-resolution endpoint exists.
 Workaround: an unreachable Nexus is fine. It is the slow-but-answering case
 that hurts.
-
-## A suppressed nudge is phrased anyway [#687] {#nudges}
-
-Costs: `PhraseNudge` runs before the dedupe is known. The `continue` meant to
-skip it is the last statement in the loop body. Every tick that
-keeps suppressing the same rule pays the resident model again. The comment
-above it claims the opposite.
-Revisit when: digestion ticks show up in the model's load, or when nudge rules
-grow past a handful.
-Workaround: none.

docs/deployment.md

@@ -78,7 +78,10 @@ vocabulary size. CW2's 51897 tokens shift seven special token ids. So CW2 is its
 own transformers service on port 8081 (`deploy/cw2/serve.py`).
 `stt.HTTPTranscriber` posts raw PCM to it with a bearer token, because audio is
 the most sensitive thing that crosses this seam. The switch is `workstation.stt`
-in `deploy/mavend.json`, and deleting the block sends every utterance to mavsttd.
+in `deploy/mavend.json`. A LAN URL with an empty token fails config validation;
+`workstation.stt.disabled: true` is the STT-only dark state;
+`workstation.disabled: true` disables both remote arms. The model has its own
+`model_disabled` switch because CW2 can remain live without the model proxy.
 
 **mavgpud runs that service as a second child.** This is not an optimisation.
 CW2 is a ROCm process on the same card, so it registers on the KFD like any
@@ -208,6 +211,18 @@ rule.
 
 ## Web UI conventions
 
+Every HTTP response carries a server-generated `X-Request-ID`. Error responses
+use `application/problem+json` with three fields: a sanitized `error`, a stable
+low-cardinality `code`, and that `request_id`. `writeProblem` is the only error
+writer: it records the full wrapped error beside the same ID in the mavweb log,
+while implementation paths, transport messages and credentials never reach the
+browser. A page that can usefully degrade instead of failing keeps HTTP 200 and
+renders the same code/request reference beside its sanitized panel error.
+
+The `/ecosystem` panel uses its HTTP request ID as `X-Correlation-ID` on its
+direct Nexus, Praxis and Hexis reads. Calls routed through mavend retain
+mavend's action-scoped correlation contract instead.
+
 Server-rendered pages share `cmd/mavweb/static/ui.css` (served at `/ui.css`) and
 the shell partial in `cmd/mavweb/shell.html`. A page opens with
 `{{template "shellTop" "<page-key>"}}` and closes with `{{template "shellBottom"}}`,

docs/design.md

@@ -1,6 +1,6 @@
 # Maven — Design
 
-*Last verified: 2026-08-07 @ beb093a. Living doc: correct it in place, do not append.*
+*Last verified: 2026-08-13 @ a0e6643 + V-542 working tree. Living doc: correct it in place, do not append.*
 
 > Folded 2026-07-30 from `SPEC.md` (north star, 2026-07-03), `maven.md`
 > (consolidated decisions, 2026-06-30) and `ROADMAP.md` (execution plan,
@@ -338,6 +338,44 @@ one run-on thought:
 > вот что я нашла: вайфай пароль лежит в ящике стола, на какое время поставить
 > напоминание?
 
+#### Conversation context is independent of intent
+
+Decided 2026-08-13 (V-542). A conversation is a sequence of turns, not a run of
+one route label. The utterance "давай поболтаем: я купил новый монитор" may
+correctly produce a grounded fact, and the next question may correctly route as
+query. Neither decision is permission to discard the words that make "он" in
+the next turn mean the monitor.
+
+`dialogue.Session.Utterance` therefore stores the exact user turn separately
+from `Slots.Text`. Slots are intent payloads: a fact may normalize them, a
+stage-0 route may leave them empty, and a continuation may deliberately carry
+an older topic. None of those is a transcript. `Session.History` holds up to
+four prior turns in speaking order and is persisted with the session; blobs
+written by older binaries fall back to their old `Slots.Text` field until they
+expire.
+
+`Session.Conversational` is orthogonal state too. A chat route sets it, as does
+an explicit cooperative opener such as "давай поговорим" even when the
+substantive clause routes fact. The opener is recognised from the closed marker
+plus `lexicon.ConversationVerbs`, with Russian forms compared by `morph`; there
+is no route regex or substring carve-out. Conversational state carries across
+later intents and uses the existing 15-minute chat TTL instead of expiring the
+anchor after two minutes.
+
+After routing, `followUpMerge` may use state the router cannot see. A routed
+query containing an anaphoric pronoun and a live prior transcript becomes chat,
+with query-only source provenance cleared. `PhraseChat` then receives the prior
+turns and the current utterance exactly once. This is narrower than adding the
+transcript to every query source: a non-anaphoric calendar, recall or world
+question still walks its evidence chain unchanged. Acts are never widened by
+this rule; an unresolved "выключи его" still has no executable function and
+must fail closed.
+
+An explicit conversational opener does not suppress a substantive side effect.
+The monitor statement remains a fact and also becomes the dialogue anchor.
+Conversation state and save-where are orthogonal, so making the first route
+chat would merely lose a true fact to work around a session defect.
+
 ### save-where — the two-memory routing axis
 
 One discriminator: **does the loop evaluate a predicate against it?**
@@ -896,7 +934,7 @@ Condensed from `ROADMAP.md` (2026-07-06). The live queue is the Vikunja board
 | 1.3 | desk_active presence script on desk PC | P1 | **not done** — operator action on `linux` (systemd user timer + hypridle listener); 0 facts ever written, presence runs on `page_heartbeat` alone |
 | 2.1 | Cold-start unlock (passkey → L3 key seam) | P2 | code done `b0932a1`+`15fe7bb`, **tests missing** — wrap/unwrap round-trip, wrong-cred unwrap fails, locked-mode IPC rejects non-unlock methods |
 | 3.1 | Always-on listening | P3 | MVP `e57647c` (energy-VAD only); remaining: wake-word model in `vad.go` |
-| 3.2 | Conversation depth (multi-turn) | P3 | done `05236ad` — anaphora resolver + cross-intent `followUpMerge` + `Session.History` |
+| 3.2 | Conversation depth (multi-turn) | P3 | repaired V-542 on 2026-08-13 — intent-independent utterance history; anaphoric queries reach chat context across fact/query/chat boundaries |
 | 3.3 | Latency / streaming (streaming STT/TTS, barge-in) | P3 | not started; recommended path is WebSocket voice, keeping TCP for non-browser clients |
 | 4.1 | Routing quality (dev embedder) | P4 | done `b7eb53a` — `make download-embedder`, configurable `voice.query_min_score` |
 | 4.2 | Act surface broadening | P4 | not a code item (operator config) |

docs/evals/2026-08-11-classifier-baseline-after-tokenizer-fix.md

@@ -0,0 +1,71 @@
+# The classifier baseline after the tokenizer fix
+
+Measured 2026-08-11 on master at `2cf8b7e`, the classifier cascade with the ONNX
+multilingual embedder, the configuration homesrv runs. `make t
+PKG=./internal/router/eval/ RUN=TestONNXBaseline V=1`. Covers V-704.
+
+## Result
+
+Intent is **72/96 (75.0%)**. Destination is **11/33 (33.3%)**.
+
+`docs/evals/2026-08-08-destination-fixture.md` recorded 73/96 (76.0%) and 12/33
+(36.4%) three days earlier, and `CLAUDE.md` and `docs/routing.md` both carried
+that pair until today. Same fixture, same 33 labelled cases, so the two pairs
+are comparable and one case moved.
+
+| | 2026-08-08 | today |
+|---|---|---|
+| intent | 73/96 (76.0%) | 72/96 (75.0%) |
+| destination | 12/33 (36.4%) | 11/33 (33.3%) |
+| world | 5/5 | 5/5 |
+| the `SourceUnknown` floor | 5/7 | 4/7 |
+| calendar | 2/6 | 2/6 |
+| recall | 0/15 | 0/15 |
+
+## One case moved, and it cost both numbers
+
+`en-query-002`, "how long since the last backup finished". It routed `query` on
+08-08 and routes `fact` today, at 0.870.
+
+The case carries `want_source` present and empty, the floor label. `Score`
+credits a destination only after the route lands the intent. So the case paid
+once on the intent and once on the destination. Two numbers moved by one case,
+which is why the drift read as two regressions.
+
+## The commit
+
+`feabf9f`, "The tokenizer read every long word backwards" (V-664), landed
+2026-08-08 after the destination measurement.
+
+Bisected by running `TestONNXBaseline` at each commit:
+
+| commit | intent | destination |
+|---|---|---|
+| `b6eaa70` V-659, the 08-08 measurement | 73/96 | 12/33 |
+| `e470435` V-661 | 73/96 | 12/33 |
+| `a886217` V-663 | 73/96 | 12/33 |
+| `50c6637` merge #205, parent of the fix | 73/96 | 12/33 |
+| **`feabf9f` V-664, the tokenizer fix** | **72/96** | **11/33** |
+| `c938148` V-666 | 72/96 | 11/33 |
+| `2cf8b7e` master today | 72/96 | 11/33 |
+
+Nothing between `a886217` and `feabf9f` touches routing except that commit and
+one merge, and the merge holds the old pair.
+
+## What this means for the pair
+
+The higher pair is not a target to restore. Before `feabf9f`, `encodeWord`
+emitted the characters of every long word in reverse. So the 76.0% and 36.4%
+were scored on embeddings from a broken encoder. One case landed right under the
+defect and lands wrong under the fix.
+
+So 75.0% and 33.3% is the honest floor, and `en-query-002` is not a regression to
+chase. It is a case the corrected encoder gets wrong, worth the same attention as
+the other 23 intent misses and no more.
+
+## What this does not measure
+
+The routing heads row and the two gemma rows in `docs/routing.md` were not
+re-run. The heads commits all land after `feabf9f`, so that row was already
+measured against the corrected tokenizer. The gemma rows are the model arm and
+were not checked either way.

docs/evals/2026-08-13-conversation-continuity.md

@@ -0,0 +1,48 @@
+# Five turns retain one referent across fact, query and chat routes
+
+Measured 2026-08-13 on homesrv from `master` at `a0e6643` plus the V-542
+working tree. Task: V-542. The run uses the deterministic simulator phraser;
+no resident model is needed.
+
+## Setup
+
+`conversation_anaphora.json` replays the five Russian turns that exposed the
+defect. Their scripted router decisions remain the observed
+fact/query/query/chat/query sequence. Each of the four contextual replies is
+accepted only if the chat phraser receives history containing the original
+`купил новый монитор` turn; this prevents a canned response from hiding a
+missing transcript.
+
+Commands:
+
+```sh
+make t PKG=./cmd/mavend RUN='TestExplicitConversationOpenerKeepsCrossIntentSessionAlive|TestConversationOpenerDoesNotMatchAnotherDavaiCommand|TestFollowUpMerge|TestSimulatorScenarios/conversation_anaphora' V=1 RACE=1
+make t PKG=./internal/dialogue RUN=TestSessionSurvivesRestart V=1 RACE=1
+make t PKG=./internal/router RUN=TestAnaphoraResolverUsesTokenBoundariesAcrossPunctuation V=1 RACE=1
+MAVEN_DIALOGUE_NO_SKIP=1 make t PKG=./cmd/mavend RUN=TestDialogueTraces V=1 RACE=0
+```
+
+## Result
+
+| Gate | before | after |
+| --- | ---: | ---: |
+| contextual replies that name the monitor | 0/4 | **4/4** |
+| replies proven to receive the original turn in history | 0/4 | **4/4** |
+| original grounded fact still written | 1/1 | **1/1** |
+| unsolicited sends in five turns plus one tick | 0/6 | **0/6** |
+| focused race-tested packages | — | **3/3 pass** |
+
+The forced dialogue suite passed 18/22 rows. Its four failures are the existing,
+unrelated offline-floor cases for a mid-flow note, a correction while a question
+is parked, a whole-day reminder, and a short correction that does not park a
+clarification. None exercises V-542; the continuity scenario and all focused
+race gates pass.
+
+## What this rules out
+
+The fix does not rewrite pronouns into guessed nouns or add a phrase regex.
+Exact utterances form a persisted, chronological transcript independently of
+intent slots. An anaphoric query with live dialogue context moves to chat and
+clears query-source provenance; non-anaphoric queries retain their source path,
+and acts are never widened. An explicit conversation opener extends session
+lifetime without suppressing the fact side effect in its substantive clause.

docs/evals/2026-08-13-onnx-runtime-lifecycle.md

@@ -0,0 +1,65 @@
+# ONNX aggregate gate lifecycle — 2026-08-13
+
+Vikunja: V-716.
+
+## Finding
+
+`router.NewONNXEmbedder` initialized `onnxruntime_go` unconditionally. Its
+`Close` method destroyed the model session but left the package-global runtime
+environment alive. In one Go process the first `TestONNX*` therefore ran and
+every later constructor returned `The onnxruntime has already been initialized`.
+Those tests converted the constructor error into `t.Skip`, so the aggregate
+package still reported `PASS`.
+
+Reproduction before the fix:
+
+```text
+TestONNXBaseline     PASS  classifier+onnx 72/96
+TestONNXRoutingHeads SKIP  onnx: init environment: already initialized
+package              PASS
+```
+
+## Contract
+
+The router now owns ONNX Runtime through reference-counted leases. Every model
+session holds one lease; routing heads hold their own, so daemon shutdown order
+cannot unload the library underneath a live graph. The last lease destroys an
+environment Maven initialized. Package `TestMain` holds one extra lease across
+all model-aware tests in `internal/router/eval` and `cmd/mavend`.
+
+The aggregate router command additionally requires two named gates to record
+execution only after all of their model dependencies loaded. A second-test
+skip can no longer satisfy the command.
+
+## Measurement
+
+Runtime and model:
+
+```text
+deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so.1.26.0
+models/embedder/multilingual-e5-small/model_quantized.onnx
+models/embedder/router-heads/router_heads.onnx
+```
+
+Focused aggregate, one process:
+
+```text
+TestONNXBaseline     PASS  72/96 full (75.0%), destination 11/33
+TestONNXRoutingHeads PASS  93/96 full (96.9%), destination 25/33
+ONNX aggregate proof: verified 2 required model gates:
+  [TestONNXBaseline TestONNXRoutingHeads]
+```
+
+The separate lifecycle test released the last lease and successfully acquired
+the runtime again. A second same-process package run also executed all three
+selected mavend gates without a skip:
+
+```text
+TestONNXPersonalBoundary         PASS  29/29
+TestONNXPersonalBoundaryFourFold PASS  99/104
+TestONNXTopics                   PASS  43/43
+```
+
+Finally, `make eval-router` completed the full package. In addition to the two
+required proof gates, `TestONNXClaimConfidenceDistribution` and
+`TestReachBaselineONNX` executed; ecosystem reach remained 28/30.

docs/evals/2026-08-13-personal-boundary-linear-head.md

@@ -0,0 +1,101 @@
+# A class-balanced linear head closes every held-out personal-boundary cell
+
+Measured 2026-08-13 on homesrv from `master` at `56254a5` plus the V-702
+working tree. Embedder: quantized multilingual-e5-small through ONNX Runtime
+1.26.0. This supersedes
+`2026-08-13-personal-boundary-neighbourhood.md`.
+
+Commands:
+
+```sh
+MAVEN_ONNX_LIB="$PWD/deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so.1.26.0" \
+  go test ./cmd/mavend -run '^TestONNXPersonalBoundary$' -count=1 -v
+MAVEN_ONNX_LIB="$PWD/deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so.1.26.0" \
+MAVEN_EVAL_PERSONAL_BOUNDARY=1 \
+  go test ./cmd/mavend -run '^TestONNXPersonalBoundaryStratified$' -count=1 -v
+```
+
+## Setup
+
+The prior three-neighbour scorer passed the 29-case regression table but
+missed 11 of a new 72-case fixture. The fixture is balanced across Russian and
+English, expected personal and world classes, and six sentence shapes:
+remembered speech, possession, narrative, first-person preamble, current
+advice/information and public proper nouns. Its hygiene test rejects copied
+training phrases and repeated Baikal variants.
+
+Production uses a binary logistic head fitted over 132 bilingual examples.
+Each class has total sample weight 0.5 even though the class sizes differ. The
+optimiser is deterministic: 5,000 full-batch steps, decaying learning rate from
+10, L2 coefficient 0.0003. The fitted 384 weights are frozen into the binary
+and pinned to the embedder model ID; a model-backed test retrains from the text
+corpus and rejects any drift. An unknown embedder ID falls back to fitting its
+own corpus rather than applying weights from another vector space.
+
+No evaluation utterance is in the training corpus. Ordinary CI checks class
+balancing, mixed dimensions, exact regression-table leakage, and generalisation
+across synthetic semantic directions. The model-backed gate also runs
+four-fold cross-validation over the expanded corpus, stratified inside each
+sentence shape and class; the original compact corpus remains in every fold as
+the historical floor.
+
+The six shapes of the training corpus were chosen after the first 72-case
+matrix exposed their gaps, so 72/72 is a regression gate, not independent proof
+of generalisation. The first independently authored 24-case challenge then
+exposed one remaining miss, `на каком порту я решил поднять тестовый сервис?`,
+at personal probability 0.4666. It became model-selection data at that point
+and cannot honestly remain the independent result.
+
+A comparison rejected shrinkage LDA (24/24 challenge but 69/72 stratified) and
+an LDA/logistic blend (24/24 but 71/72). Increasing only the balanced logistic
+head's L2 coefficient from 0.0001 to 0.0003 kept the corpus and stratified gates
+intact while improving evidence that did not contain that sentence: four-fold
+cross-validation rose from 97/104 to 99/104 and whole-semantic-group holdout
+rose from 91/104 to 92/104. It also moved the original challenge to 24/24,
+although its +0.0001 minimum signed probability margin is correctly treated as
+a regression, not fresh proof.
+
+Three checks now supply the honest evidence beyond the 72-case regression:
+
+- Four-fold within-shape cross-validation scores 99/104.
+- Whole-group holdout scores 92/104 in aggregate.
+- A second 24-case challenge was written after the coefficient and frozen head
+  were fixed. It returns to private configuration, commitments and stored
+  choices versus public technical facts, compatibility and maintenance with
+  new subjects. It scores 24/24 with minimum signed probability margin +0.1718.
+  Its rows remain outside the training corpus and no result from it was used to
+  retune this revision.
+
+Whole-semantic-group holdout is intentionally diagnostic rather than claimed
+as perfect: remembered speech 14/16, possession 19/22, narrative 16/16,
+first-person preamble 15/16, advice/current information 13/16, and public proper
+nouns 15/18. This shows the embedder has a shared boundary direction but some
+ambiguities genuinely need shape coverage.
+
+## Result
+
+| Gate | three-neighbour | linear head |
+| --- | ---: | ---: |
+| historical regression | 29/29 | **29/29** |
+| stratified fixture | 61/72 | **72/72** |
+| Russian | 30/36 | **36/36** |
+| English | 31/36 | **36/36** |
+| expected personal | 28/36 | **36/36** |
+| expected world | 33/36 | **36/36** |
+
+Every one of the six strata is 12/12. The minimum signed probability margin is
++0.0522 after the independently supported regularisation change. The decision
+remains personal probability greater than 0.5; neither a lexical exception nor
+a shifted privacy prior was introduced.
+
+Cold first-boundary load plus score is 15.179µs; steady inference is 1.112µs per
+score over 100,000 iterations. The previous runtime corpus fit took 5.618s on
+the same box, which is why fitting moved to the model-backed build gate.
+The unconfigured `HashEmbedder` floor still fits its own 1024-dimensional head
+because these ONNX weights do not belong in that space; its sparse-vector fit
+uses 400 steps and measures 93.818ms on first use.
+
+The ONNX Runtime wrapper is process-global today, so these model-backed tests
+must be invoked in separate `go test` processes until V-716 repairs the harness;
+otherwise only the first test runs and the rest self-skip. The figures above
+were all collected as separate commands.

docs/evals/2026-08-13-personal-boundary-neighbourhood.md

@@ -0,0 +1,53 @@
+# Three neighbours keep a public noun from opening the personal boundary
+
+Measured 2026-08-13 on homesrv from `master` at `56254a5` plus the V-702
+working tree. Embedder: quantized multilingual-e5-small through ONNX Runtime
+1.26.0. Command:
+
+```sh
+make t PKG=./cmd/mavend/ RUN=TestONNXPersonalBoundary V=1 RACE=0
+make t PKG=./cmd/mavend/ RUN=TestONNXTopics V=1 RACE=0
+```
+
+This supersedes `2026-08-03-personal-boundary.md` for the boundary score. That
+file remains the measurement of why possession markers were replaced.
+
+## Defect
+
+The boundary used the best cosine on each side: one-nearest-neighbour
+classification. Its world class correctly includes narrative questions such
+as `расскажи про байкал`, while its personal class includes remembered-speech
+questions. The held-out `я рассказывал тебе про байкал?` therefore scored
+personal 0.9068 against world 0.9413. The public subject outweighed the question
+about what the owner had previously told Maven, and the boundary opened toward
+SearXNG.
+
+Adding two plausible personal paraphrases did not move either score. Candidate
+similarities to the failing turn ranged from 0.8373 to 0.9022, still below the
+world proper-noun neighbour. This ruled out a missing synonym and argued against
+putting the held-out sentence or another Baikal-shaped exception into the seed
+set.
+
+## Change
+
+Each class now scores as the mean of its three nearest seeds. The same `k=3`
+applies on both sides, so the larger world class cannot win merely by having
+more coverage. Only the local neighbourhood is averaged because the personal
+class has two modes—possession and remembered speech—and a whole-class centroid
+would dilute them into each other.
+
+This is a scoring change, not a seed or a phrase rule. The Baikal utterance
+remains held out.
+
+## Result
+
+| Gate | one neighbour | three neighbours |
+| --- | ---: | ---: |
+| personal boundary | 28/29 | **29/29** |
+| Baikal margin | -0.0345 | **+0.0147** |
+| topic recognisers | 43/43 | **43/43** |
+
+The nearest personal true positive is `когда мой следующий отпуск` at +0.0110.
+The nearest world true negative is `расскажи про эверест` at -0.0135. No extra
+threshold is justified between them. The gate remains the sign of the class
+difference, favouring local refusal over sending owner-related text outward.

docs/evals/CLAUDE.md

@@ -0,0 +1,135 @@
+# docs/evals/
+
+One file per measurement, named for the day it was taken. **Never edited after
+that day.** A newer number is a new file, never an edit to an old one.
+
+Reasoning does not belong here. It belongs in the subsystem's living doc under
+`docs/`. An eval holds the setup, the numbers and what they rule out.
+
+## Rules for this directory
+
+* Filename is `YYYY-MM-DD-<what-was-measured>.md`. The date is the day it ran.
+* The first line is the claim, not the topic. A reader picks a file from this
+  index without opening it, so the H1 has to carry the finding.
+* Head the file with the date, the task id, the box and the build.
+* **A file that replaces an older number says so.** It names the file it
+  replaces. This index then marks that one superseded.
+* A superseded file is not deleted and not edited. It records what was believed
+  that day. A living doc may still cite it for the run itself.
+
+## Reading a number out of here
+
+Check the state column before citing a row. **A number in a living doc must
+cite a live file.** The 2026-08-11 classifier baseline exists for that reason.
+A pair in `docs/routing.md` went stale unnoticed. Its source predated the
+`encodeWord` fix at `feabf9f`. Nothing failed (V-704).
+
+## Routing: the arms and the cascade
+
+| measurement | state |
+| --- | --- |
+| [Routing evaluation](2026-07-31-routing.md) | superseded |
+| [Resident model bake-off](2026-07-31-model-bakeoff.md) | live |
+| [gemma-4-12b on the workstation, against the resident Qwen3-1.7B](2026-08-02-workstation-gemma4-12b.md) | live |
+| [Routing from audio: four paths, one fixture](2026-08-05-audio-in-routing.md) | live |
+| [Routing with the resident model, re-measured](2026-08-05-routing-resident-model.md) | live |
+| [The routing trajectory, and the number that is missing](2026-08-06-routing-trajectory.md) | live |
+| [Gemma as a label function, and what it found in the seeds](2026-08-06-seed-labels-vs-router-prompt.md) | live |
+| [Moving the seed files onto the router prompt's boundaries](2026-08-06-seeds-to-prompt-boundary.md) | live |
+| [The first destination number](2026-08-08-destination-fixture.md) | superseded |
+| [The destination, with a model that can name one](2026-08-08-destination-model-arm.md) | live |
+| [The routing heads, running in Go](2026-08-08-routing-heads-in-go.md) | live |
+| [Two heads on e5-small, and the first destination the router did not need a model for](2026-08-08-routing-heads-two-head.md) | live |
+| [A slot head, and the corpus that did not exist this morning](2026-08-08-slot-head-three-head.md) | live |
+| [A clarify head, and a confidence that is not a hardcode](2026-08-08-clarify-head-four-head.md) | live |
+| [MASSIVE Russian warm-start for the routing heads](2026-08-08-massive-warm-start.md) | live |
+| [gemma-4-E4B against gemma-4-12B on the routing fixture](2026-08-09-e4b-vs-12b-routing.md) | live |
+| [The classifier baseline after the tokenizer fix](2026-08-11-classifier-baseline-after-tokenizer-fix.md) | live |
+
+`docs/routing.md` holds the arm table these feed. Cite from there, not from here.
+
+## Stage 0, slots and the turn
+
+| measurement | state |
+| --- | --- |
+| [Five turns retain one referent across fact, query and chat routes](2026-08-13-conversation-continuity.md) | live |
+| [Personal boundary, seed scoring vs possession markers](2026-08-03-personal-boundary.md) | superseded |
+| [Three neighbours keep a public noun from opening the personal boundary](2026-08-13-personal-boundary-neighbourhood.md) | superseded |
+| [A class-balanced linear head closes every held-out personal-boundary cell](2026-08-13-personal-boundary-linear-head.md) | live |
+| [Half-past and quarter-to hours](2026-08-05-half-past-hours.md) | live |
+| [Praxis reach at stage 0](2026-08-05-praxis-reach.md) | live |
+| [Alarm verbs reach stage 0](2026-08-06-alarm-verbs-reach-stage-0.md) | live |
+| [Russian acts reach tools](2026-08-06-russian-acts-reach-tools.md) | live |
+| [The fact parser: closed classes against the substring stems they replaced](2026-08-06-fact-parser.md) | live |
+| [The reminder completeness rule, measured on the box](2026-08-06-reminder-completeness-on-the-box.md) | live |
+| [Nine claimants interrupting a parked reminder](2026-08-06-claimant-interleave.md) | live |
+| [The parked clarify ride, bounded and re-measured](2026-08-08-parked-clarify-ride.md) | live |
+
+## Ecosystem
+
+| measurement | state |
+| --- | --- |
+| [Ecosystem reach, measured](2026-08-04-ecosystem-reach.md) | live |
+| [Ecosystem reach with the resident model as router](2026-08-05-reach-llm-router.md) | live |
+
+## Recall and memory
+
+| measurement | state |
+| --- | --- |
+| [Note recall evaluation](2026-07-31-recall.md) | superseded |
+| [Recall topic veto, what it costs and what it buys](2026-08-03-recall-topic-veto.md) | live |
+| [Note recall after the e5-small swap](2026-08-04-recall-e5-small.md) | live |
+
+## Phrasing and talk
+
+| measurement | state |
+| --- | --- |
+| [Phrasing evaluation](2026-07-31-phrasing.md) | superseded |
+| [Conversational phrasing eval](2026-07-31-talk.md) | superseded |
+| [Talk fixture against the resident model](2026-08-05-talk-fixture-resident.md) | live |
+| [Talk temperature sweep: Qwen3-1.7B, 4 temperatures times 3 runs](2026-08-05-temperature-sweep.md) | live |
+| [gemma-4-E4B on the phrasing and talk fixtures](2026-08-09-e4b-phrasing.md) | live |
+
+## World: search and Kiwix
+
+| measurement | state |
+| --- | --- |
+| [Does the ZIM answer when the line is down?](2026-08-05-kiwix-offline-fallback.md) | live |
+| [Does SearXNG claim a question it cannot answer?](2026-08-05-search-quality-signals.md) | live |
+| [Kiwix answered the wrong question, and the fix was not a relevance gate](2026-08-09-kiwix-topic-retrieval.md) | live |
+
+## Speech in and out
+
+| measurement | state |
+| --- | --- |
+| [CrisperWhisper 2.0 in Russian, measured](2026-08-09-crisperwhisper2-russian-wer.md) | live |
+| [silero-vad against the energy threshold in mavwaked](2026-08-09-silero-vad.md) | live |
+| [The "Мэйвен" wake word: what it hears and what it invents](2026-08-09-wake-word.md) | live |
+
+## Runtime and storage
+
+| measurement | state |
+| --- | --- |
+| [Both ONNX routing gates execute in one process](2026-08-13-onnx-runtime-lifecycle.md) | live |
+| [Where the resident model's 7.9GB of RSS goes](2026-08-03-llama-prompt-cache.md) | live |
+| [Does one sqlite connection make reads queue? No](2026-08-07-store-connection-cap.md) | live |
+
+## Whole-system runs
+
+Each run pairs a write-up with its raw transcript. The transcript is the
+evidence and is not summarised anywhere else.
+
+| measurement | state |
+| --- | --- |
+| [A week of talking to Maven](2026-08-07-week-of-usage.md), [transcript](2026-08-07-week-of-usage-transcript.md) | live |
+| [Two weeks of talking to Maven, as a baseline to re-run](2026-08-08-two-weeks.md), [transcript](2026-08-08-two-weeks-transcript.md) | live |
+| [The same fortnight, after V-655 merged](2026-08-08-two-weeks-after-merge.md), [transcript](2026-08-08-two-weeks-after-merge-transcript.md) | live |
+
+## Audit
+
+| measurement | state |
+| --- | --- |
+| [Repository deep-audit report](2026-08-10-repo-audit.md) | live |
+
+Its open findings live in `docs/caveats/`, one entry each with a revisit
+trigger. Read the index there, not this file, for what is still broken.

docs/offload.md

@@ -113,8 +113,11 @@ read `/slots`, which returns other callers' prompts. mavgpud now reads
 network without one. Downgrading to loopback instead would look safe and take
 the model arm down. Maven sends the same token from `workstation.token`, on the
 completion and on the `/health` probe alike. An unsigned probe answers 401,
-which Pair reads as a busy card, so a missing token degrades to the resident
-model rather than breaking a turn. The proxy also
+which Pair reads as a busy card, but Maven now rejects a live LAN workstation
+block with a missing token at startup: fallback must describe a temporarily
+unavailable machine, not hide a broken secret source. `model_disabled: true`
+is the explicit resident-only state and does not take CW2 down with it. The
+proxy also
 allowlists the five paths Maven calls, so a leaked token buys the model API and
 not llama-server's admin surface.
 

docs/operations.md

@@ -67,14 +67,30 @@ Config path: `~/.config/maven/mavend.json`. Full example with all options.
 
 Omit the `embedder` block entirely to use the deterministic HashEmbedder floor (no ML, no ONNX runtime dependency). Useful for testing or low-resource setups.
 
-`${NTFY_TOKEN}` and the `${TELEGRAM_*}` vars are expanded from `deploy/telegram.env`, which is gitignored. Copy `deploy/telegram.env.example` and fill it in. Mint a scoped token rather than reusing an admin one. It needs write access to the `maven` topic and nothing else:
+`deploy/telegram.env.example` is the canonical inventory for every deployed
+secret, including values whose destination is the root `.env`, the workpc CW2
+environment file, or `deploy/db_key.env`. Copy values only to the destination
+named beside them; never commit the populated files. Maven expands the homesrv
+sink, workstation, and Home Assistant variables from `deploy/telegram.env`.
+
+Every written integration block is either explicitly disabled or live. A live
+Telegram, ntfy, LAN workstation model/STT, Home Assistant, ambient, CW2, or
+encrypted-database configuration with an empty credential fails startup. This
+keeps a missing env file from quietly becoming fallback behavior. The deployed
+ntfy is currently `disabled: true`, and the workstation model arm is
+`model_disabled: true`; the separately credentialed CW2 STT arm remains live.
+Remove a dark-state flag only after provisioning that arm's credential.
+
+Mint a scoped ntfy token rather than reusing an admin one. It needs write access
+to the `maven` topic and nothing else:
 
 ```sh
 ntfy access maven maven write-only
 ntfy token add --expires=never maven
 ```
 
-Deleting the `ntfy` block turns the reach off, and that is not a no-op. The routing table sends sev3-away nudges and away reminders to ntfy and nowhere else. With no sink wired they hit a nil and vanish, leaving no log line and no `delivery_attempts` row (V-649).
+`disabled: true` keeps a documented ntfy block dark. When enabled, reminders
+try ntfy and fall through to Telegram; delivery attempts record each reach.
 
 ## mavsttd — STT worker (optional, remote whisper.cpp)
 

docs/plans/03-memory-evaluation.md

@@ -28,7 +28,7 @@
 
 ---
 
-## Status 2026-08-01 — foundation shipped (Vikunja #248)
+## Status 2026-08-01 — foundation shipped (V-248)
 
 **Shipped:** `internal/memeval` (not `internal/memory/eval.go` — `internal/store`
 imports `internal/memory` for the vector backend, so an evaluator that reads

docs/plans/07-vision.md

@@ -17,7 +17,7 @@ describing half is **BLOCKED on a model download** — see "What is blocked" bel
 | IPC method `describe_image` (`AuthRead`) | `internal/ipc/{wire,api,client,server}.go`, `internal/auth/policy.go` |
 | Daemon wiring + hourly retention prune | `cmd/mavend/vision.go` |
 
-`internal/media` is deliberately shared: hearing (#253) and speaker recognition (#255) have
+`internal/media` is deliberately shared: hearing (V-253) and speaker recognition (V-255) have
 the same intake problem — a blob arrives, gets stored, gets described — and they store their
 audio in the same place under the same retention.
 
@@ -77,7 +77,7 @@ To unblock, download one pair to `/mnt/hdd1/llms/vision/` (bind-mounted to
 - `moondream2` — smallest, English-only in practice. Do not bother, per the sub-500M lesson.
 
 Then run a second llama-server on 8081 with `--mmproj`, point `vision.endpoint` at it, and
-walk the QA steps on Vikunja #252.
+walk the QA steps on V-252.
 
 ## Config
 

docs/plans/08-hearing.md

@@ -14,14 +14,14 @@ shipped is the workpc-side microphone agent and the router intent — see "Still
 |---|---|
 | Session state machine: start / append / stop / abort / status | `internal/capture/capture.go` |
 | Map-reduce summarisation against `n_ctx` 4096 | `internal/capture/summarize.go` |
-| Audio blobs in the shared store, pruned by `media.retention` | `internal/media` (from #252) |
+| Audio blobs in the shared store, pruned by `media.retention` | `internal/media` (from V-252) |
 | Config block `capture`, off by default | `internal/config/config.go` |
 | IPC `capture_start` / `capture_append` / `capture_stop` / `capture_status` | `internal/ipc/{wire,api,client,server}.go` |
 | Authority: the three write methods `AuthWrite`, status `AuthRead` | `internal/auth/policy.go` |
 | Daemon wiring, note write, STT reuse | `cmd/mavend/capture.go` |
 
 The audio lands in the same content-addressed blob store as images, under the same retention
-loop, because #252 and #253 have the same intake problem and solving it twice would mean two
+loop, because V-252 and V-253 have the same intake problem and solving it twice would mean two
 directories to remember to prune.
 
 ## The refusals, and why
@@ -117,5 +117,5 @@ Both absent by default. `capture` alone does nothing without `media`.
   talking, so the recorder's stop and the speech barge-in must not collide.
 - **A `/dash` panel** showing a running session, so a recording is visible on a surface and not
   only in a log line.
-- **Speaker attribution** — who said what — is #255 and is blocked on a model; see
+- **Speaker attribution** — who said what — is V-255 and is blocked on a model; see
   `docs/plans/10-speaker-recognition.md`.

docs/plans/10-speaker-recognition.md

@@ -3,7 +3,7 @@
 **Goal:** Maven can tell who is speaking on the voice channel, and tag what she writes with
 who said it.
 
-**Status (2026-08-01, Vikunja #255):** the enrolment half is shipped. The recognising half is
+**Status (2026-08-01, V-255):** the enrolment half is shipped. The recognising half is
 **BLOCKED on a model download** — there is no speaker-embedding model on this box, and one
 was not invented to fill the gap. See "Blocked, and on what" below.
 
@@ -125,6 +125,6 @@ lied.
 - **An enrolment surface.** The three IPC methods exist; no page drives them. Enrolment is
   step-up, so it belongs on `/dash` behind a passkey, with a per-profile forget button next to
   each row — that button is the reason `list_speakers` exists.
-- **A speaker column on the meeting recorder** (#253). Attributing lines in a transcript is
+- **A speaker column on the meeting recorder** (V-253). Attributing lines in a transcript is
   the obvious pairing, and it is the place where getting attribution wrong is most damaging,
   so it waits for a real model too.

docs/plans/13-rss-news-feeds.md

@@ -30,7 +30,7 @@
 
 ---
 
-## Shipped 2026-08-01 (#258)
+## Shipped 2026-08-01 (V-258)
 
 `internal/webfetch` (the guarded HTTP door: scheme, allow/deny hosts, private-address
 refusal in the dialer, size cap, redirect cap, per-host rate limit), `internal/rss`

docs/plans/14-web-crawler.md

@@ -29,11 +29,11 @@
 8. Add `crawls` block to `config.Config` and `deploy/mavend.json`
 9. Test with a static HTML page — verify extraction matches expected values, verify scheduling fires correctly
 
-## Shipped 2026-08-01 (#259)
+## Shipped 2026-08-01 (V-259)
 
 Built as `internal/crawl` (pure: robots, extraction, watcher) plus
 `cmd/mavend/crawls.go` (fetcher, ticker, dedup facts), on top of the guarded
-`internal/webfetch` door added with the feed reader (#258). Off unless
+`internal/webfetch` door added with the feed reader (V-258). Off unless
 configured, in two separately-switched halves: `crawl.on_demand` for a URL he
 names, `crawl.watches` for a scheduled re-read.
 

docs/plans/15-board-surface.md

@@ -1,6 +1,6 @@
 # Plan: The work board surface
 
-**The decision Vikunja #431 asked for. Written 04-08-2026.**
+**The decision V-431 asked for. Written 04-08-2026.**
 
 **Verdict: build it, in a smaller shape than the task imagined.** The board is worth
 moving out of the file. The intake form belongs on the `/tasks` page, not on the voice

docs/plans/16-ambient-calendar.md

@@ -1,6 +1,6 @@
 # Plan: What the ambient calendar path should be
 
-**The decision Vikunja #432 asked for. Written 04-08-2026.**
+**The decision V-432 asked for. Written 04-08-2026.**
 
 **Verdict: keep the endpoint, change the contract.** The relay app sends structured
 fields, not a notification blob. The free-text parser stays as the degraded path, because
@@ -9,7 +9,7 @@ if the answer to the one open question below is no.
 
 ## First, the task's premise is out of date
 
-#432 states as confirmed that every ambient event lands on the day the notification was
+V-432 states as confirmed that every ambient event lands on the day the notification was
 posted, because there is no date parsing at all. That was true when the task was filed
 and it is not true now.
 
@@ -17,7 +17,7 @@ and it is not true now.
 "завтра в 15:00" now dates to tomorrow. The same commit added `ambientPastGrace`, which
 refuses an event landing more than two hours before the notification, on the reasoning
 that the day was inferred and a stale inference is wrong rather than late. `45a5e37`
-(#482, this week) fixed a second dating bug the task did not know about: the wall clock
+(V-482, this week) fixed a second dating bug the task did not know about: the wall clock
 was resolved against the notification's own zone, so every ambient meeting on a non-UTC
 box landed off by the deploy's UTC offset.
 
@@ -38,7 +38,7 @@ Everything follows from this and nothing in this repo can answer it.
 A `NotificationListenerService` sees a title and a body. It cannot know a meeting's real
 start, end or organiser, because those are not in the notification. So if the relay is
 limited to the notification stream, free-text parsing on this side is not a choice, it is
-the only thing available, and #432's suggestion that the phone send structured JSON
+the only thing available, and V-432's suggestion that the phone send structured JSON
 cannot be honoured.
 
 If the app may instead read `CalendarContract`, it has the actual event rows, and the
@@ -73,7 +73,7 @@ closes this without code, and it is his to give.
 
 ## What not to do
 
-Do not add date parsing to the free-text path yet. That is the patch #432 explicitly
+Do not add date parsing to the free-text path yet. That is the patch V-432 explicitly
 refuses to accept as closure, and it is the wrong order: if the relay can send a date, no
 date parser is needed, and if it cannot, the parser is guessing at a date from text that
 was never meant to carry one.

docs/plans/17-where-the-voice-loop-runs.md

@@ -1,6 +1,6 @@
 # Plan: Where mavwaked and mavenclient run
 
-**The decision Vikunja #463 asked for. Written 04-08-2026.**
+**The decision V-463 asked for. Written 04-08-2026.**
 
 **Verdict: not in compose on homesrv. They run on a client machine in the room he is in.**
 The transport for that already exists and nothing needs building to allow it. What needs
@@ -11,7 +11,7 @@ building is a way to check the wake path at all, which is a separate task.
 `docker-compose.yml` runs mavend, mavsttd, mavttsd, mavweb and mavpoll. `mavwaked` and
 `mavenclient` appear in no compose file and run as no host process. Both build under
 `make build`. So the wake word and the voice-activity gate are untested by construction:
-QA session 1 step 2 covers push-to-talk from `/dash` only, and #287 (voice session
+QA session 1 step 2 covers push-to-talk from `/dash` only, and V-287 (voice session
 quality) can never be more than half-answered while this holds.
 
 ## The reason is not hardware

docs/plans/18-routing-heads-on-e5-small.md

@@ -1,6 +1,6 @@
 # Plan: route with heads on e5-small, not with a generative model
 
-**Owner's call, 05-08-2026. Vikunja #546.**
+**Owner's call, 05-08-2026. V-546.**
 
 **Verdict: the routing model is the 118M multilingual-e5-small already resident on
 homesrv.** It gets one classification head per output. No LoRA on a decoder, no 100M model

docs/plans/21-persisting-the-routing-trace.md

@@ -1,6 +1,6 @@
 # Plan: persist the routing trace
 
-**Owner's call, 06-08-2026. Vikunja #629, umbrella #628.**
+**Owner's call, 06-08-2026. V-629, umbrella V-628.**
 
 **Verdict: the per-turn decision record now persists.** That reverses a written decision,
 which is the point of this file. It is not an incidental telemetry

docs/plans/CLAUDE.md

@@ -0,0 +1,41 @@
+# docs/plans/
+
+The plan for one piece of work, written before it starts and frozen once it
+does. A plan is what was intended. What happened is the commits, the
+subsystem's living doc under `docs/`, and the measurement under `docs/evals/`.
+
+Changes of mind go to the Vikunja task, never back into the plan. The value of
+a frozen plan is that it can be compared to the outcome afterwards.
+
+## Rules for this directory
+
+* **A plan carries its task id in the `V-<id>` form.** `V-` and not `#`,
+  because Gitea autolinks `#123` to the wrong tracker. Put it in the first three
+  lines, so it is visible without reading the plan.
+* A plan whose work has landed stays. It is not edited to say "shipped" beyond
+  a dated status line, and it is never rewritten to match what was built.
+* A plan nobody will act on goes to `docs/archive/`, not to the bin.
+
+## Two naming schemes, on purpose
+
+`NN-<name>.md` is a Maven feature plan. The number is an append-order id and
+carries no priority. A new plan takes the next free number. Six Go source
+comments cite these paths, so renaming one is a code change.
+
+`YYYY-MM-DD-<name>.md` is a training runbook for the model rig on workpc, not
+for this repo's daemons. Five exist, all from July 2026, all predating the
+numbering. They are dated because a runbook is read as of a day. Renumbering
+would put the oldest plans last and imply an order that is not real. Do not do
+it.
+
+## Plans with no task id
+
+These have never carried one. Do not invent ids for them. Resolve each against
+Vikunja project Maven (ID 2) before citing it, or file a task if none exists.
+
+`01-email-reader.md`, `02-pattern-proposal.md`, `04-self-update.md`,
+`05-model-swap.md`, `06-mcp-support.md`, `09-behavioral-memory.md`,
+`11-smarthome-integration.md`, `12-bluetooth-network-scan.md`.
+
+The five training runbooks have no id either. The nearest live task is V-122,
+which owns finishing the Qwen3-1.7B CPT run on workpc.

docs/qa.md

@@ -301,6 +301,23 @@ make eval-recall
 
 A large miss against 72.7% means the deploy differs from the bench harness.
 
+`make eval-router` is also the aggregate ONNX lifecycle gate. When the default
+runtime path is non-empty it requires both `TestONNXBaseline` and
+`TestONNXRoutingHeads` to load their models and execute in the same Go process.
+The final line names both verified gates. A later test that skips because the
+first one consumed the process-global runtime now makes the command fail rather
+than leaving a green package result. To exercise the proof directly:
+
+```sh
+MAVEN_ONNX_LIB="$PWD/deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so" \
+MAVEN_ONNX_REQUIRED_GATES=2 \
+  go test -v -count=1 \
+  -run '^(TestONNXBaseline|TestONNXRoutingHeads)$' ./internal/router/eval/
+```
+
+Set `MAVEN_ONNX_LIB=` explicitly when the intended measurement is the portable
+hash floor; that also disables the aggregate ONNX requirement.
+
 **Run on 02-08-2026 @ af9d213. The deploy matches the bench.** `eval-models`
 scored 56 of 77: 72.7% full, 77.9% intent-only, 2 false clarifies and 1 missed.
 That is the recorded figure to the decimal, and calendar sat at 2 of 2, so the

docs/routing.md

@@ -1,6 +1,6 @@
 # Routing
 
-*Last verified: 2026-08-11 @ 25ed201*
+*Last verified: 2026-08-11 @ 2cf8b7e*
 
 How an utterance becomes a `Decision`, why each stage exists, and what every
 stage has measured. `CLAUDE.md` carries the rules an agent must not break. This
@@ -60,7 +60,7 @@ classifier and the resident model, since those are what always answer.
 
 | Arm | Intent | Destination | p50 | Measured |
 |---|---|---|---|---|
-| classifier + ONNX | 76.0% (73/96) | 36.4% (12/33) | 16.6µs | 2026-08-08 |
+| classifier + ONNX | 75.0% (72/96) | 33.3% (11/33) | 20.6ms | 2026-08-11 |
 | resident Qwen3-1.7B, cascade | 80.2% | not measured | 1.19s | 2026-08-05 |
 | routing heads, cascade | 96.9% | 75.8% | 27.9ms | 2026-08-08 |
 | gemma-4-12b, cascade | 84.4% | 72.7% | 329ms | 2026-08-02 |
@@ -72,7 +72,15 @@ another number on the same fixture. Sources:
 `docs/evals/2026-08-02-workstation-gemma4-12b.md`,
 `docs/evals/2026-08-09-e4b-vs-12b-routing.md`,
 `docs/evals/2026-08-08-routing-heads-in-go.md`,
-`docs/evals/2026-08-08-destination-fixture.md`.
+`docs/evals/2026-08-11-classifier-baseline-after-tokenizer-fix.md`.
+
+The classifier row read 76.0% and 36.4% until 2026-08-11, from
+`docs/evals/2026-08-08-destination-fixture.md`. That pair predates `feabf9f`,
+which fixed `encodeWord` emitting long words in reverse, so it was scored on
+embeddings from a broken encoder. The fix cost one case, `en-query-002`, and that
+case carries the floor destination label, so it moved both numbers at once. The
+row also carried 16.6µs, which came from the classifier measured without the
+embedder. 20.6ms is the ONNX arm's own p50.
 
 The resident model alone scores 37.4% full against 61.5% intent-only. The gap is
 slots and not routing. It routes `reminder` and leaves the time to the daemon,
@@ -127,6 +135,13 @@ second getting it right. Every rule was added against a measurement.
   and "сколько будет 17 на 23". Wired after the agenda rules and **before** the
   feed and list rules. "что такое лента" is a definition question, and the feed
   rule would take it on the noun alone.
+- **Russian possession statements** (`PossessionStatementGrammar`, V-577,
+  2026-08-13). The closed grammatical frame `у меня …` anchors a plain
+  declaration as `IntentNote`; its remainder is open and contains no noun list.
+  Questions, captures, reminders and narrative requests keep their narrower
+  routes. Hyphenated indefinite pronouns such as `что-то`, `кто-нибудь` and
+  `кое-что` remain statements—the interrogative root inside that closed
+  morphology is not a question by itself.
 
 `calendar-query` and `event-time-query` name the calendar as the destination.
 The possessive agenda rules deliberately do not. "что у меня в списке покупок"
@@ -201,7 +216,7 @@ are `docs/evals/2026-08-08-routing-heads-two-head.md`,
 
 Read the best destination run as one seed and not a headline. One case is 3
 points on a fixture this small. Head intent accuracy is **not** comparable to the
-cascade's 76.0% and 84.4%. A softmax has no clarify class, so the head's fixture
+cascade's 75.0% and 84.4%. A softmax has no clarify class, so the head's fixture
 is 88 cases and not 96.
 
 Recall is 15/15 and world is 5/5.
@@ -323,6 +338,26 @@ tests are offline and cost nothing. False clarifies 3 to 2, intent-only 74.0% to
 The two remaining false clarifies are the act-with-no-allowlisted-fn arm of the
 gate, not this rule.
 
+### Required slots and attempt exhaustion
+
+A clarification budget limits questions, not the action schema (V-717). The
+same `missingFor` check used on a fresh route is applied after each answer to a
+parked request. If another required slot remains and `PendingAction.CanAsk`
+allows it, Maven asks exactly that first gap and re-parks the request. If the
+budget is spent—or that gap has no valid question—Maven says the give-up line,
+pops the active request, and performs no write or action. There is no
+"best-effort" partially filled execution.
+
+Reminder time answers are held separately from the utterance that becomes the
+spoken payload. The schema check therefore receives a decision copy carrying
+the full time evidence, while the action receives the clean payload decision.
+The rebuilt-action boundary repeats the `missingFor` invariant before
+`applyAction`, so a future dialogue caller cannot bypass it.
+
+At stack depth two, exhausting the active request uses `CompleteTop`: the lower
+request remains parked, its answer window restarts, and its one resumed question
+is appended after the visible give-up in the same reply.
+
 ## The destination
 
 `query` was a shrug. The cascade sorted an utterance into one of seven intents,
@@ -349,6 +384,32 @@ at all. It was measured on the box 2026-08-07
 TCP?" and "сколько будет 17 на 23?" with "для какого города?". The feed answered
 "какой у меня любимый язык?" with kernel headlines.
 
+### How the personal boundary scores
+
+The boundary was fitted from a frozen bilingual training corpus for two classes:
+questions that require the owner's records, and questions an outside knowledge
+source can answer. The model-backed gate fits one class-balanced logistic head
+over those vectors, verifies it, and production loads its model-ID-pinned frozen
+weights. The head reads the whole semantic vector; it does not let the one
+training sentence with the nearest public noun decide.
+
+The corpus covers remembered speech, possession, narrative, first-person
+preambles, current advice/information and public proper nouns on both sides.
+Each class contributes total training weight 0.5, so adding coverage to the
+larger world class cannot shift the prior merely by class size. The corpus is
+separate from both evaluation sets, and deterministic CI checks dimensions,
+class balancing, leakage, and leave-one-shape-out generalisation.
+
+The measured result is 29/29 historical regressions, 72/72 on a balanced
+Russian/English stratified fixture, 99/104 four-fold training-corpus
+cross-validation, and 24/24 on a challenge authored after the final
+regularisation was frozen (V-702,
+`docs/evals/2026-08-13-personal-boundary-linear-head.md`).
+
+The decision threshold remains exactly personal > world. This boundary is
+asymmetric: a false local claim costs an honest “не знаю”, while a false world
+claim can send a question about the owner upstream.
+
 ### Who may drop the personal boundary
 
 The personal boundary guesses, so naming `SourceWorld` drops it. That is what
@@ -472,3 +533,24 @@ All three reaches offer it as of 2026-08-06:
 
 The turn source is still `tap:text` for both telegram and the web. So provenance
 cannot tell a chat turn from a typed one.
+
+### Repair and a parked question
+
+An explicit spoken correction gets first refusal before `clarify-answer`
+(V-573). It is narrower evidence than the mere presence of a parked question,
+so it must not be scored as bad slot material or spend that question's retry.
+The question is suspended and repeated after the repair reply. If redoing the
+corrected turn exposes a missing slot of its own, that new question is pushed
+on the dialogue stack; completing or cancelling it pops only the top and makes
+the older flow audible again.
+
+Completed clarifications and repairs deliberately enter different wrappers.
+`finishClarified` acts on a decision whose parked gaps were already checked;
+`finishRepaired` first validates the rebuilt decision against the current
+required-slot schema. Both record the action as the next correctable turn.
+
+The repair pointer is claimed atomically only after its window and target are
+valid. A stale correction changes no state. A correction naming the intent
+already used is acknowledged without redoing the action, and retains the
+pointer for a genuine correction that follows. This avoids routing correction
+prose as a fresh note and overwriting the referent it was meant to preserve.

internal/config/config.go

@@ -332,12 +332,11 @@ func Load(path string) (*Config, error) {
 	// file committed to git.
 	expanded, missing := expandEnv(string(b))
 	if len(missing) > 0 {
-		// An unset variable expands to "", which every block reads as "not
-		// configured" and none of them complains about. That is the intended
-		// behaviour and it stays: CI parses this same file with no secrets
-		// present. What was missing is the line telling the operator which
-		// capability he just turned off by forgetting an env file.
-		log.Printf("config: %s references unset environment variables %v — those settings are empty, so whatever they configure is off", path, missing)
+		// Expansion happens before typed validation. A disabled block may carry
+		// empty placeholders; an enabled block that needs one of these values is
+		// rejected below. Log the names too so a failed deploy says which secret
+		// source was absent without ever printing a value.
+		log.Printf("config: %s references unset environment variables %v — expanded them to empty; enabled integrations will reject missing credentials", path, missing)
 	}
 	var c Config
 	if err := json.Unmarshal([]byte(expanded), &c); err != nil {
@@ -459,6 +458,12 @@ func (c *Config) validate() error {
 	if err := c.validateTelegram(); err != nil {
 		return err
 	}
+	if err := c.validateNtfy(); err != nil {
+		return err
+	}
+	if err := c.validateWorkstation(); err != nil {
+		return err
+	}
 	return nil
 }
 
@@ -468,16 +473,23 @@ func (c *Config) validate() error {
 // answers nothing — the failure is invisible from the chat. Same shape as
 // validateNetScan: fail the config rather than the turn.
 func (c *Config) validateTelegram() error {
-	if c.Telegram == nil || !c.Telegram.Intake {
+	if c.Telegram == nil || c.Telegram.Disabled {
 		return nil
 	}
-	// An unset ${TELEGRAM_*} expands to empty, and the daemon already reads an
-	// empty token or chat id as telegram not being wired at all. Validating a
-	// block that wires nothing would fail a box that merely has no bot.
-	if c.Telegram.BotToken == "" || c.Telegram.ChatID == "" {
+	if err := telegramsink.Validate(*c.Telegram); err != nil {
+		return err
+	}
+	if c.Telegram.Intake {
+		return telegramsink.ValidateIntakeChatID(c.Telegram.ChatID)
+	}
+	return nil
+}
+
+func (c *Config) validateNtfy() error {
+	if c.Ntfy == nil {
 		return nil
 	}
-	return telegramsink.ValidateIntakeChatID(c.Telegram.ChatID)
+	return ntfysink.Validate(*c.Ntfy)
 }
 
 // DBEncryptionKey resolves the at-rest encryption key: DBKeyEnv (if set) wins

internal/config/config_test.go

@@ -435,10 +435,21 @@ func TestNormaliseDropsAddresslessWorkstation(t *testing.T) {
 	}
 }
 
+func TestModelDisabledKeepsLiveSTT(t *testing.T) {
+	p := writeConfig(t, `{"workstation":{"model_disabled":true,"stt":{"url":"http://192.168.1.105:8081/transcribe","token":"secret"}}}`)
+	c, err := Load(p)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if c.Workstation == nil || c.Workstation.Stt == nil || !c.Workstation.ModelDisabled {
+		t.Fatalf("model-only dark state did not preserve STT: %+v", c.Workstation)
+	}
+}
+
 // The health endpoint defaults to the supervisor's, not llama-server's: mavgpud
 // answers 503 while the card is held, and that refusal is the whole signal.
 func TestNormaliseFillsWorkstationDefaults(t *testing.T) {
-	c := &Config{Workstation: &WorkstationConfig{URL: "http://192.168.1.105:8080/"}}
+	c := &Config{Workstation: &WorkstationConfig{URL: "http://192.168.1.105:8080/", Token: "secret"}}
 	c.applyDefaults()
 	if c.Workstation == nil {
 		t.Fatal("dropped a usable workstation block")
@@ -460,6 +471,7 @@ func TestNormaliseKeepsExplicitWorkstationHealth(t *testing.T) {
 	c := &Config{Workstation: &WorkstationConfig{
 		URL:    "http://192.168.1.105:8080",
 		Health: "http://192.168.1.105:9000/ready",
+		Token:  "secret",
 	}}
 	c.applyDefaults()
 	if got, want := c.Workstation.Health, "http://192.168.1.105:9000/ready"; got != want {
@@ -467,6 +479,112 @@ func TestNormaliseKeepsExplicitWorkstationHealth(t *testing.T) {
 	}
 }
 
+func TestWorkstationLANEndpointsRequireSecrets(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		body string
+	}{
+		{"model", `{"workstation":{"url":"http://192.168.1.105:8080"}}`},
+		{"stt", `{"workstation":{"url":"http://127.0.0.1:8080","stt":{"url":"http://192.168.1.105:8081/transcribe"}}}`},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if _, err := Load(writeConfig(t, tc.body)); err == nil {
+				t.Fatal("Load accepted an enabled LAN endpoint with no secret")
+			}
+		})
+	}
+}
+
+func TestWorkstationDisabledAllowsEmptySecrets(t *testing.T) {
+	p := writeConfig(t, `{"workstation":{"disabled":true,"url":"http://192.168.1.105:8080","stt":{"url":"http://192.168.1.105:8081/transcribe"}}}`)
+	c, err := Load(p)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if c.Workstation != nil {
+		t.Fatalf("disabled workstation survived normalisation: %+v", c.Workstation)
+	}
+}
+
+func TestWorkstationArmsMayBeDisabledIndependently(t *testing.T) {
+	modelOff := writeConfig(t, `{"workstation":{"model_disabled":true,"url":"http://192.168.1.105:8080","stt":{"url":"http://127.0.0.1:8081/transcribe"}}}`)
+	if _, err := Load(modelOff); err != nil {
+		t.Fatalf("Load model-disabled config: %v", err)
+	}
+
+	sttOff := writeConfig(t, `{"workstation":{"url":"http://127.0.0.1:8080","stt":{"disabled":true,"url":"http://192.168.1.105:8081/transcribe"}}}`)
+	c, err := Load(sttOff)
+	if err != nil {
+		t.Fatalf("Load STT-disabled config: %v", err)
+	}
+	if c.Workstation == nil || c.Workstation.Stt != nil {
+		t.Fatalf("STT-only dark state changed model arm: %+v", c.Workstation)
+	}
+}
+
+func TestWorkstationLoopbackMayRunWithoutSecret(t *testing.T) {
+	p := writeConfig(t, `{"workstation":{"url":"http://127.0.0.1:8080","stt":{"url":"http://localhost:8081/transcribe"}}}`)
+	if _, err := Load(p); err != nil {
+		t.Fatalf("Load loopback development endpoints: %v", err)
+	}
+}
+
+func TestTelegramLiveBlockRequiresBothSecrets(t *testing.T) {
+	for _, body := range []string{
+		`{"telegram":{"chat_id":"42"}}`,
+		`{"telegram":{"bot_token":"token"}}`,
+	} {
+		if _, err := Load(writeConfig(t, body)); err == nil {
+			t.Fatalf("Load accepted enabled Telegram block: %s", body)
+		}
+	}
+}
+
+func TestTelegramDisabledAllowsEmptySecrets(t *testing.T) {
+	if _, err := Load(writeConfig(t, `{"telegram":{"disabled":true}}`)); err != nil {
+		t.Fatalf("Load disabled Telegram: %v", err)
+	}
+}
+
+func TestNtfyLiveBlockRequiresSecret(t *testing.T) {
+	p := writeConfig(t, `{"ntfy":{"base_url":"https://ntfy.example","topic":"maven"}}`)
+	if _, err := Load(p); err == nil {
+		t.Fatal("Load accepted enabled ntfy block with no credential")
+	}
+}
+
+func TestNtfyDisabledAllowsEmptySecret(t *testing.T) {
+	p := writeConfig(t, `{"ntfy":{"disabled":true,"base_url":"https://ntfy.example","topic":"maven"}}`)
+	if _, err := Load(p); err != nil {
+		t.Fatalf("Load disabled ntfy: %v", err)
+	}
+}
+
+func TestSmartHomeLiveBlockRequiresSecret(t *testing.T) {
+	p := writeConfig(t, `{"smarthome":{"enabled":true,"provider":"homeassistant","url":"http://192.168.1.50:8123"}}`)
+	if _, err := Load(p); err == nil {
+		t.Fatal("Load accepted enabled Home Assistant block with no token")
+	}
+}
+
+func TestSmartHomeDisabledAllowsEmptySecret(t *testing.T) {
+	p := writeConfig(t, `{"smarthome":{"enabled":false,"provider":"homeassistant","url":"http://192.168.1.50:8123"}}`)
+	if _, err := Load(p); err != nil {
+		t.Fatalf("Load disabled Home Assistant: %v", err)
+	}
+}
+
+func TestConfiguredDBKeyEnvCannotBeEmpty(t *testing.T) {
+	t.Setenv("MAVEN_TEST_DB_KEY", "")
+	c := &Config{DBKeyEnv: "MAVEN_TEST_DB_KEY"}
+	if _, err := c.DBEncryptionKey(); err == nil {
+		t.Fatal("configured empty database key did not fail startup resolution")
+	}
+	if key, err := (&Config{}).DBEncryptionKey(); err != nil || key != nil {
+		t.Fatalf("explicit plaintext config = (%v, %v), want (nil, nil)", key, err)
+	}
+}
+
 func TestTelegramIntakeRefusesNamedChat(t *testing.T) {
 	// The push half accepts an @channelusername and the intake half cannot use
 	// one, so a box with both boots clean and answers nothing. Refuse the

internal/config/deployconfig_test.go

@@ -3,6 +3,7 @@ package config
 import (
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 )
 
@@ -14,14 +15,20 @@ import (
 // a config change and a code change have to agree here or the suite is red.
 //
 // The ${VAR} expansions come from a gitignored deploy/telegram.env that is not
-// present in CI. An unset var expands to the empty string, which is exactly the
-// "not configured" state every block already has to handle, so the parse is
-// still meaningful without the secrets.
+// present in CI. Live blocks reject empty secrets; this test supplies inert
+// Telegram values and verifies that every credential-less block is explicitly
+// disabled.
 func TestDeployConfigLoads(t *testing.T) {
 	path := filepath.Join("..", "..", "deploy", "mavend.json")
 	if _, err := os.Stat(path); err != nil {
 		t.Skipf("no deploy config at %s: %v", path, err)
 	}
+	// Live blocks fail on expanded-empty credentials. CI provides inert values
+	// so this test exercises the committed shape; explicitly disabled blocks
+	// (ntfy, workstation and Home Assistant) require none.
+	t.Setenv("TELEGRAM_BOT_TOKEN", "test-token")
+	t.Setenv("TELEGRAM_CHAT_ID", "-1001234567890")
+	t.Setenv("MAVEN_STT_TOKEN", "test-token")
 	cfg, err := Load(path)
 	if err != nil {
 		t.Fatalf("Load(%s): %v", path, err)
@@ -46,11 +53,10 @@ func TestDeployConfigLoads(t *testing.T) {
 		t.Error("router threshold did not get its default")
 	}
 
-	// The second reach (V-649). Deleting this block is how you turn ntfy off,
-	// so its absence has to be loud: sev3-away nudges and away reminders route
-	// to ntfy and to nothing else, and a nil sink drops them with no log and no
-	// outbox row. The token is a ${VAR} that CI cannot resolve, so this checks
-	// the wiring and not the credential.
+	// The second reach (V-649). The token is a ${VAR} that CI cannot resolve, so
+	// the committed deployment makes the dark state explicit. Removing disabled
+	// without provisioning a credential makes runtime wiring fail startup; it
+	// can never silently publish anonymously.
 	if cfg.Ntfy == nil {
 		t.Fatal("deploy config has no ntfy block — sev3-away and away reminders " +
 			"would have nowhere to land, and would vanish silently rather than fail")
@@ -58,4 +64,67 @@ func TestDeployConfigLoads(t *testing.T) {
 	if cfg.Ntfy.BaseURL == "" || cfg.Ntfy.Topic == "" {
 		t.Errorf("ntfy block is incomplete: base_url=%q topic=%q", cfg.Ntfy.BaseURL, cfg.Ntfy.Topic)
 	}
+	if !cfg.Ntfy.Disabled {
+		t.Fatal("deploy ntfy reach has no checked-in credential and must remain explicitly disabled")
+	}
+	if cfg.Workstation == nil || !cfg.Workstation.ModelDisabled || cfg.Workstation.Stt == nil {
+		t.Fatalf("deploy must disable only its uncredentialed model arm and retain authenticated STT: %+v", cfg.Workstation)
+	}
+}
+
+func TestCanonicalDeployEnvExampleNamesEverySecret(t *testing.T) {
+	path := filepath.Join("..", "..", "deploy", "telegram.env.example")
+	b, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read %s: %v", path, err)
+	}
+	example := string(b)
+	references := map[string]bool{
+		// These two live outside ${...}: DBKeyEnv names an environment variable
+		// as JSON data, while the separately deployed Python child reads its own
+		// environment directly.
+		"CW2_TOKEN":    true,
+		"MAVEN_DB_KEY": true,
+	}
+	for _, source := range []string{
+		filepath.Join("..", "..", "deploy", "mavend.json"),
+		filepath.Join("..", "..", "docker-compose.yml"),
+	} {
+		raw, err := os.ReadFile(source)
+		if err != nil {
+			t.Fatalf("read deploy source %s: %v", source, err)
+		}
+		_ = os.Expand(string(raw), func(expr string) string {
+			// Compose supports ${NAME:-default}; os.Expand deliberately hands the
+			// full braced expression to this callback.
+			name, _, _ := strings.Cut(expr, ":-")
+			references[name] = true
+			return ""
+		})
+	}
+	for name := range references {
+		if !strings.Contains(example, name+"=") {
+			t.Errorf("canonical deploy env example omits %s", name)
+		}
+	}
+}
+
+// Go's flag package treats a bare boolean flag as true and does not consume a
+// following "true"/"false" argument. That following value becomes the first
+// positional argument and stops parsing, so every flag after it silently keeps
+// its default. Keep the Compose boolean in -name=value form (V-691 live QA).
+func TestComposeAmbientBooleanDoesNotStopFlagParsing(t *testing.T) {
+	path := filepath.Join("..", "..", "docker-compose.yml")
+	b, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatalf("read %s: %v", path, err)
+	}
+	compose := string(b)
+	const joined = `"-ambient-enabled=${MAVEN_AMBIENT_ENABLED:-false}"`
+	if !strings.Contains(compose, joined) {
+		t.Fatalf("mavweb ambient boolean must be one argv element %s", joined)
+	}
+	if strings.Contains(compose, `"-ambient-enabled",`) {
+		t.Fatal("bare -ambient-enabled leaves its value positional and prevents -ambient-token from being parsed")
+	}
 }

internal/config/workstation.go

@@ -1,6 +1,8 @@
 package config
 
 import (
+	"fmt"
+	"net"
 	"net/url"
 	"strings"
 	"time"
@@ -18,6 +20,13 @@ import (
 // Only the prompt crosses the LAN, and the workstation is not "the box". The
 // rules in CLAUDE.md about what may leave still apply.
 type WorkstationConfig struct {
+	// Disabled keeps both written workpc arms explicitly dark. ModelDisabled is
+	// the narrower switch: CW2 STT may remain live while the large-model
+	// supervisor has no provisioned client token.
+	Disabled bool `json:"disabled,omitempty"`
+
+	ModelDisabled bool `json:"model_disabled,omitempty"`
+
 	// URL — where mavgpud listens, e.g. "http://192.168.1.105:8080". Empty ⇒
 	// the whole block is normalised to nil and nothing probes anything.
 	URL string `json:"url,omitempty"`
@@ -30,8 +39,8 @@ type WorkstationConfig struct {
 	// Token — the bearer credential mavgpud requires, expanded from the
 	// environment like every other secret here. It is what stops anything on
 	// the LAN spending the card, so a URL that is not loopback needs one.
-	// Wrong or missing reads as a workstation that is down, and Maven falls
-	// back to the resident model.
+	// A missing token on a LAN URL fails config validation. Loopback development
+	// endpoints may omit it.
 	Token string `json:"token,omitempty"`
 
 	// Probe — how often admission is re-checked. 0 ⇒ DefaultWorkstationProbe.
@@ -60,6 +69,10 @@ type WorkstationConfig struct {
 // the ggml-small.bin homesrv loads
 // (docs/evals/2026-08-09-crisperwhisper2-russian-wer.md).
 type WorkstationSttConfig struct {
+	// Disabled keeps the written CW2 endpoint dark without also disabling the
+	// independently authenticated model supervisor.
+	Disabled bool `json:"disabled,omitempty"`
+
 	// URL — the transcribe endpoint, e.g.
 	// "http://192.168.1.105:8081/transcribe". Empty ⇒ the block is normalised
 	// to nil and mavsttd takes every turn.
@@ -97,29 +110,85 @@ const (
 // model: an unconfigured workstation is the default deploy and must be
 // indistinguishable from today.
 func (c *Config) normaliseWorkstation() {
-	if c.Workstation != nil && strings.TrimSpace(c.Workstation.URL) == "" {
+	if c.Workstation != nil && c.Workstation.Disabled {
 		c.Workstation = nil
 	}
 	if c.Workstation == nil {
 		return
 	}
 	w := c.Workstation
-	if strings.TrimSpace(w.Health) == "" {
-		w.Health = strings.TrimRight(w.URL, "/") + "/health"
+	// Preserve the historical empty-block meaning. A live STT sub-block makes
+	// the parent non-empty; in that case omitting the model URL is an error
+	// unless model_disabled states the operator's intent.
+	if !w.ModelDisabled && strings.TrimSpace(w.URL) == "" &&
+		(w.Stt == nil || w.Stt.Disabled || strings.TrimSpace(w.Stt.URL) == "") {
+		c.Workstation = nil
+		return
 	}
-	if w.Probe <= 0 {
-		w.Probe = Duration(DefaultWorkstationProbe)
-	}
-	if w.Timeout <= 0 {
-		w.Timeout = Duration(DefaultWorkstationTimeout)
+	if !w.ModelDisabled {
+		if strings.TrimSpace(w.Health) == "" {
+			w.Health = strings.TrimRight(w.URL, "/") + "/health"
+		}
+		if w.Probe <= 0 {
+			w.Probe = Duration(DefaultWorkstationProbe)
+		}
+		if w.Timeout <= 0 {
+			w.Timeout = Duration(DefaultWorkstationTimeout)
+		}
 	}
 	normaliseWorkstationStt(w)
+	if w.ModelDisabled && w.Stt == nil {
+		c.Workstation = nil
+	}
+}
+
+// validateWorkstation rejects a live LAN endpoint without its bearer secret.
+// Loopback remains useful for local development without manufacturing a secret;
+// malformed or non-HTTP endpoints are rejected before any probe starts.
+func (c *Config) validateWorkstation() error {
+	if c.Workstation == nil {
+		return nil
+	}
+	w := c.Workstation
+	if !w.ModelDisabled {
+		if err := validateWorkstationEndpoint("workstation.url", w.URL, w.Token); err != nil {
+			return err
+		}
+		if err := validateWorkstationEndpoint("workstation.health", w.Health, w.Token); err != nil {
+			return err
+		}
+	}
+	if w.Stt != nil {
+		if err := validateWorkstationEndpoint("workstation.stt.url", w.Stt.URL, w.Stt.Token); err != nil {
+			return err
+		}
+		if err := validateWorkstationEndpoint("workstation.stt.health", w.Stt.Health, w.Stt.Token); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateWorkstationEndpoint(name, raw, token string) error {
+	u, err := url.Parse(raw)
+	if err != nil || u.Host == "" || (u.Scheme != "http" && u.Scheme != "https") {
+		return fmt.Errorf("%s must be an absolute http(s) URL", name)
+	}
+	host := strings.TrimSpace(u.Hostname())
+	loopback := strings.EqualFold(host, "localhost")
+	if ip := net.ParseIP(host); ip != nil {
+		loopback = ip.IsLoopback()
+	}
+	if !loopback && strings.TrimSpace(token) == "" {
+		return fmt.Errorf("%s is not loopback, so its token is required while enabled", name)
+	}
+	return nil
 }
 
 // normaliseWorkstationStt applies the speech-to-text block's defaults. No
 // address, no remote: mavsttd then takes every utterance, which is today.
 func normaliseWorkstationStt(w *WorkstationConfig) {
-	if w.Stt != nil && strings.TrimSpace(w.Stt.URL) == "" {
+	if w.Stt != nil && (w.Stt.Disabled || strings.TrimSpace(w.Stt.URL) == "") {
 		w.Stt = nil
 	}
 	if w.Stt == nil {

internal/delivery/channel.go

@@ -20,7 +20,8 @@
 //
 //   - reminders are a SEPARATE class — two delivery paths. reminders bypass
 //     the restraint gate ("wake me 7" fires in quiet hours; that's the point).
-//     snooze still applies. voice when present, ntfy when away. fire once.
+//     snooze still applies. voice when present; when away, try ntfy then
+//     telegram as alternatives and stop after the first success. fire once.
 //
 // Architecture mirrors the loop's gather/pure split: the routing table is a
 // PURE function of (severity, presence); the Dispatcher holds the impure Sinks
@@ -43,6 +44,12 @@ import (
 // to import the voice package.
 var ErrVoiceNoSession = errors.New("delivery: voice: no live session")
 
+// ErrPermanent is the class of transport failures that waiting cannot repair:
+// a revoked credential or an endpoint that refuses this sender. Dispatchers
+// may still try a different reach for the same message, but the failed reach
+// must not be put on an automatic retry clock until its configuration changes.
+var ErrPermanent = errors.New("delivery: permanent failure")
+
 // Channel — one delivery transport. Drop is an explicit no-op (the routing
 // table chose to suppress, which is a decision, not a failure — "a missed
 // water nudge is noise"). a nil Sink for a wired channel is a daemon config
@@ -91,8 +98,11 @@ func ChannelsFor(sev loop.Severity, presence store.Bucket) []Channel {
 
 // ChannelsForReminder — reminders are a SEPARATE class that bypasses the gate.
 // "wake me 7" fires in quiet hours; that's the point. presence still routes
-// reachability: voice when present, ntfy when away. fires once — no repeat
-// (repeat-til-ack is a sev4 ops-hard behavior, not a reminder behavior).
+// reachability: voice when present, then an ordered ntfy→telegram alternative
+// chain when away. The dispatcher stops after the first successful alternative,
+// so a reminder still fires once rather than being broadcast on both channels.
+// There is no repeat (repeat-til-ack is a sev4 ops-hard behavior, not a reminder
+// behavior).
 //
 // reminders don't carry a Severity — they're user-stated future intent, not
 // loop-derived insistence. the routing is presence-only: reachability without
@@ -100,7 +110,7 @@ func ChannelsFor(sev loop.Severity, presence store.Bucket) []Channel {
 // per-reminder override, not a table entry.
 func ChannelsForReminder(presence store.Bucket) []Channel {
 	if presence == store.Away {
-		return []Channel{ChannelNtfy}
+		return []Channel{ChannelNtfy, ChannelTelegram}
 	}
 	return []Channel{ChannelVoice}
 }