the unplaceable word rides a typed error, not the message (V-634)

Recovering it by cutting on quotes in err.Error() meant the reply depended on
the wording of an error string. UnknownTargetError carries the word and
errors.Is still holds.

cmd/mavend/actions_act.go

@@ -60,6 +60,17 @@ func (h *reactiveHandler) actionAct(ctx context.Context, dec router.Decision) st
 			phrase := actPhrase(dec.Slots.Fn, dec.Slots.Args)
 			h.park(dec.Slots.Fn, dec.Slots.Args, phrase)
 			return phraser.A(phraser.ActConfirm, map[string]string{"name": phrase})
+		case errors.Is(err, tool.ErrUnknownTarget):
+			// The verb reached a tool and the tail did not reach a target, so
+			// nothing ran. Saying which word she could not place is the whole
+			// answer: he either renames it or gives the row an alias that
+			// carries the target, and both are one turn away (V-634).
+			word := ""
+			var unknown *tool.UnknownTargetError
+			if errors.As(err, &unknown) {
+				word = unknown.Target
+			}
+			return phraser.A(phraser.ActUnknownTarget, map[string]string{"name": word})
 		case errors.Is(err, tool.ErrNeedsAuthedSurface):
 			// Irreversible (internal/tool/risk.go). A confirm turn would not
 			// help: everything that proposed this act — the STT, the router,
@@ -93,3 +104,4 @@ func (h *reactiveHandler) actionAct(ctx context.Context, dec router.Decision) st
 	}
 	return phraser.A(phraser.ActDone, nil)
 }
+

cmd/mavweb/chat.go

@@ -131,11 +131,12 @@ func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, ses
 // optionally the intent it should have been. An unstated target is accepted,
 // because a turn marked wrong with no target is still a usable negative.
 //
-// Not step-up gated, unlike POST /api/chat. Writing a label reaches no router,
-// no model and no act path; it writes one row nothing executes from. Gating it
-// would price the gesture out of being used, which is the one thing that makes
-// it worthless.
-func handleCorrectAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
+// Step-up gated like POST /api/chat, and that costs the gesture nothing: he
+// tapped to send the turn he is now correcting, so the session is already up.
+// It is gated because trace ids are sequential integers and this writes the one
+// table the routing heads (V-546) will be fitted on. A caller who can guess an
+// id could otherwise mislabel turns he never corrected.
+func handleCorrectAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
 		http.Error(w, "POST only", http.StatusMethodNotAllowed)
 		return
@@ -143,6 +144,9 @@ func handleCorrectAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI)
 	if !requireCore(w, core, "correct") {
 		return
 	}
+	if !stepUpGate(w, session, requireStepUp) {
+		return
+	}
 	id, err := strconv.ParseInt(strings.TrimSpace(r.FormValue("trace_id")), 10, 64)
 	if err != nil || id <= 0 {
 		http.Error(w, "trace_id required", http.StatusBadRequest)

cmd/mavweb/correct_test.go

@@ -38,7 +38,7 @@ func TestCorrectAPIWithTarget(t *testing.T) {
 	rr := httptest.NewRecorder()
 	handleCorrectAPI(rr, postCorrect(url.Values{
 		"trace_id": {"42"}, "should_be": {"fact"}, "q": {"поужинал"}, "rep": {"поняла"},
-	}), core)
+	}), core, stepUpSession(), false)
 
 	if rr.Code != http.StatusSeeOther {
 		t.Fatalf("status %d, want 303; body=%s", rr.Code, rr.Body.String())
@@ -58,7 +58,7 @@ func TestCorrectAPIWithTarget(t *testing.T) {
 func TestCorrectAPIWithNoTarget(t *testing.T) {
 	core := &correctCore{}
 	rr := httptest.NewRecorder()
-	handleCorrectAPI(rr, postCorrect(url.Values{"trace_id": {"7"}}), core)
+	handleCorrectAPI(rr, postCorrect(url.Values{"trace_id": {"7"}}), core, stepUpSession(), false)
 
 	if rr.Code != http.StatusSeeOther {
 		t.Fatalf("status %d, want 303", rr.Code)
@@ -76,7 +76,7 @@ func TestCorrectAPIWithNoTarget(t *testing.T) {
 func TestCorrectAPIRejectsUnknownTarget(t *testing.T) {
 	core := &correctCore{}
 	rr := httptest.NewRecorder()
-	handleCorrectAPI(rr, postCorrect(url.Values{"trace_id": {"7"}, "should_be": {"погода"}}), core)
+	handleCorrectAPI(rr, postCorrect(url.Values{"trace_id": {"7"}, "should_be": {"погода"}}), core, stepUpSession(), false)
 
 	if rr.Code != http.StatusBadRequest {
 		t.Fatalf("status %d, want 400", rr.Code)
@@ -90,7 +90,7 @@ func TestCorrectAPINeedsTraceID(t *testing.T) {
 	for _, form := range []url.Values{{}, {"trace_id": {"0"}}, {"trace_id": {"nope"}}} {
 		core := &correctCore{}
 		rr := httptest.NewRecorder()
-		handleCorrectAPI(rr, postCorrect(form), core)
+		handleCorrectAPI(rr, postCorrect(form), core, stepUpSession(), false)
 		if rr.Code != http.StatusBadRequest {
 			t.Errorf("form %v: status %d, want 400", form, rr.Code)
 		}
@@ -105,7 +105,7 @@ func TestCorrectAPINeedsTraceID(t *testing.T) {
 func TestCorrectAPIReportsFailure(t *testing.T) {
 	core := &correctCore{err: errors.New("disk is full")}
 	rr := httptest.NewRecorder()
-	handleCorrectAPI(rr, postCorrect(url.Values{"trace_id": {"9"}, "should_be": {"note"}}), core)
+	handleCorrectAPI(rr, postCorrect(url.Values{"trace_id": {"9"}, "should_be": {"note"}}), core, stepUpSession(), false)
 	if rr.Code != http.StatusBadGateway {
 		t.Fatalf("status %d, want 502", rr.Code)
 	}
@@ -115,7 +115,7 @@ func TestCorrectAPIReportsFailure(t *testing.T) {
 func TestCorrectAPIExpiredTurn(t *testing.T) {
 	core := &correctCore{err: ipc.ErrNoSuchTrace}
 	rr := httptest.NewRecorder()
-	handleCorrectAPI(rr, postCorrect(url.Values{"trace_id": {"9"}, "should_be": {"note"}}), core)
+	handleCorrectAPI(rr, postCorrect(url.Values{"trace_id": {"9"}, "should_be": {"note"}}), core, stepUpSession(), false)
 	if rr.Code != http.StatusNotFound {
 		t.Fatalf("status %d, want 404", rr.Code)
 	}
@@ -123,7 +123,7 @@ func TestCorrectAPIExpiredTurn(t *testing.T) {
 
 func TestCorrectAPIPostOnly(t *testing.T) {
 	rr := httptest.NewRecorder()
-	handleCorrectAPI(rr, httptest.NewRequest(http.MethodGet, "/api/correct", nil), &correctCore{})
+	handleCorrectAPI(rr, httptest.NewRequest(http.MethodGet, "/api/correct", nil), &correctCore{}, stepUpSession(), false)
 	if rr.Code != http.StatusMethodNotAllowed {
 		t.Fatalf("status %d, want 405", rr.Code)
 	}
@@ -144,3 +144,17 @@ func TestCorrectionTargetsAreTheSeven(t *testing.T) {
 		t.Error("empty is not a target: it is the absence of one, handled separately")
 	}
 }
+
+// Trace ids are sequential, so a caller who cannot assert step-up must not be
+// able to label a turn the owner never corrected.
+func TestCorrectAPINeedsStepUp(t *testing.T) {
+	core := &correctCore{}
+	rr := httptest.NewRecorder()
+	handleCorrectAPI(rr, postCorrect(url.Values{"trace_id": {"9"}, "should_be": {"note"}}), core, nil, true)
+	if rr.Code != http.StatusForbidden {
+		t.Fatalf("status %d, want 403", rr.Code)
+	}
+	if core.called {
+		t.Error("wrote a label with no step-up")
+	}
+}

cmd/mavweb/main.go

@@ -210,13 +210,7 @@ func main() {
 	mux.HandleFunc("/routines", gatedPage(handleRoutines))
 	mux.HandleFunc("/api/chat", gatedPage(handleChatAPI))
 	mux.HandleFunc("/api/revert", gatedPage(handleRevert))
-	// POST /api/correct is deliberately NOT on the step-up list (V-630). It
-	// reaches no router, no model and no act path: it writes one label row that
-	// nothing executes from. A correction that costs a passkey tap is a
-	// correction the owner does not make, and then the table stays empty.
-	mux.HandleFunc("/api/correct", func(w http.ResponseWriter, r *http.Request) {
-		handleCorrectAPI(w, r, core)
-	})
+	mux.HandleFunc("/api/correct", gatedPage(handleCorrectAPI))
 	mux.HandleFunc("/models", func(w http.ResponseWriter, r *http.Request) {
 		handleModels(w, r, core, swapConn, stepUpSession, *requireStepUp)
 	})

docs/plans/22-correcting-a-turn.md

@@ -11,7 +11,11 @@ almost all of them teach nothing. A correction is the only high-value supervised
 the box produces. It is also the only one that costs the owner something to give.
 
 So the design constraint is the cost, not the schema. One gesture beside the reply. No
-form, no separate page, no passkey tap.
+form and no separate page.
+
+It is step-up gated like the chat POST beside it, which costs nothing: he tapped to send
+the turn he is correcting. It is gated because trace ids are sequential integers, and this
+is the one table the routing heads will be fitted on.
 
 ## Two things to capture, and only one of them is required
 

internal/phraser/acts.go

@@ -45,6 +45,10 @@ const (
 	// is the only authority the voice path can offer, and this is the one act
 	// it is not enough for (Vikunja #449, #523).
 	ActNeedsAuthedSurface = "act_needs_authed_surface"
+	// ActUnknownTarget — the verb reached a tool and the target did not reach
+	// anything. Named rather than run, because the alias match swallowed the verb
+	// and handed on the next word of the sentence (V-634).
+	ActUnknownTarget = "act_unknown_target"
 
 	EcoDenied        = "eco_denied"
 	EcoDown          = "eco_down"
@@ -76,7 +80,7 @@ const (
 var actKeys = []string{
 	ActDone, ActDoneOut, ActDoneEntity, ActConfirm, ActConfirmEntity, ActWhich,
 	ActFail, ActFailOut, ActFailEntity, ActServerDown, ActWithdrawn, ActNeedsArgs,
-	ActNeedsAuthedSurface,
+	ActNeedsAuthedSurface, ActUnknownTarget,
 	EcoDenied, EcoDown, EcoAmbiguous, EcoUnknownEntity, EcoNoNexus, EcoAboutWhat, EcoRecall,
 	AttentionNone, AttentionList, AttentionFail,
 	AttentionNoneEntity, AttentionListEntity, AttentionFailEntity,
@@ -102,6 +106,7 @@ var actFloor = map[string]string{
 	ActServerDown:         "инструмент есть, но сервер не подключён.",
 	ActWithdrawn:          "сервер больше не отдаёт этот инструмент — сняла его с разрешённых, посмотри /tools.",
 	ActNeedsArgs:          "тут нужны аргументы, из голоса не соберу. угадывать не буду.",
+	ActUnknownTarget:      "«{name}» — не знаю такой цели. назови её как в системе.",
 	ActNeedsAuthedSurface: "это из голоса не выполню — после него ничего не вернуть. запусти сам.",
 
 	EcoDenied:        "{name} отклоняет доступ, проверь токен.",

internal/phraser/acts_ru_v1.json

@@ -60,6 +60,10 @@
       "fixed": true,
       "variants": ["тут нужны аргументы, из голоса не соберу. угадывать не буду."]
     },
+    "act_unknown_target": {
+      "fixed": true,
+      "variants": ["«{name}» — не знаю такой цели. назови её как в системе."]
+    },
     "act_needs_authed_surface": {
       "fixed": true,
       "variants": ["это из голоса не выполню — после него ничего не вернуть. запусти сам."]

internal/tool/tool.go

@@ -39,6 +39,7 @@ import (
 	"os/exec"
 	"strings"
 	"time"
+	"unicode"
 
 	"github.com/kami/maven/internal/ipc"
 	"github.com/kami/maven/internal/mcp"
@@ -73,8 +74,27 @@ var (
 	// confirm turn that would help: asking again would imply the second answer
 	// changes the outcome.
 	ErrNeedsAuthedSurface = errors.New("tool is irreversible and voice may not authorise it")
+	// ErrUnknownTarget — the act matched a tool and the target it carries cannot
+	// be one. A process row's args become argv for a real program, and a unit,
+	// container or host is named in ASCII on this box, so a Cyrillic tail is a
+	// word from the sentence rather than a target. Held apart from every failure
+	// above because the command never ran: forwarding it would spend a confirm
+	// turn on an act that cannot succeed, and then report the program's own
+	// confusion as if she had tried something sensible (V-634).
+	ErrUnknownTarget = errors.New("the act names a target the system cannot have")
 )
 
+// UnknownTargetError carries the word the executor could not place, because the
+// reply names it: "«роутер» — не знаю такой цели" is actionable and "не
+// получилось" sends him to the log. errors.Is(err, ErrUnknownTarget) holds.
+type UnknownTargetError struct{ Target string }
+
+func (e *UnknownTargetError) Error() string {
+	return fmt.Sprintf("%s: %q", ErrUnknownTarget, e.Target)
+}
+
+func (e *UnknownTargetError) Unwrap() error { return ErrUnknownTarget }
+
 // MCPCaller is the seam for an act that is an MCP tool call rather than a
 // process (Vikunja #251). internal/mcp.Manager satisfies it via CallPositional.
 // nil ⇒ MCP is not configured, and an MCP row refuses to run rather than
@@ -144,6 +164,16 @@ func (e *Executor) Exec(ctx context.Context, name string, args []string, confirm
 	if t.Status != "enabled" {
 		return "", ErrNotEnabled
 	}
+	// A process row's args become argv, so the target has to be able to exist.
+	// Checked before the confirm gate below, because asking "выполнить X?" about
+	// an act that cannot run spends a turn on nothing (V-634). The other two
+	// dispatches are exempt: an MCP tool may take Russian text as an argument,
+	// since a task title is not a target, and a house row drops the spoken args.
+	if !isMCPRow(t.Cmd) && !isHouseRow(t.Cmd) {
+		if bad, ok := firstUnknownTarget(args); !ok {
+			return "", &UnknownTargetError{Target: bad}
+		}
+	}
 	// The tier decides, not the column (Vikunja #449). RiskOf reads the row and
 	// answers the three questions the boolean never did: which acts are
 	// destructive, whether a confirm sticks (it never does), and what an
@@ -260,3 +290,41 @@ func (m *Matcher) Allowlist() []string { return m.names() }
 func (m *Matcher) Match(utterance string) (string, []string, bool) {
 	return router.DefaultActMatcher{Fns: m.names(), Aliases: m.aliases}.Match(utterance)
 }
+
+// firstUnknownTarget reports whether every arg could name something on this box,
+// and returns the first that could not.
+//
+// The check is the script, not a word list: this is not a fourth Russian
+// mechanism (CLAUDE.md § "Russian patterns"). A systemd unit, a container, a
+// host and a path are written in ASCII, so a non-ASCII rune in an argv element
+// means the alias match swallowed the verb and handed on the next word of the
+// sentence. "перезагрузи роутер" is the case: restart is a real tool and
+// "роутер" is a real word, and `systemctl restart роутер` is neither.
+//
+// Every process row this box enables takes a system identifier (systemctl,
+// docker, journalctl, df). A process row that legitimately wanted Russian text
+// would want a different dispatch, not a hole in this check.
+//
+// It deliberately does not try to guess the right target. Identity is Nexus's
+// (CLAUDE.md § "The ecosystem"), and a target Nexus resolves reaches Hexis
+// through handleHexisAct before this executor is asked.
+func firstUnknownTarget(args []string) (string, bool) {
+	for _, a := range args {
+		for _, r := range a {
+			if r > unicode.MaxASCII {
+				return a, false
+			}
+		}
+	}
+	return "", true
+}
+
+func isMCPRow(cmd []string) bool {
+	_, _, ok := mcp.ParseCmd(cmd)
+	return ok
+}
+
+func isHouseRow(cmd []string) bool {
+	_, _, ok := smarthome.ParseCmd(cmd)
+	return ok
+}

internal/tool/tool_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"reflect"
+	"strings"
 	"testing"
 	"time"
 
@@ -320,3 +321,55 @@ func TestExecEmptyCmdRefuses(t *testing.T) {
 		t.Fatal("a row with no cmd ran a program named by the utterance")
 	}
 }
+
+// V-634. The alias match resolves the verb and hands on the next word of the
+// sentence, so "перезагрузи роутер" became `systemctl restart роутер`: a real
+// tool, a real word, and a target that cannot exist on this box.
+func TestExecRefusesATargetTheSystemCannotHave(t *testing.T) {
+	api := fakeAPI{tools: map[string]ipc.Tool{
+		"restart": {Name: "restart", Cmd: []string{"systemctl", "restart"}, Status: "enabled"},
+		"drop": {Name: "drop", Cmd: []string{"dropdb"}, Destructive: true, Status: "enabled"},
+	}}
+	ran := false
+	e := NewExecutor(api, 0)
+	e.run = func(context.Context, []string) (string, error) { ran = true; return "ok", nil }
+
+	_, err := e.Exec(context.Background(), "restart", []string{"роутер"}, false)
+	if !errors.Is(err, ErrUnknownTarget) {
+		t.Fatalf("err = %v, want ErrUnknownTarget", err)
+	}
+	if ran {
+		t.Fatal("the program was called with a target that cannot exist")
+	}
+	// The word is in the error, because a reply naming no word sends him to the log.
+	if !strings.Contains(err.Error(), "роутер") {
+		t.Errorf("err %v does not name the word she could not place", err)
+	}
+	// Ahead of the confirm gate: asking about an act that cannot run spends a
+	// turn on nothing.
+	if _, err := e.Exec(context.Background(), "drop", []string{"база"}, false); !errors.Is(err, ErrUnknownTarget) {
+		t.Errorf("destructive row: err = %v, want ErrUnknownTarget before ErrNeedsConfirm", err)
+	}
+	// An ASCII target still runs, unchanged.
+	if _, err := e.Exec(context.Background(), "restart", []string{"nginx"}, false); err != nil {
+		t.Errorf("restart nginx: %v", err)
+	}
+}
+
+// An MCP argument is not a target. A task title is Russian and always was.
+func TestExecMCPRowKeepsRussianArgs(t *testing.T) {
+	api := fakeAPI{tools: map[string]ipc.Tool{
+		"vikunja_create": {
+			Name: "vikunja_create", Status: "enabled",
+			Cmd: []string{"mcp", "vikunja", "create_task"},
+		},
+	}}
+	m := &fakeMCP{out: "создала"}
+	e := NewExecutor(api, time.Second).WithMCP(m)
+	if _, err := e.Exec(context.Background(), "vikunja_create", []string{"купить хлеб"}, false); err != nil {
+		t.Fatalf("exec: %v", err)
+	}
+	if len(m.args) != 1 || m.args[0] != "купить хлеб" {
+		t.Fatalf("args = %v, want the Russian title forwarded", m.args)
+	}
+}