router: add ActionCandidate type and ResolveActionCandidate

Introduce the typed boundary between routing and action resolution:

- ActionCandidate: Fn, Args, Source (route|matcher), Producer, Confidence
- ResolveActionCandidate(dec, m): standalone function usable by both
  the daemon and the eval harness
- Update eval harness Reach() to use ResolveActionCandidate instead of
  duplicating the matcher fallback logic

This is the routing-side half of the action-resolution boundary.
The daemon integration follows in the next commit.

.gitignore

@@ -76,3 +76,18 @@ __pycache__/
 .env
 # silero-vad, downloaded (see AGENTS.md)
 /models/vad/
+
+# Go build cache and GOPATH from the containerised e2eprobe build. Created by
+# the command in docs/capabilities/README.md, which runs as root in a container
+# and so cannot share the host cache. Multi-GB, entirely reproducible.
+/.cache/
+
+# docs/architecture/ derived output. The sources, findings.md and the inventory
+# JSON are tracked; these rebuild from them with pack_evidence.sh and are large.
+/docs/architecture/index.html
+/docs/architecture/anchors.md
+/docs/architecture/architecture-evidence.txt
+/docs/architecture/tree.txt
+/docs/architecture/docker-compose.redacted.yml
+/docs/architecture/diagrams/*.svg
+/maven-evidence.zip

cmd/mavend/boundary_test.go

@@ -0,0 +1,136 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/decision"
+	"github.com/kami/maven/internal/router"
+)
+
+// TestTextAndVoiceConvergeOnNormalizedInput — both entry points construct a
+// NormalizedInput and pass it to runTurn. The same utterance produces the same
+// route intent regardless of whether it arrived as text or voice.
+func TestTextAndVoiceConvergeOnNormalizedInput(t *testing.T) {
+	h, _ := newRoutingClarifyHandler(t)
+	h.decisions = decision.NewRing()
+	ctx := context.Background()
+
+	utterance := "который час"
+	voiceCtx := withDialogueID(ctx, dialogueIDFor(sourceVoice, ""))
+	textCtx := withDialogueID(ctx, dialogueIDFor(sourceText, "test"))
+
+	voiceReply := h.runTurn(voiceCtx, router.NormalizedInput{Text: utterance, Source: sourceVoice})
+	textReply := h.runTurn(textCtx, router.NormalizedInput{Text: utterance, Source: sourceText})
+
+	// Both paths should produce the same kind of reply (time answer).
+	for _, pair := range []struct {
+		label, reply string
+	}{
+		{"voice", voiceReply},
+		{"text", textReply},
+	} {
+		if !strings.Contains(pair.reply, "час") && !strings.Contains(pair.reply, "время") {
+			t.Errorf("%s reply %q does not look like a time answer", pair.label, pair.reply)
+		}
+	}
+}
+
+// TestNormalizedInputSourcePreserved — the source survives into the decision
+// record so a trace can tell voice from text.
+func TestNormalizedInputSourcePreserved(t *testing.T) {
+	h, _ := newRoutingClarifyHandler(t)
+	h.decisions = decision.NewRing()
+	ctx := context.Background()
+
+	textCtx := withDialogueID(ctx, dialogueIDFor(sourceText, "test"))
+	h.runTurn(textCtx, router.NormalizedInput{Text: "привет", Source: sourceText})
+
+	recs := h.decisions.Recent(1)
+	if len(recs) == 0 {
+		t.Fatal("no decision record")
+	}
+	if recs[0].InputSource != string(sourceText) {
+		t.Errorf("InputSource = %q, want %q", recs[0].InputSource, sourceText)
+	}
+}
+
+// TestRouteProducerOnDecisionRecord — the producer is carried from the router
+// decision into the decision record for observability.
+func TestRouteProducerOnDecisionRecord(t *testing.T) {
+	h, _ := newRoutingClarifyHandler(t)
+	h.decisions = decision.NewRing()
+	ctx := context.Background()
+
+	textCtx := withDialogueID(ctx, dialogueIDFor(sourceText, "test"))
+	h.runTurn(textCtx, router.NormalizedInput{Text: "который час", Source: sourceText})
+
+	recs := h.decisions.Recent(1)
+	if len(recs) == 0 {
+		t.Fatal("no decision record")
+	}
+	// A time query is a stage-0 grammar match.
+	if recs[0].RouteProducer != string(router.RouteProducerGrammar) {
+		t.Errorf("RouteProducer = %q, want %q", recs[0].RouteProducer, router.RouteProducerGrammar)
+	}
+}
+
+// TestPreRouteClaimHasNoRouteProducer — a turn claimed by a pre-route resolver
+// never reaches the router, so the record's RouteProducer must be empty.
+func TestPreRouteClaimHasNoRouteProducer(t *testing.T) {
+	h, _ := newRoutingClarifyHandler(t)
+	h.decisions = decision.NewRing()
+	// Park a confirm so the next "да" is consumed before routing.
+	// newRoutingClarifyHandler uses a fixed clock at 2026-07-31 09:00 UTC.
+	h.pending = &pendingAct{
+		fn:     "test",
+		phrase: "delete everything",
+		expiry: time.Date(2026, 7, 31, 9, 1, 0, 0, time.UTC),
+	}
+	ctx := context.Background()
+	textCtx := withDialogueID(ctx, dialogueIDFor(sourceText, "test"))
+	h.runTurn(textCtx, router.NormalizedInput{Text: "да", Source: sourceText})
+
+	recs := h.decisions.Recent(1)
+	if len(recs) == 0 {
+		t.Fatal("no decision record")
+	}
+	if recs[0].RouteProducer != "" {
+		t.Errorf("RouteProducer = %q, want empty (pre-route claimed the turn)", recs[0].RouteProducer)
+	}
+}
+
+// TestStage0ProducerUnchanged — grammars still produce the exact same intents
+// at confidence 1.0. This pins stage-0 behavior through the new boundary.
+func TestStage0ProducerUnchanged(t *testing.T) {
+	h, _ := newRoutingClarifyHandler(t)
+	h.decisions = decision.NewRing()
+	ctx := context.Background()
+	textCtx := withDialogueID(ctx, dialogueIDFor(sourceText, "test"))
+
+	cases := []struct {
+		utterance string
+		intent    router.Intent
+	}{
+		{"напомни позвонить маме завтра", router.IntentReminder},
+		{"который час", router.IntentSystem},
+	}
+	for _, c := range cases {
+		reply := h.runTurn(textCtx, router.NormalizedInput{Text: c.utterance, Source: sourceText})
+		_ = reply // behavior unchanged; we test the record, not the reply text.
+
+		recs := h.decisions.Recent(1)
+		if len(recs) == 0 {
+			t.Errorf("%s: no decision record", c.utterance)
+			continue
+		}
+		rec := recs[0]
+		if rec.RouteProducer != string(router.RouteProducerGrammar) {
+			t.Errorf("%s: RouteProducer = %q, want %q", c.utterance, rec.RouteProducer, router.RouteProducerGrammar)
+		}
+		// Clear the ring for the next case.
+		h.decisions = decision.NewRing()
+	}
+}

cmd/mavend/clarify_test.go

@@ -439,7 +439,7 @@ func TestClarifySecondGapExhaustionResumesLowerFlow(t *testing.T) {
 	h.clarifyStore.Push(voiceDialogueID, older)
 	h.clarifyStore.Push(voiceDialogueID, top)
 
-	reply := h.runTurn(ctx, "купить хлеб", sourceText)
+	reply := h.runTurn(ctx, router.NormalizedInput{Text: "купить хлеб", Source: sourceText})
 	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
 	want := withResumed(clarifyGaveUp, resumed)
 	if reply != want {

cmd/mavend/reactive_notes_test.go

@@ -126,7 +126,7 @@ func TestRunTurnExplicitNoteStoresOnlyTheBody(t *testing.T) {
 	}
 
 	const utterance = "запомни: запасной ключ лежит в синей коробке"
-	if reply := h.runTurn(ctx, utterance, sourceText); reply != "сохранила заметку." {
+	if reply := h.runTurn(ctx, router.NormalizedInput{Text: utterance, Source: sourceText}); reply != "сохранила заметку." {
 		t.Fatalf("reply = %q, want the fixed feminine acknowledgement", reply)
 	}
 	if model.calls != 0 {

cmd/mavend/reminder_cancel_test.go

@@ -382,7 +382,7 @@ func TestReminderCancellationIsAPreRouteTurnAndDoesNotGetSwallowedByClarify(t *t
 		Utterance: "напомни позвонить маме", Asked: h.now(), TTL: clarifyTTL,
 	})
 
-	reply := h.runTurn(ctx, "отмени напоминание про врача", sourceText)
+		reply := h.runTurn(ctx, router.NormalizedInput{Text: "отмени напоминание про врача", Source: sourceText})
 	if !strings.Contains(reply, clarifyDropped) || !strings.Contains(reply, "отменила напоминание") {
 		t.Fatalf("reply = %q, want dropped clarify notice and cancellation", reply)
 	}

cmd/mavend/repair_test.go

@@ -149,7 +149,7 @@ func TestRepairResumesQuestionParkedAfterTheCorrectedTurn(t *testing.T) {
 		t.Fatal("expected a parked reminder question")
 	}
 
-	reply := h.runTurn(ctx, "нет, это был вопрос", sourceText)
+	reply := h.runTurn(ctx, router.NormalizedInput{Text: "нет, это был вопрос", Source: sourceText})
 	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
 	if !strings.HasSuffix(reply, resumed) {
 		t.Fatalf("the correction hid the still-live question: reply=%q want suffix=%q", reply, resumed)
@@ -176,14 +176,14 @@ func TestRepairedClarifyCompletesWithoutDroppingTheOlderQuestion(t *testing.T) {
 		t.Fatal("expected the older reminder question")
 	}
 
-	if reply := h.runTurn(ctx, "нет, это было напоминание", sourceText); !strings.Contains(reply, "Когда") {
+	if reply := h.runTurn(ctx, router.NormalizedInput{Text: "нет, это было напоминание", Source: sourceText}); !strings.Contains(reply, "Когда") {
 		t.Fatalf("the repaired reminder did not ask for its missing time: %q", reply)
 	}
 	if depth := h.clarifyStore.Depth(voiceDialogueID); depth != 2 {
 		t.Fatalf("the repaired question overwrote the older one: depth=%d want=2", depth)
 	}
 
-	reply := h.runTurn(ctx, "сегодня в 15:00", sourceText)
+	reply := h.runTurn(ctx, router.NormalizedInput{Text: "сегодня в 15:00", Source: sourceText})
 	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
 	if !strings.HasSuffix(reply, resumed) {
 		t.Fatalf("completing the repaired request did not resume the older one: reply=%q", reply)

cmd/mavend/routingtrace.go

@@ -120,6 +120,7 @@ func (h *reactiveHandler) persistDecision(turnCtx context.Context, rec *decision
 		Source:            string(src),
 		Winner:            rec.Winner,
 		Intent:            wonIntent(rec),
+		RouteProducer:     rec.RouteProducer,
 		ClaimedBeforeHead: claimedBeforeHead(rec),
 		EncoderID:         h.encoderID,
 		Outcome:           wonAt(rec, decision.StageAction),

cmd/mavend/simulator_test.go

@@ -696,7 +696,7 @@ func (w *simWorld) stimulate(ctx context.Context, s step) {
 
 	switch {
 	case s.Say != "":
-		reply := w.handler.runTurn(ctx, s.Say, sourceText)
+		reply := w.handler.runTurn(ctx, router.NormalizedInput{Text: s.Say, Source: sourceText})
 		w.replies = append(w.replies, reply)
 		w.logf("он: %s", s.Say)
 		w.logf("она: %s", reply)

cmd/mavend/turnrole_test.go

@@ -264,10 +264,10 @@ func TestClarifyCancelEndsTheExchange(t *testing.T) {
 // the same memo.
 func TestTheTurnIsRoutedOnce(t *testing.T) {
 	h, _ := newRoutingClarifyHandler(t)
-	rt := h.newTurnRoute("какая сейчас погода в Риме?", h.now())
+	rt := h.newTurnRoute(router.NormalizedInput{Text: "какая сейчас погода в Риме?", Source: sourceText}, h.now())
 	ctx := withTurnRoute(withDialogueID(context.Background(), voiceDialogueID), rt)
 
-	first, ok := h.routeForRole(ctx, rt.text)
+	first, ok := h.routeForRole(ctx, rt.input.Text)
 	if !ok {
 		t.Fatal("the cascade must produce a decision to classify against")
 	}

cmd/mavend/turnroute.go

@@ -18,9 +18,9 @@ import (
 // second on the resident model and — worse — could disagree with itself, which
 // is exactly the class of bug this task is about.
 type turnRoute struct {
-	h    *reactiveHandler
-	text string
-	now  time.Time
+	h     *reactiveHandler
+	input router.NormalizedInput
+	now   time.Time
 
 	once sync.Once
 	dec  router.Decision
@@ -46,8 +46,8 @@ type turnRoute struct {
 
 type turnRouteKey struct{}
 
-func (h *reactiveHandler) newTurnRoute(text string, now time.Time) *turnRoute {
-	return &turnRoute{h: h, text: text, now: now}
+func (h *reactiveHandler) newTurnRoute(input router.NormalizedInput, now time.Time) *turnRoute {
+	return &turnRoute{h: h, input: input, now: now}
 }
 
 func withTurnRoute(ctx context.Context, rt *turnRoute) context.Context {
@@ -70,7 +70,7 @@ func (r *turnRoute) resolve(ctx context.Context) (router.Decision, bool, *dialog
 		if r.h.dialogueSessions != nil {
 			r.prev = r.h.dialogueSessions.Get(dialogueIDOf(ctx), r.now)
 		}
-		if dec, cont := continuationDecision(r.prev, r.text, r.now); cont {
+		if dec, cont := continuationDecision(r.prev, r.input.Text, r.now); cont {
 			log.Printf("voice: continuation of %s from the previous turn", dec.Intent)
 			r.dec, r.cont = dec, true
 			return
@@ -79,7 +79,7 @@ func (r *turnRoute) resolve(ctx context.Context) (router.Decision, bool, *dialog
 			r.err = router.ErrNoIntents
 			return
 		}
-		r.dec, r.err = r.h.router.Route(ctx, r.text, r.now)
+		r.dec, r.err = r.h.router.Route(ctx, r.input.Text, r.now)
 	})
 	return r.dec, r.cont, r.prev, r.err
 }
@@ -92,7 +92,7 @@ func (r *turnRoute) resolve(ctx context.Context) (router.Decision, bool, *dialog
 func (h *reactiveHandler) routeForRole(ctx context.Context, text string) (router.Decision, bool) {
 	rt := turnRouteFrom(ctx)
 	if rt == nil {
-		rt = h.newTurnRoute(text, h.now())
+		rt = h.newTurnRoute(router.NormalizedInput{Text: text, Source: sourceText}, h.now())
 	}
 	dec, _, _, err := rt.resolve(ctx)
 	if err != nil {

cmd/mavend/voice.go

@@ -211,7 +211,7 @@ func (h *reactiveHandler) HandlePushToTalk(ctx context.Context, req voice.PushTo
 
 	// 2-5. the shared turn pipeline (confirm → clarify → route → dialogue →
 	// action → replier), identical to the text path.
-	replyText := h.runTurn(ctx, text, sourceVoice)
+	replyText := h.runTurn(ctx, router.NormalizedInput{Text: text, Source: sourceVoice})
 
 	// 6. tts — synthesise the reply text; return to the voice server which
 	// ships it back on the conn.
@@ -244,30 +244,30 @@ func (h *reactiveHandler) upgradeAPI(api ipc.CoreAPI) {
 // HandlePushToTalk so text channels share the same routing logic.
 func (h *reactiveHandler) handleText(ctx context.Context, conversation, text string) string {
 	log.Printf("voice: handleText: %q", text)
-	return h.runTurn(withDialogueID(ctx, dialogueIDFor(sourceText, conversation)), text, sourceText)
+	return h.runTurn(withDialogueID(ctx, dialogueIDFor(sourceText, conversation)), router.NormalizedInput{Text: text, Source: sourceText})
 }
 
-// turnSource — which channel this utterance arrived on, in the same provenance
-// vocabulary facts use (internal/event). It is threaded through runTurn because
-// a turn can write a fact, and a fact that lies about where it came from is
-// worse than no fact: provenance is the first column read when asking why a
-// daemon-wide setting is the way it is.
-type turnSource string
+// turnSource is a local alias for router.InputSource, kept so the daemon code
+// reads sourceVoice/sourceText without a package prefix at every call site.
+// The canonical type lives in the router package; this is pure convenience.
+type turnSource = router.InputSource
 
 const (
-	sourceVoice turnSource = "tap:voice" // HandlePushToTalk, a real microphone
-	sourceText  turnSource = "tap:text"  // handleText: mavweb /api/chat, telegram
+	sourceVoice = router.InputSourceVoice
+	sourceText  = router.InputSourceText
 )
 
 // runTurn — the reactive turn pipeline shared by the voice and text entry
 // points: expired-clarify notice → confirm answer → explicit correction →
 // clarify answer → quiet toggle → reminder cancellation → route → dialogue
 // merge → clarify question → action → replier.
-// Takes the already-transcribed utterance, returns the reply text; the voice
-// path wraps it in stt/tts, the text path returns it as-is.
+// Takes the NormalizedInput (typed ingress boundary), returns the reply text;
+// the voice path wraps it in stt/tts, the text path returns it as-is.
 //
 // The ordering is load-bearing — see the step comments.
-func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSource) (reply string) {
+func (h *reactiveHandler) runTurn(ctx context.Context, input router.NormalizedInput) (reply string) {
+	text := input.Text
+	src := input.Source
 	// 0. the decision record (V-564). Installed here rather than in the IPC
 	// entry point, so the mic, telegram and the web all leave the same trail —
 	// a record only the web produced would be missing exactly the turns that
@@ -275,7 +275,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	// on a human-rate path, and no claim site can change a route with it.
 	if h.decisions != nil {
 		var rec *decision.Record
-		ctx, rec = decision.With(ctx, text)
+		ctx, rec = decision.With(ctx, text, string(src))
 		decision.Expect(ctx, decision.StagePreRoute, preRouteLadder)
 		defer func() {
 			done := rec.Finish(h.now())
@@ -289,7 +289,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	// claiming it, and step 5 acts on the same decision — routing twice would
 	// cost a second on the resident model and could disagree with itself.
 	now := h.now()
-	rt := h.newTurnRoute(text, now)
+	rt := h.newTurnRoute(input, now)
 	ctx = withTurnRoute(ctx, rt)
 	// A resolver may suspend an older clarify flow even when it handles this
 	// turn itself. Finalise that state at one choke point so early returns from
@@ -414,6 +414,10 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, "не получилось разобрать команду.")
 	}
 	log.Printf("voice: route result: intent=%s slots=%+v", dec.Intent, dec.Slots)
+	// Carry the route producer into the decision record for observability.
+	if rec := decision.From(ctx); rec != nil && dec.Producer != "" {
+		rec.RouteProducer = string(dec.Producer)
+	}
 
 	// 7. dialogue — fill this turn's missing slots from a prior same-intent
 	// turn (follow-ups like «напомни завтра» → «…позвонить маме»), then remember

docs/CLAUDE.md

@@ -11,6 +11,8 @@ The tier is the path, so staleness is visible from the filename.
 | `docs/evals/` | dated measurements, one file per measurement. **Never edited after the day.** A newer number is a new file. Indexed in `docs/evals/CLAUDE.md`, which marks each one live or superseded. | forever |
 | `docs/caveats/` | known limits, one entry per limit, each with a task id and a revisit trigger. Indexed in `docs/caveats/CLAUDE.md`. | until fixed, then deleted |
 | `docs/plans/` | the plan for one piece of work, frozen once it starts. Indexed in `docs/plans/CLAUDE.md`. | until the work lands |
+| `docs/capabilities/` | generated. The capability ledger and its probe harness, regenerated from `docs/spec.md` plus a named eval. **Never hand-edited**, except `domains.yaml`, `probes_field.json` and the scripts, which are its sources. Indexed in `docs/capabilities/README.md`. | until the spec or the measurement moves |
+| `docs/architecture/` | generated. The architecture observation and its evidence pack, rebuilt from source by the scripts beside it. Indexed in `docs/architecture/README.md`. | until the shape changes |
 | `docs/archive/` | dead. Read by nobody by default. | forever |
 
 ## Rules for this directory
@@ -21,6 +23,10 @@ The tier is the path, so staleness is visible from the filename.
   correction. Do not append a changelog to it.
 * A number in prose with no `docs/evals/` file behind it is an opinion.
 * Fixing something deletes its caveat. It does not edit the eval that found it.
+* **A generated tier is rebuilt, never corrected.** A wrong row in
+  `docs/capabilities/` or `docs/architecture/` is a bug in the generator or in
+  one of its hand-written inputs. Editing the output makes the next rebuild
+  silently undo the fix.
 
 ## Where a subsystem's reasoning lives
 

docs/architecture/README.md

@@ -0,0 +1,143 @@
+# docs/architecture
+
+An observation of Maven as built, read at `5cae33a` on 2026-08-25. It describes
+what the code does today. It proposes nothing.
+
+This directory is a build output plus its sources. `index.html`,
+`maven-architecture.json`, `anchors.md` and `diagrams/*.svg` are generated.
+
+## Read it
+
+| file | what it is |
+|---|---|
+| `index.html` | the viewer. Open it from the filesystem, no server needed. Seven views, the rendered diagram above each, click a component for its record. |
+| `check_viewer.js` | the viewer's only check. Runs every view against a DOM stub, because a TypeError in a renderer shows as a blank panel and not as an error. |
+| `findings.md` | the analysis. Kept apart from the facts on purpose. |
+| `maven-architecture.json` | the inventory. 160 components, 204 relations. The factual source for everything else. |
+| `anchors.md` | every symbol the inventory names, resolved to `path:line` with the line quoted. |
+| `diagrams/*.mmd` | the five views as Mermaid source. `03a`, `03b` and `03c` are the three traced requests. |
+| `diagrams/*.svg` | the same, rendered. |
+
+## Rebuild it
+
+```sh
+python3 docs/architecture/build_inventory.py   # → maven-architecture.json
+python3 docs/architecture/verify_anchors.py    # → anchors.md, exit 1 if stale
+sh      docs/architecture/render.sh            # → diagrams/*.svg, then index.html, then check_viewer.js
+python3 docs/architecture/build_viewer.py      # → index.html alone
+node    docs/architecture/check_viewer.js     # → every view rendered, no throw
+```
+
+Views 6 and 7 read `docs/capabilities/`, not this directory. View 6 is the
+capability matrix, 51 rows against seven dimensions. View 7 is the twelve
+cross-cutting invariants and the components that participate in each. Both are
+inlined by `build_viewer.py`, which reads `ledger.yaml` and `invariants.yaml`
+rather than deriving anything itself: the ledger's build is the only thing
+allowed to decide a dimension.
+
+`render.sh` drives mermaid-cli through the system chromium rather than letting
+puppeteer download its own. It is also the only syntax check this repo has for a
+`.mmd`.
+
+## What is verified, and what is not
+
+**Verified mechanically.** `verify_anchors.py` resolves all 692 claimed symbols
+against the files their component names. Current state: 681 resolved to a line
+and 0 unresolved, with 0 missing files. The other 11 are config keys and make
+targets rather than Go identifiers, so they are skipped. The script exits
+non-zero on any failure, which makes it a staleness gate.
+
+Writing it caught 29 symbols filed under the wrong component and seven names
+that were wrong outright. Two examples: `Store.RecordEvent` for what is really
+`Store.CreateEvent`, and `media.Keeper` for what is really `media.Store`.
+
+**Not verified.** That a symbol means what its `responsibility` says. An anchor
+proves the identifier is on that line and nothing more. Judgements about
+ownership, coupling and enforcement are readings of the code. A reading can be
+wrong in a way grep cannot catch.
+
+**Marked, not resolved.** Relations carry a `confidence` field. `medium` means
+the wiring is in the source and the call path was not traced end to end. `low`
+means it was inferred from one reference. The viewer can hide both. Four
+relations are `medium` and one is `low`.
+
+**Deployment-specific.** Sixteen components are `configured-off` against
+`deploy/mavend.json` as it stood on the day, and that file was dirty in the
+working tree. A different config makes different components live. `status` says
+which, per component.
+
+## The one thing to check first
+
+`findings.md` 6.3 through 6.3d. They say the system has no single point that
+decides whether an origin may cause an effect, and that the pieces which look
+like that point are each answering a different question.
+
+Revised on 2026-08-25 after an independent second pass. Four readings changed
+and one earlier statement was wrong. Section 6.3 marks the corrections.
+
+Start at `internal/tool/tool.go:181`, `cmd/mavend/ecosystem_acts.go:158` and
+`internal/router/claim.go:38`.
+
+## The evidence pack
+
+`sh docs/architecture/pack_evidence.sh` builds `maven-evidence.zip` at the repo
+root: this directory, the structural context, and whole source files for the
+architectural seams. Whole files, never snippets, because a cut-down file loses
+the call path that makes a claim checkable.
+
+The path list is an allowlist, not an exclusion list. A denylist ships whatever
+nobody thought to exclude, and this tree has a database key in it.
+
+`architecture-evidence.txt` is the reviewer's index. It resolves a named symbol
+list against the checkout and says plainly when a requested name does not exist.
+It also re-runs the probe under every contradiction, so a claim and its grep
+cannot drift apart.
+
+One file is not verbatim. `docker-compose.yml` carries an uptime-kuma API key,
+so a redacted copy ships in its place with that one value replaced. The script
+diffs the two and aborts if anything else changed.
+
+The scan at the end refuses to build on a credential-shaped hit rather than
+printing a warning. Both of its first two versions were wrong in instructive
+ways. The name filter deleted `internal/router/singletoken.go` for matching
+`*token*`. The value scan flagged docker volume lines that name where a secret
+would live and contain none.
+
+## The authorization function as implemented
+
+The reconstruction, at the one decision point that gates an act
+(`internal/tool/tool.go:156`):
+
+```
+permit(tool, confirmed) =
+      row.status == "enabled"                          tool.go:164
+  AND tier != irreversible                             risk.go:74  VoiceMayRun:false
+  AND (tier == safe OR confirmed)                      risk.go:72,76
+```
+
+`tier` is `RiskOf(row)`. The reach is not an input: `Executor.Exec` takes
+`(ctx, name, args, confirmed)` and no surface.
+
+`confirmed` is unproven at this boundary too. The invariant that a confirmation
+binds one capability, one target and an expiry lives in `pendingAct` and
+`resolveConfirm`. `Exec` trusts the boolean.
+
+The expression covers two of the three act paths. Hexis reuses it deliberately
+(`cmd/mavend/ecosystem_acts.go:768`). The Praxis lifecycle path has no tier and
+no confirm turn: `praxisItemAction.handle` calls straight through at
+`ecosystem_acts.go:158`.
+
+Behind the IPC boundary, `auth.Can(method, scope, params)` runs with
+`scope.Surface` always `SurfaceCoreProcess` (`internal/auth/enrollment.go:65`)
+and step-up held as one global timestamp that ignores `Scope`
+(`internal/webauthn/session.go:38` and `:62`).
+
+`auth` answers who may carry what authority. `tool` answers what effect a
+capability has and what proof it demands. Those are orthogonal, not competing.
+The decision combining them does not exist.
+
+Two representations of reach exist and both are ignored. `server.go:198` only
+defaults an empty `p.Surface`, so a client-asserted one survives and nothing
+reads it. `server.go:148` hardcodes `Session.Surface`. Since `req.Surface` is
+request payload on an unauthenticated wire, it must not become an authorization
+input as it stands.

docs/architecture/build_evidence.py

@@ -0,0 +1,290 @@
+#!/usr/bin/env python3
+"""Write architecture-evidence.txt: the reviewer's index into the pack.
+
+It resolves a named symbol list against this checkout and prints where each one
+is, or says plainly that it does not exist. A requested name that is absent is
+evidence too, so nothing here is silently dropped or silently corrected.
+
+Every contradiction is re-checked at generation time by running its own probe,
+so the claim and the grep that supports it cannot drift apart in the pack.
+
+    python3 docs/architecture/build_evidence.py
+"""
+import os
+import re
+import subprocess
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+ROOT = os.path.abspath(os.path.join(HERE, "..", ".."))
+TREES = ["cmd", "internal"]
+
+# The reviewer's list, verbatim on the left. Where a name does not exist in this
+# repo, the right side is what it appears to mean. Resolution below reports both
+# so a wrong name is visible rather than quietly fixed.
+REQUESTED = [
+    ("auth.TierFor", "auth.MaxLayer"),
+    ("auth.Surface", None),
+    ("auth.Layer", None),
+    ("tool.Executor.Exec", None),
+    ("tool.PolicyFor", None),
+    ("tool.RiskOf", None),
+    ("tool.RiskSafe", "tool.TierSafe"),
+    ("tool.RiskDestructive", "tool.TierDestructive"),
+    ("tool.RiskIrreversible", "tool.TierIrreversible"),
+    ("router.ClaimOf", None),
+    ("reactiveHandler", None),
+    ("tickLoop", None),
+]
+
+# Added because the authorization function the reviewer wants to reconstruct
+# runs through these and the list above does not reach them.
+ALSO = [
+    "auth.Gate", "auth.Can", "auth.Requirement", "auth.Authority",
+    "auth.NewFloorEnrollment", "auth.StaticEnrollment", "auth.Scope",
+    "tool.Policy", "tool.RiskOfCapability", "tool.irreversibleVerbs",
+    "tool.ErrNeedsConfirm", "tool.ErrNeedsAuthedSurface", "tool.ErrNotEnabled",
+    "ipc.Server.Check", "ipc.CheckFunc",
+    "voice.PushToTalkReq", "voice.Sessions.Add", "voice.Session",
+    "PolicyFor", "RiskOf", "Executor.Exec",
+    "pendingAct", "resolveConfirm", "actionAct", "runTurn", "applyAction",
+    "querySources", "queryWalk", "StageZeroGrammars", "Router.Route",
+]
+
+PKG_DIR = {
+    "auth": "internal/auth", "tool": "internal/tool", "claim": "internal/claim",
+    "modes": "internal/modes", "router": "internal/router", "voice": "internal/voice",
+    "ipc": "internal/ipc", "store": "internal/store",
+}
+
+
+def go_files(rel):
+    full = os.path.join(ROOT, rel)
+    out = []
+    for base, _, names in os.walk(full):
+        for n in sorted(names):
+            if n.endswith(".go"):
+                out.append(os.path.relpath(os.path.join(base, n), ROOT))
+    return sorted(out)
+
+
+def all_go():
+    out = []
+    for t in TREES:
+        out.extend(go_files(t))
+    return out
+
+
+_CACHE = {}
+
+
+def lines_of(rel):
+    """Read once. resolve() sweeps every file per pattern per symbol, and
+    re-reading cmd/ and internal/ that many times took minutes."""
+    if rel not in _CACHE:
+        try:
+            _CACHE[rel] = open(os.path.join(ROOT, rel), errors="replace").read().splitlines()
+        except OSError:
+            _CACHE[rel] = []
+    return _CACHE[rel]
+
+
+def resolve(sym):
+    """Find the declaration of sym. Returns (path, line, text) or (None,)*3."""
+    tail = sym.split(".")[-1]
+    recv = sym.split(".")[-2] if sym.count(".") >= 1 else None
+    pats = [
+        re.compile(r"^func\s+\(\w+\s+\*?" + re.escape(recv or "\x00") + r"\)\s+" + re.escape(tail) + r"\b"),
+        re.compile(r"^func\s+" + re.escape(tail) + r"\b"),
+        re.compile(r"^type\s+" + re.escape(tail) + r"\b"),
+        re.compile(r"^\s*" + re.escape(tail) + r"\s+\w+\s*=\s"),   # typed const
+        re.compile(r"^\s*" + re.escape(tail) + r"\s*=\s"),
+        re.compile(r"^(var|const)\s+" + re.escape(tail) + r"\b"),
+        re.compile(r"^\s*" + re.escape(tail) + r"\s+\w"),          # struct field
+    ]
+    pkg = sym.split(".")[0]
+    files = go_files(PKG_DIR[pkg]) if pkg in PKG_DIR else all_go()
+    files = [f for f in files if not f.endswith("_test.go")]
+    for pat in pats:
+        for rel in files:
+            for i, line in enumerate(lines_of(rel), 1):
+                if pat.match(line):
+                    return rel, i, line.strip()
+    return None, None, None
+
+
+def exported(pkg_rel):
+    """Every exported declaration in a package, for the `claim.*` / `modes.*` asks."""
+    out = []
+    pat = re.compile(r"^(func|type|const|var)\s+\(?[^)]*\)?\s*([A-Z]\w*)")
+    fn = re.compile(r"^func\s+(\([^)]*\)\s*)?([A-Z]\w*)")
+    for rel in go_files(pkg_rel):
+        if rel.endswith("_test.go"):
+            continue
+        for i, line in enumerate(lines_of(rel), 1):
+            m = fn.match(line) or pat.match(line)
+            if m:
+                name = m.group(m.lastindex)
+                if name and name[0].isupper():
+                    out.append((name, f"{rel}:{i}", line.strip()))
+    return out
+
+
+def sh(cmd):
+    return subprocess.run(cmd, shell=True, cwd=ROOT, capture_output=True,
+                          text=True).stdout.strip()
+
+
+# Each probe is a shell command whose output IS the evidence. Re-run at pack
+# time so the pack cannot claim something the checkout no longer shows.
+CONTRADICTIONS = [
+    ("auth surface/layer documented as control, not consumed on turn path",
+     # px.Surface is the Praxis lifecycle verb, an unrelated name collision, and
+     # Surfaced* are the read-out-item helpers. Excluded by name so the absence
+     # this probe reports is the auth Surface and not a filtering accident.
+     "grep -rnE 'req\\.Surface|sess\\.Surface|Session\\.Surface|auth\\.Surface|voice\\.Surface' cmd/mavend/*.go "
+     "| grep -v _test | grep -vE 'px\\.Surface|Surfaced' "
+     "|| echo '(no match: no file in cmd/mavend reads the auth Surface of a request or a session)'"),
+    ("auth.Can runs only behind the IPC boundary",
+     "grep -rn 'auth\\.' cmd/ internal/ --include='*.go' | grep -v _test "
+     "| grep -v '^internal/auth/' | grep -vE ':[0-9]+:\\s*(//|\\*)'"),
+    ("tool risk policy live on execution path",
+     "sed -n '176,190p' internal/tool/tool.go"),
+    ("tool executor receives no reach/surface",
+     "grep -n 'func (e \\*Executor) Exec' internal/tool/tool.go"),
+    ("voice server normalizes incoming surface to pc-client",
+     "grep -n 'SurfacePCClient' internal/voice/server.go"),
+    ("claim abstraction exists but Route does not consume it",
+     "grep -rn 'ClaimOf' --include='*.go' cmd internal | grep -v _test || echo '(only the definition; no caller)'"),
+    ("modes package is imported by nothing",
+     "grep -rn 'internal/modes' --include='*.go' cmd internal | grep -v '^internal/modes/' || echo '(no importer)'"),
+    ("voice server DEFAULTS an empty surface, it does not overwrite a sent one",
+     "sed -n '193,201p' internal/voice/server.go"),
+    ("session surface is hardcoded, independently of the request field",
+     "sed -n '146,149p' internal/voice/server.go"),
+    ("HandlePushToTalk never reads req.Surface",
+     "sed -n '200,203p' cmd/mavend/voice.go"),
+    ("hexis reuses the same risk policy",
+     "grep -n 'RiskOfCapability\\|PolicyFor' cmd/mavend/ecosystem_acts.go"),
+    ("praxis lifecycle mutations bypass the risk policy entirely",
+     "sed -n '156,172p' cmd/mavend/ecosystem_acts.go"),
+    ("Exec trusts a confirmed bool it cannot verify was bound",
+     "grep -n 'func (e \\*Executor) Exec' internal/tool/tool.go; grep -rn 'tools.Exec(' cmd/mavend/*.go | grep -v _test"),
+    ("FloorEnrollment maps every same-uid caller to one surface",
+     "sed -n '63,72p' internal/auth/enrollment.go"),
+    ("PasskeySession ignores Scope in both methods",
+     "grep -n 'func (s \\*PasskeySession) CurrentLayer\\|func (s \\*PasskeySession) Assert' internal/webauthn/session.go"),
+    ("Claim.Coverage can be 1.0 with nothing extracted",
+     "grep -n 'func claimSpans' -A 4 internal/router/claim.go; grep -n 'd.Slots.Text = ex.Text' -B 2 internal/router/router.go; grep -n 'func (c Claim) Coverage' -A 7 internal/claim/claim.go"),
+    ("claim_test asserts Band only, and every case sets Text == Utterance",
+     "grep -n 'Utterance:\\|Text:\\|want:' internal/router/claim_test.go | head -20"),
+    ("systemctl reboot is destructive, not irreversible",
+     "grep -n 'irreversibleVerbs = map' -A 8 internal/tool/risk.go; grep -n 'reboot' deploy/mavend.json"),
+]
+
+
+def main() -> int:
+    out = []
+    w = out.append
+    w("architecture evidence pack")
+    w("=" * 72)
+    w("")
+    w("commit: " + sh("git rev-parse HEAD"))
+    w("date:   " + sh("git log -1 --format=%cd --date=short"))
+    w("branch: " + sh("git rev-parse --abbrev-ref HEAD"))
+    w("")
+    w("working tree at pack time (git status --short):")
+    for line in (sh("git status --short") or "(clean)").splitlines():
+        w("  " + line)
+    w("")
+    w("The pack is built from the WORKING TREE, not from the commit. The lines")
+    w("above are the difference. deploy/mavend.json in particular is modified:")
+    w("phraser.model_path points at maven-instruct-b2, the committed value was")
+    w("Qwen3-1.7B-UD-Q4_K_XL. Sixteen 'configured-off' claims read this file.")
+    w("")
+
+    w("requested symbols")
+    w("-" * 72)
+    for name, actual in REQUESTED:
+        rel, line, text = resolve(name)
+        if rel:
+            w(f"- {name}")
+            w(f"    {rel}:{line}   {text}")
+        elif actual:
+            arel, aline, atext = resolve(actual)
+            w(f"- {name}  ->  DOES NOT EXIST in this repo")
+            if arel:
+                w(f"    the name appears to be {actual}")
+                w(f"    {arel}:{aline}   {atext}")
+            else:
+                w(f"    and neither does {actual}")
+        else:
+            w(f"- {name}  ->  NOT FOUND")
+    w("")
+
+    for pkg, rel in (("claim.*", "internal/claim"), ("modes.*", "internal/modes")):
+        w(f"{pkg}  ({rel})")
+        w("-" * 72)
+        for name, anchor, text in exported(rel):
+            w(f"- {name}")
+            w(f"    {anchor}   {text}")
+        w("")
+
+    w("additional symbols on the authorization path")
+    w("-" * 72)
+    for name in ALSO:
+        rel, line, text = resolve(name)
+        w(f"- {name}")
+        w(f"    {rel}:{line}   {text}" if rel else "    NOT FOUND")
+    w("")
+
+    w("known contradictions, each re-checked at pack time")
+    w("=" * 72)
+    w("The command under each claim was run against this checkout just now.")
+    w("Its output is what follows. Nothing here is transcribed by hand.")
+    w("")
+    for claim, cmd in CONTRADICTIONS:
+        w("- " + claim)
+        w("  $ " + cmd)
+        res = sh(cmd)
+        for line in (res or "(no output)").splitlines():
+            w("      " + line)
+        w("")
+
+    w("what the pack does NOT contain, and why")
+    w("=" * 72)
+    w("- .git, so no history and no gitignored working files travel with it.")
+    w("- deploy/telegram.env and deploy/db_key.env. The second holds the")
+    w("  database key. Both are gitignored and present in the working tree.")
+    w("- docker-compose.yml verbatim. It carries one live-looking credential on")
+    w("  line 132 (an uptime-kuma API key). The pack ships")
+    w("  docker-compose.redacted.yml with that one value replaced and nothing")
+    w("  else changed, so the mavcaldav and mavmaild claims stay checkable.")
+    w("- models/, deps/, *.db, *.onnx, *.gguf, certs, logs, node_modules.")
+    w("- internal/session, internal/db and tests/ from the requested list: none")
+    w("  of the three exists. Sessions live in internal/voice/session.go, the")
+    w("  store is internal/store, and tests sit beside their code as *_test.go.")
+    w("")
+    w("included test files, since the ask named them by subject:")
+    for pat, label in (
+        ("internal/router", "routing and arbitration"),
+        ("internal/tool", "risk and confirmation"),
+        ("internal/auth", "authorization"),
+        ("internal/claim", "claim"),
+        ("cmd/mavend", "turn path, confirm gate, query chain"),
+    ):
+        n = sh(f"find {pat} -name '*_test.go' | wc -l")
+        w(f"  {label}: {n} *_test.go under {pat}/")
+    w("")
+    w("fixtures are synthetic, not captured speech: internal/router/eval/*.json")
+    w("and cmd/mavend/testdata/**.json are hand-written contracts. Named here")
+    w("because they are Russian utterances and look like personal data.")
+
+    path = os.path.join(HERE, "architecture-evidence.txt")
+    open(path, "w").write("\n".join(out) + "\n")
+    print(f"architecture-evidence.txt: {os.path.getsize(path)} bytes, {len(out)} lines")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

docs/architecture/build_viewer.py

@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+"""Assemble index.html from the template, the inventory and the diagrams.
+
+index.html is self-contained on purpose: it opens from the filesystem with no
+server, and a browser at file:// refuses to fetch a sibling JSON. So the
+inventory, every .mmd source and every rendered .svg are inlined here rather
+than loaded at runtime.
+
+Run it through docs/architecture/render.sh, which re-renders the SVGs first.
+Running it alone rebuilds the viewer against whatever SVGs are already there.
+"""
+import json
+import os
+
+import yaml
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+DIA = os.path.join(HERE, "diagrams")
+CAPDIR = os.path.join(os.path.dirname(HERE), "capabilities")
+
+
+def main() -> None:
+    arch = json.load(open(os.path.join(HERE, "maven-architecture.json")))
+    mermaid, svg = {}, {}
+    for name in sorted(os.listdir(DIA)):
+        path = os.path.join(DIA, name)
+        if name.endswith(".mmd"):
+            mermaid[name] = open(path).read()
+        elif name.endswith(".svg"):
+            svg[name] = open(path).read()
+
+    # The capability half. Generated beside this one and read here rather than
+    # re-derived: the ledger's build is the only thing allowed to decide a
+    # dimension, and a second derivation would drift from it silently.
+    ledger = yaml.safe_load(open(os.path.join(CAPDIR, "ledger.yaml")))
+    invariants = yaml.safe_load(
+        open(os.path.join(CAPDIR, "invariants.yaml")))["invariants"]
+
+    payload = (
+        "const ARCH = " + json.dumps(arch, ensure_ascii=False) + ";\n"
+        "const CAPS = " + json.dumps(ledger, ensure_ascii=False) + ";\n"
+        "const INV = " + json.dumps(invariants, ensure_ascii=False) + ";\n"
+        "const MERMAID = " + json.dumps(mermaid, ensure_ascii=False) + ";\n"
+        "const SVG = " + json.dumps(svg, ensure_ascii=False) + ";\n"
+    )
+    template = open(os.path.join(HERE, "viewer.template.html")).read()
+    if "/*__DATA__*/" not in template:
+        raise SystemExit("viewer.template.html has no /*__DATA__*/ marker")
+    out = os.path.join(HERE, "index.html")
+    open(out, "w").write(template.replace("/*__DATA__*/", payload))
+    print(
+        "index.html: %d bytes, %d components, %d relations, %d diagrams, "
+        "%d rendered, %d capabilities, %d invariants"
+        % (os.path.getsize(out), len(arch["components"]), len(arch["edges"]),
+           len(mermaid), len(svg), len(ledger["capabilities"]), len(invariants))
+    )
+
+
+if __name__ == "__main__":
+    main()

docs/architecture/check_viewer.js

@@ -0,0 +1,64 @@
+// Smoke test for index.html's renderers, run by render.sh when node is present.
+//
+// The viewer has no test harness and a TypeError in a renderer produces a blank
+// panel, not an error anyone sees. This runs every view's render function
+// against a DOM stub and fails loudly on the first throw. It checks that the
+// renderers run over the real data, not that the result looks right.
+//
+//   node docs/architecture/check_viewer.js [path/to/index.html]
+
+const fs = require('fs');
+const path = process.argv[2] || __dirname + '/index.html';
+const src = fs.readFileSync(path, 'utf8');
+const js = src.match(/<script>([\s\S]*)<\/script>/)[1];
+
+const el = () => {
+  const e = {
+    innerHTML: '', textContent: '', style: {}, checked: true, value: '',
+    _written: 0,
+    dataset: {}, classList: { add(){}, remove(){}, toggle(){} },
+    querySelectorAll: () => [], querySelector: () => null,
+    appendChild(){}, addEventListener(){}, scrollIntoView(){},
+    getBoundingClientRect: () => ({top:0,left:0,width:0,height:0}),
+  };
+  return e;
+};
+// One shared element per id, so a renderer's output can be read back. A stub
+// that silently swallows innerHTML would let an empty render pass.
+const els = {};
+const document = {
+  getElementById: id => (els[id] = els[id] || el()), querySelectorAll: () => [], querySelector: () => null,
+  createElementNS: el, createElement: el, addEventListener(){},
+};
+const window = { addEventListener(){} };
+const requestAnimationFrame = () => {};
+
+// `const` inside a direct eval stays in the eval's own scope, so the checks are
+// appended to the source and evaluated with it rather than run beside it.
+const checks = `
+let n = 0;
+for (const v of VIEWS) {
+  setView(v.id);
+  n++;
+}
+// Every flow, and every capability's side panel: the branch a click takes.
+for (const k of Object.keys(FLOWS)) { S.flow = k; renderFlow(el()); n++; }
+setView('c1');
+if (els.main.innerHTML.length < 5000) throw new Error('capability matrix rendered ' + els.main.innerHTML.length + ' chars');
+for (const c of CAPS.capabilities) {
+  renderCapSide(c.id);
+  if (els.side.innerHTML.length < 400) throw new Error('thin panel for ' + c.id);
+  n++;
+}
+S.capBy = 'domain'; renderCaps(el()); n++;
+setView('c2');
+if (els.main.innerHTML.length < 4000) throw new Error('invariants view rendered ' + els.main.innerHTML.length + ' chars');
+for (const iv of INV) { invRollup(iv); n++; }
+for (const c of ARCH.components) { renderSide(c.id); n++; }
+
+console.log('viewer: ' + n + ' render calls, ' + VIEWS.length + ' views, ' +
+            CAPS.capabilities.length + ' capabilities, ' + INV.length +
+            ' invariants, no throw');
+`;
+
+eval(js + checks);

docs/architecture/diagrams/01-system-topology.mmd

@@ -0,0 +1,120 @@
+%% View 1 — System topology.
+%% Runtime processes and external systems, with process boundaries drawn explicitly.
+%% mavend is the centre because the code makes it one: it is the only key holder,
+%% it owns the store, the IPC socket, the voice listener, the tick loop, eight
+%% in-process background workers and the child llama-server.
+%% Evidence: docker-compose.yml, cmd/mavend/main.go, cmd/mavend/boot.go,
+%% deploy/mavwaked.service, deploy/mavgpud.service.
+flowchart LR
+
+  subgraph WORKPC["workpc — systemd user units, never in docker-compose"]
+    direction TB
+    MAVWAKED["mavwaked<br/>process<br/>arecord · silero VAD · keyword head"]
+    MAVGPUD["mavgpud<br/>process<br/>GPU supervisor"]
+    LLAMA_W["llama-server<br/>model · workstation card"]
+    CW2["CrisperWhisper2 turbo<br/>model · port 8081"]
+    ALSA["arecord / aplay<br/>external"]
+    TUNNEL["maven-voice-tunnel.service<br/>ssh · the only path in"]
+  end
+
+  subgraph HOMESRV["homesrv — docker compose project `maven`"]
+    direction TB
+
+    subgraph MAVEND_P["mavend — process boundary · the only key holder"]
+      direction TB
+      IPCSRV["IPC server<br/>unix /run/maven/mavend.sock"]
+      VOICESRV["voice server<br/>TCP 0.0.0.0:9100"]
+      TURN["reactive handler<br/>the turn pipeline"]
+      TICK["tick loop<br/>60s"]
+      WORKERS["8 background workers<br/>tick · fact-enrichment · feed · crawl<br/>voice · mcp · home · memory-eval"]
+      STORE[("store<br/>sqlite, MaxOpenConns=1")]
+    end
+
+    LLAMA_H["llama-server<br/>model · resident<br/>child process of mavend"]
+    MAVSTTD["mavsttd<br/>process<br/>whisper.cpp"]
+    MAVTTSD["mavttsd<br/>process<br/>piper"]
+    MAVWEB["mavweb<br/>process<br/>HTTP 127.0.0.1:9201"]
+    MAVPOLL["mavpoll<br/>process<br/>network_mode: host"]
+    SEARX["SearXNG<br/>external"]
+    KIWIX["kiwix-server<br/>external"]
+    NETDATA["netdata<br/>external"]
+    KUMA["uptime-kuma<br/>external"]
+  end
+
+  subgraph OFF["built, not deployed — commented out in docker-compose.yml"]
+    direction TB
+    MAVCALDAV["mavcaldav<br/>process"]
+    MAVMAILD["mavmaild<br/>process"]
+  end
+
+  subgraph ECO["ecosystem network — external compose project"]
+    direction TB
+    NEXUS["Nexus<br/>external · identity"]
+    PRAXIS["Praxis<br/>external · attention"]
+    HEXIS["Hexis<br/>external · capabilities"]
+  end
+
+  subgraph NET["internet"]
+    direction TB
+    TG["Telegram Bot API<br/>external · via SOCKS relay"]
+    NTFY["ntfy<br/>external · DISABLED in config"]
+    ZM["zenmoney<br/>external · no token mounted"]
+  end
+
+  HA["Home Assistant<br/>external · enabled:false"]
+
+  %% ---- voice path
+  ALSA --- MAVWAKED
+  MAVWAKED -->|"PushToTalk · TCP"| TUNNEL
+  TUNNEL -->|"ssh to 127.0.0.1:9110"| VOICESRV
+  VOICESRV -->|"proactive Push on the same conn"| MAVWAKED
+
+  %% ---- module IPC
+  MAVWEB -->|"3 × ipc.Client · unix"| IPCSRV
+  MAVWEB -->|"POST /api/ptt · TCP mavend:9100"| VOICESRV
+  MAVPOLL -->|"WriteFact · unix"| IPCSRV
+  MAVCALDAV -.->|"WriteFact · unix"| IPCSRV
+  MAVMAILD -.->|"IngestMail · unix"| IPCSRV
+
+  %% ---- worker sockets
+  TURN -->|"worker · unix stt.sock"| MAVSTTD
+  TURN -->|"worker · unix tts.sock"| MAVTTSD
+  TURN -->|"HTTP · preferred, silent fallback"| CW2
+
+  %% ---- models
+  MAVEND_P ---|"spawns and owns"| LLAMA_H
+  MAVGPUD ---|"spawns and supervises"| LLAMA_W
+  MAVGPUD ---|"spawns and supervises"| CW2
+  TURN -.->|"llm.Pair · model_disabled:true"| MAVGPUD
+
+  %% ---- world and ecosystem
+  TURN -->|"HTTP · query string only"| SEARX
+  TURN -->|"HTTP"| KIWIX
+  TURN -->|"HTTP · v1 contract, correlation id"| NEXUS
+  TURN -->|"HTTP"| PRAXIS
+  TURN -->|"HTTP"| HEXIS
+  MAVWEB -->|"HTTP · read-only panel"| NEXUS
+  MAVWEB -->|"HTTP · read-only panel"| PRAXIS
+  MAVWEB -->|"HTTP · read-only panel"| HEXIS
+  TURN -.->|"HTTP · enabled:false"| HA
+
+  %% ---- reaches
+  TICK -->|"telegram sink"| TG
+  TG -->|"getUpdates long poll"| TURN
+  TICK -.->|"ntfy sink · nil, disabled"| NTFY
+
+  %% ---- pollers
+  MAVPOLL --> NETDATA
+  MAVPOLL --> KUMA
+  MAVPOLL -.-> ZM
+
+  classDef proc fill:#1f3a5f,stroke:#7fb3ff,color:#eaf2ff
+  classDef ext fill:#3d2f4f,stroke:#c39bd3,color:#f4ecf7
+  classDef model fill:#4a3a1f,stroke:#e0b050,color:#fff6e0
+  classDef store fill:#1f4a3a,stroke:#6ed0a8,color:#e8fff5
+  classDef off fill:#3a3a3a,stroke:#888,color:#ccc,stroke-dasharray:4 3
+  class MAVWAKED,MAVGPUD,MAVSTTD,MAVTTSD,MAVWEB,MAVPOLL,IPCSRV,VOICESRV,TURN,TICK,WORKERS proc
+  class ALSA,SEARX,KIWIX,NETDATA,KUMA,NEXUS,PRAXIS,HEXIS,TG,TUNNEL ext
+  class LLAMA_H,LLAMA_W,CW2 model
+  class STORE store
+  class MAVCALDAV,MAVMAILD,NTFY,ZM,HA off

docs/architecture/diagrams/02-core-internals.mmd

@@ -0,0 +1,160 @@
+%% View 2 — Core internals of mavend.
+%% The real path, in the order runTurn actually runs it. The sequence is NOT
+%% input → routing → intent → state → tools → response: eleven stateful
+%% pre-emptors get first refusal BEFORE routing, and a query intent then enters
+%% a second, longer arbitration of its own.
+%% Evidence: cmd/mavend/voice.go runTurn, cmd/mavend/turnroute.go,
+%% cmd/mavend/actions.go, cmd/mavend/actions_query.go, internal/router/router.go.
+flowchart TB
+
+  subgraph IN["input — three reaches, one pipeline"]
+    A1["voice.Server<br/>HandlePushToTalk"]
+    A2["daemonAPI.Chat<br/>mavweb /api/chat"]
+    A3["telegram poller<br/>getUpdates"]
+    STT["stt seam<br/>Remote mavsttd · CW2 · Stub"]
+  end
+
+  A1 --> STT --> RT
+  A2 --> RT
+  A3 --> A2
+
+  RT["runTurn<br/>cmd/mavend/voice.go"]
+
+  RT --> D0["decision.With<br/>one arbitration record per turn"]
+  D0 --> TR0["turnRoute created<br/>sync.Once, on the context"]
+
+  subgraph PRE["pre-route ladder — 11 rungs, order load-bearing"]
+    direction TB
+    P1["1 expired-clarify notice"]
+    P2["2 confirm answer<br/>resolveConfirm"]
+    P3["3 targeted repair"]
+    P4["3b untargeted repair"]
+    P5["3c command prohibition"]
+    P6["4 clarify answer"]
+    P7["5 quiet toggle"]
+    P8["5b snooze"]
+    P9["5c ack"]
+    P10["5d reminder cancellation"]
+    P11["5e ordinal selection"]
+    P1-->P2-->P3-->P4-->P5-->P6-->P7-->P8-->P9-->P10-->P11
+  end
+  TR0 --> PRE
+  PRE -->|"any rung claims"| OUT
+
+  subgraph ROUTE["step 6 — the cascade · internal/router"]
+    direction TB
+    CONT["continuationDecision<br/>an elliptical follow-up is answered<br/>from the previous turn, not routed"]
+    S0["stage 0 grammars<br/>StageZeroGrammars · first match wins at 1.0<br/>the ONLY arm that may set SourceAnchored"]
+    SH["stage 0b routing heads<br/>ONNX softmax over the label set"]
+    SL["stage 1a LLM router<br/>resident model, grammar-constrained"]
+    SC["stage 1 classifier<br/>nearest centroid · THE FLOOR<br/>names no destination"]
+    SE["stage 2 extractor + stage 3 gate"]
+    CONT -->|"not a continuation"| S0
+    S0 -->|"no match"| SH
+    SH -->|"declines"| SL
+    SL -->|"error or unparsable"| SC
+    SH --> SE
+    SL --> SE
+    SC --> SE
+  end
+  PRE -->|"nobody claimed"| ROUTE
+
+  ROUTE --> DLG["step 7 dialogue merge<br/>followUpMerge · rememberTurn"]
+  DLG --> CLAR{"step 8<br/>dec.Clarify OR a required slot missing?"}
+  CLAR -->|"yes"| ASK["askClarify<br/>park the request, ask one question"]
+  ASK --> OUT
+  CLAR -->|"no"| ACT
+
+  subgraph ACT["step 9 — actionHandlers, 7 intents"]
+    direction TB
+    HF["fact<br/>actions_fact.go"]
+    HR["reminder<br/>actions_reminder.go"]
+    HA["act<br/>actions_act.go"]
+    HN["note"]
+    HC["chat"]
+    HS["system"]
+    HQ["query → the chain"]
+  end
+
+  subgraph QC["the query chain — a SECOND arbitration, 22 sources"]
+    direction TB
+    QW["queryWalk<br/>removes only guesses:true sources<br/>when the cascade named a destination"]
+    Q1["his data<br/>fact-by-key · day-plan · habits · tasks<br/>attention · list · money · history · feeds<br/>home · network · calendar · weather · self<br/>embed · memory · notes"]
+    QB["personal boundary<br/>the only source a stage 0 anchor may drop"]
+    Q2["the world<br/>search → kiwix → web → general-knowledge"]
+    QW --> Q1 --> QB --> Q2
+  end
+  HQ --> QC
+
+  HF -->|"question-shaped ⇒ re-route"| QC
+  HF -->|"complaint ⇒ re-route"| HC
+
+  subgraph STATE["state and memory"]
+    direction TB
+    DB[("store · sqlite<br/>facts · reminders · notes · tools<br/>tasks · lists · nudges")]
+    VEC[("memory_vectors<br/>brute-force cosine")]
+    DLGS[("dialogue_sessions<br/>persisted, TTL 2m")]
+    CLS["clarifyStore<br/>IN MEMORY ONLY, by design"]
+    PEND["pending act / routine / hexis<br/>3 single-slot registers, one mutex"]
+    SURF["surfacedItems<br/>last Praxis read-out order"]
+    RING["decision.Ring<br/>bounded, in memory"]
+  end
+
+  HF --> DB
+  HF --> VEC
+  HR --> DB
+  HN --> DB
+  HN --> VEC
+  Q1 --> DB
+  Q1 --> VEC
+  DLG --> DLGS
+  ASK --> CLS
+  HA --> PEND
+  QC --> SURF
+  D0 --> RING
+
+  subgraph TOOLS["act execution"]
+    direction TB
+    ALLOW[("tools table<br/>only status='enabled' runs")]
+    EXEC["tool.Executor<br/>+ MCP + Home Assistant callers"]
+    CONF["destructive confirm turn<br/>binds capability, entity, args, requester, expiry"]
+    HEX["Hexis capability<br/>entity id resolved via Nexus first"]
+  end
+  HA --> ALLOW --> EXEC
+  HA --> CONF
+  HA --> HEX
+
+  subgraph RESP["response generation"]
+    direction TB
+    REP["replier<br/>only when the handler returned \"\""]
+    PHR["phraser<br/>parseResponseMood is the one parser"]
+    TTS["tts seam<br/>Remote mavttsd · Stub"]
+  end
+  ACT --> RESP
+  QC --> RESP
+  REP --> PHR
+  OUT["reply text<br/>+ notice + resumed question"]
+  RESP --> OUT
+  OUT -->|"voice path only"| TTS
+
+  subgraph PROACT["the other half of the process — nothing above touches it"]
+    direction TB
+    TICKL["tick loop · 60s<br/>13 jobs in one function"]
+    GTH["loop.Gatherer<br/>one consistent snapshot"]
+    RUL["loop rules + restraint gate<br/>pure"]
+    DISP["delivery.Dispatcher<br/>ChannelsFor severity,presence"]
+    SNK["sinks: voice · ntfy · telegram"]
+    TICKL --> GTH --> RUL --> TICKL
+    TICKL --> DISP --> SNK
+  end
+  TICKL --> DB
+  SNK -->|"PushToMostRecent on the request conn"| A1
+
+  classDef stage fill:#1f3a5f,stroke:#7fb3ff,color:#eaf2ff
+  classDef store fill:#1f4a3a,stroke:#6ed0a8,color:#e8fff5
+  classDef mem fill:#4a3a1f,stroke:#e0b050,color:#fff6e0
+  classDef danger fill:#4f2626,stroke:#e08080,color:#ffecec
+  class S0,SH,SL,SC,SE,CONT stage
+  class DB,VEC,DLGS,ALLOW store
+  class CLS,PEND,SURF,RING mem
+  class QB,CONF danger

docs/architecture/diagrams/03a-flow-reminder.mmd

@@ -0,0 +1,78 @@
+%% View 3a — Runtime flow: a reminder request.
+%% Traced through cmd/mavend/voice.go runTurn, internal/router/stagezero.go,
+%% cmd/mavend/clarify.go, cmd/mavend/actions_reminder.go, cmd/mavend/tick.go,
+%% internal/loop/loop.go and internal/delivery/dispatcher.go.
+%% Shows the branch where the hour is missing, the parked clarify, the answer
+%% turn, the write and the eventual delivery with durable retry.
+sequenceDiagram
+  autonumber
+  participant K as Owner
+  participant W as mavwaked
+  participant V as voice.Server
+  participant H as reactiveHandler.runTurn
+  participant PRE as pre-route ladder
+  participant R as router cascade
+  participant CL as clarifyStore
+  participant AR as actionReminder
+  participant DB as store
+  participant T as tick loop
+  participant D as dispatcher
+
+  Note over K,W: "Мэйвен, напомни позвонить маме"
+  K->>W: speech
+  W->>W: silero VAD + keyword head, score ≥ 0.999
+  W->>V: PushToTalkReq, one utterance
+  V->>H: HandlePushToTalk
+  H->>H: stt seam → text
+  H->>H: decision.With, turnRoute created
+  H->>PRE: 11 rungs
+  PRE-->>H: nobody claims
+  H->>R: rt.resolve
+  R->>R: stage 0 ReminderGrammar matches, Stage=0, conf 1.0
+  R-->>H: IntentReminder, Slots.Text="позвонить маме", HasTime=false
+
+  rect rgb(70,40,40)
+    Note over H,CL: BRANCH — missingFor names `time`, whatever the confidence
+    H->>H: dec.Clarify false BUT len missingFor > 0 → step 8 fires
+    H->>CL: Push a PendingQuestion, park the request
+    H-->>V: "во сколько напомнить?"
+    V-->>W: reply audio + text
+  end
+
+  Note over K,W: "в семь вечера"
+  K->>W: speech
+  W->>V: PushToTalkReq
+  V->>H: runTurn
+  H->>PRE: rung 4, resolveClarifyAnswer
+  PRE->>CL: Pop the parked question
+  PRE->>R: extractor parses the hour with the SAME parsers stage 2 uses
+  PRE->>AR: finishClarified → applyAction
+  Note right of AR: filling in an argument never grants authority
+  AR->>AR: router.ResolvedTheHour guard
+  AR->>DB: CreateReminder fire_ts, payload
+  DB-->>AR: id
+  AR-->>H: reminderConfirm, phrased FROM THE ROW not the utterance
+  H-->>V: "хорошо, напомню сегодня в 19:00."
+
+  Note over T,D: later — the proactive half, no shared code with the turn path
+  loop every 60s
+    T->>DB: Gatherer.GatherState, due reminders, collapsed by group
+    T->>T: loop.RemindDecisions — reminders BYPASS the restraint gate
+    alt not cached
+      T->>T: phraser.PhraseReminder
+    end
+    T->>D: DispatchReminder
+    D->>DB: BeginDeliveryAttempt BEFORE the external send
+    alt a voice session is live
+      D->>V: voicesink push on the request conn
+    else away
+      D->>D: ntfy is nil (disabled) → telegram
+    end
+    alt success
+      D->>DB: CompleteSuccessfulReminderAttempt + fire the originals, one txn
+    else failure
+      D->>DB: advance the persisted bounded backoff, next_attempt_ts
+    end
+  end
+
+  Note over T,DB: Recurring is NOT on this path. reminders.cron and next_fire_ts<br/>exist since migration #2 and no spoken path writes them.

docs/architecture/diagrams/03b-flow-fact.mmd

@@ -0,0 +1,61 @@
+%% View 3b — Runtime flow: a factual / state update.
+%% Traced through cmd/mavend/actions_fact.go, cmd/mavend/ack.go,
+%% cmd/mavend/patterns.go, cmd/mavend/factenrichment.go, cmd/mavend/intake.go
+%% and internal/morning.
+%% Shows the two re-route branches this handler owns, the vector prune-and-insert,
+%% the nudge it can close, and the async entity resolution behind it.
+sequenceDiagram
+  autonumber
+  participant K as Owner
+  participant H as runTurn
+  participant R as router cascade
+  participant AF as actionFact
+  participant API as CoreAPI · intakeAPI then storeAPI
+  participant DB as facts table
+  participant VEC as memory_vectors
+  participant BUS as event.Bus
+  participant FE as fact-enrichment worker
+  participant NX as Nexus
+  participant T as tick loop
+
+  Note over K,H: "выпил воды"
+  K->>H: utterance, src=tap:voice
+  H->>R: rt.resolve
+  R->>R: stage 0 declines → heads → LLM router → classifier
+  R-->>H: IntentFact, Slots.Key="water", Slots.Value=...
+
+  rect rgb(70,40,40)
+    Note over AF: two guards that RE-ROUTE rather than write
+    AF->>AF: router.IsQuestionShaped? → becomes actionQuery, Key cleared
+    AF->>AF: router.IsTransientComplaint? → becomes actionChat, nothing stored
+  end
+
+  AF->>AF: factConfidence — 1.0 only for a value he actually said
+  AF->>API: WriteFact kind=self, source=tap:voice, Subject=Key
+  API->>DB: append-only row
+  API->>BUS: publish one intake envelope
+  API-->>AF: factID
+
+  AF->>VEC: pruneFactVectors by key
+  AF->>VEC: EmbedPassage(FactRecallText) then Insert "fact:<key>:<unix>"
+  Note right of VEC: the FACT is embedded, not the utterance.<br/>The utterance rides along as provenance only
+
+  AF->>DB: RecordEvent action+object, for pattern detection
+  H->>H: step 9b ackFromFact — a fact answering a live nudge closes it as `acted`, silently
+
+  par asynchronous, minutes later
+    FE->>DB: read facts with resolution_state='pending'
+    FE->>NX: Resolve(Subject)
+    alt resolved
+      NX-->>FE: entity_id
+      FE->>DB: UPDATE entity_id, resolution_state='resolved'
+    else ambiguous
+      Note right of FE: candidates are NOT stored —<br/>ambiguity blocks, it does not pick
+    end
+  and the next tick
+    T->>DB: Gatherer reads the same row
+    T->>T: morning routine item `water` is now evidenced, so it will not nudge
+    T->>T: detectPatterns scans events for a stable interval
+  end
+
+  Note over DB,VEC: A wrong value is superseded, never overwritten:<br/>voids_id points at the row it cancels, and CorrectValue /<br/>VoidLatestFact drop the key's vectors so recall keeps exactly one.

docs/architecture/diagrams/03c-flow-world-query.mmd

@@ -0,0 +1,70 @@
+%% View 3c — Runtime flow: a world query, tool-backed.
+%% Traced through internal/router/worldquery.go, internal/router/source.go,
+%% cmd/mavend/actions_query.go queryWalk + querySources, cmd/mavend/personalboundary.go,
+%% cmd/mavend/searchwire.go, cmd/mavend/kiwixwire.go.
+%% Shows destination anchoring, which sources are skipped and why, and the
+%% four-step fallback to the model's own weights.
+sequenceDiagram
+  autonumber
+  participant K as Owner
+  participant H as runTurn
+  participant R as router cascade
+  participant QC as actionQuery
+  participant W as queryWalk
+  participant LOC as local sources
+  participant PB as personal boundary
+  participant SX as SearXNG
+  participant KX as kiwix-server
+  participant PH as phraser / resident model
+  participant REC as decision record
+
+  Note over K,H: "что такое TCP?"
+  K->>H: utterance
+  H->>R: rt.resolve
+  R->>R: stage 0 — WorldQueryGrammars matches a literal definition frame
+  R->>R: d.SourceAnchored = true, set HERE and nowhere else
+  R-->>H: IntentQuery, Source=SourceWorld, anchored
+
+  H->>QC: applyAction → actionQuery
+  QC->>REC: Expect the full 22-source roster
+  QC->>W: queryWalk(SourceWorld, anchored=true)
+
+  rect rgb(70,40,40)
+    Note over W: removes ONLY sources with guesses:true whose dest ≠ world
+    W-->>REC: skipped: attention, list, feeds, home, network, weather, self
+    W-->>REC: skipped: personal boundary — anchored, so a literal pattern may drop it
+    Note right of W: a model or a softmax naming SourceWorld<br/>would NOT drop the boundary (V-666)
+  end
+
+  W-->>QC: the sources that LOOK still walk, in table order
+
+  loop first source to claim answers the turn
+    QC->>LOC: fact-by-key, day-plan, habits, tasks, money, history, calendar
+    LOC-->>QC: no rows → pass
+    QC->>LOC: embed → memory → notes (vector recall, gated by min score + margin)
+    LOC-->>QC: below the gate → pass
+    QC->>PB: personal boundary
+    PB-->>QC: SKIPPED this turn
+    QC->>SX: Search(utterance verbatim, max 4)
+    alt results
+      SX-->>QC: snippets
+      QC->>PH: phraseSource("search", utterance, evidence)
+      PH-->>QC: reply
+      QC->>REC: claimed by "search", and everyone below is NeverAsked
+    else empty or unreachable
+      QC->>KX: ZIM search, ru then en
+      alt hit
+        KX-->>QC: article snippet
+        QC->>PH: phraseSource("kiwix", ...)
+      else miss
+        QC->>QC: "web" claims only if he named a URL out loud
+        QC->>PH: queryGeneral — the model answers from its own weights, LAST
+      end
+    end
+  end
+
+  QC-->>H: reply text
+  H-->>K: spoken or written answer
+
+  Note over LOC,SX: What leaves the box is the query string and nothing else.<br/>His notes, his facts, the persona block and the history never travel.
+  Note over W,PB: With no destination named — the classifier arm sets none —<br/>the whole chain walks in table order. That is the floor.

docs/architecture/diagrams/04-state-ownership.mmd

@@ -0,0 +1,115 @@
+%% View 4 — State ownership.
+%% Every persistent and shared store, its authoritative owner, its writers and
+%% readers, its synchronisation boundary and its lifecycle.
+%% Red = written by components that do not know about each other.
+%% Evidence: internal/store/schema.sql, internal/store/migrations.go,
+%% internal/store/crypt.go, cmd/mavend/voice.go, cmd/mavend/tick.go,
+%% cmd/mavweb/*.go, cmd/mavpoll/main.go, cmd/mavcaldav/main.go.
+flowchart LR
+
+  subgraph OWNER["authoritative owner — mavend, the only key holder"]
+    STORE[("store.Store<br/>SetMaxOpenConns(1)<br/>every write serialised at the db")]
+  end
+
+  subgraph LIFE["lifecycle of the database itself"]
+    direction TB
+    ENC[("maven.db.enc<br/>AES-256-GCM at rest<br/>volume dbdata")]
+    TMP[("/dev/shm/maven-plain.db<br/>tmpfs working copy<br/>dies with the container")]
+    ENC -->|"Open: decrypt"| TMP
+    TMP -->|"Close: checkpoint, re-encrypt, atomic rename"| ENC
+    SEAL["mavseal<br/>recovery only, VACUUM INTO"]
+    TMP -.->|"when mavend was killed, not stopped"| SEAL
+    SEAL -.-> ENC
+  end
+  STORE --- TMP
+
+  %% ------------- multiply written tables
+  FACTS[("facts<br/>append-only, ts = valid-time<br/>correction sets voids_id")]:::multi
+  NOTES[("notes<br/>float32 blob, brute-force scan")]:::multi
+  TOOLS[("tools<br/>only status='enabled' executes")]:::multi
+
+  %% ------------- singly owned tables
+  REM[("reminders")]
+  NUD[("nudges — the restraint memory<br/>AND the only feedback input")]
+  VEC[("memory_vectors<br/>marked with the embedder id")]
+  PRES[("presence_state — singleton row")]
+  EV[("events")]
+  PROP[("proposed_routines")]
+  DIG[("digest_entries — gate-BLOCKED candidates")]
+  DEL[("delivery_attempts — the outbox")]
+  ACK[("ack_sends")]
+  DLGS[("dialogue_sessions — TTL 2m")]
+  TASKS[("tasks")]
+  LISTS[("list_items")]
+  RTR[("routing_traces — 14-day retention")]
+  RLB[("routing_labels")]
+  ETR[("ecosystem_traces")]
+  META[("meta — schema version + embedder marker")]
+
+  STORE --- FACTS & NOTES & TOOLS & REM & NUD & VEC & PRES & EV & PROP & DIG & DEL & ACK & DLGS & TASKS & LISTS & RTR & RLB & ETR & META
+
+  %% ------------- writers into facts
+  WF1["actionFact — tap:voice / tap:text"] --> FACTS
+  WF2["quiet toggle — config fact"] --> FACTS
+  WF3["mavpoll — poll:netdata, poll:uptimekuma,<br/>infer:wg, poll:zenmoney"] --> FACTS
+  WF4["mavcaldav — poll:caldav<br/>NOT DEPLOYED"]:::off -.-> FACTS
+  WF5["mavweb — /api/signal presence,<br/>/api/ambient meeting time"] --> FACTS
+  WF6["feed + crawl watermarks<br/>crawl:hash:*"] --> FACTS
+  WF7["fact-enrichment worker<br/>entity_id, resolution_state"] --> FACTS
+  WF8["tick loop tune()<br/>cooldown:<rule> feedback fact"] --> FACTS
+  WF9["mavweb /api/revert<br/>voids the latest fact for a key"] --> FACTS
+
+  %% ------------- writers into notes
+  WN1["actionNote"] --> NOTES
+  WN2["RSS poller — source rss:*"] --> NOTES
+  WN3["crawl watcher"] --> NOTES
+  WN4["meeting capture"]:::off -.-> NOTES
+  WN5["image description"]:::off -.-> NOTES
+  WN6["netscan record"] --> NOTES
+
+  %% ------------- writers into tools
+  WT1["seedTools from mavend.json"] --> TOOLS
+  WT2["MCP discovery — proposed"]:::off -.-> TOOLS
+  WT3["Home Assistant discovery<br/>proposed, always destructive"]:::off -.-> TOOLS
+  WT4["mavweb POST /tools<br/>the ONLY enable path"] --> TOOLS
+
+  %% ------------- readers
+  FACTS --> RD1["loop.Gatherer — the tick snapshot"]
+  FACTS --> RD2["queryFactByKey · money · history · morning"]
+  NOTES --> RD3["queryNotes · queryFeeds · recall"]
+  VEC --> RD4["queryMemory · queryEmbed"]
+  TOOLS --> RD5["tool.Matcher + tool.Executor"]
+  NUD --> RD6["restraint gate · TuneCooldown · UnackedTelegramRules"]
+
+  %% ------------- in-memory shared state
+  subgraph MEM["shared mutable state — process-local, no synchronisation boundary beyond a mutex"]
+    direction TB
+    CLS["clarifyStore<br/>per-reach stack · NOT persisted on purpose:<br/>a restart expires the open question"]
+    PEND["pending act / pendingRoutine / pendingHexis<br/>3 single-slot registers under handler.mu<br/>last-asked wins, TTL each"]
+    SURF["surfacedItems<br/>replaced by the next digest, NO TTL"]
+    RING["decision.Ring — bounded, diagnosis only"]
+    BUS["event.Bus — bounded journal, read surface only"]
+    TICKM["tickLoop: lastPhrase, lastTrace, digestQ,<br/>routineLast, morningLast, lastProposalAt"]
+    LASTR["lastRouted — the previous acted turn, for a spoken correction"]
+  end
+
+  H1["reactiveHandler<br/>one instance, called from per-conn goroutines"] --- CLS
+  H1 --- PEND
+  H1 --- SURF
+  H1 --- RING
+  H1 --- LASTR
+  TICKL["tickLoop"] --- TICKM
+  INTAKE["intakeAPI decorator"] --- BUS
+
+  %% ------------- outside the database
+  subgraph OUT["state outside the database"]
+    direction TB
+    PK[("passkeys.json<br/>OWNED BY mavweb, not mavend")]:::multi
+    WK[("wrapped key blob<br/>written by mavend WrapKeyFn,<br/>triggered by mavweb")]:::multi
+    MAIL[("mavmaild seen-UID file<br/>own volume · NOT DEPLOYED")]:::off
+    BLOB[("media blobs · retention loop")]:::off
+  end
+  PK -.->|"a v1 blob + this file together<br/>recover the database key with no authenticator"| WK
+
+  classDef multi fill:#4f2626,stroke:#e08080,color:#ffecec
+  classDef off fill:#3a3a3a,stroke:#888,color:#ccc,stroke-dasharray:4 3

docs/architecture/diagrams/05-dependency-boundary.mmd

@@ -0,0 +1,141 @@
+%% View 5 — Dependency and boundary map.
+%% Architectural components, not classes. Highlights the cycle, the cross-layer
+%% calls, the duplicated responsibilities, the fan-in and fan-out hotspots, the
+%% process and IPC boundaries, and where a failure propagates.
+%% Evidence: cmd/mavend/boot.go, cmd/mavend/tick_api.go, cmd/mavend/voice.go,
+%% cmd/mavend/voicewire.go, internal/ipc/server.go, internal/delivery/channel.go.
+flowchart TB
+
+  subgraph B1["process boundary — mavend"]
+    direction TB
+
+    subgraph L_EDGE["entry layer"]
+      IPCS["ipc.Server<br/>fan-in: 6 processes<br/>+ 8 bypass function fields"]
+      VSRV["voice.Server"]
+      HTTPIN["telegram poller"]
+    end
+
+    subgraph L_API["API layer"]
+      DAPI["daemonAPI<br/>store adapter + 8 closures"]
+      IAPI["intakeAPI decorator"]
+      SAPI["ipc.NewStoreAPI"]
+    end
+
+    subgraph L_TURN["turn layer"]
+      RH["reactiveHandler<br/>GOD COMPONENT<br/>34 fields · fan-out ≈ 20"]
+      TRT["turnRoute"]
+      PRE["pre-route ladder · 11 rungs"]
+      ATBL["actionHandlers · 7"]
+      QCH["querySources · 22"]
+    end
+
+    subgraph L_ROUTE["routing layer"]
+      RTR["router.Router cascade"]
+      G0["stage 0 grammars · 22+"]
+      HDS["routing heads"]
+      LLMR["LLM router"]
+      CLF["classifier"]
+    end
+
+    subgraph L_PROACT["proactive layer"]
+      TICK["tickLoop<br/>13 jobs, one function<br/>fan-out ≈ 10"]
+      GATH["loop.Gatherer"]
+      RULES["loop rules + gate · pure"]
+      DISP["delivery.Dispatcher"]
+    end
+
+    subgraph L_WIRE["construction layer"]
+      WIRE["wireVoice<br/>builds 17 subsystems<br/>returns voiceWiring"]
+      BOOT["boot.go<br/>newDaemonAPI + startBackground"]
+    end
+
+    subgraph L_STATE["state layer"]
+      ST[("store.Store")]
+    end
+  end
+
+  subgraph B2["process boundary — modules"]
+    MSTT["mavsttd"]
+    MTTS["mavttsd"]
+    MWEB["mavweb"]
+    MPOLL["mavpoll"]
+  end
+
+  subgraph B3["process boundary — workstation"]
+    MWAKE["mavwaked"]
+    MGPU["mavgpud"]
+  end
+
+  subgraph B4["external services"]
+    EXT["SearXNG · kiwix · Nexus · Praxis · Hexis<br/>Telegram · ntfy · Home Assistant"]
+  end
+
+  %% ---------- boundaries
+  MWEB -.->|"UNIX IPC · 3 conns"| IPCS
+  MPOLL -.->|"UNIX IPC"| IPCS
+  MWAKE -.->|"TCP over ssh · plaintext, no auth"| VSRV
+  MWEB -.->|"TCP · /api/ptt"| VSRV
+  RH -.->|"UNIX worker"| MSTT
+  RH -.->|"UNIX worker"| MTTS
+  RH -.->|"HTTP"| EXT
+  RH -.->|"HTTP"| MGPU
+  DISP -.->|"HTTP"| EXT
+
+  %% ---------- the cycle
+  IPCS --> DAPI
+  DAPI -->|"chatFn = handler.handleText"| RH
+  RH -->|"h.api, back-patched by upgradeAPI"| DAPI
+
+  DAPI --> IAPI --> SAPI --> ST
+
+  %% ---------- turn layer
+  VSRV --> RH
+  HTTPIN --> DAPI
+  RH --> TRT --> RTR
+  RH --> PRE --> TRT
+  RH --> ATBL --> QCH
+  QCH --> ST
+  ATBL --> ST
+  RTR --> G0 & HDS & LLMR & CLF
+
+  %% ---------- cross-layer calls
+  QCH -->|"CROSS-LAYER: a query source reads the tick loop"| TICK
+  RH -->|"CROSS-LAYER: dataStore, the raw store beside the CoreAPI"| ST
+  DAPI -->|"reads tick state"| TICK
+  WIRE --> RH
+  WIRE --> RTR
+  WIRE --> DISP
+  BOOT --> DAPI
+  BOOT --> TICK
+
+  %% ---------- proactive
+  TICK --> GATH --> ST
+  TICK --> RULES
+  TICK --> DISP
+  DISP --> ST
+  DISP -->|"voicesink pushes on the request conn"| VSRV
+
+  %% ---------- annotations
+  DUP1["DUPLICATED RESPONSIBILITY<br/>two independent arbitrations decide a turn:<br/>the 22-grammar cascade, then the 22-source chain.<br/>Both are ordered lists; neither can compare scores."]:::note
+  DUP1 -.- RTR
+  DUP1 -.- QCH
+
+  DUP2["DUPLICATED RESPONSIBILITY<br/>restraint is decided twice:<br/>loop.Gate says whether a rule EMITS,<br/>delivery.ChannelsFor says where it LANDS.<br/>Deliberate, and documented in channel.go."]:::note
+  DUP2 -.- RULES
+  DUP2 -.- DISP
+
+  DUP3["DUPLICATED RESPONSIBILITY<br/>three unrelated components propose tool rows:<br/>config seeding, MCP discovery, HA discovery."]:::note
+  DUP3 -.- ST
+
+  FRAG1["FRAGILE PATH<br/>4 seams degrade silently:<br/>workstation model → resident model,<br/>CW2 → mavsttd, heads → LLM → classifier,<br/>search → kiwix → weights.<br/>Nothing on the turn says which one answered."]:::warn
+  FRAG1 -.- RTR
+  FRAG1 -.- QCH
+
+  FRAG2["FAILURE PROPAGATION<br/>ipc.Server holds long-lived conns from 4 modules.<br/>Before V-638 that deadlocked EVERY shutdown and<br/>the deployed ciphertext went 11 days stale."]:::warn
+  FRAG2 -.- IPCS
+
+  FRAG3["PLANNED, UNWIRED<br/>internal/claim + router.ClaimOf: a comparable<br/>unit of evidence for exactly the two arbitrations above.<br/>Nothing calls it. internal/modes: nothing imports it."]:::warn
+  FRAG3 -.- RTR
+
+  classDef note fill:#2a3f2a,stroke:#7fbf7f,color:#eaffea
+  classDef warn fill:#4f2626,stroke:#e08080,color:#ffecec

docs/architecture/findings.md

@@ -0,0 +1,699 @@
+# Architecture findings: Maven as built
+
+Read at commit `5cae33a`, 2026-08-25. Working tree dirty: `deploy/mavend.json`
+swaps `phraser.model_path` to `maven-instruct-b2-Q4_K_XL.gguf`, plus an edited
+`docs/evals/CLAUDE.md` and two untracked files.
+
+This file is analysis. The factual inventory is
+`docs/architecture/maven-architecture.json` and the diagrams under
+`docs/architecture/diagrams/`. Nothing here proposes a new architecture.
+
+**Revised 2026-08-25 after an independent second pass over the evidence pack.**
+Four readings changed, and section 6.3 contained one statement that was wrong:
+the voice server defaults an empty `Surface`, it does not overwrite the client's.
+The sections marked below carry the corrections.
+
+**The ranking changed with them.** The missing end-to-end authority model
+(6.3 through 6.3d) is the first architectural issue, ahead of `reactiveHandler`
+size (4.1) and the process boundaries (section 5). Those are refactors. This one
+is a property nobody can state.
+
+Each finding cites what it was read from. Where the repository already names a
+problem in its own comments, that is said. A known defect and an undiscovered
+one are different facts.
+
+---
+
+## 1. Unclear ownership
+
+### 1.1 The `facts` table has nine writers and no owner
+
+`internal/store/schema.sql` calls facts "substrate, all observations". Nine
+components append to it, and no component owns the key namespace:
+
+| Writer | Source tag | Evidence |
+|---|---|---|
+| `actionFact` | `tap:voice`, `tap:text` | `cmd/mavend/actions_fact.go` |
+| quiet-hours toggle | `config` | `cmd/mavend/quiet_toggle.go` |
+| mavpoll | `poll:netdata`, `poll:uptimekuma`, `infer:wg`, `poll:zenmoney` | `cmd/mavpoll/main.go` |
+| mavcaldav | `poll:caldav` | `cmd/mavcaldav/main.go`, not deployed |
+| mavweb | presence, ambient meeting time | `cmd/mavweb/facts.go`, `cmd/mavweb/ambient.go` |
+| feed worker | RSS watermark | `cmd/mavend/feeds.go` |
+| crawl worker | `crawl:hash:<name>` | `cmd/mavend/crawls.go` `hashKey` |
+| fact-enrichment worker | mutates `entity_id`, `resolution_state` | `cmd/mavend/factenrichment.go` |
+| tick loop autotune | `cooldown:<rule>` | `cmd/mavend/tick.go` `tune`, `internal/loop/feedback.go` `FeedbackKey` |
+
+Two of these are not observations at all. `crawl:hash:*` is a fetch watermark
+and `cooldown:<rule>` is a tuning parameter. Both live in the same append-only
+table that recall embeds and that `queryFactByKey` reads back as an answer. The
+`source` column is what keeps them apart, and it is a convention, not a
+constraint: `schema.sql` documents the vocabulary in a comment and the `CHECK`
+covers only `kind`.
+
+### 1.2 `notes` has six writers and one of them is a LAN scan
+
+`cmd/mavend/netscan.go` `writeScanRecord` writes a scan result as a note. Notes
+are the recall corpus: `queryNotes` and `queryMemory` answer from them. So a
+network scan record competes by cosine similarity with things he said.
+
+### 1.3 `tools` is proposed by three unrelated components
+
+Config seeding (`seedTools`), MCP discovery (`cmd/mavend/mcp.go` `propose`) and
+Home Assistant discovery (`cmd/mavend/smarthome.go` `propose`) all write rows.
+Only `mavweb` `POST /tools` can enable one, which is the invariant that holds.
+But nothing arbitrates a name collision between the three proposers, and
+`tools.name` is the primary key.
+
+### 1.4 The day plan has no store and two owners
+
+`queryDayPlan` is a query source. The day plan it reads is assembled by the tick
+loop (`cmd/mavend/tick_morning.go` `dayPlan`). The bare store adapter cannot
+answer it, which is why `upgradeAPI` exists at all (finding 3.1). So a read of
+his calendar depends on a proactive scheduler being wired.
+
+---
+
+## 2. Duplicated responsibilities
+
+### 2.1 Two independent arbitrations decide one turn
+
+The cascade sorts an utterance into one of seven intents through four arms
+(`internal/router/router.go` `Route`). An `IntentQuery` then enters a second
+arbitration of twenty-two ordered sources (`cmd/mavend/actions_query.go`
+`querySources`, counted in the source). Both are ordered lists. Neither can
+compare scores across arms.
+
+The repository states this itself, in `internal/router/source.go`:
+
+> The cascade sorted an utterance into one of seven intents with stage 0 rules,
+> the resident model and the classifier behind it, a fixture measuring it and
+> the decision trace recording it. Then IntentQuery handed the turn to
+> querySources in the daemon, a chain of twenty-two branches deciding by seed
+> similarity in a fixed order, with none of that.
+
+`Source` and `queryWalk` narrow the second arbitration with a decision from the
+first. They do not merge the two.
+
+### 2.2 A third arbitration runs before both
+
+`runTurn` steps 1 through 5e are eleven stateful pre-emptors, each answering "is
+this mine?" alone (`cmd/mavend/voice.go`, `preRouteLadder` in
+`cmd/mavend/decisiontrace.go`). Their order is argued rung by rung in comments.
+That is three ordered lists deciding one utterance, in three files, with three
+different notions of confidence.
+
+`internal/claim/claim.go` names exactly this and counts it:
+
+> Maven's cascade has twenty-two stage-0 grammars, seven router intents,
+> twenty-two query sources and seven stateful pre-emptors, and every one of them
+> answers "is this mine?" alone. None can answer "is this more mine than
+> yours?" … So list order is the whole arbitration.
+
+The unit that would fix it is written, tested and called by nothing. See 6.1.
+
+### 2.3 Restraint is decided twice, deliberately
+
+`internal/loop/loop.go` `Gate` decides whether a rule emits.
+`internal/delivery/channel.go` `ChannelsFor` decides where it lands, and drops
+care nudges on away for its own reasons. `channel.go` argues the duplication:
+
+> double authority is intentional: the gate decides whether a rule EMITS;
+> delivery decides where it LANDS.
+
+Recorded here as duplication that is owned, not as a defect.
+
+### 2.4 Two digest mechanisms with the same word in the name
+
+`tickLoop.digestQ` is an in-memory queue batching candidates the gate **allowed**.
+`digest_entries` is a table durably holding candidates the gate **blocked**. Both
+are flushed in the same `tick()` body, six lines apart
+(`cmd/mavend/tick_digest.go`). The distinction is carried entirely by a comment.
+
+---
+
+## 3. Accidental coupling
+
+### 3.1 A construction cycle between the API layer and the turn layer
+
+Two back-patches, each documented, together forming a cycle:
+
+- `cmd/mavend/boot.go`: `api.chatFn = d.voiceW.handler.handleText`
+- `cmd/mavend/voice.go` `upgradeAPI`: `h.api = api`, the daemon's own CoreAPI
+
+So `daemonAPI` holds the handler and the handler holds `daemonAPI`. The comment
+on `upgradeAPI` states the reason and the safety argument:
+
+> Wiring order forces this. wireVoice runs before the tick loop exists … main
+> already back-patches the other direction … this is the same seam in reverse.
+> Safe against the obvious loop: nothing in the voice path calls api.Chat.
+
+The safety rests on a negative that nothing enforces. Adding a query source that
+calls `api.Chat` would recurse.
+
+### 3.2 The handler holds the raw store beside the mediated one
+
+`reactiveHandler` carries both `api ipc.CoreAPI` and
+`dataStore *store.Store`, "direct store access for event extraction + pattern
+detection" (`cmd/mavend/voice.go`). `internal/ipc/frame.go` states the opposing
+rule for the boundary:
+
+> Core mediates, never hands back a db handle … Anything needing raw db access
+> lives in core and is unreachable.
+
+That holds across the process boundary and not inside it. The turn path has two
+ways to reach the same tables, with different auditing.
+
+### 3.3 The intake journal is bypassed by the one path that needed it
+
+`cmd/mavend/intake.go` decorates `CoreAPI` so every intake write narrates
+itself, and names its own exception:
+
+> The exception is cmd/mavend/mail.go, which reaches past the interface to
+> st.CaptureTask directly. It publishes explicitly.
+
+One caller reaching past a decorator means the decorator is not the boundary it
+claims to be.
+
+### 3.4 A query source reads the proactive scheduler
+
+`queryDayPlan` → `tickLoop.dayPlan`. The reactive and proactive halves otherwise
+share only the store. This is the single call across that line, and it is the
+reason for the `upgradeAPI` back-patch in 3.1.
+
+---
+
+## 4. God components
+
+### 4.1 `reactiveHandler` has 34 fields
+
+`cmd/mavend/voice.go:75`. One struct holds stt, tts, the router, the CoreAPI,
+the raw store, the tool executor and matcher, the phraser, the replier, the
+recall wiring, the crawler, the search client, the Kiwix client, the feeds flag,
+the Home Assistant wiring, the LAN scanner, the weather provider and its default
+location, the time parser, the dialogue session store, the decision ring, the
+trace writer, the encoder id, the clarify store and its attempt cap, the
+extractor, a mutex, `lastRouted`, three pending-confirmation registers,
+`surfacedItems`, and the ecosystem clients.
+
+`docs/handler-wiring.md` exists because grouping five of these into `recall`
+was itself a task (Vikunja #433).
+
+Every query source, every action handler and every pre-route resolver is a
+method on this one type. There is no seam between "the thing that routes a
+turn" and "the thing that knows the house is a Home Assistant".
+
+### 4.2 `runTurn` is one function with eleven early returns
+
+`cmd/mavend/voice.go:270`, about 226 lines. Two deferred finalisers, six numbered
+steps with lettered sub-steps up to `5e`, and an explicit statement that the
+ordering is load-bearing. Eleven of the returns are `return withNotice(...)`
+from a pre-emptor.
+
+### 4.3 `tick` runs thirteen jobs in one function
+
+`cmd/mavend/tick.go:160`. Gather, save presence, pick a candidate, queue or
+phrase-and-dispatch, flush the digest, enqueue gate-suppressed candidates,
+expire stale digest, drain digest, fire routines, fire accepted routines, fire
+morning routines, detect patterns, deliver reminders, repeat un-acked sev4
+alarms. One 60s ticker drives all of it, so a slow phraser call delays every job
+after it.
+
+### 4.4 `wireVoice` is one constructor for seventeen subsystems
+
+`cmd/mavend/voicewire.go:108`, about 270 lines, returning a `voiceWiring` struct
+whose fields the rest of the daemon reaches into (`embedderOf`, `nexusOf`,
+`d.voiceW.mcp`, `d.voiceW.home`, `d.voiceW.server`, `d.voiceW.handler`).
+
+---
+
+## 5. Process boundaries
+
+### 5.1 Unnecessary: `mavsttd` and `mavttsd` at current scale
+
+Both are justified in their own headers as "restart-free, key-free,
+fail-independent". Both run in the same container image, on the same host, as
+the same user, over a socket in a shared volume, and both are hard dependencies
+of a turn: `HandlePushToTalk` returns an error reply when either is unavailable.
+The key argument is real but partial. `internal/ipc/frame.go` says "a crashing
+tts can't read the key page", and the same holds for any goroutine that never
+touches the key.
+
+The boundary earns itself for a different reason the docs do not lead with:
+whisper.cpp and piper are cgo and subprocess dependencies, so an in-process
+crash would be a daemon crash. Recorded as a boundary whose stated reason and
+real reason differ.
+
+### 5.2 Unnecessary: three IPC connections from one process
+
+`cmd/mavweb/main.go` opens `core`, `swapConn` and `turnConn` to the same socket,
+because `ipc.Client` serialises every call on one mutex and a model swap or a
+chat turn would otherwise freeze every page. The comments say so. Connection
+count is standing in for request concurrency.
+
+### 5.3 Missing: the turn path and the tick loop are one process
+
+They share `store.Store` at `SetMaxOpenConns(1)`, one `phraser.Phraser` and one
+`llm.Gate`. A reminder being phrased and a spoken turn being answered contend
+for the same llama-server through `internal/llm/gate.go`. Nothing isolates a
+foreground turn from a background job beyond that gate.
+
+### 5.4 Missing: the act executor runs in the key holder
+
+`internal/tool/tool.go:238` is `exec.CommandContext(ctx, argv[0], argv[1:]...)`,
+running inside mavend, the only process holding the database key.
+`deploy/mavend.json` seeds twelve rows, five of them destructive, including
+`systemctl restart`, `docker restart` and `systemctl reboot`.
+
+The controls are the enabled allowlist, the risk tier (6.3b) and the confirm
+turn. The process boundary is not one of them. `internal/tool/risk.go:84` says
+so directly: "It is not a sandbox and it does not try to be one. An enabled row
+can already run anything the daemon's user can run."
+
+### 5.5 The one boundary that is load-bearing and undefended by itself
+
+The voice TCP wire is plaintext with no auth (`internal/voice/server.go`). Its
+security argument is entirely external: loopback publish plus an ssh tunnel
+(`docker-compose.yml` `ports: ["127.0.0.1:9110:9100"]`,
+`deploy/mavwaked.service` `Requires=maven-voice-tunnel.service`). Correct, and
+it means a single compose edit silently removes the whole control.
+
+---
+
+## 6. Implementation disagreeing with apparent responsibility
+
+### 6.1 `internal/claim` and `router.ClaimOf` are called by nothing
+
+`internal/router/claim.go` says so in its own doc comment:
+
+> Nothing in Route calls this yet. The arbiter that reads claims is V-560.
+
+V-560 landed as `turnRoute` (memoise the route), not as an arbiter. The package
+and its `router` adapter are complete and tested and are on no path.
+
+### 6.2 `internal/modes` is imported by nothing outside itself
+
+`grep -rn "internal/modes"` over `cmd/` and `internal/` returns only its own
+test. It describes itself as "the roughly thirty distinct downstream behaviours
+mavend has". That is an inventory of the very thing findings 2.1 and 2.2 are
+about.
+
+### 6.3 The auth tier system does not bind the turn path
+
+`internal/auth/tier.go` documents "voice can never reach EnableTool, not
+because we check the method, but because the surface can't carry the layer",
+and `MaxLayer(SurfaceVoice)` returns `Layer0`. `cmd/mavwaked/main.go:275` duly
+sends `Surface: voice.SurfaceVoice` on the wire.
+
+Nothing in `cmd/mavend` reads it. `grep -rn "internal/auth" cmd/ internal/`
+outside tests returns `cmd/mavend/main.go` (building the IPC `Gate`),
+`cmd/mavweb/webauthn.go`, `internal/webauthn/session.go` and
+`internal/voice/wire.go` (type aliases only). `actionAct`
+(`cmd/mavend/actions_act.go`) contains no surface check.
+
+**Two representations of reach exist, and both are ignored.** An earlier draft
+of this file said the server overwrites the client's value. It does not.
+
+1. **Client-asserted, and it survives.** `internal/voice/server.go:198` reads
+   `if p.Surface == "" { p.Surface = SurfacePCClient }`. That defaults an empty
+   field. `mavwaked`'s `SurfaceVoice` arrives intact and reaches
+   `HandlePushToTalk`, which ignores it (`cmd/mavend/voice.go:200`, the
+   parameter is `req` and only `req.Audio` is read).
+2. **Server-created, and it is wrong.** `internal/voice/server.go:148` is
+   `sess := s.sessions.Add(c, SurfacePCClient)`, hardcoded for every connection
+   whatever the peer is. Nothing reads that either.
+
+The consequence matters more than the finding. `req.Surface` is request payload
+on a plaintext wire with no auth, so **any voice-wire client can claim
+`"pc_client"`**. It must not become an authorization input as it stands. A reach
+has to be derived from the transport or the session, never trusted from the
+body.
+
+`auth.Can` runs only in `ipc.Server.Check`, and `FloorEnrollment` maps every
+same-uid caller there to `SurfaceCoreProcess` / `Layer3`
+(`internal/auth/enrollment.go:65`).
+
+The comments in `cmd/mavwaked/main.go`, `deploy/mavwaked.service` and
+`CLAUDE.md` all present "SurfaceVoice caps acts at L0" as a live control. On the
+reactive turn path, `internal/auth` is not what enforces it. Finding 6.3b is.
+
+### 6.3b There is a second tier system, it is live, and it is not keyed on the reach
+
+`internal/tool/risk.go` carries its own two-axis policy, and this one runs on
+every act:
+
+```go
+policy := PolicyFor(RiskOf(t))          // internal/tool/tool.go:181
+if !policy.VoiceMayRun { return "", ErrNeedsAuthedSurface }
+if policy.Confirm && !confirmed { return "", ErrNeedsConfirm }
+```
+
+`RiskOf` sorts a row into `TierSafe`, `TierDestructive` or `TierIrreversible`.
+`PolicyFor` maps those to `{Confirm:false, VoiceMayRun:true}`,
+`{Confirm:true, VoiceMayRun:true}` and `{Confirm:true, VoiceMayRun:false}`
+(`internal/tool/risk.go:69`). So the control that actually stops an act is real,
+well argued, and fails safe on an unknown shape.
+
+Two observations about it:
+
+1. **`VoiceMayRun` is not conditioned on voice.** `Executor.Exec` takes
+   `(ctx, name, args, confirmed)` and no surface. The same policy is applied to
+   the mic, to telegram inbound and to `POST /api/chat` on the authed page. A
+   field named for a reach is evaluated identically for every reach.
+2. **`systemctl reboot` is `TierDestructive`, not `TierIrreversible`.**
+   `irreversibleVerbs` (`internal/tool/risk.go:88`) lists `rm`, `mkfs`, `dd`,
+   `prune`, `truncate` and eleven more. `reboot` is not among them, and
+   `deploy/mavend.json` seeds it as an enabled row with `destructive: true`. So
+   it runs on the reactive path after one spoken "да", which is exactly what
+   `PolicyFor(TierDestructive)` says and is worth stating out loud.
+
+So the repository has two tier systems: `Surface × Layer` in `internal/auth`,
+unread on the turn path, and `Risk × Policy` in `internal/tool`, live.
+
+They are **not two implementations of one idea**, which is how an earlier draft
+of this file read. They are two orthogonal dimensions that never meet. `auth`
+answers who or where may carry what authority. `tool` answers what effect a
+capability has and what proof it demands. The decision that combines them does
+not exist anywhere.
+
+That both dimensions are also thin today makes the gap easier to see:
+
+- `FloorEnrollment.Lookup` maps **every** same-uid IPC caller to
+  `SurfaceCoreProcess` (`internal/auth/enrollment.go:65`), so the process-radius
+  distinction behind IPC is a future contract, not a live one.
+- `PasskeySession` is one global timestamp. `CurrentLayer` and `Assert` both
+  take a `Scope` and both ignore it (`internal/webauthn/session.go:38` and
+  `:62`), so step-up is per-daemon rather than per-scope.
+
+### 6.3c The act policy is more distributed than one gate
+
+`RiskOf → PolicyFor → Executor.Exec` is one of three act paths, not the act
+path.
+
+| path | risk policy? | evidence |
+|---|---|---|
+| local tool row | yes | `internal/tool/tool.go:181` |
+| Hexis capability | yes, explicitly reused | `cmd/mavend/ecosystem_acts.go:768` `tool.RiskOfCapability` then `tool.PolicyFor` |
+| Praxis lifecycle | **no** | `cmd/mavend/ecosystem_acts.go:158` `praxisItemAction.handle` calls `a.call(ctx, px, id)` directly |
+
+Acknowledge, resolve, ignore and pin are remote mutations that run on first
+hearing, with no tier and no confirm turn. They are reversible on the Praxis
+side, which is a reason, and it is a reason nothing in the code states.
+
+`Exec` also has no proof that its `confirmed bool` was bound correctly. The
+invariant that a confirmation names one capability, one target and an expiry
+lives in `pendingAct` and `resolveConfirm` (`cmd/mavend/confirm.go`), not at the
+boundary that acts on it. `Exec` trusts the boolean because only two callers
+exist today.
+
+So the authorization function is spread across origin handling, routing, parked
+confirm state, risk classification, allowlist state and execution. Section
+"The authorization function as implemented" in `README.md` writes down the part
+that is one expression. The rest is not.
+
+### 6.3d `Claim.Coverage` returns 1.0 for a claim that extracted nothing
+
+`ClaimOf` builds its consumed span from `claimSpans`, which includes
+`d.Slots.Text` unconditionally (`internal/router/claim.go:38`).
+`Router.fillSlots` backfills the raw utterance into `Text` for a note, a query
+and a chat turn (`internal/router/router.go:334`, `if d.Slots.Text == "" &&
+d.Intent != IntentReminder`).
+
+`claim.Split` then marks every token of the utterance explained, and
+`Coverage()` is `len(Consumed) / total` (`internal/claim/claim.go:122`). A query
+claim that extracted nothing scores 1.0, and `MoreSpecificThan` reads coverage
+first.
+
+`filledSlots` in the same file already knows about this: it counts `Text` "only
+when it differs from the whole utterance". `claimSpans`, four functions above
+it, does not.
+
+`internal/router/claim_test.go` does not catch it. All five cases in
+`TestClaimOfBands` set `Text` equal to `Utterance`, and the test asserts `Band`
+only. Coverage is never asserted anywhere.
+
+This is why `internal/claim` is not yet an answer to "what competes for a turn".
+It is the beginning of a vocabulary. It also has no production callers, no
+builders for query sources or pre-route claimants, and it identifies only the
+seven-intent destination rather than the roughly thirty behaviours
+`internal/modes` enumerates. Keeping it unwired is the right state until that is
+resolved, and the file's own comment already warns against it becoming a fourth
+arbitration layer.
+
+### 6.4 Two query sources do not do what their names say
+
+Two of the twenty-two "query sources" have side effects or read a different
+substrate than their name implies. `queryNetwork` triggers a live LAN scan
+inside a read path (`cmd/mavend/netscan.go` `scanSummary`), and the scan writes
+a note.
+
+### 6.5 `actionFact` answers queries and chat
+
+`cmd/mavend/actions_fact.go` re-routes a question-shaped utterance into
+`actionQuery` and a complaint into `actionChat`. Both re-routes are argued and
+correct in effect. The consequence is that the fact handler is one of three
+entry points into the query chain.
+
+### 6.6 `mavgpud`'s model arm is off and its STT arm is on
+
+`deploy/mavend.json` sets `workstation.model_disabled: true` while
+`workstation.stt` is live. One config block, two independently authenticated
+services, one flag that turns off half of it. The block's own comment explains
+this. A reader of the topology would not guess it.
+
+---
+
+## 7. Hidden shared state
+
+### 7.1 Six context keys carry per-turn state
+
+`querySourceKey`, `turnRouteKey`, `dialogueKey`, `ecosystemCorrelationKey`,
+`traceIDKey` (all `cmd/mavend/`), and `recorderKey`
+(`internal/decision/decision.go`). Plus `callerKey` in `internal/ipc/api.go`.
+
+Every one is invisible in a function signature. `turnRouteFrom` returns nil
+"when the caller is not inside runTurn, a unit test calling one resolver
+directly, most often". That is the shape of the problem: a resolver behaves
+differently depending on invisible context.
+
+### 7.2 Three single-slot confirmation registers under one mutex
+
+`reactiveHandler.pending`, `pendingRoutine`, `pendingHexis`
+(`cmd/mavend/voice.go:170-180`). The comment states the posture: "single slot,
+single-user box, a second act while one waits overwrites it (last-asked wins)".
+Three separate registers, one shared mutex, and the pre-route ladder decides
+between them by position rather than by comparing them.
+
+### 7.3 `surfacedItems` has no TTL
+
+Same struct. The comment argues it: a stale position resolves to an item Praxis
+reports as already acknowledged, "which is a harmless answer, unlike a stale
+confirmation". That is correct given Praxis is the arbiter. It also means an
+ordinal can refer to a list read out an arbitrarily long time ago.
+
+### 7.4 The tick loop's memory is in-process and unbounded in one place
+
+`tickLoop.lastPhrase` is a `map[string]delivery.PhrasedNudge` keyed by rule
+name, and rules are a fixed set, so it is bounded. `digestQ` is a slice with a
+config `MaxItems`. `lastProposalAt` is deliberately not persisted: "a restart is
+allowed to permit one more announcement".
+
+### 7.5 The clarify store is deliberately not persisted, while the dialogue store is
+
+`cmd/mavend/voicewire.go`: `dialogue.NewPersistentSessionStore` for follow-up
+slots, `dialogue.NewClarifyStore` for the parked question. The reasoning is
+recorded (Vikunja #385). The consequence is that a restart mid-clarify silently
+drops a request the user believes is parked, and the "expired clarify notice"
+path in `runTurn` step 1 cannot fire for it, because the store it reads is gone
+too.
+
+---
+
+## 8. Fragile request paths
+
+### 8.1 Four silent degradations stacked on one turn
+
+| Seam | Falls back to | Told to the user? |
+|---|---|---|
+| workstation model → resident model | `internal/llm/remote.go` `Pair.Complete` | no, by design (`docs/offload.md`) |
+| CW2 → mavsttd | `cmd/mavend/voicewire.go` `sttSeam` | no |
+| routing heads → LLM router → classifier | `internal/router/router.go` | no |
+| search → kiwix → named page → model weights | `cmd/mavend/actions_query.go` | no |
+
+Each is individually argued. Together, a single answer can be the resident model
+routing a worse transcript with the classifier as a floor and answering from its
+own weights, and nothing in the reply distinguishes that from the best case. The
+only instrument is the decision record and the query-source log line.
+
+### 8.2 The reminder path depends on a table nobody writes
+
+`queryCalendar` reads `facts(kind=env, source=caldav:*)`, and `mavcaldav` is
+commented out in `docker-compose.yml`. `loop.State.CalendarBusy` reads the same
+facts, so the "do not nag mid-meeting" suppressor is permanently false. The
+compose comment says both of these explicitly, which makes it a known gap rather
+than a hidden one.
+
+### 8.3 Recurring reminders have storage, an IPC parameter, and no caller
+
+`reminders.cron` and `reminders.next_fire_ts` exist since migration #2
+(`internal/store/migrations.go`). `ipc.CreateReminder` takes a cron argument.
+`actionReminder` passes `""`. Nothing on the spoken path can create one.
+
+### 8.4 Shutdown is a known past failure with a bounded workaround
+
+`cmd/mavend/main.go` carries the history: long-lived module connections
+deadlocked every shutdown, `run()` never returned, `defer st.Close()` never
+sealed, and "the deployed ciphertext was eleven days stale before anyone
+noticed". The fix is `workerGrace = 4 * time.Second` plus tracked connections.
+A worker parked in a model call still loses its tick, and the seal proceeds
+without it.
+
+### 8.5 One inbound worker is outside the assertable worker set
+
+`backgroundWorkers` in `cmd/mavend/boot.go` exists so "a test can compare the
+set the two paths would start without standing a daemon up". `wireTelegramIntake`
+starts its poller with `wg.Add(1)` and a bare goroutine
+(`cmd/mavend/telegramintake.go:41`), so it is not in that set. It is at least on
+the outer `WaitGroup`, unlike the seven workers V-639 fixed.
+
+### 8.6 The daemon is wired twice, in two places
+
+`run()` wires everything at boot. `srv.UnlockFn` wires everything again after a
+passkey assertion. `boot.go` exists because those two lists had already drifted:
+"seven workers started untracked on the unlock path and two daemonAPI fields
+were never set there, silently". Both paths now funnel through `newDaemonAPI`
+and `startBackground`. But `wireRules`, `wireGatherer`, `wirePhraser`,
+`wireEcosystem`, `wireVoice`, `wireDispatcher`, `wireTickLoop`, the four worker
+constructors, `wireMailIntake`, `wireModelSwap`, `wireTelegramIntake`,
+`wireVision`, `wireCapture` and `wireSpeaker` are still listed twice, by hand,
+in the same file.
+
+---
+
+## 9. Difficult-to-test boundaries
+
+### 9.1 A resolver's behaviour depends on invisible context
+
+See 7.1. `turnRouteFrom(ctx)` returning nil is the documented test case, and it
+changes what the resolver does.
+
+### 9.2 The single-instance handler is the unit under test for ~60 behaviours
+
+Twenty-two query sources, seven action handlers, eleven pre-route resolvers and
+the recall gate are all methods on `*reactiveHandler`. Testing one requires
+constructing a struct with 34 fields, most of them nil.
+
+### 9.3 The static gates pass against a baseline, and the baseline records the debt
+
+`scripts/analyzers/deadcode.baseline` accepts thirteen unreachable symbols,
+eleven of them from the 2026-08-10 audit (V-686), with three marked as
+"must stay". `make audit` is a git-grep inventory and is explicitly not a
+reachability check (`CLAUDE.md`).
+
+### 9.4 Measurement needs weights that are not in the tree
+
+`make t` self-skips the four `TestONNX*` measurements without `MAVEN_ONNX_LIB`,
+and still prints `ok` (`CLAUDE.md`). The routing heads, the embedder, silero and
+the keyword head are all ONNX files under `models/`, bind-mounted from
+`/mnt/hdd1/llms` in the case of the gguf. A checkout alone cannot reproduce a
+routing measurement.
+
+### 9.5 Only 5 of 51 spec entries cite a scenario that exists
+
+Recorded in the previous session's handoff, from `docs/spec.md` and
+`cmd/mavend/testdata/scenarios/`. Not re-verified here.
+
+---
+
+## 10. Excessive fan-in and fan-out
+
+**Fan-in.** `ipc.Server` is reached by six processes (mavweb ×3 connections,
+mavpoll, mavcaldav, mavmaild, mavupdate, e2eprobe) and carries eight function
+fields that bypass `CoreAPI` entirely: `StepUp`, `UnlockFn`, `WrapKeyFn`,
+`IngestMailFn`, `SwapModelFn`, `ModelStatusFn`, `DescribeImageFn` and the four
+`Capture*` fields. Each is nil unless its config block exists, so the wire
+surface of the daemon depends on `deploy/mavend.json`.
+
+**Fan-out.** `reactiveHandler` reaches roughly twenty distinct subsystems
+(4.1). `tickLoop` reaches ten (4.3). `wireVoice` constructs seventeen (4.4).
+
+**Failure propagation.** The store is the shared point: `SetMaxOpenConns(1)`
+means every writer in the daemon and every module over IPC serialises through
+one connection. The measurement backing that cap is
+`docs/evals/2026-08-07-store-connection-cap.md` (V-642), cited in
+`internal/ipc/server.go` and not re-run here.
+
+---
+
+## 11. What is dark, and what that costs
+
+Sixteen components are wired in code and off in the deployed configuration:
+`ntfy`, `zenmoney`, Home Assistant, MCP, the weather provider, the workstation
+model arm, vision, meeting capture, speaker identification, mail intake, model
+swap, memory evaluation, and the `mavcaldav` and `mavmaild` services.
+
+Three of these have a visible cost:
+
+1. **ntfy disabled** means the away reach is telegram alone, through a SOCKS
+   relay, through `api.telegram.org`. `deploy/mavend.json` documents that this
+   was exactly the fragility ntfy was added to remove: "three things in series
+   that have each failed once, and when they do a sev4 nudge has nowhere to go."
+2. **mavcaldav absent** disables both the calendar answer and the busy
+   suppressor (8.2).
+3. **The weather provider is a stub.** `wireVoice` selects Open-Meteo only when
+   `cfg.Voice.Weather.Provider == "open-meteo"`, and the deployed `voice` block
+   has no `weather` key at all. `weather` is nevertheless a live query source with
+   `guesses: true`, so it can claim a turn and answer it from a stub.
+
+---
+
+# Questions the current architecture raises
+
+1. **Which of the three ordered lists is the arbiter?** Stage 0 grammars, the
+   query-source chain and the pre-route ladder each decide by position. If
+   `internal/claim` is the answer, what stops it being a fourth list rather than
+   the thing that collapses the other three?
+
+2. **Where is the one point that decides whether this authenticated origin may
+   perform this specific effect using this specific evidence?** Today there is
+   no such point. `reboot` shows why the question is not "which tier system
+   wins": it is correctly classified as not irreversible, and that does not
+   imply a room microphone plus "да" should carry reboot authority.
+   Reversibility, effect severity, reach authority and confirmation strength are
+   four dimensions, and `TierDestructive → VoiceMayRun:true` collapses them into
+   one.
+
+3. **What owns the `facts` key namespace?** Nine writers, two of which store
+   watermarks and tuning parameters in the table that recall embeds. Is `source`
+   meant to be a partition, and if so what enforces it?
+
+4. **Should the executor live in the key holder?** `systemctl reboot` is a
+   seeded, enabled row in a process holding the unlocked database. The controls
+   are an allowlist and a spoken confirm. Is that the intended trust boundary,
+   or the one that happened?
+
+5. **Should the tick loop and the turn path share one llama-server?**
+   `internal/llm/gate.go` exists to arbitrate them. What is the acceptable
+   latency a foreground turn may pay for a background nudge being phrased?
+
+6. **Is a silent four-level degradation still honest?** Each fallback is argued
+   separately. Nothing tells the user when all four fire at once. The M1 honesty
+   milestone in `docs/roadmap.md` is about the turn path. Does it cover this?
+
+7. **What is `docker-compose.yml` the source of truth for?** Two complete
+   services are commented out in it with their reasoning, and one of them
+   silently disables two behaviours elsewhere. Should absence be expressible in
+   `deploy/mavend.json` where the rest of the capability switches live?
+
+8. **Why is the daemon wired twice?** `boot.go` fixed the drift that had already
+   happened. Fifteen `wire*` calls are still listed by hand on both paths. Is
+   cold-start unlock worth a second wiring path, or should the locked daemon
+   wire everything and gate at the `Check` hook alone?
+
+9. **What is a query source allowed to do?** One triggers a live LAN scan and
+   writes a note. If a source may have side effects, what does "first source to
+   claim answers the turn" guarantee about the sources that ran before it?
+
+10. **Is `mavsttd`/`mavttsd`'s process boundary about the key or about cgo?**
+    The stated reason is key isolation. The operative reason looks like crash
+    isolation from cgo and subprocesses. Which one governs whether the next
+    model caller gets its own process?

docs/architecture/pack_evidence.sh

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+# Build maven-evidence.zip: the architecture package plus the source seams a
+# reviewer needs to test its claims, and nothing else.
+#
+#   sh docs/architecture/pack_evidence.sh
+#
+# Three rules this script exists to enforce:
+#
+#   1. Whole files, never snippets. A cut-down file loses the call path that
+#      makes a claim checkable, which is the whole point of sending source.
+#   2. Allowlist, not denylist. Paths are named one by one below. A denylist
+#      ships whatever nobody thought to exclude, and this tree has a database
+#      key in it.
+#   3. Refuse rather than warn. The scan at the end aborts on a hit instead of
+#      printing something a tired person scrolls past.
+#
+# The one file that is not verbatim is docker-compose.yml. It carries a live
+# uptime-kuma API key, so a redacted copy goes in its place and the redaction is
+# recorded in architecture-evidence.txt and printed here.
+set -euo pipefail
+
+here=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+root=$(CDPATH= cd -- "$here/../.." && pwd)
+cd "$root"
+
+out=maven-evidence.zip
+stage=$(mktemp -d)
+trap 'rm -rf "$stage"' EXIT
+
+echo "== regenerating the architecture package"
+python3 "$here/build_inventory.py"
+python3 "$here/verify_anchors.py"      # exits 1 if any claim no longer resolves
+python3 "$here/build_evidence.py"
+python3 "$here/build_viewer.py"
+
+echo "== structural context"
+# `tree` here is an eza alias in the owner's shell and absent in a plain sh, so
+# the listing is generated with find and does not depend on either.
+{
+  echo "# find -L internal cmd -maxdepth 3 -type d"
+  echo
+  find internal cmd -maxdepth 3 -type d | sort
+  echo
+  echo "# go files per package"
+  echo
+  find internal cmd -name '*.go' ! -name '*_test.go' | sed 's|/[^/]*$||' | sort | uniq -c | sort -rn
+  echo
+  echo "# test files per package"
+  echo
+  find internal cmd -name '*_test.go' | sed 's|/[^/]*$||' | sort | uniq -c | sort -rn
+} > "$here/tree.txt"
+
+echo "== redacting the one credential in docker-compose.yml"
+sed 's/"uk5_[^"]*"/"<REDACTED: uptime-kuma api key>"/' docker-compose.yml \
+  > "$here/docker-compose.redacted.yml"
+if grep -q 'uk5_' "$here/docker-compose.redacted.yml"; then
+  echo "pack_evidence.sh: redaction failed, refusing to build" >&2; exit 1
+fi
+diff <(sed 's/"uk5_[^"]*"/X/' docker-compose.yml) \
+     <(sed 's/"<REDACTED: uptime-kuma api key>"/X/' "$here/docker-compose.redacted.yml") \
+  >/dev/null || { echo "pack_evidence.sh: redacted copy differs by more than the key" >&2; exit 1; }
+
+# ---- the allowlist -------------------------------------------------------
+# Requested and present. internal/session, internal/db and tests/ are absent
+# from this repo; architecture-evidence.txt says where their contents live.
+paths=(
+  docs/architecture
+  CLAUDE.md
+  docs/CLAUDE.md
+  go.mod
+  deploy/mavend.json          # ${VAR} placeholders only; 16 off-claims read it
+  cmd/mavend
+  internal/auth
+  internal/tool
+  internal/claim
+  internal/modes
+  internal/router
+  internal/voice
+  internal/ipc                # the boundary auth.Can actually runs on
+  internal/store
+  internal/dialogue           # clarify + session state the turn path parks in
+  internal/decision           # the arbitration record
+  internal/delivery/channel.go
+  internal/loop
+  internal/webauthn           # the other half of the auth story
+  cmd/mavwaked/main.go        # the client that sends Surface
+  cmd/mavweb/main.go          # the six unguarded surfaces
+)
+
+echo "== staging"
+for p in "${paths[@]}"; do
+  if [ ! -e "$p" ]; then echo "  MISSING $p (skipped)"; continue; fi
+  mkdir -p "$stage/$(dirname "$p")"
+  cp -r "$p" "$stage/$(dirname "$p")/"
+done
+
+# Generated-in-place files that must not travel, and anything that is a secret,
+# a model, a database or a build artefact regardless of how it got staged.
+#
+# The name filters skip .go on purpose: internal/router/singletoken.go matched
+# '*token*' and was deleted out of the first build of this pack. That is exactly
+# the silent hole an allowlist exists to prevent, and a Go source file is never
+# the thing this clause is for.
+find "$stage" ! -name '*.go' \( \
+     -name '*.db' -o -name '*.sqlite*' -o -name '*.enc' \
+  -o -name '*.pem' -o -name '*.key' -o -name '*.crt' -o -name '*.p12' \
+  -o -name '.env*' -o -name '*.token' -o -name '*.secret' -o -name '*.password' \
+  -o -name '*.onnx' -o -name '*.gguf' -o -name '*.bin' -o -name '*.wav' \
+  -o -name '*.zip' -o -name '*.log' -o -name '.git' \
+  \) -print -exec rm -rf {} + 2>/dev/null || true
+
+echo "== scanning the staged tree"
+# A value-shaped assignment: a credential word, a delimiter, then twelve or more
+# characters of value. The value must NOT begin with a slash or a dot, because a
+# docker volume line pairs a host path with a container path and both halves end
+# in the same secret-sounding filename while containing no secret. Three of those
+# in docker-compose.yml tripped the first version of this scan.
+hits=$(grep -rInE '(api[_-]?key|secret|passwo?r?d|bearer|token)["'"'"' ]*[:=]["'"'"' ]*[A-Za-z0-9+_-][A-Za-z0-9/+_-]{11,}' "$stage" \
+       | grep -vE '\$\{|<REDACTED|example|EXAMPLE|xxx|XXX|your-|changeme' \
+       | grep -vE '_test\.go|\.md:' \
+       | grep -vE ':[0-9]+:[[:space:]]*(#|//)' || true)
+if [ -n "$hits" ]; then
+  echo "pack_evidence.sh: possible credentials in the staged tree, refusing to build:" >&2
+  echo "$hits" >&2
+  exit 1
+fi
+
+echo "== building $out"
+rm -f "$out"
+( cd "$stage" && zip -qr "$root/$out" . )
+
+echo
+printf '%s  %s  %s files\n' "$out" \
+  "$(du -h "$out" 2>/dev/null | cut -f1)" \
+  "$(unzip -l "$out" | tail -1 | awk '{print $2}')"
+echo
+echo "redacted: docker-compose.yml -> docs/architecture/docker-compose.redacted.yml"
+echo "          one uptime-kuma api key, nothing else"
+echo "excluded: .git, deploy/telegram.env, deploy/db_key.env, models, deps, databases"

docs/architecture/render.sh

@@ -0,0 +1,52 @@
+#!/bin/sh
+# Re-render every diagram in diagrams/*.mmd to a committed SVG beside it, then
+# rebuild index.html so the viewer carries the new pictures.
+#
+# mermaid-cli drives a real browser through puppeteer. It downloads its own
+# chrome-headless-shell by default, which fails behind a proxy and wastes
+# 150 MB; PUPPETEER_EXECUTABLE_PATH points it at the system chromium instead.
+# --no-sandbox is required because that chromium is not the one puppeteer
+# provisioned and has no sandbox helper of its own here.
+#
+#   sh docs/architecture/render.sh
+#
+# Run it from anywhere. A parse error in one file leaves the others alone and
+# prints FAIL with the mermaid error, which is the only way this repo has to
+# syntax-check a .mmd.
+set -eu
+
+here=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+dia="$here/diagrams"
+cfg=$(mktemp)
+trap 'rm -f "$cfg"' EXIT
+printf '{"args":["--no-sandbox","--disable-gpu"]}' > "$cfg"
+
+: "${PUPPETEER_EXECUTABLE_PATH:=$(command -v chromium || command -v chromium-browser || command -v google-chrome-stable || true)}"
+if [ -z "$PUPPETEER_EXECUTABLE_PATH" ]; then
+  echo "render.sh: no chromium found. Install one, or set PUPPETEER_EXECUTABLE_PATH." >&2
+  exit 1
+fi
+export PUPPETEER_EXECUTABLE_PATH
+
+for f in "$dia"/*.mmd; do
+  n=$(basename "$f" .mmd)
+  err=$(mktemp)
+  if npx --yes @mermaid-js/mermaid-cli@11 -p "$cfg" -t dark -b '#0e1116' \
+        -i "$f" -o "$dia/$n.svg" >/dev/null 2>"$err" && [ -s "$dia/$n.svg" ]; then
+    echo "OK   $n"
+  else
+    echo "FAIL $n"
+    grep -m1 -A3 'Parse error' "$err" || tail -3 "$err"
+  fi
+  rm -f "$err"
+done
+
+python3 "$here/build_viewer.py"
+
+# The only check the viewer has. A TypeError in a renderer shows as a blank
+# panel, not as an error, so run every view against a DOM stub before shipping.
+if command -v node >/dev/null 2>&1; then
+  node "$here/check_viewer.js" || exit 1
+else
+  echo "SKIP check_viewer.js: no node"
+fi

docs/architecture/verify_anchors.py

@@ -0,0 +1,155 @@
+#!/usr/bin/env python3
+"""Resolve every claim in maven-architecture.json to a file and a line.
+
+The inventory names files and symbols. A reader has to take on trust that the
+symbol is in the file and that the file still exists. This script removes the
+trust: it looks up every symbol in the component's own files and writes
+anchors.md, a table of component, symbol, path:line and the verbatim line.
+
+Exit code is 1 when anything fails to resolve, so it doubles as a staleness
+gate. A symbol that moved to another file, or a file that was deleted, fails
+here rather than in a reader's head.
+
+    python3 docs/architecture/verify_anchors.py            # write anchors.md
+    python3 docs/architecture/verify_anchors.py --quiet    # gate only
+
+What it deliberately does NOT check: that the symbol means what the
+responsibility says it means. That is the human pass this file exists to make
+cheap.
+"""
+import json
+import os
+import re
+import sys
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+ROOT = os.path.abspath(os.path.join(HERE, "..", ".."))
+
+# Symbols the inventory names that are not Go identifiers in this repo: config
+# keys, make targets, flags, wire strings, table names. Looking them up in a .go
+# file would fail for the wrong reason, so they are resolved against the file
+# they belong to when possible and skipped when not.
+NON_GO = re.compile(r"^(make |-|/|\$)|\.(json|sql|service|yml)$| ")
+
+
+def candidates(sym: str):
+    """Search forms for one symbol, longest first.
+
+    A dotted symbol like `Store.WriteFact` or `voice.NewServer` is written as a
+    method or a qualified call, so the tail is what appears in a definition and
+    the whole string is what appears at a call site. Try both.
+    """
+    forms = [sym]
+    if "." in sym:
+        forms.append(sym.split(".")[-1])
+    return forms
+
+
+def find(paths, sym):
+    for form in candidates(sym):
+        needle = re.compile(r"\b" + re.escape(form) + r"\b")
+        for rel in paths:
+            full = os.path.join(ROOT, rel)
+            if not os.path.isfile(full):
+                continue
+            try:
+                lines = open(full, errors="replace").read().splitlines()
+            except OSError:
+                continue
+            # Three passes, best anchor first: a definition, then any code
+            # line, then a comment. Without the comment pass being last, a
+            # const whose doc comment names it anchors on the prose rather
+            # than on the declaration.
+            for rank in (0, 1, 2):
+                for i, line in enumerate(lines, 1):
+                    if not needle.search(line):
+                        continue
+                    bare = line.strip()
+                    comment = bare.startswith(("//", "#", "--", "%%", "*"))
+                    isdef = bool(re.match(
+                        r"\s*(func|type|const|var)\b", line)) or bool(re.match(
+                        r"\s*\"?" + re.escape(form) + r"\"?\s*[:=]", line))
+                    got = 2 if comment else (0 if isdef else 1)
+                    if got == rank:
+                        return rel, i, bare
+    return None, None, None
+
+
+def expand(rel):
+    """A directory in the inventory stands for the files under it."""
+    full = os.path.join(ROOT, rel)
+    if os.path.isdir(full):
+        return sorted(
+            os.path.join(rel, f) for f in os.listdir(full)
+            if f.endswith((".go", ".json", ".sql")) and not f.endswith("_test.go")
+        )
+    return [rel]
+
+
+def main() -> int:
+    quiet = "--quiet" in sys.argv
+    arch = json.load(open(os.path.join(HERE, "maven-architecture.json")))
+    rows, missing_files, unresolved = [], [], []
+
+    for c in arch["components"]:
+        paths = []
+        for f in c["files"]:
+            if not os.path.exists(os.path.join(ROOT, f)):
+                missing_files.append((c["id"], f))
+                continue
+            paths.extend(expand(f))
+        for sym in c["symbols"]:
+            if NON_GO.search(sym):
+                rows.append((c["id"], sym, "", "", "not a Go identifier, not looked up"))
+                continue
+            rel, line, text = find(paths, sym)
+            if rel is None:
+                unresolved.append((c["id"], sym))
+                rows.append((c["id"], sym, "", "", "UNRESOLVED"))
+            else:
+                rows.append((c["id"], sym, f"{rel}:{line}", text, ""))
+
+    resolved = sum(1 for r in rows if r[2])
+    if not quiet:
+        with open(os.path.join(HERE, "anchors.md"), "w") as fh:
+            fh.write("# Claim anchors\n\n")
+            fh.write(
+                "Generated by `docs/architecture/verify_anchors.py`. Every symbol the\n"
+                "inventory names, resolved to a file and a line in this checkout, with the\n"
+                "line quoted. Regenerate after any edit to the inventory or the code.\n\n"
+            )
+            fh.write(
+                f"- components: {len(arch['components'])}\n"
+                f"- symbols claimed: {len(rows)}\n"
+                f"- resolved to a line: {resolved}\n"
+                f"- unresolved: {len(unresolved)}\n"
+                f"- missing files: {len(missing_files)}\n\n"
+            )
+            if unresolved:
+                fh.write("## Unresolved\n\n")
+                for cid, sym in unresolved:
+                    fh.write(f"- `{cid}` claims `{sym}` and it is in none of its files\n")
+                fh.write("\n")
+            if missing_files:
+                fh.write("## Missing files\n\n")
+                for cid, f in missing_files:
+                    fh.write(f"- `{cid}` names `{f}`, which does not exist\n")
+                fh.write("\n")
+            fh.write("## Anchors\n\n| component | symbol | anchor | line |\n|---|---|---|---|\n")
+            for cid, sym, anchor, text, note in rows:
+                shown = (text or note).replace("|", "\\|")
+                if len(shown) > 120:
+                    shown = shown[:117] + "..."
+                fh.write(f"| `{cid}` | `{sym}` | {anchor or '—'} | `{shown}` |\n")
+
+    print(f"symbols {len(rows)}, resolved {resolved}, unresolved {len(unresolved)}, "
+          f"missing files {len(missing_files)}")
+    for cid, sym in unresolved[:20]:
+        print(f"  UNRESOLVED {cid} :: {sym}")
+    for cid, f in missing_files[:20]:
+        print(f"  MISSING    {cid} :: {f}")
+    return 1 if (unresolved or missing_files) else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

docs/architecture/viewer.template.html

@@ -0,0 +1,691 @@
+<!doctype html>
+<html lang="en" data-theme="dark">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Maven architecture — as built</title>
+<style>
+:root{
+  --bg:#0e1116; --panel:#141922; --panel2:#1a2130; --line:#26304a; --line2:#38456b;
+  --fg:#dfe6f2; --dim:#8d9bb5; --dim2:#5f6c85;
+  --proc:#7fb3ff; --procbg:#16263f;
+  --svc:#8fd0ff; --svcbg:#132433;
+  --store:#6ed0a8; --storebg:#0f2a20;
+  --model:#e0b050; --modelbg:#2a2210;
+  --adapter:#b79bf0; --adapterbg:#221a33;
+  --ext:#c39bd3; --extbg:#241a2b;
+  --bnd:#ff9f6b; --bndbg:#2c1c12;
+  --warn:#e08080; --warnbg:#2e1616;
+  --ok:#7fbf7f;
+}
+*{box-sizing:border-box}
+html,body{margin:0;height:100%}
+body{background:var(--bg);color:var(--fg);font:14px/1.5 ui-sans-serif,-apple-system,"Segoe UI",Roboto,sans-serif;overflow:hidden}
+code,.mono{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}
+
+#app{display:grid;grid-template-columns:250px 1fr 420px;grid-template-rows:auto 1fr;height:100vh}
+header{grid-column:1/-1;display:flex;align-items:center;gap:18px;padding:10px 16px;border-bottom:1px solid var(--line);background:var(--panel)}
+header h1{font-size:15px;margin:0;font-weight:650;letter-spacing:.2px}
+header .meta{color:var(--dim2);font-size:12px}
+header .meta b{color:var(--dim);font-weight:500}
+
+nav{border-right:1px solid var(--line);background:var(--panel);overflow-y:auto;padding:12px 10px}
+nav h2{font-size:10px;letter-spacing:.12em;text-transform:uppercase;color:var(--dim2);margin:14px 6px 6px}
+nav h2:first-child{margin-top:0}
+.viewbtn{display:block;width:100%;text-align:left;background:transparent;border:1px solid transparent;color:var(--dim);
+  padding:7px 9px;border-radius:6px;cursor:pointer;font:inherit;font-size:13px}
+.viewbtn:hover{background:var(--panel2);color:var(--fg)}
+.viewbtn.on{background:#1d2c47;border-color:var(--line2);color:#fff}
+.viewbtn small{display:block;color:var(--dim2);font-size:11px;line-height:1.35;margin-top:2px}
+.toggle{display:flex;align-items:center;gap:8px;padding:5px 7px;color:var(--dim);font-size:12.5px;cursor:pointer;border-radius:5px}
+.toggle:hover{background:var(--panel2)}
+.toggle input{accent-color:#5b8ff9}
+.legend{display:flex;flex-wrap:wrap;gap:5px;padding:4px 6px}
+.legend span{font-size:10.5px;padding:2px 6px;border-radius:99px;border:1px solid var(--line2);color:var(--dim)}
+
+/* capability matrix and invariants */
+.capsel{display:flex;gap:6px;margin:0 0 14px}
+.capsel button{background:var(--panel2);border:1px solid var(--line);color:var(--dim);padding:5px 11px;border-radius:6px;cursor:pointer;font:inherit;font-size:12.5px}
+.capsel button.on{background:#1d2c47;border-color:var(--line2);color:#fff}
+table.mx{border-collapse:collapse;width:100%;font-size:12.5px}
+table.mx th{text-align:left;font-weight:500;color:var(--dim2);font-size:10px;letter-spacing:.1em;text-transform:uppercase;padding:0 6px 7px;vertical-align:bottom}
+table.mx th.d{text-align:center;width:64px}
+table.mx tr.grp td{padding:16px 6px 5px;color:var(--dim);font-size:10.5px;letter-spacing:.1em;text-transform:uppercase;border-bottom:1px solid var(--line)}
+table.mx tbody tr.cap{cursor:pointer}
+table.mx tbody tr.cap:hover td{background:var(--panel2)}
+table.mx tbody tr.cap.sel td{background:#1b2b45}
+table.mx td{padding:4px 6px;border-bottom:1px solid #1b2230}
+table.mx td.n{font-weight:600}
+table.mx td.n em{font-style:normal;color:var(--dim2);font-weight:400;font-size:11px;margin-left:7px}
+table.mx td.d{text-align:center}
+.dot{display:inline-block;width:11px;height:11px;border-radius:3px;border:1px solid #0006}
+.dot.yes{background:#4f9d69}.dot.partial{background:#c8992e}.dot.no{background:#3a4256}
+.dot.speconly{background:#3a4256;border-style:dashed;border-color:#6b7896}
+.gapc{font-size:10.5px;color:var(--dim2)}
+.gapc.missing{color:#e08080}.gapc.unreachable{color:#e0a060}.gapc.partial{color:#c8992e}
+.mark{font-size:10px;letter-spacing:.06em;text-transform:uppercase;padding:2px 7px;border-radius:99px;border:1px solid var(--line2)}
+.mark.explicit{color:#7fbf7f;border-color:#3d6b43}
+.mark.implied{color:#e0b050;border-color:#6b5a26}
+.mark.unresolved{color:#e08080;border-color:#6b3838}
+.inv{background:var(--panel2);border:1px solid var(--line);border-radius:9px;padding:12px 14px;margin-bottom:12px}
+.inv h4{margin:0 0 6px;font-size:14px;display:flex;align-items:center;gap:10px}
+.inv h4 span.n{color:var(--dim2);font-weight:400}
+.inv .q{color:#e0b8b8;font-size:12.5px;margin:8px 0 0}
+.bars{display:flex;gap:14px;margin:9px 0 4px;flex-wrap:wrap}
+.bar{font-size:10.5px;color:var(--dim2)}
+.bar b{display:block;font-size:9.5px;letter-spacing:.1em;text-transform:uppercase;color:var(--dim2);font-weight:500;margin-bottom:3px}
+.bar .v{color:var(--fg);font-size:12px}
+.bar .v.warn{color:#e08080}.bar .v.mid{color:#c8992e}.bar .v.ok{color:#7fbf7f}
+.cchip{display:inline-block;background:var(--panel);border:1px solid var(--line);border-radius:6px;padding:3px 8px;margin:3px 4px 0 0;
+  font-size:11.5px;cursor:pointer;color:var(--dim)}
+.cchip:hover{border-color:var(--line2);color:var(--fg)}
+.cchip.off{border-color:#6b5a26;color:#e0b050}
+.cchip.pl{border-color:#6b3838;color:#e08080}
+.crit{border-left:2px solid var(--line2);padding:0 0 0 10px;margin:0 0 11px}
+.crit .vd{font-size:10px;letter-spacing:.08em;text-transform:uppercase;margin-right:8px}
+.crit .vd.pass{color:#7fbf7f}.crit .vd.fail{color:#e08080}.crit .vd.blocked{color:#e0a060}
+.crit .vd.untested{color:var(--dim2)}.crit .vd.unknown{color:#b79bf0}
+.crit .rs{color:var(--dim2);font-size:11px}
+.crit p{margin:5px 0 0;color:var(--dim);font-size:12px}
+main{position:relative;overflow:auto;padding:18px 20px 60px}
+.lane{margin-bottom:20px}
+.lane-h{display:flex;align-items:baseline;gap:10px;margin:0 0 8px;cursor:pointer;user-select:none}
+.lane-h b{font-size:11px;letter-spacing:.1em;text-transform:uppercase;color:var(--dim)}
+.lane-h i{font-style:normal;color:var(--dim2);font-size:11px}
+.lane-h .caret{color:var(--dim2);font-size:11px;width:10px}
+.chips{display:flex;flex-wrap:wrap;gap:8px}
+.chip{position:relative;background:var(--panel2);border:1px solid var(--line);border-radius:8px;padding:7px 10px;cursor:pointer;
+  max-width:280px;transition:border-color .12s,background .12s}
+.chip:hover{border-color:var(--line2)}
+.chip.sel{border-color:#7fb3ff;background:#1b2b45;box-shadow:0 0 0 1px #7fb3ff44}
+.chip.rel{border-color:#4a5f8f}
+.chip.dim{opacity:.28}
+.chip .nm{font-weight:600;font-size:13px}
+.chip .ty{font-size:10.5px;color:var(--dim2);letter-spacing:.04em;text-transform:uppercase}
+.chip .badges{display:flex;gap:4px;margin-top:4px;flex-wrap:wrap}
+.b{font-size:9.5px;padding:1px 5px;border-radius:99px;border:1px solid currentColor;letter-spacing:.03em}
+.b.off{color:#c9a227}.b.nd{color:#c98a27}.b.pl{color:#a07fe0}.b.tmp{color:#8d9bb5}.b.pw{color:#e08080}
+.b.lo{color:#e08080}.b.me{color:#c9a227}
+.chip[data-t=process]{border-left:3px solid var(--proc)}
+.chip[data-t=service],.chip[data-t=worker],.chip[data-t=handler]{border-left:3px solid var(--svc)}
+.chip[data-t=arbitration],.chip[data-t=query_source]{border-left:3px solid #ffd479}
+.chip[data-t=storage],.chip[data-t=table]{border-left:3px solid var(--store)}
+.chip[data-t=model]{border-left:3px solid var(--model)}
+.chip[data-t=adapter]{border-left:3px solid var(--adapter)}
+.chip[data-t=external]{border-left:3px solid var(--ext)}
+.chip[data-t=boundary]{border-left:3px solid var(--bnd)}
+.chip[data-t="shared-state"]{border-left:3px solid #ff9ec7}
+.chip[data-t=planned]{border-left:3px solid #a07fe0}
+.chip[data-t=config],.chip[data-t=test]{border-left:3px solid var(--dim2)}
+svg.wires{position:absolute;inset:0;pointer-events:none;overflow:visible}
+
+aside{border-left:1px solid var(--line);background:var(--panel);overflow-y:auto;padding:16px 16px 60px}
+aside .empty{color:var(--dim2);font-size:13px;margin-top:30px;line-height:1.7}
+aside h3{margin:0 0 2px;font-size:16px}
+aside .sub{color:var(--dim2);font-size:11px;text-transform:uppercase;letter-spacing:.08em;margin-bottom:10px}
+aside section{margin-top:16px}
+aside section > h4{font-size:10px;letter-spacing:.12em;text-transform:uppercase;color:var(--dim2);margin:0 0 6px}
+aside p{margin:0 0 8px;color:#c9d3e6}
+.note{background:#1c1f14;border-left:2px solid #c9a227;padding:8px 10px;border-radius:0 5px 5px 0;color:#ded6b6;font-size:12.5px}
+ul.plain{list-style:none;margin:0;padding:0}
+ul.plain li{padding:3px 0;border-bottom:1px solid #1d2433;font-size:12.5px}
+ul.plain li:last-child{border-bottom:0}
+.rel{display:block;width:100%;text-align:left;background:transparent;border:0;color:#a9c6f5;cursor:pointer;font:inherit;font-size:12.5px;padding:3px 0}
+.rel:hover{color:#fff;text-decoration:underline}
+.rel .k{display:inline-block;min-width:66px;color:var(--dim2);font-size:10.5px;text-transform:uppercase;letter-spacing:.05em}
+.rel .ev{display:block;color:var(--dim2);font-size:11px;margin-left:66px;line-height:1.4}
+pre.mm{white-space:pre-wrap;word-break:break-word;background:#0b0e13;border:1px solid var(--line);border-radius:6px;
+  padding:12px;font-size:11.5px;color:#b8c6de;overflow-x:auto;max-height:none}
+.searchbox{width:100%;background:var(--panel2);border:1px solid var(--line);border-radius:6px;color:var(--fg);
+  padding:7px 9px;font:inherit;font-size:12.5px}
+.searchbox:focus{outline:none;border-color:var(--line2)}
+.results{margin-top:6px;max-height:280px;overflow:auto}
+.results button{display:block;width:100%;text-align:left;background:transparent;border:0;color:var(--dim);
+  padding:5px 7px;border-radius:5px;cursor:pointer;font:inherit;font-size:12px}
+.results button:hover{background:var(--panel2);color:#fff}
+.results button em{font-style:normal;color:#ffd479}
+.flowsel{display:flex;gap:6px;margin-bottom:14px;flex-wrap:wrap}
+.flowsel button{background:var(--panel2);border:1px solid var(--line);color:var(--dim);border-radius:6px;
+  padding:6px 11px;cursor:pointer;font:inherit;font-size:12.5px}
+.flowsel button.on{background:#1d2c47;border-color:var(--line2);color:#fff}
+ol.steps{counter-reset:s;list-style:none;margin:0;padding:0;max-width:1000px}
+ol.steps li{position:relative;padding:9px 12px 9px 44px;border-left:2px solid var(--line);margin-left:14px}
+ol.steps li:before{counter-increment:s;content:counter(s);position:absolute;left:-13px;top:9px;width:24px;height:24px;
+  border-radius:99px;background:var(--panel2);border:1px solid var(--line2);color:var(--dim);font-size:11px;
+  display:flex;align-items:center;justify-content:center}
+ol.steps li.branch{border-left-color:var(--warn);background:#1e1414}
+ol.steps li.branch:before{border-color:var(--warn);color:#e08080}
+ol.steps b{color:#fff}
+ol.steps .who{display:inline-block;background:#1d2c47;border:1px solid var(--line2);border-radius:4px;
+  padding:0 6px;font-size:11px;color:#a9c6f5;cursor:pointer;margin-right:8px}
+ol.steps .who:hover{color:#fff;border-color:#7fb3ff}
+ol.steps .ev{display:block;color:var(--dim2);font-size:11.5px;margin-top:3px}
+.viewnote{max-width:1000px;color:var(--dim);font-size:12.5px;background:var(--panel2);border:1px solid var(--line);
+  border-radius:7px;padding:11px 13px;margin-bottom:18px}
+.viewnote b{color:var(--fg)}
+.dia{margin-bottom:20px;border:1px solid var(--line);border-radius:8px;background:#0b0e13;overflow:hidden}
+.dia-h{display:flex;align-items:center;gap:10px;padding:8px 12px;background:var(--panel2);border-bottom:1px solid var(--line);cursor:pointer;user-select:none}
+.dia-h b{font-size:11px;letter-spacing:.1em;text-transform:uppercase;color:var(--dim)}
+.dia-h .fn{color:var(--dim2);font-size:11px}
+.dia-h .zoom{margin-left:auto;display:flex;gap:4px}
+.dia-h .zoom button{background:var(--panel);border:1px solid var(--line);color:var(--dim);border-radius:4px;
+  width:24px;height:22px;cursor:pointer;font:inherit;font-size:12px;line-height:1}
+.dia-h .zoom button:hover{color:#fff;border-color:var(--line2)}
+.dia-body{overflow:auto;max-height:70vh;padding:10px}
+.dia-body > div{transform-origin:0 0}
+.dia-body svg{max-width:none;height:auto;display:block}
+</style>
+</head>
+<body>
+<div id="app">
+  <header>
+    <h1>Maven — architecture as built</h1>
+    <div class="meta">commit <b id="commit"></b> · <b id="gen"></b> · <b id="counts"></b></div>
+    <div class="meta" id="dirty"></div>
+  </header>
+
+  <nav>
+    <h2>Views</h2>
+    <div id="views"></div>
+    <h2>Search</h2>
+    <input class="searchbox" id="q" placeholder="component, file or symbol">
+    <div class="results" id="results"></div>
+    <div id="archctl">
+    <h2>Filters</h2>
+    <label class="toggle"><input type="checkbox" id="tLow" checked> show low-confidence relations</label>
+    <label class="toggle"><input type="checkbox" id="tMed" checked> show medium-confidence relations</label>
+    <label class="toggle"><input type="checkbox" id="tOff" checked> show configured-off</label>
+    <label class="toggle"><input type="checkbox" id="tUndeployed" checked> show built-not-deployed</label>
+    <label class="toggle"><input type="checkbox" id="tPlanned" checked> show planned / unwired</label>
+    <label class="toggle"><input type="checkbox" id="tWires" checked> draw relation wires</label>
+    <h2>Type</h2>
+    <div class="legend" id="legend"></div>
+    </div>
+  </nav>
+
+  <main id="main"></main>
+  <aside id="side"><div class="empty">Select a component to see its responsibility, the files and symbols it was read from, and every relation in and out.<br><br>Every claim here cites a file. Nothing is inferred from a directory name.</div></aside>
+</div>
+
+<script>
+/*__DATA__*/
+
+const byId = Object.fromEntries(ARCH.components.map(c => [c.id, c]));
+const S = { view: 'v1', sel: null, selCap: null, capBy: 'section', flow: 'reminder', collapsed: {}, diaClosed: false, diaZoom: 1 };
+
+/* ---------------- view definitions ---------------- */
+const VIEWS = [
+  { id:'v1', name:'1 · System topology', hint:'Processes and external systems, with process boundaries drawn.',
+    note:'<b>mavend is the centre because the code makes it one.</b> It is the only holder of the database key, it owns the store, the IPC socket, the voice TCP listener, the tick loop, eight background workers and the child llama-server. Every other daemon is key-free and fail-independent. Five services run under docker-compose; two more are built and commented out; two run under systemd on the workstation.',
+    lanes:[
+      ['homesrv — docker compose', c => c.group==='homesrv' && ['process','model','boundary','external'].includes(c.type)],
+      ['workpc — systemd user units', c => c.group==='workpc'],
+      ['ecosystem network', c => c.group==='ecosystem'],
+      ['internet / LAN', c => ['internet','lan'].includes(c.group)],
+      ['dev and recovery binaries', c => c.group==='dev' || ['proc.mavseal','proc.mavupdate'].includes(c.id)],
+      ['configuration boundary', c => c.type==='config'],
+    ]},
+  { id:'v2', name:'2 · Core internals', hint:'The real path through mavend, in the order runTurn runs it.',
+    note:'The implementation does <b>not</b> follow input → routing → intent → state → tools → response. Eleven stateful pre-emptors get first refusal <b>before</b> routing; the routing cascade is four arms deep; and an <code>IntentQuery</code> then enters a <b>second</b> arbitration of twenty-two ordered sources. The proactive half shares no code with any of it.',
+    lanes:[
+      ['input and entry', c => ['core.voice_server','core.ipc_server','core.daemon_api','core.intake_api','core.store_api','core.stt_seam','core.telegram_intake','core.auth_gate','core.daemon_lock'].includes(c.id)],
+      ['turn pipeline', c => ['core.reactive_handler','core.turn_route','core.preroute','core.action_table'].includes(c.id)],
+      ['routing cascade', c => c.id.startsWith('router.')],
+      ['intent handlers', c => c.type==='handler' || c.id==='core.query_chain'],
+      ['query sources — the second arbitration, in table order', c => c.type==='query_source'],
+      ['response generation', c => ['core.replier','core.phraser','core.tts_seam','core.model_seam','core.recall','core.topics'].includes(c.id)],
+      ['proactive half', c => ['core.tick_loop','core.gatherer','core.rules','core.pattern','core.morning','core.routines','core.dispatcher','core.sink_voice','core.sink_ntfy','core.sink_telegram'].includes(c.id)],
+      ['background workers', c => c.type==='worker' && c.id!=='core.tick_loop' && c.id!=='core.telegram_intake'],
+      ['dark capabilities — wired, no config block', c => ['core.vision','core.capture','core.speaker','core.mail_intake','core.modelswap','core.netscan','core.memory_eval'].includes(c.id)],
+      ['construction and diagnosis', c => ['core.wiring','core.decision_trace','core.event_bus'].includes(c.id)],
+    ]},
+  { id:'v3', name:'3 · Runtime flow', hint:'Three representative requests traced through real code.', flow:true },
+  { id:'v4', name:'4 · State ownership', hint:'Every persistent and shared store, its owner, writers and readers.',
+    note:'One process owns the database and every write is serialised at it: <code>SetMaxOpenConns(1)</code>. Three tables are nevertheless written by components that do not know about each other — <b>facts</b> by nine, <b>notes</b> by six, <b>tools</b> by four. Two files live outside the database entirely, and together they weaken the at-rest key.',
+    lanes:[
+      ['authoritative owner', c => ['proc.mavend','state.db'].includes(c.id)],
+      ['database lifecycle', c => ['state.db_file','state.db_tmpfs','state.wrapped_key','proc.mavseal'].includes(c.id)],
+      ['tables written by unrelated components', c => ['state.facts','state.notes','state.tools'].includes(c.id)],
+      ['singly-owned tables', c => c.type==='table' && !['state.facts','state.notes','state.tools'].includes(c.id)],
+      ['shared mutable state — process-local', c => c.type==='shared-state'],
+      ['state outside the database', c => ['state.passkey_file','state.maildata','state.media_blobs'].includes(c.id)],
+      ['writers', c => (c.writes||[]).length>0 && c.type!=='table'],
+      ['readers', c => (c.reads||[]).length>0 && c.type!=='table' && !(c.writes||[]).length],
+    ]},
+  { id:'v5', name:'5 · Dependency and boundary map', hint:'Components, not classes. Cycles, cross-layer calls, fan-in and fan-out.',
+    note:'The one <b>cycle</b> is deliberate and documented at both ends: <code>daemonAPI.chatFn = handler.handleText</code> and <code>handler.api</code> back-patched by <code>upgradeAPI</code>. The <b>fan-in</b> hotspot is <code>ipc.Server</code>, reached by six processes and carrying eight function fields that bypass CoreAPI entirely. The <b>fan-out</b> hotspots are <code>reactiveHandler</code> (34 fields) and <code>tickLoop</code> (thirteen jobs in one function).',
+    lanes:[
+      ['process and network boundaries', c => c.type==='boundary'],
+      ['entry layer', c => ['core.ipc_server','core.voice_server','core.telegram_intake','core.auth_gate'].includes(c.id)],
+      ['API layer', c => c.type==='adapter'],
+      ['turn layer — fan-out hotspot', c => ['core.reactive_handler','core.turn_route','core.preroute','core.action_table','core.query_chain'].includes(c.id)],
+      ['routing layer', c => c.id.startsWith('router.')],
+      ['proactive layer — fan-out hotspot', c => ['core.tick_loop','core.gatherer','core.rules','core.dispatcher'].includes(c.id)],
+      ['construction layer', c => ['core.wiring'].includes(c.id)],
+      ['state layer', c => ['state.db'].includes(c.id) || c.type==='shared-state'],
+      ['evaluation and gates', c => c.type==='test'],
+    ]},
+  { id:'c1', name:'6 · Capabilities', hint:'Every capability against the seven dimensions. Sorted by the spec, or by domain.', caps:true,
+    note:'<b>Nothing here is asserted.</b> The six build dimensions come from the <code>status</code> field of every component the capability maps to, and <code>verified</code> comes from a probe run against the deployed stack. A capability can be coded and unwired, wired and unconfigured, or configured and undeployed, and those are three different pieces of work — which is why this is not one <code>implemented</code> column. Source: <code>docs/capabilities/ledger.yaml</code>.' },
+  { id:'c2', name:'7 · Invariants', hint:'The twelve cross-cutting rules, and which components participate in each.', inv:true,
+    note:'These rules run across all 51 capabilities and no capability\'s definition of done states any of them, so breaking one breaks many at once without producing a single failing criterion. <b>Target</b> is whether the rule is written down. <b>Implementation</b> is the status of the components that participate. <b>Runtime</b> is what the probe run observed for the capabilities it touches. Source: <code>docs/capabilities/invariants.yaml</code>, prose and evidence in <code>invariants.md</code>.' },
+];
+
+/* ---------------- runtime flows ---------------- */
+const FLOWS = {
+  reminder: { name:'A reminder request', file:'03a-flow-reminder.mmd', steps:[
+    {who:['proc.mavwaked'], t:'The keyword head scores the utterance at or above 0.999 and silero VAD closes it. One clean blob ships over the ssh tunnel.', ev:'cmd/mavwaked/wakeword.go, deploy/mavwaked.service'},
+    {who:['core.voice_server','core.reactive_handler'], t:'The conn already has a Session; HandlePushToTalk transcribes and enters runTurn.', ev:'internal/voice/server.go, cmd/mavend/voice.go'},
+    {who:['core.decision_trace'], t:'A decision record is installed on the context before anything can claim the turn, so the mic, telegram and the web leave the same trail.', ev:'cmd/mavend/voice.go step 0'},
+    {who:['core.preroute'], t:'Eleven rungs get first refusal. None claims "напомни позвонить маме".', ev:'cmd/mavend/voice.go steps 1 to 5e, preRouteLadder'},
+    {who:['router.stage0','router.cascade'], t:'ReminderGrammar matches at stage 0 and wins outright at confidence 1.0. The extractor then fills the slots the grammar did not match.', ev:'internal/router/stagezero.go, router.go fillMatchedSlots'},
+    {who:['core.reactive_handler'], t:'BRANCH — the route is confident and incomplete. missingFor names `time`, so step 8 fires even though dec.Clarify is false.', ev:'cmd/mavend/voice.go step 8, Vikunja #557', branch:true},
+    {who:['state.clarify_store'], t:'The request is parked as a PendingQuestion and she asks one question about one thing. The store is in memory on purpose: a restart expires it.', ev:'internal/dialogue/clarify.go, cmd/mavend/clarify.go'},
+    {who:['core.preroute'], t:'The next utterance is claimed by rung 4, resolveClarifyAnswer, and parsed with the same parsers stage 2 uses.', ev:'cmd/mavend/clarify.go finishClarified'},
+    {who:['core.action_reminder'], t:'ResolvedTheHour guards a time the parser did not really read. The row is written, and the confirmation is phrased FROM THE ROW, never from the utterance.', ev:'cmd/mavend/actions_reminder.go, Vikunja #507'},
+    {who:['state.reminders'], t:'One append. cron and next_fire_ts exist as columns and this path never sets them.', ev:'internal/store/reminders.go, migrations.go #2', branch:true},
+    {who:['core.tick_loop','core.gatherer'], t:'Later, on a 60s ticker: the gatherer collapses due reminders by delivery group and RemindDecisions bypasses the restraint gate.', ev:'internal/loop/gather.go collapseReminders, loop.go RemindDecisions'},
+    {who:['core.dispatcher','state.delivery_attempts'], t:'The outbox records intent BEFORE the external send, so a crash leaves a pending row rather than silence.', ev:'internal/delivery/dispatcher.go beginReminderOutbox'},
+    {who:['core.sink_voice','core.sink_telegram'], t:'Voice when a session is live; away, ntfy is nil because the config disables it, so telegram carries it. A definite failure advances the persisted bounded backoff.', ev:'internal/delivery/channel.go ChannelsFor, cmd/mavend/main.go wireNtfySink'},
+  ]},
+  fact: { name:'A factual / state update', file:'03b-flow-fact.mmd', steps:[
+    {who:['core.reactive_handler','router.cascade'], t:'"выпил воды" reaches the cascade. Stage 0 declines, the heads or the LLM router or the classifier names IntentFact with a key and a value.', ev:'internal/router/router.go Route'},
+    {who:['core.action_fact'], t:'BRANCH — a question-shaped utterance is never a fact. It is re-routed into actionQuery with the model-guessed key cleared, and the stage 0 world destination reconstructed so the boundary cannot claim it.', ev:'cmd/mavend/actions_fact.go, Vikunja #470', branch:true},
+    {who:['core.action_fact','core.action_chat'], t:'BRANCH — a passing complaint is not a fact either. It becomes chat and stores nothing, because recall reads a self row back later as if it were still true.', ev:'cmd/mavend/actions_fact.go, Vikunja #481', branch:true},
+    {who:['core.intake_api','state.facts'], t:'WriteFact appends kind=self, source=tap:voice, Subject=Key. Confidence is 1.0 only for a value he actually said. The decorator publishes one intake envelope.', ev:'cmd/mavend/actions_fact.go factConfidence, cmd/mavend/intake.go'},
+    {who:['state.memory_vectors'], t:'The key’s old vectors are pruned, then the FACT text is embedded with the passage prefix and inserted. The utterance rides along as provenance and is never embedded.', ev:'cmd/mavend/actions_fact.go pruneFactVectors, Vikunja #493'},
+    {who:['core.reactive_handler'], t:'Step 9b: a fact that answers a live nudge closes it as `acted`, silently. The fact reply stands.', ev:'cmd/mavend/ack.go ackFromFact'},
+    {who:['core.fact_enrichment','ext.nexus'], t:'Asynchronously, the enrichment worker resolves Subject to a canonical entity id with per-fact backoff. An ambiguous result is NOT stored.', ev:'cmd/mavend/factenrichment.go resolveOne'},
+    {who:['core.tick_loop','core.morning'], t:'On the next tick the morning routine sees the item evidenced inside its window and will not nudge for it.', ev:'cmd/mavend/tick_morning.go gatherMorningFacts'},
+    {who:['core.pattern','state.events'], t:'detectPatterns scans every action+object pair for a stable interval and may propose a routine. notify is false in the deployed config, so it proposes silently.', ev:'cmd/mavend/tick_routines.go, deploy/mavend.json pattern_proposals'},
+    {who:['state.facts'], t:'A wrong value is superseded, never overwritten: voids_id points at the row it cancels, and both correction paths drop the key’s vectors.', ev:'internal/store/schema.sql, internal/store/facts.go'},
+  ]},
+  world: { name:'A world query, tool-backed', file:'03c-flow-world-query.mmd', steps:[
+    {who:['router.stage0'], t:'"что такое TCP?" matches WorldQueryGrammars, a literal definition frame. That match sets Source=SourceWorld AND SourceAnchored, which happens here and nowhere else in the cascade.', ev:'internal/router/router.go d.SourceAnchored = d.Source != SourceUnknown'},
+    {who:['core.query_chain','core.decision_trace'], t:'actionQuery declares the full 22-source roster to the record, so a reader can tell "looked and passed" from "never asked".', ev:'cmd/mavend/actions_query.go decision.Expect'},
+    {who:['core.query_chain'], t:'queryWalk removes only the sources marked guesses:true whose destination is not world. Sources that LOOK are all still asked, because a named destination is evidence and not a promise.', ev:'cmd/mavend/actions_query.go queryWalk'},
+    {who:['core.q.personal'], t:'BRANCH — the personal boundary is dropped only because a literal pattern named the destination. A model or a softmax naming SourceWorld would NOT drop it.', ev:'cmd/mavend/actions_query.go queryWalk anchored, V-666', branch:true},
+    {who:['core.q.factbykey','core.q.memory','core.q.notes'], t:'His own data still gets its turn: fact-by-key, the day plan, tasks, money, history, the calendar, then the three recall passes gated by min score 0.80 and min margin 0.008.', ev:'cmd/mavend/actions_query.go querySources, deploy/mavend.json'},
+    {who:['core.q.search','ext.searxng'], t:'SearXNG is asked verbatim, with no rewriter. Only the query string leaves the box: no note, no fact, no persona block, no history.', ev:'cmd/mavend/actions_query.go querySearch'},
+    {who:['core.phraser'], t:'The snippets are handed over as evidence for the question, trimmed under one budget, and phrased. With no phraser the best snippet is read back rather than pretending the search did not happen.', ev:'cmd/mavend/actions_query.go phraseSource, readBack'},
+    {who:['core.q.kiwix','ext.kiwix'], t:'BRANCH — empty or unreachable falls through to the offline ZIMs, Russian first. No results there is not announced.', ev:'cmd/mavend/actions_query.go queryKiwix', branch:true},
+    {who:['core.q.web'], t:'A page he named by URL is read only if he actually said a URL, and it sits AFTER the ZIMs on purpose.', ev:'cmd/mavend/actions_query.go queryWeb, Vikunja #259'},
+    {who:['core.q.general'], t:'Last: the resident model answers from its own weights. Response.Empty() is the whole gate on a world answer; there is no quality threshold in front of it.', ev:'cmd/mavend/actions_query.go queryGeneral, CLAUDE.md'},
+    {who:['core.query_chain'], t:'Whichever source claimed is logged and noted on the turn sink, so /chat can show it. Everyone below the winner is recorded as NeverAsked.', ev:'cmd/mavend/querysource.go noteQuerySource, Vikunja #474'},
+  ]},
+};
+
+/* ---------------- filters ---------------- */
+const T = id => document.getElementById(id).checked;
+function statusHidden(st){
+  if (st==='configured-off') return !T('tOff');
+  if (st==='built-not-deployed') return !T('tUndeployed');
+  if (st==='planned-unwired'||st==='dead') return !T('tPlanned');
+  return false;
+}
+function edgeHidden(e){
+  if (e.confidence==='low' && !T('tLow')) return true;
+  if (e.confidence==='medium' && !T('tMed')) return true;
+  return statusHidden(e.status);
+}
+const edgesOf = id => ARCH.edges.filter(e => e.from===id || e.to===id);
+
+/* ---------------- rendering ---------------- */
+function badges(c){
+  const out=[];
+  if (c.status!=='implemented') out.push(`<span class="b ${ {'configured-off':'off','built-not-deployed':'nd','planned-unwired':'pl','temporary':'tmp','partially-wired':'pw','dead':'pl'}[c.status]||'tmp'}">${c.status}</span>`);
+  if (c.confidence==='low') out.push('<span class="b lo">uncertain</span>');
+  if (c.confidence==='medium') out.push('<span class="b me">medium confidence</span>');
+  return out.length?`<div class="badges">${out.join('')}</div>`:'';
+}
+
+function chipHTML(c){
+  return `<div class="chip" data-id="${c.id}" data-t="${c.type}">
+    <div class="nm">${c.id.split('.').pop().replace(/_/g,' ')}</div>
+    <div class="ty">${c.type} · ${c.id}</div>${badges(c)}</div>`;
+}
+
+function renderView(){
+  const v = VIEWS.find(x=>x.id===S.view);
+  const main = document.getElementById('main');
+  if (v.flow) return renderFlow(main);
+  if (v.caps) return renderCaps(main);
+  if (v.inv)  return renderInv(main);
+  let html = v.note ? `<div class="viewnote">${v.note}</div>` : '';
+  html += diagramPanel(diagramFileFor());
+  const used = new Set();
+  v.lanes.forEach(([title, pred], i) => {
+    const items = ARCH.components.filter(c => !used.has(c.id) && pred(c) && !statusHidden(c.status));
+    items.forEach(c=>used.add(c.id));
+    if (!items.length) return;
+    const key = v.id+':'+i, open = !S.collapsed[key];
+    html += `<div class="lane"><div class="lane-h" data-lane="${key}">
+      <span class="caret">${open?'▾':'▸'}</span><b>${title}</b><i>${items.length}</i></div>
+      <div class="chips" ${open?'':'style="display:none"'}>${items.map(chipHTML).join('')}</div></div>`;
+  });
+  html += `<svg class="wires" id="wires"></svg>`;
+  main.innerHTML = html;
+  main.querySelectorAll('.lane-h').forEach(h=>h.onclick=()=>{ S.collapsed[h.dataset.lane]=!S.collapsed[h.dataset.lane]; renderView(); paint(); });
+  main.querySelectorAll('.chip').forEach(ch=>ch.onclick=()=>select(ch.dataset.id));
+  wireDiagram();
+  requestAnimationFrame(drawWires);
+}
+
+/* ---------------- capabilities and invariants ---------------- */
+const DIMS = ['designed','code_present','wired','configured','deployed','reachable','verified'];
+const DIMH = {designed:'design',code_present:'code',wired:'wired',configured:'config',
+              deployed:'deploy',reachable:'reach',verified:'verified'};
+const capById = Object.fromEntries(CAPS.capabilities.map(c => [c.id, c]));
+// A criterion is blocked when it was observed blocked, or when its reason names
+// something outside the code as the thing in the way.
+const BLOCKREASON = new Set(['configuration missing','deployment missing',
+                             'external dependency unavailable','scenario missing']);
+const dotCls = v => v==='spec-only' ? 'speconly' : v;
+// The ledger carries markdown inline code, because docs/spec.md does. Rendering
+// it literally puts backticks on screen next to every path.
+const md = t => (t||'').replace(/[&<>]/g, m => ({'&':'&amp;','<':'&lt;','>':'&gt;'}[m]))
+                       .replace(/`([^`]+)`/g, '<code>$1</code>')
+                       .replace(/\*\*([^*]+)\*\*/g, '<b>$1</b>');
+
+function capRow(c){
+  const cls = {'capability missing':'missing','capability exists but unreachable':'unreachable',
+               'capability partial':'partial'}[c.implementation.gap_class] || '';
+  const gap = c.implementation.gap_class==='none' ? '' : c.implementation.gap_class;
+  return `<tr class="cap" data-cap="${c.id}">
+    <td class="n">${c.title}${c.scope!=='v1'?'<em>deferred</em>':''}
+      <em class="gapc ${cls}">${gap}</em></td>
+    ${DIMS.map(d=>`<td class="d"><span class="dot ${dotCls(c.implementation[d])}" title="${d}: ${c.implementation[d]}"></span></td>`).join('')}
+  </tr>`;
+}
+
+function renderCaps(main){
+  const v = VIEWS.find(x=>x.id===S.view);
+  const by = S.capBy;
+  const groups = {};
+  CAPS.capabilities.forEach(c => {
+    const keys = by==='domain' ? (c.domain.length?c.domain:['unassigned']) : [c.section];
+    keys.forEach(k => (groups[k] = groups[k]||[]).push(c));
+  });
+  const order = by==='domain' ? Object.keys(groups).sort()
+    : [...new Set(CAPS.capabilities.map(c=>c.section))];
+  main.innerHTML = `<div class="viewnote">${v.note}</div>
+    <div class="capsel">
+      <button data-by="section" class="${by==='section'?'on':''}">by spec section</button>
+      <button data-by="domain" class="${by==='domain'?'on':''}">by domain</button>
+    </div>
+    <table class="mx"><thead><tr><th>capability</th>
+      ${DIMS.map(d=>`<th class="d">${DIMH[d]}</th>`).join('')}</tr></thead>
+    <tbody>${order.map(g=>`<tr class="grp"><td colspan="8">${g} · ${groups[g].length}</td></tr>`
+       + groups[g].map(capRow).join('')).join('')}</tbody></table>`;
+  main.querySelectorAll('.capsel button').forEach(b=>b.onclick=()=>{S.capBy=b.dataset.by;renderCaps(main);});
+  main.querySelectorAll('tr.cap').forEach(r=>r.onclick=()=>selectCap(r.dataset.cap));
+}
+
+function selectCap(id){
+  S.sel = null; S.selCap = id;
+  document.querySelectorAll('tr.cap').forEach(r=>r.classList.toggle('sel', r.dataset.cap===id));
+  renderCapSide(id);
+}
+
+function compChip(cid){
+  const c = byId[cid];
+  const k = c && (c.status==='configured-off' ? 'off'
+    : ['planned-unwired','dead','partially-wired'].includes(c.status) ? 'pl' : '');
+  return `<button class="cchip ${k}" data-id="${cid}" title="${c?c.status:'unknown'}">${cid}</button>`;
+}
+
+function renderCapSide(id){
+  const c = capById[id], side = document.getElementById('side');
+  const blockers = c.criteria.filter(cr => cr.verified==='blocked' || BLOCKREASON.has(cr.reason));
+  const qs = INV.filter(iv => iv.capabilities.includes(id) && iv.question);
+  const scen = c.scenarios || [];
+  side.innerHTML = `
+    <h3>${c.title}</h3>
+    <div class="sub">${c.section} · ${c.domain.join(', ')} · ${c.scope}${
+      c.implementation.gap_class==='none'?'':' · '+c.implementation.gap_class}</div>
+    <p>${md(c.state)}</p>
+    <section><h4>Implementation</h4>
+      <div class="bars">${DIMS.map(d=>{
+        const v = c.implementation[d];
+        const k = v==='yes'?'ok':v==='partial'?'mid':'warn';
+        return `<div class="bar"><b>${DIMH[d]}</b><span class="v ${k}">${v}</span></div>`;
+      }).join('')}</div></section>
+    <section><h4>Components — ${(c.components||[]).length}</h4>
+      ${(c.components||[]).length ? c.components.map(compChip).join('')
+        : '<div class="empty" style="margin:0">Nothing carries this capability. That is the finding.</div>'}</section>
+    <section><h4>Definition of done — ${c.criteria.length}</h4>
+      ${c.criteria.map(cr=>`<div class="crit">
+        <span class="vd ${cr.verified}">${cr.verified}</span><span class="rs">${cr.reason}</span>
+        <p>${md(cr.text)}</p>
+        ${cr.detail?`<p style="color:var(--dim2)">${md(cr.detail)}</p>`:''}
+        ${(cr.evidence||[]).length?`<p class="mono" style="font-size:11px;color:var(--dim2)">${cr.evidence.join('<br>')}</p>`:''}
+      </div>`).join('')}</section>
+    <section><h4>Blockers — ${blockers.length}</h4>
+      ${blockers.length ? '<ul class="plain">'+blockers.map(b=>`<li>${b.reason} · <span class="mono">${b.id}</span></li>`).join('')+'</ul>'
+        : '<div class="empty" style="margin:0">none. Nothing outside the code is in the way.</div>'}</section>
+    <section><h4>Scenarios — ${scen.length}</h4>
+      ${scen.length ? '<ul class="plain">'+scen.map(x=>`<li class="mono">${x.name} ${x.exists?'':'<span class="b off">absent from disk</span>'}</li>`).join('')+'</ul>'
+        : '<div class="empty" style="margin:0">none named</div>'}</section>
+    <section><h4>Unresolved product questions — ${qs.length}</h4>
+      ${qs.length ? qs.map(iv=>`<div class="crit"><span class="mark ${iv.mark}">invariant ${iv.id}</span>
+         <p>${iv.question}</p></div>`).join('')
+        : '<div class="empty" style="margin:0">none</div>'}</section>`;
+  side.querySelectorAll('.cchip').forEach(b=>b.onclick=()=>{S.sel=b.dataset.id;renderSide(b.dataset.id);});
+}
+
+function invRollup(iv){
+  const comps = iv.components.map(x=>byId[x]).filter(Boolean);
+  const bad = comps.filter(c=>c.status!=='implemented'&&c.status!=='temporary').length;
+  const caps = iv.capabilities.map(x=>capById[x]).filter(Boolean);
+  const ver = caps.filter(c=>c.implementation.verified==='yes').length;
+  const part = caps.filter(c=>c.implementation.verified==='partial').length;
+  return {comps, bad, caps, ver, part};
+}
+
+function renderInv(main){
+  const v = VIEWS.find(x=>x.id===S.view);
+  main.innerHTML = `<div class="viewnote">${v.note}</div>` + INV.map(iv=>{
+    const r = invRollup(iv);
+    const mk = iv.mark==='explicit'?'ok':iv.mark==='implied'?'mid':'warn';
+    const ik = r.bad?'mid':'ok';
+    const vk = r.ver===r.caps.length?'ok':(r.ver+r.part)?'mid':'warn';
+    return `<div class="inv" data-inv="${iv.id}">
+      <h4><span class="n">${iv.id}</span> ${iv.title}
+        <span class="mark ${iv.mark}">${iv.mark}${iv.split?' · split':''}</span></h4>
+      <div class="bars">
+        <div class="bar"><b>target</b><span class="v ${mk}">${
+          iv.mark==='explicit'?'written down':iv.mark==='implied'?'not stated':'no answer exists'}</span></div>
+        <div class="bar"><b>implementation</b><span class="v ${ik}">${r.comps.length} components, ${r.bad} not live</span></div>
+        <div class="bar"><b>runtime verification</b><span class="v ${vk}">${r.ver} of ${r.caps.length} capabilities verified${r.part?', '+r.part+' partly':''}</span></div>
+      </div>
+      ${iv.question?`<p class="q">${iv.question}</p>`:''}
+      <div style="margin-top:8px">${iv.capabilities.map(c=>`<button class="cchip" data-cap="${c}">${c}</button>`).join('')}</div>
+      <div style="margin-top:4px">${iv.components.map(compChip).join('')}</div>
+    </div>`;
+  }).join('');
+  main.querySelectorAll('.cchip[data-id]').forEach(b=>b.onclick=()=>{S.sel=b.dataset.id;renderSide(b.dataset.id);});
+  main.querySelectorAll('.cchip[data-cap]').forEach(b=>b.onclick=()=>renderCapSide(b.dataset.cap));
+}
+
+function renderFlow(main){
+  const f = FLOWS[S.flow];
+  main.innerHTML = `${diagramPanel(FLOWS[S.flow].file)}<div class="viewnote"><b>Three requests, traced through real code.</b> Steps marked in red are branches, fallbacks or refusals the implementation actually takes. Click a component name to open its record. The Mermaid sequence source for each flow is under the panel on the right.</div>
+  <div class="flowsel">${Object.entries(FLOWS).map(([k,x])=>`<button data-f="${k}" class="${k===S.flow?'on':''}">${x.name}</button>`).join('')}</div>
+  <ol class="steps">${f.steps.map(s=>`<li class="${s.branch?'branch':''}">
+     ${s.who.map(w=>`<span class="who" data-id="${w}">${byId[w]?byId[w].id:w}</span>`).join('')}
+     ${s.t}<span class="ev">${s.ev}</span></li>`).join('')}</ol>`;
+  main.querySelectorAll('.flowsel button').forEach(b=>b.onclick=()=>{S.flow=b.dataset.f;renderFlow(main);});
+  main.querySelectorAll('.who').forEach(b=>b.onclick=()=>select(b.dataset.id));
+  wireDiagram();
+}
+
+function diagramFileFor(){
+  return {v1:'01-system-topology.mmd',v2:'02-core-internals.mmd',
+          v4:'04-state-ownership.mmd',v5:'05-dependency-boundary.mmd'}[S.view] || null;
+}
+
+// The rendered picture, from the committed SVG beside the .mmd. Absent SVG ⇒
+// no panel at all, rather than an empty frame: `sh docs/architecture/render.sh`
+// is what fills it, and a missing file means that has not been run.
+function diagramPanel(mmFile){
+  if (!mmFile) return '';
+  const svg = SVG[mmFile.replace(/\.mmd$/, '.svg')];
+  if (!svg) return '';
+  const open = !S.diaClosed;
+  return `<div class="dia">
+    <div class="dia-h" id="diaH"><span class="caret">${open?'▾':'▸'}</span><b>Rendered diagram</b>
+      <span class="fn">diagrams/${mmFile.replace(/\.mmd$/,'.svg')}</span>
+      <span class="zoom"><button data-z="-1" title="zoom out">−</button><button data-z="0" title="fit">◻</button><button data-z="1" title="zoom in">+</button></span>
+    </div>
+    <div class="dia-body" id="diaBody" ${open?'':'style="display:none"'}><div id="diaScale">${svg}</div></div>
+  </div>`;
+}
+
+function wireDiagram(){
+  const h = document.getElementById('diaH'); if (!h) return;
+  const body = document.getElementById('diaBody'), scale = document.getElementById('diaScale');
+  // The mermaid SVG carries width="100%" and a viewBox, so it fills whatever
+  // box it is given. Widening the wrapper past 100% is the zoom, and the
+  // .dia-body scrollbar is what makes the extra width reachable. A CSS
+  // transform would scale the scrollport too and clip the bottom of a tall
+  // flowchart, which 01-system-topology is at 2304x3542.
+  const apply = () => { scale.style.width = (S.diaZoom*100)+'%'; };
+  h.onclick = ev => {
+    const z = ev.target.closest('button');
+    if (z){ ev.stopPropagation();
+      const d = +z.dataset.z;
+      S.diaZoom = d===0 ? 1 : Math.min(3, Math.max(.25, S.diaZoom + d*0.2));
+      apply(); return; }
+    S.diaClosed = !S.diaClosed; renderView(); if (S.sel) select(S.sel);
+  };
+  apply();
+}
+
+function drawWires(){
+  const svg = document.getElementById('wires');
+  if (!svg) return;
+  svg.innerHTML='';
+  if (!T('tWires') || !S.sel) return;
+  const main = document.getElementById('main'), mr = main.getBoundingClientRect();
+  const pos = id => { const el = main.querySelector(`.chip[data-id="${id}"]`); if(!el) return null;
+    const r = el.getBoundingClientRect();
+    return {x:r.left-mr.left+main.scrollLeft+r.width/2, y:r.top-mr.top+main.scrollTop+r.height/2}; };
+  const a = pos(S.sel); if (!a) return;
+  edgesOf(S.sel).filter(e=>!edgeHidden(e)).forEach(e=>{
+    const other = e.from===S.sel ? e.to : e.from, b = pos(other); if (!b) return;
+    const out = e.from===S.sel;
+    const col = e.confidence==='low' ? '#e08080' : e.confidence==='medium' ? '#c9a227' : (out?'#7fb3ff':'#6ed0a8');
+    const mx = (a.x+b.x)/2;
+    const p = document.createElementNS('http://www.w3.org/2000/svg','path');
+    p.setAttribute('d',`M${a.x},${a.y} C${mx},${a.y} ${mx},${b.y} ${b.x},${b.y}`);
+    p.setAttribute('stroke',col); p.setAttribute('stroke-width','1.4'); p.setAttribute('fill','none');
+    p.setAttribute('opacity','.75');
+    if (e.status!=='implemented') p.setAttribute('stroke-dasharray','5 4');
+    svg.appendChild(p);
+  });
+}
+
+function select(id){
+  S.sel = id;
+  document.querySelectorAll('.chip').forEach(ch=>{
+    ch.classList.remove('sel','rel','dim');
+    if (ch.dataset.id===id) ch.classList.add('sel');
+  });
+  const rel = new Set(edgesOf(id).filter(e=>!edgeHidden(e)).map(e=>e.from===id?e.to:e.from));
+  document.querySelectorAll('.chip').forEach(ch=>{
+    if (ch.dataset.id!==id) ch.classList.add(rel.has(ch.dataset.id)?'rel':'dim');
+  });
+  renderSide(id);
+  drawWires();
+}
+
+function relRow(e, id){
+  const out = e.from===id, other = out?e.to:e.from, oc = byId[other];
+  const marks=[];
+  if (e.confidence!=='high') marks.push(`<span class="b ${e.confidence==='low'?'lo':'me'}">${e.confidence}</span>`);
+  if (e.status!=='implemented') marks.push(`<span class="b off">${e.status}</span>`);
+  return `<button class="rel" data-id="${other}"><span class="k">${out?'→':'←'} ${e.kind}</span>${oc?oc.id:other} ${marks.join('')}
+    <span class="ev">${e.label}${e.evidence?' · '+e.evidence:''}</span></button>`;
+}
+
+function renderSide(id){
+  const c = byId[id], side = document.getElementById('side');
+  if (!c){ side.innerHTML = `<div class="empty">No record for <code>${id}</code>.</div>`; return; }
+  const es = edgesOf(id).filter(e=>!edgeHidden(e));
+  const outE = es.filter(e=>e.from===id), inE = es.filter(e=>e.to===id);
+  const mmFile = S.view==='v3' ? FLOWS[S.flow].file : {v1:'01-system-topology.mmd',v2:'02-core-internals.mmd',v4:'04-state-ownership.mmd',v5:'05-dependency-boundary.mmd'}[S.view];
+  side.innerHTML = `
+    <h3>${c.id}</h3>
+    <div class="sub">${c.type} · ${c.group} · ${c.status} · ${c.confidence} confidence</div>
+    <p>${c.responsibility}</p>
+    ${c.notes?`<div class="note">${c.notes}</div>`:''}
+    <section><h4>Files</h4><ul class="plain">${c.files.map(f=>`<li class="mono">${f}</li>`).join('')}</ul></section>
+    <section><h4>Symbols</h4><ul class="plain">${c.symbols.map(s=>`<li class="mono">${s}</li>`).join('')}</ul></section>
+    <section><h4>Outgoing — ${outE.length}</h4>${outE.map(e=>relRow(e,id)).join('')||'<div class="empty" style="margin:0">none</div>'}</section>
+    <section><h4>Incoming — ${inE.length}</h4>${inE.map(e=>relRow(e,id)).join('')||'<div class="empty" style="margin:0">none</div>'}</section>
+    ${mmFile?`<section><h4>Mermaid source — ${mmFile}</h4><pre class="mm">${MERMAID[mmFile].replace(/[&<>]/g,m=>({'&':'&amp;','<':'&lt;','>':'&gt;'}[m]))}</pre></section>`:''}`;
+  side.querySelectorAll('.rel').forEach(b=>b.onclick=()=>{
+    const t=b.dataset.id;
+    if (!document.querySelector(`.chip[data-id="${t}"]`)) { renderSide(t); S.sel=t; drawWires(); }
+    else select(t);
+  });
+}
+
+/* ---------------- search ---------------- */
+function search(){
+  const q = document.getElementById('q').value.trim().toLowerCase();
+  const box = document.getElementById('results');
+  if (q.length<2){ box.innerHTML=''; return; }
+  const hits=[];
+  for (const c of ARCH.components){
+    const where=[];
+    if (c.id.toLowerCase().includes(q)) where.push('id');
+    if (c.responsibility.toLowerCase().includes(q)) where.push('responsibility');
+    const f = c.files.filter(x=>x.toLowerCase().includes(q));
+    const s = c.symbols.filter(x=>x.toLowerCase().includes(q));
+    if (f.length) where.push('file: '+f[0]);
+    if (s.length) where.push('symbol: '+s[0]);
+    if ((c.notes||'').toLowerCase().includes(q)) where.push('note');
+    if (where.length) hits.push([c, where]);
+  }
+  box.innerHTML = hits.slice(0,60).map(([c,w])=>`<button data-id="${c.id}">${c.id}<br><em>${w.join(' · ')}</em></button>`).join('')
+    || '<button disabled style="color:#5f6c85">no match</button>';
+  box.querySelectorAll('button[data-id]').forEach(b=>b.onclick=()=>{
+    const el = document.querySelector(`.chip[data-id="${b.dataset.id}"]`);
+    if (el){ select(b.dataset.id); el.scrollIntoView({block:'center',behavior:'smooth'}); }
+    else { S.sel=b.dataset.id; renderSide(b.dataset.id); }
+  });
+}
+
+/* ---------------- boot ---------------- */
+document.getElementById('commit').textContent = ARCH.commit.slice(0,7);
+document.getElementById('gen').textContent = ARCH.generated;
+document.getElementById('counts').textContent = `${ARCH.components.length} components · ${ARCH.edges.length} relations`;
+document.getElementById('dirty').textContent = ARCH.working_tree;
+document.getElementById('views').innerHTML = VIEWS.map(v=>`<button class="viewbtn" data-v="${v.id}">${v.name}<small>${v.hint}</small></button>`).join('');
+document.getElementById('legend').innerHTML = [...new Set(ARCH.components.map(c=>c.type))].sort().map(t=>`<span>${t}</span>`).join('');
+
+function setView(id){ S.view=id; S.sel=null; S.selCap=null;
+  // The relation filters and the component-type legend do nothing in the
+  // capability views. Leaving them visible reads as controls that are broken.
+  const vw = VIEWS.find(x=>x.id===id);
+  document.getElementById('archctl').style.display = (vw.caps || vw.inv) ? 'none' : '';
+  document.querySelectorAll('.viewbtn').forEach(b=>b.classList.toggle('on', b.dataset.v===id));
+  renderView();
+  const v = VIEWS.find(x=>x.id===id);
+  document.getElementById('side').innerHTML = v.caps
+    ? '<div class="empty">Select a capability to see its definition of done, every verdict and its evidence, the components that carry it, its blockers and the product questions it waits on.<br><br>A dot is never an opinion. Six of the seven come from component status, the seventh from a probe run.</div>'
+    : v.inv
+    ? '<div class="empty">Twelve rules that run across all 51 capabilities. Click a capability or a component to open its record.<br><br>An unresolved rule is a product question, not a defect.</div>'
+    : '<div class="empty">Select a component to see its responsibility, the files and symbols it was read from, and every relation in and out.</div>';
+}
+document.querySelectorAll('.viewbtn').forEach(b=>b.onclick=()=>setView(b.dataset.v));
+['tLow','tMed','tOff','tUndeployed','tPlanned','tWires'].forEach(k=>
+  document.getElementById(k).onchange=()=>{ renderView(); if(S.sel) select(S.sel); });
+document.getElementById('q').oninput = search;
+document.getElementById('main').addEventListener('scroll', drawWires);
+window.addEventListener('resize', drawWires);
+setView('v1');
+</script>
+</body>
+</html>

docs/capabilities/README.md

@@ -0,0 +1,125 @@
+# docs/capabilities/
+
+Generated. Regenerated from `docs/spec.md` plus a named eval. Not hand-edited.
+
+`docs/spec.md` says what Maven should do. This directory says how much of that
+exists, measured rather than asserted. The predecessor audit had a green test
+suite while 22 of 39 capabilities were not live, which is the failure mode the
+whole directory is built against.
+
+## The files
+
+| file | what it is | hand-edited |
+| --- | --- | --- |
+| `ledger.yaml` | the ledger: 51 capabilities, 156 DoD criteria, one verdict per criterion, seven implementation dimensions per capability | no |
+| `build_ledger.py` | extracts the ledger from `docs/spec.md` and joins the two inputs | yes, it is the source |
+| `domains.yaml` | the domain axis, one of the two judgment calls in the extraction | yes |
+| `implementation.yaml` | capability to component mapping, the other judgment call | yes |
+| `verdicts.json` | one verdict per criterion id, produced by scoring a probe run | no, scored |
+| `probes_field.json` | 25 multi-turn probes: the owner's real week | yes |
+| `probes_dod.json` | probes derived from the ledger's criteria | no, generated |
+| `run_probes.py` | drives a probe file through the deployed stack | yes |
+| `store_counts.py` | row counts per store, over IPC | yes |
+| `invariants.md` | the twelve cross-cutting rules the 51 capabilities imply, with the prose and the evidence | yes |
+| `invariants.yaml` | the machine-readable half of the same twelve: mark, capabilities, components | yes |
+| `gaps.md` | eight gap classes and the one ranked priority list | yes, except classes 1-4 |
+| `out/` | raw probe output, one JSON object per line | no |
+
+## Rebuilding
+
+```sh
+python3 docs/capabilities/build_ledger.py      # spec.md + domains.yaml + implementation.yaml + verdicts.json + maven-architecture.json -> ledger.yaml
+```
+
+The generator is also the checker. It fails, loudly and non-zero, on a
+capability with no DoD criteria, a capability with no `State` line, a criterion
+id collision, a capability with no domain or more than two, an unknown domain
+name, a `domains.yaml` row naming a capability that does not exist, a
+`verdicts.json` row scoring a criterion that does not exist, a verdict word
+outside the five, and a reason outside the plan's list. It caught the domain
+reconciler silently dropping `recall` from its 51.
+
+It fails on an invariant whose `## N. Title` heading is absent from
+`invariants.md`, on a count mismatch between the two files, on an unknown
+capability or component in `invariants.yaml`, and on an `unresolved` invariant
+carrying no product question. The two files exist separately so the viewer can
+read one and a person can read the other, and they drift the moment nothing
+checks them.
+
+It also fails on a capability missing from `implementation.yaml`, a component id
+that `docs/architecture/maven-architecture.json` does not carry, and a component
+status the dimension table does not know. A capability absent from the mapping
+would read `no` on every dimension, which is indistinguishable from a capability
+nothing carries.
+
+## The seven dimensions
+
+Never one `implemented` boolean. Coded and unwired, wired and unconfigured, and
+configured and undeployed are three different pieces of work.
+
+`designed`, `code_present`, `wired`, `configured`, `deployed` and `reachable`
+come from the `status` field of every component mapped to the capability, rolled
+up as all yes, none no, otherwise partial. `verified` comes from the criteria
+verdicts: yes when every one passes, partial when some do.
+
+`designed` answers a narrower question, because `docs/spec.md` states all 51 of
+them. It reads `yes` when a living doc owns the subsystem, and `spec-only` when
+the State line says no living doc or no package.
+
+A component the mapping does not use is reported by name at the end of a build.
+Shared infrastructure is excluded on purpose: mapping `core.reactive_handler` to
+everything would give all 51 rows the same status and say nothing.
+
+## Running the probes
+
+The probes run **on homesrv**, where mavweb is on `127.0.0.1:9201` and the
+mavend socket is reachable from inside the container.
+
+```sh
+# Build the probe binary. It needs CGO and the target's glibc, so build it in a
+# trixie container: both the golang image and the mavend image are trixie.
+docker run --rm -v "$PWD":/src -w /src \
+  -e CGO_ENABLED=1 -e GOFLAGS=-mod=vendor \
+  -e GOCACHE=/src/.cache/gocache -e GOPATH=/src/.cache/gopath \
+  golang:1.25-trixie go build -buildvcs=false -o /src/.cache/e2eprobe ./cmd/e2eprobe
+docker cp .cache/e2eprobe maven-mavend-1:/tmp/e2eprobe
+
+python3 docs/capabilities/store_counts.py                          # before
+python3 docs/capabilities/run_probes.py probes_field.json > out/field.raw.jsonl
+python3 docs/capabilities/store_counts.py                          # after
+```
+
+## Two things the harness learned the hard way
+
+**Probes must be isolated.** `mavweb` hardcodes one conversation id for the
+whole web reach, so a clarify parked by one probe is still parked for the next.
+The first run measured the previous probe, not the current one: the park set at
+turn 8 appended `Сейчас 01:07. В какой день?` to turns 9 through 13, five
+unrelated turns in a row, including plain statements. `run_probes.py` now sends `отмена` before every
+probe. The contaminated run is kept at `out/field.contaminated.jsonl`, because
+the leak is a finding and not only an artifact.
+
+**Readback is the contract, not the file.** The plaintext database copy at
+`/dev/shm/maven-plain.db` would answer every question faster and would bypass
+the IPC contract the ledger exists to measure. The mavweb pages are a
+second-hand rendering of the same thing.
+
+## What a verdict means
+
+`pass` comes only from `live` evidence: the deployed build, the real model, real
+store rows. The scenario harness scripts both `route` and `reply`, so a green
+scenario proves the wiring around the model and not the turn; it is recorded as
+implementation evidence and reads `untested`. `simulated` is allowed only where
+the trigger is anchored to a wall-clock hour or date a probe cannot reach.
+
+## The viewer
+
+`docs/architecture/index.html` views 6 and 7 read this directory.
+`build_viewer.py` inlines `ledger.yaml` and `invariants.yaml` and derives
+nothing: the ledger's build is the only thing allowed to decide a dimension, and
+a second derivation would drift from it silently.
+
+```sh
+python3 docs/architecture/build_viewer.py
+node    docs/architecture/check_viewer.js
+```

docs/capabilities/build_ledger.py

@@ -0,0 +1,592 @@
+#!/usr/bin/env python3
+"""Extract the target side of the capability ledger from docs/spec.md.
+
+Mechanical. No implementation judgment, no verification status, no ranking.
+Domain assignment is the one human input and lives in domains.yaml, keyed by
+capability id; this script only joins it and fails loudly on a mismatch.
+
+Run from the repo root:  python3 docs/capabilities/build_ledger.py
+"""
+import hashlib
+import json
+import pathlib
+import re
+import sys
+
+ROOT = pathlib.Path(__file__).resolve().parents[2]
+SPEC = ROOT / "docs" / "spec.md"
+OUT = ROOT / "docs" / "capabilities" / "ledger.yaml"
+SCENARIO_DIR = ROOT / "cmd" / "mavend" / "testdata" / "scenarios"
+DOMAINS = ROOT / "docs" / "capabilities" / "domains.yaml"
+VERDICTS = ROOT / "docs" / "capabilities" / "verdicts.json"
+IMPL = ROOT / "docs" / "capabilities" / "implementation.yaml"
+ARCH = ROOT / "docs" / "architecture" / "maven-architecture.json"
+INV_YAML = ROOT / "docs" / "capabilities" / "invariants.yaml"
+INV_MD = ROOT / "docs" / "capabilities" / "invariants.md"
+
+# Sections of docs/spec.md whose ### headings are capabilities. Every other ##
+# is prose about how to read the file.
+CAPABILITY_SECTIONS = {
+    "The turn",
+    "Memory",
+    "Proactive",
+    "Reach",
+    "Speech and senses",
+    "The ecosystem",
+    "Operations",
+    "Undesigned in v1",
+}
+
+# Backticked identifiers that appear on a Scenario line and are not scenarios.
+NOT_SCENARIOS = {"mavseal", "docker"}
+
+DOMAIN_NAMES = {
+    "perception", "memory", "attention", "deliberation",
+    "initiative", "action", "interaction", "governance", "operations",
+}
+
+
+def slug(title):
+    s = re.sub(r"[^a-z0-9]+", "-", title.lower()).strip("-")
+    return s
+
+
+def crit_id(cap_slug, text):
+    h = hashlib.sha256(text.encode("utf-8")).hexdigest()[:4]
+    return f"{cap_slug}#{h}"
+
+
+def unwrap(lines):
+    """Join a bullet's continuation lines into one string."""
+    return " ".join(l.strip() for l in lines).strip()
+
+
+def parse():
+    lines = SPEC.read_text(encoding="utf-8").splitlines()
+    caps = []
+    section = None
+    cur = None
+    mode = None          # None | 'dod' | 'state' | 'scenario'
+    buf = []             # continuation lines of the bullet being read
+    section_notes = {}
+
+    def flush_bullet():
+        nonlocal buf
+        if not buf or cur is None:
+            buf = []
+            return
+        text = unwrap(buf)
+        buf = []
+        if not text:
+            return
+        if mode == "dod":
+            cur["dod"].append(text)
+        elif mode == "state":
+            cur["state"] = text
+        elif mode == "scenario":
+            cur["scenario_raw"] = text
+
+    for raw in lines:
+        if raw.startswith("## "):
+            flush_bullet()
+            mode = None
+            cur = None
+            section = raw[3:].strip()
+            continue
+        if raw.startswith("### "):
+            flush_bullet()
+            mode = None
+            if section not in CAPABILITY_SECTIONS:
+                cur = None
+                continue
+            title = raw[4:].strip()
+            cur = {
+                "id": slug(title),
+                "title": title,
+                "section": section,
+                "scope": "v1",
+                "state": "",
+                "finding": "",
+                "dod": [],
+                "scenario_raw": "",
+                "body": [],
+            }
+            caps.append(cur)
+            continue
+        if cur is None:
+            # Section-level prose. Keep a Finding paragraph, it belongs to the
+            # whole cluster (Memory has one).
+            if section in CAPABILITY_SECTIONS and "**Finding**" in raw:
+                section_notes.setdefault(section, []).append(raw.strip())
+            elif section in section_notes and raw.strip() and not raw.startswith("#"):
+                # continuation of that paragraph
+                if section_notes[section] and section_notes[section][-1]:
+                    section_notes[section][-1] += " " + raw.strip()
+            continue
+
+        cur["body"].append(raw)
+        stripped = raw.strip()
+
+        if stripped.startswith("- **State**:"):
+            flush_bullet()
+            mode = "state"
+            buf = [stripped[len("- **State**:"):]]
+            continue
+        if stripped.startswith("- **DoD**"):
+            flush_bullet()
+            mode = "dod"
+            continue
+        if stripped.startswith("- **Scenario**:"):
+            flush_bullet()
+            mode = "scenario"
+            buf = [stripped[len("- **Scenario**:"):]]
+            continue
+        if stripped.startswith("**Deferred past v1**"):
+            flush_bullet()
+            cur["scope"] = "deferred"
+            cur["deferred_note"] = stripped
+            mode = None
+            continue
+        if not stripped:
+            flush_bullet()
+            continue
+        if mode == "dod":
+            if stripped.startswith("- "):
+                flush_bullet()
+                buf = [stripped[2:]]
+            else:
+                buf.append(stripped)
+            continue
+        if mode in ("state", "scenario"):
+            if stripped.startswith("- "):
+                flush_bullet()
+                mode = None
+            else:
+                buf.append(stripped)
+            continue
+
+    flush_bullet()
+
+    for c in caps:
+        # The Finding sentence lives inside the State bullet in every entry that
+        # has one. Split it out so a gap is a field, not prose.
+        m = re.search(r"\*\*Finding\*\*:\s*(.*)$", c["state"], re.S)
+        if m:
+            c["finding"] = m.group(1).strip()
+            c["state"] = c["state"][: m.start()].strip()
+        c["state"] = c["state"].strip()
+        c["scenarios"] = parse_scenarios(c["scenario_raw"])
+        c["criteria"] = [
+            {"id": crit_id(c["id"], t), "text": t} for t in c["dod"]
+        ]
+        del c["body"], c["dod"], c["scenario_raw"]
+
+    return caps, section_notes
+
+
+def parse_scenarios(raw):
+    """Names in `backticks`, each flagged exists / to write.
+
+    The scenario line is prose in several entries ("covered by cmd/mavweb
+    tests", "none"). Keep the prose verbatim as `note` rather than guessing.
+    """
+    out = []
+    for m in re.finditer(r"`([a-z0-9_]+)`(\s*\*\(to write\)\*)?", raw):
+        name = m.group(1)
+        # A path, a package or a binary named in prose is not a scenario name.
+        if "/" in name or "." in name or name in NOT_SCENARIOS:
+            continue
+        claimed = m.group(2) is None
+        on_disk = (SCENARIO_DIR / f"{name}.json").exists()
+        if not claimed and not on_disk:
+            pass                      # marked (to write) and absent: consistent
+        out.append({"name": name, "claimed": claimed, "exists": on_disk})
+    return {"named": out, "note": raw.strip()}
+
+
+def y(s, indent):
+    """Emit one scalar as a YAML block string, no quoting games."""
+    pad = " " * indent
+    body = "\n".join(pad + "  " + l for l in s.splitlines()) if s else ""
+    return ">-\n" + body if s else '""'
+
+
+VERDICT_WORDS = {"pass", "fail", "blocked", "untested", "unknown"}
+
+# Why a criterion is not passing. The plan's list, and nothing outside it.
+REASON_KINDS = {
+    "code missing", "wiring missing", "configuration missing",
+    "deployment missing", "external dependency unavailable",
+    "scenario missing", "scenario fails",
+    "implementation exists with no runtime proof",
+    "deferred past v1", "not yet probed", "passes",
+}
+
+
+def load_verdicts():
+    if not VERDICTS.exists():
+        return {}
+    return json.loads(VERDICTS.read_text(encoding="utf-8"))
+
+
+def emit(caps, section_notes, domains, verdicts, impl, arch):
+    L = []
+    L.append("# Capability ledger, target side.")
+    L.append("#")
+    L.append("# GENERATED by docs/capabilities/build_ledger.py from docs/spec.md.")
+    L.append("# Do not hand-edit. Domain assignment is the one human input and")
+    L.append("# lives in docs/capabilities/domains.yaml.")
+    L.append("#")
+    L.append("# Verification is per criterion, from verdicts.json. Implementation is")
+    L.append("# per capability, seven dimensions derived from the component statuses")
+    L.append("# in docs/architecture/maven-architecture.json through the mapping in")
+    L.append("# docs/capabilities/implementation.yaml. Never one boolean.")
+    L.append("")
+    L.append(f"source: docs/spec.md")
+    L.append(f"capability_count: {len(caps)}")
+    L.append(f"criterion_count: {sum(len(c['criteria']) for c in caps)}")
+    L.append("")
+    if section_notes:
+        L.append("section_findings:")
+        for sec, notes in section_notes.items():
+            L.append(f"  - section: {sec!r}")
+            L.append("    finding: " + y(" ".join(notes), 4))
+    L.append("")
+    L.append("capabilities:")
+    for c in caps:
+        L.append(f"  - id: {c['id']}")
+        L.append(f"    title: {c['title']!r}")
+        L.append(f"    section: {c['section']!r}")
+        L.append(f"    scope: {c['scope']}")
+        d = domains.get(c["id"], [])
+        L.append("    domain: [" + ", ".join(d) + "]")
+        L.append("    state: " + y(c["state"], 4))
+        if arch:
+            dims = dimensions(c, impl.get(c["id"], []), arch, verdicts)
+            L.append("    implementation:")
+            for k in ("designed", "code_present", "wired", "configured",
+                      "deployed", "reachable", "verified", "gap_class"):
+                # Quoted: bare yes/no are YAML booleans and the
+                # round-trip check reads them back as True/False.
+                L.append(f"      {k}: {dims[k]!r}")
+            comps = impl.get(c["id"], [])
+            L.append("    components: [" + ", ".join(comps) + "]")
+        if c["finding"]:
+            L.append("    finding: " + y(c["finding"], 4))
+        if c.get("deferred_note"):
+            L.append("    deferred_note: " + y(c["deferred_note"], 4))
+        L.append("    scenarios:")
+        for s in c["scenarios"]["named"]:
+            L.append(f"      - name: {s['name']}")
+            L.append(f"        exists: {str(s['exists']).lower()}")
+            if s["claimed"] != s["exists"]:
+                L.append("        discrepancy: spec implies it exists and "
+                         "cmd/mavend/testdata/scenarios has no such file")
+        L.append("    scenario_note: " + y(c["scenarios"]["note"], 4))
+        L.append("    criteria:")
+        for cr in c["criteria"]:
+            L.append(f"      - id: {cr['id']!r}")
+            L.append("        text: " + y(cr["text"], 8))
+            v = verdicts.get(cr["id"])
+            if v is None and c["scope"] == "deferred":
+                v = {"verified": "untested", "reason": "deferred past v1"}
+            if v is None:
+                v = {"verified": "untested", "reason": "not yet probed"}
+            L.append(f"        verified: {v['verified']}")
+            L.append(f"        reason: {v['reason']!r}")
+            if v.get("detail"):
+                L.append("        detail: " + y(v["detail"], 8))
+            ev = v.get("evidence", [])
+            if ev:
+                L.append("        evidence:")
+                for e in ev:
+                    L.append(f"          - {e!r}")
+        L.append("")
+    return "\n".join(L) + "\n"
+
+
+# --- Implementation dimensions -------------------------------------------
+#
+# Never one `implemented` boolean. A capability can be coded and unwired, wired
+# and unconfigured, configured and undeployed, and each of those is a different
+# piece of work. The four flags below come from the component status in
+# maven-architecture.json, which was read from code, config and compose.
+#
+#                        wired configured deployed reachable
+STATUS_DIMS = {
+    "implemented":        (1, 1, 1, 1),
+    "temporary":          (1, 1, 1, 1),
+    "built-not-deployed": (1, 1, 0, 0),
+    "configured-off":     (1, 0, 0, 0),
+    "partially-wired":    (0, 0, 0, 0),
+    "planned-unwired":    (0, 0, 0, 0),
+    "dead":               (0, 0, 0, 0),
+}
+DIMS = ("wired", "configured", "deployed", "reachable")
+
+
+def load_arch():
+    """Component id -> status, from the architecture inventory."""
+    if not ARCH.exists():
+        return {}
+    d = json.loads(ARCH.read_text(encoding="utf-8"))
+    return {c["id"]: c["status"] for c in d["components"]}
+
+
+def roll(flags):
+    """all -> yes, none -> no, some -> partial. Empty -> no."""
+    if not flags:
+        return "no"
+    if all(flags):
+        return "yes"
+    if not any(flags):
+        return "no"
+    return "partial"
+
+
+def dimensions(cap, comps, arch, verdicts):
+    """The seven dimensions for one capability. Never collapsed."""
+    known = [c for c in comps if c in arch]
+    out = {}
+
+    # designed: the spec states every one of these, so the question this
+    # dimension answers is narrower. Does a living doc own the subsystem.
+    st = cap["state"].lower()
+    if "no package" in st:
+        out["designed"] = "spec-only"
+    elif "no living doc" in st or "no capture client" in st:
+        out["designed"] = "spec-only"
+    else:
+        out["designed"] = "yes"
+
+    out["code_present"] = roll([1] * len(known)) if comps else "no"
+
+    for i, name in enumerate(DIMS):
+        out[name] = roll([STATUS_DIMS[arch[c]][i] for c in known])
+
+    vs = [verdicts.get(cr["id"], {}).get("verified", "untested")
+          for cr in cap["criteria"]]
+    # The gap class, for docs/capabilities/gaps.md. Order matters: nothing built
+    # outranks nothing reachable, which outranks something reachable and wrong.
+    if out["code_present"] == "no":
+        out["gap_class"] = "capability missing"
+    elif out["reachable"] != "yes":
+        out["gap_class"] = "capability exists but unreachable"
+    elif any(v == "fail" for v in vs):
+        out["gap_class"] = "capability partial"
+    elif all(v == "pass" for v in vs):
+        out["gap_class"] = "none"
+    else:
+        out["gap_class"] = "capability exists but unverified"
+    if vs and all(v == "pass" for v in vs):
+        out["verified"] = "yes"
+    elif any(v == "pass" for v in vs):
+        out["verified"] = "partial"
+    else:
+        out["verified"] = "no"
+    return out
+
+
+def load_flat(path):
+    """`key: [a, b]` per line, # comments stripped. domains and implementation."""
+    if not path.exists():
+        return {}
+    out = {}
+    for line in path.read_text(encoding="utf-8").splitlines():
+        line = line.split("#", 1)[0].strip()
+        if not line or ":" not in line:
+            continue
+        k, v = line.split(":", 1)
+        vals = [x.strip() for x in v.strip().strip("[]").split(",") if x.strip()]
+        out[k.strip()] = vals
+    return out
+
+
+def main():
+    caps, section_notes = parse()
+    domains = load_flat(DOMAINS)
+    impl = load_flat(IMPL)
+    arch = load_arch()
+    verdicts = load_verdicts()
+
+    errs = []
+    seen = {}
+    for c in caps:
+        for cr in c["criteria"]:
+            if cr["id"] in seen:
+                errs.append(f"criterion id collision: {cr['id']}")
+            seen[cr["id"]] = cr["text"]
+        if not c["criteria"]:
+            errs.append(f"{c['id']}: no DoD criteria extracted")
+        if not c["state"]:
+            errs.append(f"{c['id']}: no State line extracted")
+        d = domains.get(c["id"])
+        if domains:
+            if not d:
+                errs.append(f"{c['id']}: no domain assigned")
+            elif len(d) > 2:
+                errs.append(f"{c['id']}: {len(d)} domains, max is 2")
+            else:
+                for x in d:
+                    if x not in DOMAIN_NAMES:
+                        errs.append(f"{c['id']}: unknown domain {x!r}")
+    cap_ids = {c["id"] for c in caps}
+    for k in domains:
+        if k not in cap_ids:
+            errs.append(f"domains.yaml names unknown capability {k!r}")
+
+    # The mapping is the whole basis of the implementation columns. A capability
+    # missing from it reads as `no` on every dimension, which is indistinguishable
+    # from a capability nothing carries. Refuse rather than guess which.
+    if impl:
+        if not arch:
+            errs.append("implementation.yaml is present and "
+                        "docs/architecture/maven-architecture.json is not")
+        for k in impl:
+            if k not in cap_ids:
+                errs.append(f"implementation.yaml names unknown capability {k!r}")
+        for c in caps:
+            if c["id"] not in impl:
+                errs.append(f"{c['id']}: no row in implementation.yaml")
+        for k, comps in impl.items():
+            for comp in comps:
+                if arch and comp not in arch:
+                    errs.append(f"{k}: unknown component {comp!r}")
+        for comp, st in arch.items():
+            if st not in STATUS_DIMS:
+                errs.append(f"maven-architecture.json: unknown status {st!r} on {comp}")
+
+    # A verdict cites evidence by path, and a path that resolves to nothing is
+    # worse than no citation: it reads as verified and is not. Section refs are
+    # checked too, because writing "§ Something" that no heading matches is the
+    # easy way to make an unsupported claim look sourced.
+    for cid, v in verdicts.items():
+        for e in v.get("evidence", []):
+            path, _, section = e.partition(" § ")
+            # An evidence string is "<path>[:line] [locator]" or
+            # "<path> § <heading>". The locator points inside the file
+            # (a probe id, a readback key) and is not part of the path.
+            path = path.strip().split()[0].split(":")[0]
+            f = ROOT / path
+            if not f.exists():
+                errs.append(f"{cid}: evidence path does not exist: {path}")
+            elif section and f.suffix == ".md" and section.strip() not in f.read_text(encoding="utf-8"):
+                errs.append(f"{cid}: evidence names a section not in {path}: {section}")
+
+    for cid, v in verdicts.items():
+        if cid not in seen:
+            errs.append(f"verdicts.json scores unknown criterion {cid!r}")
+        elif v.get("verified") not in VERDICT_WORDS:
+            errs.append(f"{cid}: verdict {v.get('verified')!r} is not one of {sorted(VERDICT_WORDS)}")
+        elif v.get("reason") not in REASON_KINDS:
+            errs.append(f"{cid}: reason {v.get('reason')!r} is not one of the plan's kinds")
+        elif v["verified"] == "pass" and v["reason"] != "passes":
+            errs.append(f"{cid}: a pass carries reason {v['reason']!r}")
+        elif v["verified"] != "pass" and v["reason"] == "passes":
+            errs.append(f"{cid}: reason 'passes' on a {v['verified']} verdict")
+        elif v["verified"] == "fail" and v["reason"] == "implementation exists with no runtime proof":
+            # That reason means nothing was observed. A fail was observed, or it
+            # is not a fail. Mixing them is how a wrong diagnosis survives.
+            errs.append(f"{cid}: a fail cannot rest on 'no runtime proof'")
+
+    # The invariants exist twice on purpose: prose and evidence in the .md, the
+    # machine-readable half in the .yaml for the viewer. They drift the moment
+    # nothing checks them, so check them.
+    if INV_YAML.exists():
+        try:
+            import yaml as _y
+        except ImportError:
+            errs.append("pyyaml absent: invariants.yaml was not checked")
+        else:
+            inv = _y.safe_load(INV_YAML.read_text(encoding="utf-8"))["invariants"]
+            md = INV_MD.read_text(encoding="utf-8") if INV_MD.exists() else ""
+            if not md:
+                errs.append("invariants.yaml exists and invariants.md does not")
+            n_md = md.count("\n## ") - md.count("\n## What this file")
+            if md and n_md != len(inv):
+                errs.append(f"invariants: {len(inv)} in the yaml, {n_md} headings in the md")
+            for iv in inv:
+                head = f"## {iv['id']}. {iv['title']}"
+                if md and head not in md:
+                    errs.append(f"invariant {iv['id']}: no heading {head!r} in invariants.md")
+                if iv["mark"] not in {"explicit", "implied", "unresolved"}:
+                    errs.append(f"invariant {iv['id']}: mark {iv['mark']!r} is not one of three")
+                for c in iv["capabilities"]:
+                    if c not in cap_ids:
+                        errs.append(f"invariant {iv['id']}: unknown capability {c!r}")
+                for c in iv["components"]:
+                    if arch and c not in arch:
+                        errs.append(f"invariant {iv['id']}: unknown component {c!r}")
+                if iv["mark"] == "unresolved" and not iv.get("question"):
+                    errs.append(f"invariant {iv['id']}: unresolved with no product question")
+
+    OUT.write_text(emit(caps, section_notes, domains, verdicts, impl, arch), encoding="utf-8")
+
+    # The emitter hand-writes YAML, so it can produce something that reads fine
+    # and does not parse. It did once: evidence came out as a bare list item
+    # inside a mapping. Parse what was just written.
+    try:
+        import yaml
+    except ImportError:
+        errs.append("pyyaml absent: the output was written without a parse check")
+    else:
+        try:
+            doc = yaml.safe_load(OUT.read_text(encoding="utf-8"))
+        except yaml.YAMLError as e:
+            errs.append(f"the emitted ledger is not valid YAML: {e}")
+        else:
+            n = sum(len(c["criteria"]) for c in doc["capabilities"])
+            if n != len(seen):
+                errs.append(f"round trip lost criteria: wrote {len(seen)}, read back {n}")
+            for c in doc["capabilities"]:
+                if c["scope"] != "v1":
+                    continue
+                for cr in c["criteria"]:
+                    if cr["verified"] != "untested" and not cr.get("evidence"):
+                        errs.append(f"{cr['id']}: scored {cr['verified']} with no evidence")
+
+    print(f"{len(caps)} capabilities, {len(seen)} criteria -> {OUT.relative_to(ROOT)}")
+    print(f"  v1: {sum(1 for c in caps if c['scope'] == 'v1')}, "
+          f"deferred: {sum(1 for c in caps if c['scope'] == 'deferred')}")
+    scen = {s["name"]: s["exists"] for c in caps for s in c["scenarios"]["named"]}
+    ghosts = sorted(n for n, e in scen.items() if not e
+                    and any(s["claimed"] for c in caps for s in c["scenarios"]["named"] if s["name"] == n))
+    if ghosts:
+        print(f"  named as existing but absent from disk: {', '.join(ghosts)}")
+    print(f"  scenarios named: {len(scen)}, existing: {sum(scen.values())}, "
+          f"to write: {len(scen) - sum(scen.values())}")
+    if verdicts:
+        from collections import Counter
+        tally = Counter(v["verified"] for v in verdicts.values())
+        print("  verdicts: " + ", ".join(f"{k} {n}" for k, n in sorted(tally.items())))
+    if arch:
+        from collections import Counter as _C
+        for k in ("code_present", "wired", "configured", "deployed", "reachable"):
+            t = _C(dimensions(c, impl.get(c["id"], []), arch, verdicts)[k] for c in caps)
+            print(f"  {k}: " + ", ".join(f"{a} {n}" for a, n in sorted(t.items())))
+        # A capability nothing carries that still scores a pass. Always a
+        # negative criterion passing by absence. Worth seeing, not an error.
+        for c in caps:
+            d_ = dimensions(c, impl.get(c["id"], []), arch, verdicts)
+            if d_["code_present"] == "no" and d_["verified"] != "no":
+                print(f"  ANOMALY {c['id']}: nothing carries it and it scores "
+                      f"verified={d_['verified']} (a negative criterion passing by absence)")
+        t = _C(dimensions(c, impl.get(c["id"], []), arch, verdicts)["gap_class"]
+               for c in caps if c["scope"] == "v1")
+        print("  v1 gap classes: " + ", ".join(f"{a} {n}" for a, n in sorted(t.items())))
+        used = {x for v in impl.values() for x in v}
+        orphan = sorted(set(arch) - used)
+        print(f"  components serving no capability: {len(orphan)}")
+        for o in orphan:
+            print(f"    {o} ({arch[o]})")
+    print(f"  no living doc: {sum(1 for c in caps if 'No living doc' in c['state'] or 'no living doc' in c['state'].lower())}")
+    if errs:
+        print("\nERRORS:", file=sys.stderr)
+        for e in errs:
+            print("  " + e, file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

docs/capabilities/domains.yaml

@@ -0,0 +1,166 @@
+# Domain assignment for the capability ledger. The one human input to
+# build_ledger.py; everything else in ledger.yaml is mechanical.
+#
+# At most two domains, PRIMARY FIRST. Three independent passes ran under
+# different lenses (bottom-up from the DoD, from the owner's experience,
+# from state ownership and effect), then one reconciler re-read the DoD of
+# every contested row and broke the tie. A row marked (contested) is one the
+# three passes did not agree on; its note names what broke the tie.
+#
+# 35 of 51 were unanimous. Goes to the owner once, before any probe runs.
+
+# Unanimous: every criterion interprets an utterance into intent plus source and records which stage decided.
+route-an-utterance: [deliberation]
+
+# Contested; broken by criterion count: two of three DoD lines are parked-turn dialogue lifecycle (cancel by "отмена", survive an interleaved turn and resume), and none is a permission or confirmation, so interaction beats governance for second. (contested)
+ask-instead-of-guessing: [deliberation, interaction]
+
+# Unanimous: every criterion polices what wording reaches the outbound wire.
+speak-as-herself: [interaction]
+
+# Contested; broken by criterion dbeb, which is the privacy ordering rule (owner's sources before anything outside, every time), not an interpretation step, so governance beats deliberation. (contested)
+answer-from-your-own-data: [memory, governance]
+
+# Unanimous: retrieve an external answer, bounded by what may leave the box.
+answer-from-the-world: [action, governance]
+
+# Unanimous: pick the right Kiwix book and retrieve a topically correct article — pure retrieval.
+read-an-encyclopedia: [action]
+
+# Unanimous: call a configured provider, with the follow-up city parked as a clarify rather than guessed.
+weather: [action, deliberation]
+
+# Contested; I overrule the two perception-first votes on the ledger's own weather logic: the DoD is an offloaded vision tool call over content he supplied, with a silent fallback, so it is a tool call first and sensing second. (contested)
+see-an-image: [action, perception]
+
+# Contested; broken by reading the criteria: write, honest confirmation, supersede and Nexus-resolved subject are all fact-store integrity, and none is a permission, privacy or confirmation-binding rule, so governance drops. (contested)
+facts: [memory]
+
+# Contested; broken by criterion count: capture, recall and delete are the store's lifecycle, and "a question is not stored as a statement" is a routing defect already owned by route-an-utterance, so deliberation drops. (contested)
+notes: [memory]
+
+# Unanimous across all three passes: it reads the note and fact store through
+# the embedder, with the personal boundary deciding what that read may cross
+# into. Recovered from the three passes' journal: the reconciler dropped this
+# row from its 51, and build_ledger.py's guard caught the omission.
+recall: [memory, governance]
+
+# Contested; broken by the ledger finding that the evaluator cannot speak: nothing surfaces to him, so initiative cannot hold, and the DoD's checkable conclusions over notes it read are deliberation. (contested)
+memory-evaluation: [memory, deliberation]
+
+# Unanimous: hold a future commitment, fire it at its time, and get it delivered across reaches.
+reminders: [attention, interaction]
+
+# Unanimous: the whole DoD is whether an unprompted item may break in, keyed on presence and severity.
+interruption-policy: [initiative, perception]
+
+# Unanimous: a suppressed nudge candidate must resurface unprompted in a later digest, without acting.
+digest-of-held-nudges: [initiative, attention]
+
+# Unanimous: an unprompted plan inside its window that must find another reach rather than be dropped.
+morning-routine: [initiative, interaction]
+
+# Unanimous: propose from observed repeated behaviour and store the decline.
+routine-proposals: [initiative, memory]
+
+# Unanimous: open items ordered by deadline and urgency over a stored work list.
+tasks: [attention, memory]
+
+# Unanimous: fetch configured feeds and find the matching item on request, explicitly never unprompted.
+rss-and-news: [action]
+
+# Unanimous: outbound delivery with an outbox row and continuous inbound reading — a reach.
+telegram: [interaction]
+
+# Unanimous: a push reach whose criteria are its credential and not looping when refused.
+ntfy: [interaction]
+
+# Unanimous: a live speech reach, capped at L0 and bound to loopback.
+voice: [interaction, governance]
+
+# Unanimous: a page per capability with step-up standing in front of a destructive write.
+web-ui: [interaction, governance]
+
+# Unanimous: inbound ingests desktop events as low-confidence facts; the outbound half is an undecided fourth reach.
+desk-notifications: [perception, interaction]
+
+# Contested; broken by the DoD being accuracy-enough-to-route plus a silent fallback arm on the voice surface, with nothing about context, so interaction leads and perception stays second. (contested)
+speech-to-text: [interaction, perception]
+
+# Unanimous: the reply rendered as Russian speech with times and numbers expanded for the ear.
+text-to-speech: [interaction]
+
+# Contested; broken by criterion 10ca being the detection itself ("Мэйвен" wakes her, a near-miss does not) — the session it opens belongs to voice, so perception leads. (contested)
+wake-word: [perception, interaction]
+
+# Contested; broken by the DoD being a microphone capture client existing at all — sensing that must exist before any surface — so perception leads over the reach it feeds. (contested)
+hearing: [perception, interaction]
+
+# Contested (order only); broken by criterion 3110 being the recognition itself, with the act-path gate the second criterion it feeds, so perception leads. (contested)
+speaker-recognition: [perception, governance]
+
+# Unanimous: free text resolves to a canonical entity or she asks, and that resolution precedes any mutating call.
+nexus: [deliberation, governance]
+
+# Unanimous: the source of items needing attention, bound by lifecycle words and the no-auto-act rule.
+praxis: [attention, governance]
+
+# Unanimous: the only path that changes the world, bound by a confirmation LLM output cannot supply.
+hexis: [action, governance]
+
+# Unanimous: control a device through Hexis on a Nexus-resolved entity, never by free text.
+smart-home: [action, governance]
+
+# Contested; broken by what the rate-limit criterion actually is — a politeness bound in config, not an authorization gate — so governance drops and action stands alone. (contested)
+network-scans: [action]
+
+# Unanimous: connect and disconnect a paired radio device through the act path.
+bluetooth-control: [action]
+
+# Unanimous: external tools callable through the act path with the allowlist as the only door.
+mcps: [action, governance]
+
+# Unanimous: compose services on the current build and a lossless restart — infrastructure, filed under Operations.
+the-deployed-stack: [operations]
+
+# Contested; broken by all three criteria being secrecy mechanisms (at-rest encryption, key held only by mavend, passwords from files), which is governance's privacy clause carried by infrastructure. (contested)
+encrypted-database: [operations, governance]
+
+# Unanimous: no privileged gate fail-open and step-up per-request — authorization, filed under Operations.
+passkey-and-step-up: [governance, operations]
+
+# Unanimous: which gguf may load and whether the swap survives a restart.
+model-swap: [operations]
+
+# Unanimous: updating the deployment from inside it and rolling back a failure.
+self-update: [operations]
+
+# Unanimous: the build and analyzer gate itself, no agent behaviour in it.
+tests-and-analyzers: [operations]
+
+# Unanimous: a mail workflow whose open criteria are candidates staying candidates and no content leaving the box.
+email-triage: [action, governance]
+
+# Contested; broken by criteria 4047 and 5f7c both refusing to proceed on an under-determined request (ask for the slot, name the conflict), which is deliberation, not proactive attention. (contested)
+calendar-management: [action, deliberation]
+
+# Contested; broken by criterion count: two of four are constraints (robots and politeness, only the URL and utterance leave) against one for the watch, so governance takes second — the watch does pull at initiative. (contested)
+web-crawling: [action, governance]
+
+# Unanimous: pull a named source and condense it, refusing a summary that would invent content.
+summaries: [action, governance]
+
+# Contested; broken by criterion 5134 naming authentication for both directions explicitly, which outweighs the inbound half's perception flavour. (contested)
+webhooks: [interaction, governance]
+
+# Unanimous: a user-set schedule that runs acts under the same confirmation rules as a spoken act.
+cron-jobs: [action, governance]
+
+# Unanimous: a correction stored as a readable, deletable outcome whose only effect is later phrasing.
+learning-the-style: [memory, interaction]
+
+# Unanimous: stored outcomes from dismissals and repairs that change the next decision.
+learning-from-mistakes: [memory, deliberation]
+
+# Contested; broken by criterion 77b5 stating that a chain containing an act confirms each act separately, an explicit confirmation rule that outranks the generic "performs both" pull toward action. (contested)
+command-chaining: [deliberation, governance]

docs/capabilities/gaps.md

@@ -0,0 +1,241 @@
+# Gaps: what is missing, and what the architecture does about it
+
+Hand-written, except the four capability classes, which are derived.
+
+This file compares responsibilities. It never compares package names. A package
+existing is not a capability, and a capability can be spread over six packages
+and still be missing.
+
+## Where each class comes from
+
+Classes 1 through 4 are the `gap_class` field in `docs/capabilities/ledger.yaml`,
+derived from the seven implementation dimensions and the criteria verdicts.
+Rebuild them:
+
+```sh
+python3 docs/capabilities/build_ledger.py
+```
+
+Classes 5 through 8 are read from `docs/architecture/findings.md` and
+`docs/capabilities/invariants.md`. **Every entry names the capability or
+invariant it affects.** An entry affecting neither is marked non-blocking
+cleanup, in those words, and it is the whole of class 8.
+
+Counts are over the 46 v1 capabilities. The 5 deferred ones are excluded.
+
+---
+
+## 1. Capability missing (5)
+
+Nothing carries it. `code_present: no`.
+
+| capability | criteria | note |
+| --- | --- | --- |
+| `summaries` | 0 pass, 3 fail | no package. Wanted by `email-triage`, `web-crawling`, `hearing` and `rss-and-news`, each of which would consume it |
+| `webhooks` | 0 pass, 3 fail | no package. Telegram's own inbound channel is mapped to `telegram`, not here |
+| `command-chaining` | 0 pass, 3 fail | no package. The `chain` in `internal/router` is the world chain and the source chain |
+| `learning-the-style` | 1 pass, 2 fail | the pass is a negative criterion satisfied by absence. The build reports it as an anomaly |
+| `learning-from-mistakes` | 0 pass, 2 fail | no package |
+
+The last two are invariant 10, and it is `unresolved`. Whether behavioural
+learning is wanted is a product question, so these two are not automatically
+work.
+
+## 2. Capability partial (21)
+
+Reachable, and at least one criterion was observed failing. This is the class
+that matters most, because a user can get to all 21 today and 21 misbehave.
+
+`route-an-utterance`, `ask-instead-of-guessing`, `answer-from-your-own-data`,
+`answer-from-the-world`, `read-an-encyclopedia`, `facts`, `notes`, `recall`,
+`reminders`, `voice`, `web-ui`, `desk-notifications`, `wake-word`, `nexus`,
+`praxis`, `the-deployed-stack`, `encrypted-database`, `passkey-and-step-up`,
+`tests-and-analyzers`, `web-crawling`, `cron-jobs`.
+
+`wake-word` is the sharpest: reachable on every dimension and 0 of 2 criteria
+pass.
+
+## 3. Capability exists but unreachable (9)
+
+Built, and the deployed configuration does not reach it.
+
+| capability | why | class of fix |
+| --- | --- | --- |
+| `speak-as-herself` | `reachable: partial` on `core.model_seam` | configuration |
+| `weather` | no `weather` key in the deployed `voice` block | configuration |
+| `see-an-image` | no media block | configuration |
+| `memory-evaluation` | worker is `configured-off` | configuration |
+| `ntfy` | present in the config and disabled there | configuration |
+| `hearing` | `capture.enabled` false and no capture client ships (V-514) | configuration and code |
+| `mcps` | no MCP server configured, and V-478 blocks the one candidate | deployment |
+| `email-triage` | `mavmaild` is not in `docker-compose.yml` | deployment |
+| `calendar-management` | `mavcaldav` is not in `docker-compose.yml` | deployment |
+
+None of these nine is a code defect. Seven are one config block and two are one
+compose entry. `docs/spec.md` says this about the audit's four and it still
+holds for these nine.
+
+## 4. Capability exists but unverified (11)
+
+Reachable, nothing observed failing, and not all criteria pass. These are
+measurement gaps, not defects.
+
+`interruption-policy`, `digest-of-held-nudges`, `morning-routine`,
+`routine-proposals`, `tasks`, `rss-and-news`, `telegram`, `speech-to-text`,
+`text-to-speech`, `hexis`, `network-scans`.
+
+Four of them, the whole Proactive cluster, are untested on every criterion,
+because a proactive behaviour cannot be probed by sending an utterance. That is
+the shape of the gap and it needs a different harness, not more probes.
+
+---
+
+## 5. Duplicated mechanism (6)
+
+| what | affects | owned? |
+| --- | --- | --- |
+| Two independent arbitrations decide one turn: seven intents, then twenty-two ordered query sources (`findings.md` 2.1) | invariant 11, `route-an-utterance`, `answer-from-your-own-data` | no |
+| A third arbitration runs before both: eleven stateful pre-emptors in the pre-route ladder (`findings.md` 2.2) | invariant 11, invariant 6, `ask-instead-of-guessing` | no |
+| Two tier systems. `internal/auth` does not bind the turn path, `internal/tool` is not keyed on the reach (`findings.md` 6.3, 6.3b) | invariant 8, `hexis`, `passkey-and-step-up` | no |
+| Two representations of reach, both ignored (`findings.md` 6.3) | invariant 8, `voice` | no |
+| Two digest mechanisms with the same word in the name, flushed six lines apart (`findings.md` 2.4) | invariant 5, `digest-of-held-nudges` | no |
+| Restraint decided twice: the gate decides whether a rule emits, delivery decides where it lands (`findings.md` 2.3) | `interruption-policy` | **yes**, argued in `channel.go` |
+
+The last row is duplication that is owned. It is listed so it is not
+rediscovered as a defect.
+
+## 6. Missing shared mechanism (6)
+
+| what is missing | affects |
+| --- | --- |
+| A single point that decides whether this origin may perform this effect with this evidence. `origin × effect × evidence → permit` is the target and nothing computes it | invariant 8, `hexis`, `praxis`, `voice`, `passkey-and-step-up` |
+| An owner for a key namespace. `facts` has nine writers, `notes` six, `tools` three unrelated proposers (`findings.md` 1.1, 1.2, 1.3) | invariant 2, `facts`, `notes`, `recall` |
+| A comparable unit of evidence, so claimants can answer "is this more mine than yours?". `internal/claim` is that unit, written, tested and called by nothing (`findings.md` 6.1) | invariant 11, `command-chaining` |
+| A conversation that spans reaches. `mavweb` instead hardcodes one conversation id for the whole web reach | invariant 1, `web-ui`, `voice`, `telegram` |
+| A stated rule for what survives a restart. Six stores, six independent choices, two of them argued | invariant 12, `ask-instead-of-guessing` |
+| A summariser. Four capabilities would consume one and none exists | `summaries`, `email-triage`, `web-crawling`, `hearing` |
+
+## 7. Current architecture conflicts with target behavior (10)
+
+The class where the code works as written and the written thing is not what the
+spec asks for.
+
+| conflict | affects |
+| --- | --- |
+| Four silent degradations stack on one turn, and `docs/spec.md` writes every v1 DoD at "honest" (`findings.md` 8.1) | invariant 7, `answer-from-the-world`, `speech-to-text`, `route-an-utterance`, `speak-as-herself` |
+| `praxisItemAction.handle` calls straight through: acknowledge, resolve, ignore and pin run on first hearing with no tier and no confirm turn (`findings.md` 6.3c, `cmd/mavend/ecosystem_acts.go:158`) | invariant 8, `praxis` |
+| `weather` is a live query source with `guesses: true` and the deployed config selects no provider, so it can claim a turn and answer from a stub (`findings.md` 11.3) | invariant 7, `weather` |
+| `loop.State.CalendarBusy` reads facts `mavcaldav` never writes, so the do-not-nag-mid-meeting suppressor is permanently false (`findings.md` 8.2) | invariant 3, `interruption-policy`, `calendar-management` |
+| Recurring reminders have a column, an IPC parameter and no caller. `actionReminder` passes `""` (`findings.md` 8.3) | `reminders`, `cron-jobs` |
+| The clarify store is not persisted and the expired-clarify notice reads the store that is gone (`findings.md` 7.5) | invariant 6, invariant 12, `ask-instead-of-guessing` |
+| `Claim.Coverage` returns 1.0 for a claim that extracted nothing (`findings.md` 6.3d) | invariant 11. Latent: it corrupts the fix for class 6 row 3 before that fix ships |
+| The act executor runs inside the key holder, and the process boundary is not one of the controls (`findings.md` 5.4) | invariant 8, `hexis`, `encrypted-database` |
+| The voice wire's whole security argument is external: loopback publish plus an ssh tunnel, so one compose edit removes it (`findings.md` 5.5) | invariant 8, `voice` |
+| `make test` is green with the four `TestONNX*` measurements silently skipped, because the recipe does not set `MAVEN_ONNX_LIB` | `tests-and-analyzers`, `recall`. It is why the predecessor audit had a green suite and 22 dead capabilities |
+
+## 8. Architecture concern with no current product impact (11)
+
+**Every row here is non-blocking cleanup.** None names a capability or an
+invariant, which is the test for belonging in this class rather than in 5, 6 or
+7.
+
+- `reactiveHandler` has 34 fields (`findings.md` 4.1).
+- `runTurn` is one function with eleven early returns (4.2).
+- `tick` runs thirteen jobs in one function (4.3).
+- `wireVoice` is one constructor for seventeen subsystems (4.4).
+- `mavsttd` and `mavttsd` are separate processes at a scale that does not need it (5.1).
+- Three IPC connections from one process (5.2).
+- A construction cycle between the API layer and the turn layer (3.1).
+- The handler holds the raw store beside the mediated one (3.2).
+- `queryDayPlan` reads the proactive scheduler, the single call across that line (3.4).
+- `internal/modes` is imported by nothing outside itself (6.2).
+- The daemon is wired twice, in two places (8.6).
+
+Two entries were considered for this class and moved out. `queryNetwork`
+triggering a live LAN scan inside a read path (6.4) affects `network-scans`,
+whose two remaining criteria are `unknown`. `actionFact` re-routing into the
+query chain (6.5) affects `facts` and `route-an-utterance`, which is where the
+"меня зовут Ками" misroute lives.
+
+---
+
+# Priority
+
+One list. The rank is the plan's, and it is about impact today, not about how
+ugly the code is. An unwired or unreachable future defect never outranks a live
+user-visible failure because its architecture is offensive.
+
+## 1. Prevents intended everyday use today
+
+1. **`speak-as-herself` fails all three criteria.** The deployed resident model,
+   `maven-instruct-b2-Q4_K_XL`, produces Russian sentences that no longer hold
+   together, and the phrasing checks that would catch it run in the eval and not
+   on the outbound path. Everything that asks the model to write a sentence
+   inherits this. Formal `вас` and `вы` reached the wire while `CheckFeminine`
+   passed.
+2. **His own name is not stored as a fact.** "меня зовут Ками" routes to chat,
+   so nothing is written, and "что ты помнишь обо мне?" routes to chat too.
+   Two of the seven audit probes, still broken and now broken differently.
+3. **`wake-word` fails both criteria while reachable on every dimension.** Voice
+   is the spine of v1 and the always-on half of it does not work.
+4. **Nine capabilities are one config block or one compose entry from
+   reachable.** `weather`, `ntfy`, `see-an-image`, `memory-evaluation`,
+   `email-triage`, `calendar-management` and `mcps` are the cheap ones. This is
+   the highest ratio of capability to work in the whole list.
+
+## 2. Makes existing behavior incorrect or unreliable
+
+5. **The Praxis lifecycle path has no gate.** Four remote mutations run on first
+   hearing. This is live today and needs no new wiring to matter.
+6. **`weather` answers from a stub and is allowed to claim the turn.** A source
+   marked `guesses: true` with no provider is worse than a named gap.
+7. **The busy suppressor is permanently false.** Every interruption decision
+   that should have deferred to a meeting fails open.
+8. **Four silent degradations stack**, and nothing in a reply distinguishes the
+   worst case from the best. Invariant 7 has no written boundary between "only
+   better" and "cannot do the job".
+9. **A parked clarify survived five consecutive turns** and was released by a
+   path other than `отмена`. Invariant 6 says nobody owns closing it.
+
+## 3. Blocks multiple capabilities
+
+10. **No single authorization point.** Invariant 8, `unresolved`, and the third
+    of the three questions the freeze was called to answer. It blocks `hexis`,
+    `praxis`, `voice` and `passkey-and-step-up`, and it is the one property
+    nobody can currently state.
+11. **No owner for a key namespace.** A fetch watermark and a tuning parameter
+    live in the table recall embeds and `queryFactByKey` reads back as an
+    answer.
+12. **No comparable unit of evidence.** Three ordered lists decide one turn.
+    `command-chaining` cannot be built on top of them, and `internal/claim`
+    carries a live defect before it is wired.
+13. **No summariser.** Four capabilities would consume one.
+
+## 4. Prevents verification
+
+14. **`make test` is green with four measurements skipped.** The recipe does not
+    set `MAVEN_ONNX_LIB`. This is the exact trap `CLAUDE.md` describes, and the
+    baseline walked into it while measuring whether other things had.
+15. **The whole Proactive cluster is untested on every criterion.** A proactive
+    behaviour cannot be probed by sending an utterance. It needs a clock-driving
+    harness, not more probes.
+16. **26 of 31 named scenarios do not exist on disk.** Only 5 of 51 spec entries
+    cite a scenario that is there (`findings.md` 9.5).
+17. **`POST /api/ptt` was called unreachable in an earlier draft and is not.**
+    Four speech criteria were filed `deployment missing` when the deployment is
+    present and the probe was never written.
+
+## 5. Architectural cleanup with no present user impact
+
+18. Everything in class 8, in any order. None of it blocks a capability or an
+    invariant, and that is why it is last.
+
+---
+
+## What this file does not do
+
+It does not schedule. `docs/roadmap.md` orders the work and this file feeds it.
+
+It does not decide the four `unresolved` invariants. Authority and confirmation,
+learning from outcomes, capability composition and the shelf life of a held
+nudge are the owner's, and items 10, 12 and 13 above stall on them.

docs/capabilities/implementation.yaml

@@ -0,0 +1,88 @@
+# Capability -> component mapping. HAND-WRITTEN. This is the judgment call.
+#
+# Component ids come from docs/architecture/maven-architecture.json, whose
+# `status` field was read from code, config and compose and audited against
+# them. build_ledger.py derives the six implementation dimensions from those
+# statuses and refuses an id that file does not carry.
+#
+# What is mapped is what CARRIES the capability, never the infrastructure every
+# capability shares. core.reactive_handler, core.wiring, core.action_table,
+# core.daemon_api and bnd.ipc are deliberately absent: mapping them everywhere
+# would give all 51 rows the same status and say nothing.
+#
+# An empty list means no component carries it. That is the finding, not a hole
+# in this file.
+
+# --- The turn ---
+route-an-utterance: [router.cascade, router.stage0, router.heads, router.llm, router.classifier, router.embedder, router.extractor, core.turn_route, core.topics, core.decision_trace, state.decision_ring, state.routing_traces, state.routing_labels]
+ask-instead-of-guessing: [core.preroute, state.clarify_store, state.dialogue_sessions]
+speak-as-herself: [core.phraser, core.replier, core.action_chat, core.model_seam, svc.llama_server, eval.phrasing]
+answer-from-your-own-data: [core.query_chain, core.q.embed, core.q.memory, core.q.factbykey, core.q.notes, core.q.history, core.q.list, core.q.self, core.q.personal, state.list_items]
+answer-from-the-world: [core.q.search, core.q.web, core.q.general, core.q.personal, ext.searxng]
+read-an-encyclopedia: [core.q.kiwix, ext.kiwix]
+weather: [core.q.weather, ext.openmeteo]
+see-an-image: [core.vision, state.media_blobs]
+
+# --- Memory ---
+facts: [state.facts, core.action_fact, core.fact_enrichment, core.store_api]
+notes: [state.notes, core.action_note]
+recall: [core.recall, state.memory_vectors, router.embedder, core.q.memory, core.q.notes]
+memory-evaluation: [core.memory_eval]
+
+# --- Proactive ---
+reminders: [state.reminders, core.action_reminder, core.dispatcher, state.delivery_attempts]
+interruption-policy: [core.rules, core.dispatcher, core.gatherer, state.presence_state, state.nudges, state.tick_memo]
+digest-of-held-nudges: [state.digest_entries, core.tick_loop, core.rules]
+morning-routine: [core.morning, core.q.dayplan]
+routine-proposals: [core.pattern, core.routines, state.proposed_routines, state.events]
+tasks: [state.tasks, core.q.tasks]
+rss-and-news: [core.feed_worker, core.q.feeds]
+
+# --- Reach ---
+telegram: [core.sink_telegram, core.telegram_intake, ext.telegram, state.ack_sends]
+ntfy: [core.sink_ntfy, ext.ntfy]
+voice: [core.voice_server, bnd.voice_tcp, core.sink_voice, proc.mavenclient]
+web-ui: [proc.mavweb, bnd.http_web]
+desk-notifications: [core.event_bus, proc.mavweb]
+
+# --- Speech and senses ---
+speech-to-text: [core.stt_seam, proc.mavsttd, ext.whispercpp, ext.cw2_stt, bnd.worker]
+text-to-speech: [core.tts_seam, proc.mavttsd, ext.piper, bnd.worker]
+wake-word: [proc.mavwaked, cfg.systemd, ext.alsa]
+hearing: [core.capture, state.media_blobs]
+speaker-recognition: [core.speaker]
+
+# --- The ecosystem ---
+nexus: [ext.nexus, core.ecosystem, bnd.http_ecosystem, state.ecosystem_traces]
+praxis: [ext.praxis, core.ecosystem, core.praxis_acts, core.q.attention, state.surfaced_items, state.ecosystem_traces]
+hexis: [ext.hexis, core.ecosystem, core.ecosystem_hexis_gate, core.action_act, core.risk_policy, state.tools, state.pending_act, state.ecosystem_traces]
+smart-home: [ext.homeassistant, core.home_worker, core.q.home]
+network-scans: [core.netscan, core.q.network]
+# No package, no component. The finding, not an omission.
+bluetooth-control: []
+mcps: [core.mcp_worker, ext.vikunja_mcp]
+
+# --- Operations ---
+the-deployed-stack: [cfg.compose, cfg.mavend, proc.mavend, proc.mavweb, proc.mavsttd, proc.mavttsd, proc.mavpoll, proc.mavgpud, ext.netdata, ext.uptimekuma]
+encrypted-database: [state.db_file, state.db, state.db_tmpfs, proc.mavseal]
+passkey-and-step-up: [state.wrapped_key, state.passkey_file, core.daemon_lock, core.auth_gate, bnd.http_web]
+model-swap: [core.modelswap, svc.llama_server]
+self-update: [proc.mavupdate]
+tests-and-analyzers: [eval.gates, eval.router, eval.phrasing]
+
+# --- Undesigned in v1 ---
+email-triage: [proc.mavmaild, core.mail_intake, state.maildata]
+calendar-management: [proc.mavcaldav, core.q.calendar]
+web-crawling: [core.crawl_worker, core.q.web]
+summaries: []
+# Empty on purpose. core.telegram_intake is Telegram's own inbound channel and
+# is mapped to `telegram`. Mapping it here too would make this row read as
+# built and deployed when all three of its criteria fail on code missing.
+webhooks: []
+cron-jobs: [core.routines, core.tick_loop]
+learning-the-style: []
+# state.routing_labels holds owner corrections of a route and is deliberately
+# NOT mapped here. It is route learning, not behavioural learning, and mapping
+# it would make this row read as partially built when nothing reads it back.
+learning-from-mistakes: []
+command-chaining: []

docs/capabilities/invariants.md

@@ -0,0 +1,281 @@
+# The cross-cutting rules the 51 capabilities imply
+
+Hand-written. The one file in this directory that is not generated.
+
+`docs/spec.md` states 51 capabilities one at a time. Twelve rules run across all
+of them, and no capability's definition of done states any of these. A rule
+broken here breaks many capabilities at once, which is why it does not show up
+as one failing criterion.
+
+Each rule carries a mark. A rule split between what is written down and what
+is not carries both, and says which half is which.
+
+| mark | meaning |
+| --- | --- |
+| `explicit` | a source states the rule and names its enforcement point |
+| `implied` | capabilities depend on it, no source states it, and the code decides it case by case |
+| `unresolved` | the sources do not answer it. A product question, not a defect |
+
+Nothing wanted is invented where the sources are silent. An `unresolved` rule
+needs the owner, not a commit.
+
+Evidence is `docs/architecture/findings.md` for the code reading,
+`docs/evals/2026-08-26-capability-baseline.md` for what ran, and the file itself
+where the rule is written down.
+
+---
+
+## 1. Continuity across turns and across reaches
+
+**Implied.** Continuity within one reach is built. Continuity across reaches is
+not, and nothing states whether it should be.
+
+`dialogue.NewPersistentSessionStore` carries follow-up slots across turns and
+across a restart. The clarify store is a per-reach stack and is deliberately not
+persisted (`findings.md` 7.5, Vikunja #385).
+
+Across reaches there is no shared thread. `mavweb` hardcodes one conversation id
+for the whole web reach, which is not continuity but the absence of separation:
+a clarify parked by one probe was still parked for the next, and the first field
+run had to be discarded for it (`docs/capabilities/README.md`, "Two things the
+harness learned the hard way").
+
+**What breaks:** a question asked by voice and answered on the web has no thread
+to attach to. No capability's DoD asks for one, so nothing scores this.
+
+**The product question:** is a conversation per reach, or one conversation the
+reaches are windows onto?
+
+## 2. Memory and correction semantics
+
+**Explicit for the row, implied for the namespace.**
+
+Supersede is written down and enforced: a correction points `voids_id` at the row
+it replaces, and valid-time is the `ts` column (`internal/store/schema.sql`).
+`CLAUDE.md` states the embedder contract, `EmbedQuery` and `EmbedPassage`, and
+calling plain `Embed` on a note is named as a bug.
+
+Who may write a key is not written anywhere. `facts` has nine writers and no
+owner, and two of them store things that are not observations: `crawl:hash:*` is
+a fetch watermark and `cooldown:<rule>` is a tuning parameter (`findings.md`
+1.1). The `source` column keeps them apart by convention, and the `CHECK`
+constraint covers only `kind`. `notes` has six writers, one of them a LAN scan
+whose records then compete by cosine similarity with things he said
+(`findings.md` 1.2).
+
+**What breaks:** recall answers a question about him with a fetch watermark.
+`queryFactByKey` reads the same table back as an answer.
+
+## 3. Current context and presence
+
+**Explicit and partly false at runtime.**
+
+Presence is one hysteresis bucket rewritten each tick (`state.presence_state`),
+and the dispatcher's routing table is a pure function of severity and presence.
+
+One input is permanently wrong. `loop.State.CalendarBusy` reads
+`facts(kind=env, source=caldav:*)` and `mavcaldav` is commented out of
+`docker-compose.yml`, so the "do not nag mid-meeting" suppressor is always false
+(`findings.md` 8.2). The compose file says so, which makes it a known gap.
+
+**What breaks:** every interruption decision that should have deferred to a
+meeting. It fails open, toward interrupting.
+
+## 4. Proactive attention
+
+**Explicit, and the one prohibition is stated.**
+
+`CLAUDE.md`: no automatic attention-to-action path. Digestion may summarise
+Praxis and may not call Hexis. At most one nudge candidate per tick, and the
+restraint gate is a pure function over the rule set (`core.rules`).
+
+Restraint is decided twice on purpose (`findings.md` 2.3), and blocked candidates
+are held durably in `digest_entries` rather than dropped.
+
+**What breaks:** nothing observed. This is the best-specified rule in the list.
+
+## 5. Interruption policy
+
+**Explicit for the choice, implied for the outcome.**
+
+`docs/handler-wiring.md` owns the dispatch decision, and the table over
+(severity, presence) is pure. Delivery intent is recorded in
+`delivery_attempts` before the external send, so a crash leaves a pending row
+rather than a lost one.
+
+What is not stated is what a held nudge owes the user later. `digest_entries`
+holds blocked candidates and two separate mechanisms carry the word digest
+(`findings.md` 2.4). Nothing says when a held item expires instead of
+resurfacing.
+
+**The product question:** does a held nudge have a shelf life?
+
+## 6. Clarification and follow-up ownership
+
+**Implied.** Who owns an open question, and for how long, is decided by three
+components and stated by none.
+
+`runTurn` step 1 fires an expired-clarify notice, the clarify store is a
+per-reach stack, and the pre-route ladder may claim the turn before routing
+(`findings.md` 2.2). A restart drops a parked request silently, because the
+notice path reads the store that is gone (`findings.md` 7.5).
+
+Measured: one park survived five consecutive turns, turns 9 through 13, and was
+released by a path other than `отмена`
+(`docs/evals/2026-08-26-capability-baseline.md`).
+
+**What breaks:** a question she asked stays open across unrelated turns, and
+neither the ladder nor the store says whose job it is to close it.
+
+## 7. Degradation and honesty
+
+**Explicit as a rule, and the rule contradicts itself in practice.**
+
+`CLAUDE.md` states both halves. Fall back silently when the fallback would only
+do the job better. Name the gap when the resident model cannot do the job at
+all. `docs/spec.md` writes every v1 DoD at "voice-reachable and honest", where
+honest means naming the gap and never filling it with a guess.
+
+Four silent degradations stack on one turn: workstation model to resident model,
+CW2 to mavsttd, routing heads to LLM router to classifier, and search to Kiwix to
+a named page to the model's own weights (`findings.md` 8.1). Each is argued
+individually. Together a reply can be the resident model routing a worse
+transcript with the classifier as a floor, answering from its weights, and
+nothing in the reply distinguishes that from the best case.
+
+**What breaks:** the boundary between "only better" and "cannot do the job" is
+not drawn anywhere, so the stack decides it by accident.
+
+**The product question:** at what depth of fallback does silence stop being
+honest?
+
+## 8. Authority and confirmation
+
+**Unresolved, and this is the largest hole in the list.**
+
+Two systems each answer half and never meet. `internal/auth` answers who may
+carry what authority and does not bind the reactive turn path at all
+(`findings.md` 6.3). `internal/tool` answers what effect a capability has and
+what proof it demands, runs on every act, and is not keyed on the reach
+(`findings.md` 6.3b). Neither has the other's reach.
+
+Two representations of reach exist and both are ignored.
+`internal/voice/server.go:198` defaults an empty `p.Surface` and a
+client-asserted one survives to a handler that never reads it. `:148` hardcodes
+`SurfacePCClient` for every connection. `req.Surface` is request payload on a
+plaintext wire with no auth, so any client can claim `pc_client`. It must not
+become an authorization input as it stands.
+
+One path has no gate at all. `praxisItemAction.handle`
+(`cmd/mavend/ecosystem_acts.go:158`) reads `dec.Slots.Value` and calls straight
+through. Acknowledge, resolve, ignore and pin are remote mutations that run on
+first hearing, with no tier and no confirm turn.
+
+`CLAUDE.md` states the rule the code does not implement: LLM output is not
+authorization, and a confirmation binds capability id, target entity, arguments,
+requester and expiry.
+
+**What breaks:** no one can currently state the authority property of a Maven
+turn. `origin × effect × evidence → permit` is the target shape and nothing
+computes it.
+
+## 9. Privacy boundaries
+
+**Explicit, and it is the best-enforced rule here.**
+
+`CLAUDE.md`: the owner's data first, then the world. His notes and facts are
+never search input, only the utterance leaves the box. The personal boundary is a
+query source with `boundary: true`, and `queryWalk` reads
+`Decision.SourceAnchored` for that source and no other.
+
+The exception is deliberate and recorded. The boundary guesses, so naming
+`SourceWorld` drops it, and only a stage 0 grammar may do that (owner's call,
+V-666). No component reads another component's database, and Praxis attention
+comes over HTTP rather than from its SQLite file.
+
+**What breaks:** nothing observed. The one caveat is that `queryWalk` takes
+sources out and moves none, which is the safety argument, and it holds only as
+long as the table's order stays load-bearing.
+
+## 10. Learning from outcomes
+
+**Unresolved.** One loop exists, two are specified with no package, and nothing
+says whether learning is a product goal.
+
+Built: `state.nudges` is the restraint memory and the only input to the tick
+loop's autotune, which writes `cooldown:<rule>` back into `facts`.
+`state.routing_labels` holds owner corrections of a route.
+
+Not built: `learning-the-style` and `learning-from-mistakes` have no package and
+no component. `docs/spec.md` gives each a DoD written at what done would look
+like. Both score `code_present: no`.
+
+One criterion passes by absence. "No model weights change and no training set is
+built" is a negative, and nothing being built satisfies it. The generator reports
+this as an anomaly rather than counting it as progress.
+
+**The product question:** is behavioural learning wanted, or is the negative
+criterion the whole of the intent?
+
+## 11. Capability composition
+
+**Implied and absent.** Every capability is specified alone and the turn is
+single-claim by construction.
+
+`core.action_table` dispatches one intent to one handler, and a handler returning
+the empty string hands the turn on. `queryWalk` stops at the first source that
+claims. Two independent arbitrations already decide one turn, with a third
+running before both (`findings.md` 2.1, 2.2).
+
+`command-chaining` fails all three of its criteria with reason `wiring missing`.
+The `chain` in `internal/router` is the world chain and the source chain, not
+command chaining.
+
+`internal/claim` is the beginning of a vocabulary for this and is called by
+nothing (`findings.md` 6.1). It carries a live defect: `Claim.Coverage` returns
+1.0 for a claim that extracted nothing, because `claimSpans` includes
+`Slots.Text` unconditionally and `fillSlots` backfills the raw utterance into
+`Text` (`findings.md` 6.3d).
+
+**What breaks:** "напомни мне и запиши это" performs one of the two and says
+nothing about the other.
+
+**The product question:** what is the single unit that competes for a turn. This
+is one of the three the freeze was called to answer.
+
+## 12. Persistence across restart
+
+**Implied.** Four stores made four different choices and no source states the
+rule.
+
+| state | survives a restart | evidence |
+| --- | --- | --- |
+| dialogue sessions | yes | `dialogue.NewPersistentSessionStore` |
+| clarify store | no, deliberately | `findings.md` 7.5, Vikunja #385 |
+| decision ring | no, in-memory bounded at 25 | `internal/decision/ring.go:11` |
+| routing traces | yes, retained 14 days | `CLAUDE.md` |
+| tick memo | no, in-process and argued for one field | `findings.md` 7.4 |
+| surfaced items | no, and no TTL | `findings.md` 7.3 |
+
+Two of these are principled. The decision ring holds his words and is bounded on
+purpose. The clarify store's reasoning is filed. The other four are not decided
+anywhere.
+
+**What breaks:** less than it looks. `surfacedItems` has no TTL, and the source
+comment argues that a stale ordinal resolves to an item Praxis reports as already
+acknowledged, which is harmless because Praxis is the arbiter (`findings.md`
+7.3). The cost is that the same absence of a written rule produced one argued
+choice and three unargued ones.
+
+---
+
+## What this file is for
+
+Session 2 step 2 of `docs/plans/26-capability-ledger-and-baseline.md`. It feeds
+`docs/capabilities/gaps.md`, where every architecture concern must name the
+capability or invariant it affects.
+
+Four rules are `unresolved` and they are the owner's, not a commit's: authority
+and confirmation, learning from outcomes, capability composition, and the shelf
+life of a held nudge. Two of the three questions the freeze was called to answer
+appear here as invariant 8 and invariant 11.

docs/capabilities/invariants.yaml

@@ -0,0 +1,91 @@
+# The structured half of docs/capabilities/invariants.md. HAND-WRITTEN.
+#
+# The prose, the evidence and the reasoning live in the .md. This file carries
+# only what a machine needs: the mark, which capabilities the rule touches, and
+# which components participate in it. build_ledger.py checks the two agree, so
+# an invariant cannot exist in one and not the other.
+#
+# mark: explicit | implied | unresolved. `split` means the rule is written down
+# in one half and not in the other, and the .md says which half is which.
+
+invariants:
+  - id: 1
+    title: Continuity across turns and across reaches
+    mark: implied
+    question: Is a conversation per reach, or one conversation the reaches are windows onto?
+    capabilities: [web-ui, voice, telegram, ask-instead-of-guessing]
+    components: [state.dialogue_sessions, state.clarify_store, proc.mavweb, core.voice_server, core.sink_telegram]
+
+  - id: 2
+    title: Memory and correction semantics
+    mark: explicit
+    split: true
+    capabilities: [facts, notes, recall]
+    components: [state.facts, state.notes, state.memory_vectors, core.recall, router.embedder, core.q.factbykey, core.fact_enrichment, core.netscan]
+
+  - id: 3
+    title: Current context and presence
+    mark: explicit
+    capabilities: [interruption-policy, calendar-management, morning-routine]
+    components: [state.presence_state, core.gatherer, core.q.calendar, proc.mavcaldav, core.dispatcher]
+
+  - id: 4
+    title: Proactive attention
+    mark: explicit
+    capabilities: [interruption-policy, digest-of-held-nudges, routine-proposals, praxis]
+    components: [core.tick_loop, core.rules, state.digest_entries, state.nudges, core.q.attention, ext.praxis]
+
+  - id: 5
+    title: Interruption policy
+    mark: explicit
+    split: true
+    question: Does a held nudge have a shelf life?
+    capabilities: [interruption-policy, digest-of-held-nudges, telegram, ntfy]
+    components: [core.dispatcher, state.delivery_attempts, state.digest_entries, core.rules, core.sink_telegram, core.sink_ntfy, core.sink_voice]
+
+  - id: 6
+    title: Clarification and follow-up ownership
+    mark: implied
+    capabilities: [ask-instead-of-guessing, route-an-utterance]
+    components: [core.preroute, state.clarify_store, state.dialogue_sessions, core.turn_route]
+
+  - id: 7
+    title: Degradation and honesty
+    mark: explicit
+    split: true
+    question: At what depth of fallback does silence stop being honest?
+    capabilities: [answer-from-the-world, speech-to-text, route-an-utterance, speak-as-herself, read-an-encyclopedia, weather]
+    components: [core.model_seam, core.stt_seam, router.cascade, router.classifier, core.query_chain, core.phraser, core.q.kiwix, core.q.general]
+
+  - id: 8
+    title: Authority and confirmation
+    mark: unresolved
+    question: Where is the one point that decides whether this origin may perform this effect with this evidence?
+    capabilities: [hexis, praxis, voice, passkey-and-step-up, encrypted-database]
+    components: [core.auth_gate, core.risk_policy, state.pending_act, state.tools, core.action_act, core.ecosystem_hexis_gate, core.praxis_acts, core.voice_server, bnd.voice_tcp, core.daemon_lock]
+
+  - id: 9
+    title: Privacy boundaries
+    mark: explicit
+    capabilities: [answer-from-the-world, answer-from-your-own-data, recall, read-an-encyclopedia]
+    components: [core.q.personal, core.query_chain, core.q.search, core.q.kiwix, bnd.http_ecosystem]
+
+  - id: 10
+    title: Learning from outcomes
+    mark: unresolved
+    question: Is behavioural learning wanted, or is the negative criterion the whole of the intent?
+    capabilities: [learning-the-style, learning-from-mistakes, interruption-policy, route-an-utterance]
+    components: [state.nudges, state.routing_labels, core.tick_loop, core.rules]
+
+  - id: 11
+    title: Capability composition
+    mark: implied
+    question: What is the single unit that competes for a turn?
+    capabilities: [command-chaining, route-an-utterance, answer-from-your-own-data, ask-instead-of-guessing]
+    components: [core.action_table, core.query_chain, core.preroute, router.cascade, router.stage0, router.claim, router.modes]
+
+  - id: 12
+    title: Persistence across restart
+    mark: implied
+    capabilities: [ask-instead-of-guessing, praxis, route-an-utterance]
+    components: [state.dialogue_sessions, state.clarify_store, state.decision_ring, state.routing_traces, state.tick_memo, state.surfaced_items]

docs/capabilities/out/counts_after_field.json

@@ -0,0 +1,36 @@
+{
+  "facts": {
+    "count": 13041
+  },
+  "notes": {
+    "count": 185
+  },
+  "reminders": {
+    "count": 98
+  },
+  "pending_reminders": {
+    "error": "e2eprobe: ipc: unknown method:"
+  },
+  "tasks_live": {
+    "count": 6
+  },
+  "nudges": {
+    "count": 5
+  },
+  "tools": {
+    "count": 13
+  },
+  "decisions": {
+    "count": 25
+  },
+  "events": {
+    "count": 62
+  },
+  "eco_traces": {
+    "count": 115
+  },
+  "delivery_attempts": {
+    "count": 200,
+    "note": "at e2eprobe's hardcoded 200 cap, true count is >= 200"
+  }
+}

docs/capabilities/out/counts_after_wipe.json

@@ -0,0 +1,35 @@
+{
+  "facts": {
+    "count": 1
+  },
+  "notes": {
+    "count": 4
+  },
+  "reminders": {
+    "count": 0
+  },
+  "pending_reminders": {
+    "error": "e2eprobe: ipc: unknown method:"
+  },
+  "tasks_live": {
+    "count": 0
+  },
+  "nudges": {
+    "count": 0
+  },
+  "tools": {
+    "count": 12
+  },
+  "decisions": {
+    "count": 0
+  },
+  "events": {
+    "count": 4
+  },
+  "eco_traces": {
+    "count": 0
+  },
+  "delivery_attempts": {
+    "count": 0
+  }
+}

docs/capabilities/out/field.transcript.tsv

@@ -0,0 +1,34 @@
+field:reminder:create-and-persist	напомни мне завтра в 9 утра позвонить в клинику	хорошо, напомню завтра в 09:00.		0.29
+field:reminder:clarify-the-missing-slot	напомни мне позвонить маме	Сейчас 01:09. Когда?		0.26
+field:reminder:clarify-the-missing-slot	в шесть вечера	Сейчас 01:09. Поняла: в шесть вечера. В какой день?		0.62
+field:reminder:cancel-mid-clarify	напомни мне заехать за кормом	Сейчас 01:09. Когда?		0.26
+field:reminder:cancel-mid-clarify	отмена	Хорошо, отменила.		0.27
+field:reminder:correct-the-time	напомни мне в семь вечера вынести мусор	Сейчас 01:09. В какой день?		0.3
+field:reminder:correct-the-time	нет, в восемь	Сейчас 01:09. В какой день?		0.6
+field:reminder:recurring-from-speech	напоминай мне каждый день в девять вечера дать собаке таблетку	Сейчас 01:09. В какой день?		0.29
+field:reminder:recurring-from-speech	какие у меня повторяющиеся напоминания?	Все напоминания: 0. На какое время поставить напоминание?	memory	3.36
+field:fact:record-and-confirm	меня зовут Ками	У тебя есть 35 сообщений.		4.14
+field:fact:supersede	я работаю в Тинькофф	не знаю — не нашла у тебя такой записи.	personal	0.12
+field:fact:supersede	я больше не работаю в Тинькофф, теперь я в Яндексе	не знаю — не нашла у тебя такой записи.	personal	0.13
+field:fact:supersede	где я работаю?	не знаю — не нашла у тебя такой записи.	personal	0.1
+field:fact:what-do-you-remember	что ты помнишь обо мне?	Мне известно о тебе с 2017 года. В настоящее время у меня нет информации об удалении работы в Тинькофф и возобновлений работ по этой компании.		2.98
+field:note:question-is-not-a-statement	я рассказывал тебе про байкал?	Давайте проверим.	memory	4.78
+field:note:capture-then-recall	запиши: ключи от гаража лежат в верхнем ящике стола	"Записала", "проверила"		2.65
+field:note:capture-then-recall	где лежат ключи от гаража?	В главе с Долорес он спрашивает: «где лежат ключи от гаража?» Источник утверждает, что они находятся рядом со кухней на первом этаже.	search	7.52
+field:note:recall-miss-is-honest	что я говорил тебе про ремонт балкона?	Уточни пожалуйста имя человека из которого ты будешь учиться или посмотреть информацию.	memory	2.4
+field:query:own-data-first	что у меня сегодня по плану?	на 26.08.2026 ничего не запланировано.	day-plan	0.01
+field:query:the-world-summary	почему небо голубое?	Почему небо голубое? - В статье разберемся, почему днем небо кажется голубым (см., например). Рассказываем про солнечный свет.	search	6.29
+field:query:arithmetic-must-not-escape	сколько будет два плюс два?	Похоже у вас есть интерес к математике! 2 + 2 = ? Это довольно простая задачка для ребенка с первого класса, а вы можете продолжить? Или вам нужны советы по образованию?	search	8.17
+field:query:follow-up-context	какая сейчас погода?	для какого города?	weather	0.17
+field:query:follow-up-context	Самара	Я тебя не разобрала. Повтори, пожалуйста.		0.04
+field:query:encyclopedia-language	расскажи про Байкал	Всего лишь одна фразаЕсли у тебя есть желание узнать больше о Байкале или его влиянии как гидроэнергетического комплекс, посетите сайт «Энциклопедии Кирилла и Мефодия» https://www.km.ru/encyclopedia/view.php?ID=602.	memory	5.0
+field:query:feeds-on-request	что нового в новостях?	вот что нового: mklinux-v7.0-mk2 released; [$] Old-school calendaring at the command line with Remind; Vanilla OS 3 released	feeds	1.67
+field:query:network-scan-as-prose	какие устройства сейчас в сети?	нашла 3 устройства, из них 2 с вебом, 2 с ssh. список записала.	network	27.01
+field:action:target-must-resolve	перезапусти контейнер с базой	«с» — не знаю такой цели. назови её как в системе.		0.02
+field:action:confirm-binds	выключи свет в спальне	«с» — не знаю такой цели. назови её как в системе.		0.04
+field:action:report-the-actual-result	покажи что запущено в докере	«с» — не знаю такой цели. назови её как в системе.		0.06
+field:action:praxis-lifecycle-gate	что требует моего внимания?	Нет ничего нового.		3.66
+field:action:praxis-lifecycle-gate	отметь первое как выполненное	Такую команду я не знаю.		0.04
+field:action:capture-a-task	добавь в задачи: заказать корм для собаки	внесла в список: заказать корм для собаки		0.01
+field:action:capture-a-task	какие у меня задачи?	сначала: проверить интейк форму на боксе (просрочено на 17 дней); купить хлеб (давно в списке); купить молоко (давно в списке); полить цветы (давно в списке); починить кран (давно в списке); и ещё 1 задача. 1 задача просрочено; 5 задач лежит дольше 10 дней.	tasks	0.01
+field:proactive:delivery-reaches-telegram	напомни мне через две минуты MVNPROBE проверка доставки	хорошо, напомню сегодня в 01:13.		0.33

docs/capabilities/probes_field.json

@@ -0,0 +1,130 @@
+{
+  "note": "field probes: the owner's real week, drawn from the five vertical slices, the three ugly conversations of the 2026-08-13 audit verbatim, the five existing scenarios and what deploy/mavend.json is actually configured for. A failing field probe is an unresolved product question or a missing-criterion finding against docs/spec.md, never a DoD verdict.",
+  "probes": [
+
+    { "id": "field:reminder:create-and-persist", "origin": "field", "kind": "live", "slice": "reminder",
+      "utterances": ["напомни мне завтра в 9 утра позвонить в клинику"],
+      "readback": {"reminders": ["reminders", "10"], "decisions": ["decisions", "1"]},
+      "expect": "The reply states the time back, and a reminders row exists for 09:00 tomorrow with that text." },
+
+    { "id": "field:reminder:clarify-the-missing-slot", "origin": "field", "kind": "live", "slice": "reminder",
+      "utterances": ["напомни мне позвонить маме", "в шесть вечера"],
+      "readback": {"reminders": ["reminders", "10"], "decisions": ["decisions", "2"]},
+      "expect": "Turn 1 asks only for the time, not for all slots. Turn 2 fills it and a row lands at 18:00. The audit saw this pass; it is here to catch a regression." },
+
+    { "id": "field:reminder:cancel-mid-clarify", "origin": "field", "kind": "live", "slice": "reminder",
+      "utterances": ["напомни мне заехать за кормом", "отмена"],
+      "readback": {"reminders": ["reminders", "10"]},
+      "expect": "Turn 2 drops the parked turn and says so. No reminder row is written for the kibble." },
+
+    { "id": "field:reminder:correct-the-time", "origin": "field", "kind": "live", "slice": "reminder",
+      "utterances": ["напомни мне в семь вечера вынести мусор", "нет, в восемь"],
+      "readback": {"reminders": ["reminders", "10"]},
+      "expect": "One reminder at 20:00, not two rows and not one at 19:00. Correction of a just-set reminder is the slice's real shape." },
+
+    { "id": "field:reminder:recurring-from-speech", "origin": "field", "kind": "live", "slice": "reminder",
+      "utterances": ["напоминай мне каждый день в девять вечера дать собаке таблетку", "какие у меня повторяющиеся напоминания?"],
+      "readback": {"reminders": ["reminders", "20"]},
+      "expect": "The schedule is stated back and a row carries Cron. The spec says storage and delivery are finished and no caller in cmd/mavend passes a cron, so this is expected to fail; the probe records HOW it fails." },
+
+    { "id": "field:fact:record-and-confirm", "origin": "field", "kind": "live", "slice": "fact/note",
+      "utterances": ["меня зовут Ками"],
+      "readback": {"facts": ["facts", "20"], "decisions": ["decisions", "1"]},
+      "expect": "The confirmation is feminine, and a facts row actually exists. The audit caught 'я записала информацию о тебе' confirming a write that never happened." },
+
+    { "id": "field:fact:supersede", "origin": "field", "kind": "live", "slice": "fact/note",
+      "utterances": ["я работаю в Тинькофф", "я больше не работаю в Тинькофф, теперь я в Яндексе", "где я работаю?"],
+      "readback": {"facts": ["facts", "30"]},
+      "expect": "Turn 3 answers Yandex, not Tinkoff and not both. Both rows are readable and the old value is retired." },
+
+    { "id": "field:fact:what-do-you-remember", "origin": "field", "kind": "live", "slice": "fact/note",
+      "utterances": ["что ты помнишь обо мне?"],
+      "readback": {"decisions": ["decisions", "1"], "notes": ["notes", "5"]},
+      "expect": "Routes to query, not remember, and the reply uses informal singular ты. The planning session got formal вас/вы here while the phrasing eval passed. Two of the audit's seven probes misrouted on exactly this shape." },
+
+    { "id": "field:note:question-is-not-a-statement", "origin": "field", "kind": "live", "slice": "fact/note",
+      "utterances": ["я рассказывал тебе про байкал?"],
+      "readback": {"notes": ["notes", "5"], "decisions": ["decisions", "1"]},
+      "expect": "No note row is written. The audit stored this question as a statement, and the personal boundary scored it as world." },
+
+    { "id": "field:note:capture-then-recall", "origin": "field", "kind": "live", "slice": "fact/note",
+      "utterances": ["запиши: ключи от гаража лежат в верхнем ящике стола", "где лежат ключи от гаража?"],
+      "readback": {"notes": ["notes", "10"], "decisions": ["decisions", "1"]},
+      "expect": "Turn 2 returns the drawer from the note captured in turn 1, not a world answer and not a recall miss." },
+
+    { "id": "field:note:recall-miss-is-honest", "origin": "field", "kind": "live", "slice": "fact/note",
+      "utterances": ["что я говорил тебе про ремонт балкона?"],
+      "readback": {"decisions": ["decisions", "1"]},
+      "expect": "She says she does not remember. A world answer here is the failure: the personal boundary must stop a question about him from reaching outside." },
+
+    { "id": "field:query:own-data-first", "origin": "field", "kind": "live", "slice": "query",
+      "utterances": ["что у меня сегодня по плану?"],
+      "readback": {"decisions": ["decisions", "1"], "plan": ["plan"]},
+      "expect": "The real checklist and its open items come back, and the decision trace shows an owner source winning before any world source was asked." },
+
+    { "id": "field:query:the-world-summary", "origin": "field", "kind": "live", "slice": "query",
+      "utterances": ["почему небо голубое?"],
+      "readback": {"decisions": ["decisions", "1"]},
+      "expect": "A Russian summary that does not invent physics. The audit's answer was 'корочковатые цветы отражают длинноволны'. Verbatim from the audit, so the two are comparable." },
+
+    { "id": "field:query:arithmetic-must-not-escape", "origin": "field", "kind": "live", "slice": "query",
+      "utterances": ["сколько будет два плюс два?"],
+      "readback": {"decisions": ["decisions", "1"]},
+      "expect": "The answer is 4. Measured this session: the arithmetic-query stage 0 grammar declined, the turn reached external search, and the reply was 'Во-первых - это два плюса двойки'." },
+
+    { "id": "field:query:follow-up-context", "origin": "field", "kind": "live", "slice": "query",
+      "utterances": ["какая сейчас погода?", "Самара"],
+      "readback": {"decisions": ["decisions", "2"]},
+      "expect": "Turn 2 is understood as the city for turn 1. The audit's follow-up died with 'Я тебя не разобрала'. There is no weather block in the config, so a named gap is the honest pass and a guessed forecast is the failure." },
+
+    { "id": "field:query:encyclopedia-language", "origin": "field", "kind": "live", "slice": "query",
+      "utterances": ["расскажи про Байкал"],
+      "readback": {"decisions": ["decisions", "1"]},
+      "expect": "A Russian question lands on the Russian book. The claiming source in the trace is kiwix, and the article is about the lake." },
+
+    { "id": "field:query:feeds-on-request", "origin": "field", "kind": "live", "slice": "query",
+      "utterances": ["что нового в новостях?"],
+      "readback": {"decisions": ["decisions", "1"]},
+      "expect": "Configured feed items are read back. Two sources are configured; a dead feed must name itself dead and the other still answer." },
+
+    { "id": "field:query:network-scan-as-prose", "origin": "field", "kind": "live", "slice": "query",
+      "utterances": ["какие устройства сейчас в сети?"],
+      "readback": {"decisions": ["decisions", "1"]},
+      "expect": "Hosts and open ports come back as prose, not as a table dump. netscan.enabled is true with subnets, ports and rate set." },
+
+    { "id": "field:action:target-must-resolve", "origin": "field", "kind": "live", "slice": "action",
+      "utterances": ["перезапусти контейнер с базой"],
+      "readback": {"eco-traces": ["eco-traces", "10"], "decisions": ["decisions", "1"]},
+      "expect": "Free text does not reach a mutating Hexis call. Nexus holds no entities, so the honest outcome is a named gap or a clarify, never a guessed target and never an execution." },
+
+    { "id": "field:action:confirm-binds", "origin": "field", "kind": "live", "slice": "action",
+      "utterances": ["выключи свет в спальне"],
+      "readback": {"eco-traces": ["eco-traces", "10"], "decisions": ["decisions", "1"]},
+      "expect": "smarthome.enabled is false, so this is a named gap. The failure is a reply that claims the light was switched." },
+
+    { "id": "field:action:report-the-actual-result", "origin": "field", "kind": "live", "slice": "action",
+      "utterances": ["покажи что запущено в докере"],
+      "readback": {"eco-traces": ["eco-traces", "10"], "tools": ["tools"]},
+      "expect": "Either the real container list or a named gap. A plausible invented list is the failure this slice exists to catch." },
+
+    { "id": "field:action:praxis-lifecycle-gate", "origin": "field", "kind": "live", "slice": "action",
+      "utterances": ["что требует моего внимания?", "отметь первое как выполненное"],
+      "readback": {"eco-traces": ["eco-traces", "20"], "decisions": ["decisions", "2"]},
+      "expect": "Turn 1 calls Surface, never Acknowledge. Turn 2 is a remote mutation: the architecture pass found praxisItemAction.handle calls straight through with no tier and no confirm turn. The probe records whether it runs on first hearing." },
+
+    { "id": "field:action:capture-a-task", "origin": "field", "kind": "live", "slice": "action",
+      "utterances": ["добавь в задачи: заказать корм для собаки", "какие у меня задачи?"],
+      "readback": {"tasks": ["tasks"], "decisions": ["decisions", "2"]},
+      "expect": "The task appears in the list, ordered by deadline and urgency, and the capture is visible over IPC." },
+
+    { "id": "field:proactive:delivery-reaches-telegram", "origin": "field", "kind": "live", "slice": "proactive",
+      "utterances": ["напомни мне через две минуты MVNPROBE проверка доставки"],
+      "readback": {"reminders": ["reminders", "10"], "delivery-attempts": ["delivery-attempts"]},
+      "expect": "Within a compressed live horizon the reminder fires and a delivery-attempts row records the reach that took it. TickInterval defaults to 60s and no override is configured, so two minutes is two ticks. The marker keeps it from reading as a real nudge." },
+
+    { "id": "field:proactive:failure-retries-into-another-reach", "origin": "field", "kind": "live", "slice": "proactive",
+      "utterances": [],
+      "readback": {"delivery-attempts": ["delivery-attempts"], "nudges": ["nudges", "20"], "events": ["events", "50"]},
+      "expect": "Read the existing attempt rows: a failed delivery retried into another reach rather than looping. The audit watched the ntfy failure run once a minute until 03:05, then Telegram took reminder #83 at 03:06 and nothing retried." }
+  ]
+}

docs/capabilities/run_probes.py

@@ -0,0 +1,137 @@
+#!/usr/bin/env python3
+"""Drive probes through the deployed stack and record what came back.
+
+Runs ON homesrv, where 127.0.0.1:9201 is mavweb and the mavend socket is
+reachable from inside maven-mavend-1.
+
+Transport is POST /api/chat, which runs a real turn: router, resident model,
+query walk, act path. The reply rides back on the 303 Location as
+?q=..&r=..&s=<claiming query source>&t=<trace id>.
+
+Readback is e2eprobe over the IPC socket, never the plaintext sqlite copy.
+
+  python3 run_probes.py probes.json > raw.jsonl
+"""
+import json
+import re
+import subprocess
+import sys
+import time
+import urllib.parse
+
+WEB = "http://127.0.0.1:9201"
+SOCK = "/run/maven/mavend.sock"
+CONTAINER = "maven-mavend-1"
+PROBE_BIN = "/tmp/e2eprobe"
+
+
+def sh(args, timeout=180):
+    p = subprocess.run(args, capture_output=True, text=True, timeout=timeout)
+    return p.returncode, p.stdout, p.stderr
+
+
+def chat(text):
+    """One turn. Returns the parsed redirect, or the failure verbatim."""
+    t0 = time.time()
+    rc, out, err = sh([
+        "curl", "-s", "-o", "/dev/null", "-w", "%{http_code}\t%{redirect_url}",
+        "-X", "POST", "--data-urlencode", f"text={text}", f"{WEB}/api/chat",
+    ])
+    dt = round(time.time() - t0, 2)
+    if rc != 0:
+        return {"utterance": text, "error": err.strip() or f"curl rc={rc}", "seconds": dt}
+    code, _, loc = out.partition("\t")
+    r = {"utterance": text, "http": code, "seconds": dt}
+    if code != "303":
+        r["error"] = f"expected 303, got {code}"
+        return r
+    q = urllib.parse.parse_qs(urllib.parse.urlparse(loc).query)
+    r["reply"] = q.get("r", [""])[0]
+    r["source"] = q.get("s", [""])[0]
+    r["trace"] = q.get("t", [""])[0]
+    return r
+
+
+def probe(cmd):
+    """One e2eprobe readback. Returns parsed JSON or the error verbatim."""
+    rc, out, err = sh(["docker", "exec", CONTAINER, PROBE_BIN, "-sock", SOCK] + cmd)
+    if rc != 0:
+        return {"error": (err or out).strip()}
+    try:
+        return json.loads(out)
+    except json.JSONDecodeError:
+        return {"raw": out.strip()}
+
+
+def shell(cmd):
+    """One read-only command on homesrv, for a configuration or deployment fact.
+
+    A criterion about whether a config block exists is not observable through a
+    turn, and chasing it through one measures the router instead.
+    """
+    t0 = time.time()
+    p = subprocess.run(["sh", "-c", cmd], capture_output=True, text=True, timeout=300)
+    return {
+        "cmd": cmd,
+        "rc": p.returncode,
+        "stdout": p.stdout[-8000:],
+        "stderr": p.stderr[-2000:],
+        "seconds": round(time.time() - t0, 2),
+    }
+
+
+def normalise_readback(rb):
+    """Accept both shapes: {name: argv} and [{name, argv}]."""
+    if isinstance(rb, dict):
+        return list(rb.items())
+    return [(d["name"], d["argv"]) for d in (rb or [])]
+
+
+def reset():
+    """Clear any parked clarify before the next probe.
+
+    mavweb hardcodes one conversation id for the whole web reach, so a clarify
+    parked by one probe is still parked for the next one. Measured: an
+    unanswered park appended "Сейчас 01:07. В какой день?" to eleven unrelated
+    turns in a row, including plain statements the router should have taken as
+    facts. Without this the run measures the previous probe, not this one.
+
+    The leak itself is a finding, recorded separately from a run that isolates.
+    """
+    r = chat("отмена")
+    return {"reply": r.get("reply", ""), "http": r.get("http", ""), "error": r.get("error", "")}
+
+
+def main():
+    spec = json.load(open(sys.argv[1]))
+    for p in spec["probes"]:
+        rec = {
+            "id": p["id"],
+            "origin": p.get("origin", "dod" if p["id"].startswith("dod:") else "field"),
+            "criteria": p.get("criteria", []),
+            "slice": p.get("slice", ""),
+            "expect": p.get("expect", ""),
+            "kind": p.get("kind", "live"),
+            "method": p.get("method", "chat"),
+            "turns": [],
+            "readback": {},
+        }
+        if rec["kind"] == "blocked" or rec["method"] == "none":
+            rec["blocked_reason"] = p.get("blocked_reason", "")
+            print(json.dumps(rec, ensure_ascii=False), flush=True)
+            continue
+        if p.get("isolate", True) and rec["method"] == "chat":
+            rec["reset_before"] = reset()
+            time.sleep(1)
+        if rec["method"] == "shell":
+            rec["shell"] = shell(p["shell"])
+        for text in p.get("utterances", []):
+            rec["turns"].append(chat(text))
+            time.sleep(p.get("gap", 1))
+        for name, cmd in normalise_readback(p.get("readback")):
+            rec["readback"][name] = probe(cmd)
+        print(json.dumps(rec, ensure_ascii=False), flush=True)
+
+
+if __name__ == "__main__":
+    main()

docs/capabilities/store_counts.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Row counts per store, read over IPC. Runs on homesrv.
+
+The eval's first artifact. Read before any probe writes, and again after, so
+what the probes added is attributable. Not the sqlite file: the point is to
+measure the contract, and the plaintext copy in tmpfs bypasses it.
+"""
+import json
+import subprocess
+import sys
+
+C = "maven-mavend-1"
+S = "/run/maven/mavend.sock"
+BIN = "/tmp/e2eprobe"
+
+# command, argv, and whether the reply is capped by a limit e2eprobe hardcodes.
+READS = [
+    ("facts", ["facts", "100000"], False),
+    ("notes", ["notes", "100000"], False),
+    ("reminders", ["reminders", "100000"], False),
+    ("pending_reminders", ["pending-reminders", "100000"], False),
+    ("tasks_live", ["tasks"], False),
+    ("nudges", ["nudges", "100000"], False),
+    ("tools", ["tools"], False),
+    ("decisions", ["decisions", "100000"], False),
+    ("events", ["events", "100000"], False),
+    ("eco_traces", ["eco-traces", "100000"], False),
+    ("delivery_attempts", ["delivery-attempts"], True),  # capped at 200 in e2eprobe
+]
+
+
+def main():
+    out = {}
+    for name, argv, capped in READS:
+        p = subprocess.run(["docker", "exec", C, BIN, "-sock", S] + argv,
+                           capture_output=True, text=True, timeout=180)
+        if p.returncode != 0:
+            out[name] = {"error": (p.stderr or p.stdout).strip()[:300]}
+            continue
+        try:
+            d = json.loads(p.stdout)
+        except json.JSONDecodeError:
+            out[name] = {"error": "not json", "raw": p.stdout.strip()[:300]}
+            continue
+        if d is None:
+            out[name] = {"count": 0}
+        elif isinstance(d, list):
+            r = {"count": len(d)}
+            if capped and len(d) >= 200:
+                r["note"] = "at e2eprobe's hardcoded 200 cap, true count is >= 200"
+            out[name] = r
+        else:
+            out[name] = {"value": d}
+    json.dump(out, sys.stdout, ensure_ascii=False, indent=2)
+    print()
+
+
+if __name__ == "__main__":
+    main()

docs/evals/2026-08-19-maven-model-cpt-sft.md

@@ -0,0 +1,107 @@
+# The CPT+SFT Qwen3-1.7B routes better and cannot hold a sentence
+
+*Measured 2026-08-19 on homesrv, CPU. Unfiled: Vikunja has returned 503 since
+2026-08-13. Build `5cae33a` on master. The deployment was not changed.*
+
+The candidate is `/mnt/hdd1/llms/maven/maven-model-Q4_K_XL.gguf`, built on workpc
+from a continued-pretraining stage plus a supervised fine-tune, quantised by
+replaying the Unsloth imatrix recipe with 197 per-tensor overrides read out of
+the reference gguf. The incumbent is
+`/mnt/hdd1/llms/qwen3/Qwen3-1.7B-UD-Q4_K_XL.gguf`, the deployed resident model.
+
+Both arms ran on the same homesrv `llama-server`, same flags, same port, minutes
+apart, one model resident at a time. CPU inference throughout, so **every latency
+figure here is incomparable to any GPU run**, including the 116.7 ms the build
+side reported. Accuracy is the only number that carries.
+
+The build side's own measurement claimed 88/96 for the candidate. This run
+reproduces it at 87/96 on the same fixture, so the routing claim stands.
+
+## Routing, `TestLLMRouterBaseline`, 96 cases
+
+| | full | intent-only | destination | ru | en | p50 |
+|---|---|---|---|---|---|---|
+| maven-model-Q4_K_XL | **87/96 (90.6%)** | 94.8% | **24/33 (72.7%)** | 72/81 | 15/15 | 1.29s |
+| Qwen3-1.7B-UD-Q4_K_XL | 81/96 (84.4%) | 87.5% | 16/33 (48.5%) | 67/81 | 14/15 | 1.22s |
+
+Both ran 0 errors and 1 missed clarify on the cascade. Destination is where the
+candidate earns it: eight more correct query sources, 72.7% against 48.5%. That
+equals what `docs/evals/2026-08-09-e4b-vs-12b-routing.md` records for
+gemma-4-12B at seven times the parameter count.
+
+The `llm-only` section of the same run reads 59/96 against 45/96. It bypasses
+stage 0 and the daemon slot fillers on purpose. **Do not cite it as the routing
+number**; `cascade+llm` is the deployed path.
+
+## Phrasing, `internal/phraser/eval`
+
+| | nudges | conversational |
+|---|---|---|
+| maven-model-Q4_K_XL | 15/15 (100%) | **8/36 (22.2%)** |
+| maven-model-Q4_K_XL, eos corrected | 15/15 (100%) | 11/36 (30.6%) |
+| Qwen3-1.7B-UD-Q4_K_XL | 15/15 (100%) | 22/36 (61.1%) |
+
+Nudges are tied at ceiling. Conversational phrasing falls by half.
+
+## Two defects, and they are independent
+
+**The gguf carries the wrong eos token.** `tokenizer.ggml.eos_token_id` is
+151643 (`<|endoftext|>`) against the incumbent's 151645 (`<|im_end|>`), and
+`bos` is 151643 too. Both files carry the identical Qwen3 chat template, and
+that template closes every turn with `<|im_end|>`. The candidate is told to stop
+on a token the template never emits, so generation runs through the turn
+boundary. The conversion read the base config, not the instruct one.
+
+Re-running with `--override-kv tokenizer.ggml.eos_token_id=int:151645` isolates
+its cost:
+
+| check | as shipped | eos corrected |
+|---|---|---|
+| address | 27/36 | 32/36 |
+| knowledge path | 3/9 | 7/9 |
+| ontopic | 14/36 | 15/36 |
+| reply path | 0/9 | 0/9 |
+
+Routing is untouched by this, because GBNF-constrained decoding terminates on
+the grammar and never reaches the eos token. That is why the defect is invisible
+in the routing score and fatal in free generation.
+
+**The remaining half is not packaging.** Corrected, the candidate reaches 11/36
+against the incumbent's 22/36. `ontopic` moves one case and the reply path stays
+at 0 of 9. The failures are broken Russian, not persona drift:
+
+- `Ты не одиноден?!` — not a word; `одинок`.
+- `Привёз с собой смайлики-котята и вручила им подарок` — masculine and feminine
+  verbs in one clause, wrong case on the noun.
+- `Вчера у вас не будет никакого лёг.` — yesterday in the future tense, cut off
+  mid-word.
+- `Заберите диск от системы или установочный ковш.` — "installation bucket".
+- `Вам сказал Игоря Валерьевич` — a first name declined as accusative.
+- `know-hiccups` answered with weight-loss advice.
+
+## What this rules out
+
+- **Not a harness mismatch.** Both arms ran the identical target, server and
+  fixture, and the candidate reproduced the build side's routing claim to within
+  one case.
+- **Not the missing `ROLEPLAY_ACTION` and `MASC_SELF` fixes alone.** Those were
+  the build side's stated reason to expect persona failures. `feminine` scores
+  35/36 corrected. The failures are grammatical, not persona.
+- **Not weights damage alone either.** The eos defect is real and costs five
+  address cases and four knowledge cases on its own.
+
+`inference:` the SFT stage worked and the CPT stage cost general Russian
+coherence. Routing is constrained decoding over 7 intents and a destination, and
+it improved. Free generation is where the loss shows.
+
+## The swap was not made
+
+`deploy/mavend.json:19` still reads the incumbent. One `phraser.model_path`
+serves both the router and the phraser and `voice.llm_router` is true, so
+swapping buys 6 routing cases and pays 11 conversational ones. Both ggufs stay
+at `/mnt/hdd1/llms/maven/` for the re-run.
+
+The two-week replay (`scripts/usage-run.py`,
+`docs/evals/2026-08-08-two-weeks.md`) was not run. It drives the deployed stack
+through `POST /api/chat`, so it measures whatever `mavend` has loaded, and the
+candidate was never loaded.

docs/evals/2026-08-26-capability-baseline.md

@@ -0,0 +1,757 @@
+# Capability baseline: what the deployed Maven actually does
+
+*Measured 2026-08-26 against master `5cae33a` plus the uncommitted
+`deploy/mavend.json` model switch. Frozen on the day.*
+
+The empirical half of `docs/plans/26-capability-ledger-and-baseline.md`. The
+ledger at `docs/capabilities/ledger.yaml` says what should happen. This file
+says what happened when it was asked. Every `verified` cell in the ledger cites
+this file by path.
+
+Read `docs/capabilities/README.md` for how the artifacts regenerate.
+
+## In one paragraph
+
+26 of 146 v1 criteria pass, and **no capability passes all of its own**. Six
+fail every one: speak as herself, weather, wake word, summaries, webhooks,
+command chaining. What comes closest to working is what never asks the resident
+model to write a Russian sentence, which is tasks, feeds, the network scan and
+setting a one-shot reminder. The model that does write them,
+`maven-instruct-b2-Q4_K_XL`, produces sentences that no longer hold together,
+and the phrasing checks that would catch it run in the eval and not on the
+outbound path. Four misroutes account for four more failures, including his own
+name not being stored as a fact.
+
+`make test` is green throughout. It is also green with the four `TestONNX*`
+measurements silently skipped, which is the second thing this file is about.
+
+## What was measured, and what that is worth
+
+Probes ran against the live `maven-mavend-1`, through `POST /api/chat` on
+`127.0.0.1:9201`, which drives a real turn: the pre-route ladder, the stage 0
+grammars, the routing heads, the resident model, the query walk, the act path
+and the phraser. Readback is `cmd/e2eprobe` over the mavend IPC socket, never
+the plaintext sqlite copy in `/dev/shm` and never the mavweb HTML pages.
+
+**The number this baseline is attributable to is the deployed resident model,
+`maven-instruct-b2-Q4_K_XL`, not the Qwen3-1.7B that `CLAUDE.md` names.** The
+switch sits uncommitted in `deploy/mavend.json`. A baseline measures one model
+on one config, so this file expires the moment either moves.
+
+## Row counts before anything was written
+
+Two readings. `mavend -wipe` without `-confirm-wipe` opens the encrypted file at
+rest and prints every table. That is the eval's first artifact, and it reads the
+23:50 seal, before this session touched anything.
+
+```
+  ack_sends                71        memory_vectors          116
+  delivery_attempts     16340        meta                      2
+  dialogue_sessions         1        notes                   180
+  digest_entries            0        nudges                    5
+  ecosystem_traces         86        presence_state            1
+  events                   17        proposed_routines         0
+  facts                 12984        reminders                95
+  list_items                0        routing_labels            2
+                                     routing_traces          976
+                                     tasks                    10
+                                     tools                    13
+  TOTAL                 30899 rows in 19 tables
+```
+
+Three numbers there are not visible over IPC. **`delivery_attempts` is 16,340**,
+not the 200 `e2eprobe` returns. **`routing_traces` is 976**, which matches trace
+id 977 exactly: the 14-day retention is working and has swept nothing yet.
+**`routing_labels` is 2**, so the correction gesture at `POST /api/correct` has
+been used twice in the life of the box, and it is the only supervised signal
+this deployment collects.
+
+`digest_entries` and `proposed_routines` are both 0.
+
+The second reading is over IPC, before the first probe.
+
+| store | rows |
+| --- | ---: |
+| facts | 13018 |
+| notes | 180 |
+| reminders | 95 |
+| tasks, live | 5 |
+| nudges | 5 |
+| tools | 13 |
+| events | 34 |
+| ecosystem traces | 86 |
+| delivery attempts | >= 200 |
+| decision traces | 0 |
+
+Two of these are findings on their own.
+
+**13,018 facts.** The architecture pass counted nine writers into `facts`,
+including a fetch watermark and a tuning parameter. At this volume the table is
+not a model of the owner, it is a log with a model of the owner somewhere in it.
+
+**Zero decision traces, at trace id 977.** Not a defect and not the 14-day
+sweep. `internal/decision/ring.go` sets `ringSize = 25`: the arbitration record
+is an in-memory daemon ring, and `storeAPI.TurnDecisions` says so outright,
+returning `turn decisions not available via direct store API` (V-564). `mavend`
+had restarted 49 minutes earlier, so the ring was empty.
+
+The consequence is worth stating plainly. `docs/spec.md` requires that every
+turn write a decision trace naming the stage that decided, and every turn does.
+**That record survives 25 turns and does not survive a restart.** 58 turns ran
+during this baseline and 25 rows remain. Anything wanting to explain a turn from
+yesterday cannot.
+
+`e2eprobe pending-reminders` failed with `ipc: unknown method`. The probe binary
+is built from master and the deployed image is from 2026-08-19, so this is
+build drift in the probe, not a defect in mavend.
+
+## The deployed stack is not one build
+
+| service | image | built |
+| --- | --- | --- |
+| maven-mavend-1 | `sha256:016e80eb` | 2026-08-19 |
+| maven-mavweb-1 | `sha256:016e80eb` | 2026-08-19 |
+| maven-mavsttd-1 | `sha256:fc338a2f` | 2026-08-08 |
+| maven-mavttsd-1 | `sha256:fc338a2f` | 2026-08-08 |
+| maven-mavpoll-1 | `sha256:fc338a2f` | 2026-08-08 |
+
+Three of five run a build eighteen days old. The 2026-08-13 audit found three on
+a four-day-old image and the gap has widened, not closed. The outstanding
+`docker compose up -d --force-recreate mavsttd mavttsd mavpoll` was deliberately
+NOT run before this baseline: running it would have destroyed the observation.
+
+## The field probes
+
+25 multi-turn probes across the five vertical slices, drawn from the owner's
+real week, the three failing conversations of the 2026-08-13 audit verbatim, the
+five existing scenarios, and what `deploy/mavend.json` is configured for. 34
+turns. Full transcript at `docs/capabilities/out/field.transcript.tsv`, raw
+output with readback at `docs/capabilities/out/field.raw.jsonl`.
+
+A field probe never sets a DoD verdict. It is the owner's week, not the spec.
+
+### The first run measured itself
+
+`mavweb` hardcodes one conversation id for the whole web reach, so a clarify
+parked by one probe is still parked for the next. The first run had no reset
+between probes. The park set at turn 8 reached turns 9 through 13, appending its
+own question to five consecutive unrelated turns:
+
+```
+Q  меня зовут Ками
+A  Сейчас 01:07. В какой день?
+
+Q  я работаю в Тинькофф
+A  не знаю — не нашла у тебя такой записи. На какое время поставить напоминание?
+```
+
+That run is kept at `out/field.contaminated.jsonl` and scores nothing. The
+behaviour it exposed is real and is a finding: **a parked clarify survives and
+never resumes.** It outlives every intervening turn, including plain statements,
+appending its question to their answers. At turn 14 it was dropped by the
+`Прошлую просьбу отпускаю` path, not by being answered and not by `отмена`. It
+never asks its original question again.
+
+`docs/spec.md` asks for the other half of this under "Ask instead of guessing":
+a parked clarify should survive an interleaved unrelated turn **and resume**.
+Half of that is what is broken.
+
+The scored run sends `отмена` before every probe. With nothing parked, that
+answers `Такую команду я не знаю.`
+
+### What works
+
+Four paths answered correctly, fast, and in her own voice.
+
+| probe | reply | claimed by |
+| --- | --- | --- |
+| `field:action:capture-a-task` | `внесла в список: заказать корм для собаки`, then the full list ordered by deadline with `просрочено на 17 дней` on the overdue one | `tasks`, 0.01s |
+| `field:query:feeds-on-request` | `вот что нового: mklinux-v7.0-mk2 released; [$] Old-school calendaring…` | `feeds`, 1.67s |
+| `field:query:network-scan-as-prose` | `нашла 3 устройства, из них 2 с вебом, 2 с ssh. список записала.` | `network`, 27.01s |
+| `field:reminder:create-and-persist` | `хорошо, напомню завтра в 09:00.` and reminder id 97 landed `pending` | stage 0, 0.29s |
+
+Every one of these four is answered by deterministic Go, not by the resident
+model. The three claimed by a query source took the model out of the sentence
+entirely. This is the shape of the whole run: **the parts of Maven that do not
+ask the resident model to write Russian are the parts that work.**
+
+### The resident model writes broken Russian
+
+Ten turns reached the resident model for phrasing. What came back:
+
+```
+Q  запиши: ключи от гаража лежат в верхнем ящике стола
+A  "Записала", "проверила"
+
+Q  где лежат ключи от гаража?
+A  Ключи к ГАРАЖУ находятся ВЕРХНЕМ ЯСОЧКА СТОЛА.
+
+Q  расскажи про Байкал
+A  Всего лишь одна фразаЕсли у тебя есть желание узнать больше о Байкале
+   или его влиянии как гидроэнергетического комплекс, посетите сайт
+   «Энциклопедии Кирилла и Мефодия» https://www.km.ru/encyclopedia/…
+
+Q  что я говорил тебе про ремонт балкона?
+A  Уточни пожалуйста имя человека из которого ты будешь учиться или
+   посмотреть информацию.
+
+Q  меня зовут Ками
+A  У тебя есть 35 сообщений.
+```
+
+The first leaks a raw parser fragment to the wire, quotes included. The second
+found the right note and could not restate it: `ЯСОЧКА` is not a word and the
+case is wrong. The third invents a URL. The fourth is not about anything the
+owner said. The fifth is not an answer to anything.
+
+**Every one of these is attributable to `maven-instruct-b2-Q4_K_XL`.** The
+2026-08-13 audit measured Qwen3-1.7B on the same box and its worst reply was
+invented physics inside a well-formed Russian sentence. This is a different and
+worse failure: the sentences themselves no longer hold together.
+
+### The persona breaks on the wire, in both directions
+
+`CheckFeminine`, `CheckAddress` and `CheckCringe` appear only under
+`internal/phraser/eval`. They score the phrasing eval and do not run on the
+outbound path. **Two of the 34 scored turns** used formal address on the wire.
+The masculine reply is from the discarded contaminated run, so it scores nothing
+and is shown because it is the same defect the audit found:
+
+| probe | on the wire | rule broken |
+| --- | --- | --- |
+| `field:fact:what-do-you-remember` (contaminated run) | `Я ничего о тебе и вы никуда таки не упомянул` | masculine `упомянул` and formal `вы`, both in one reply |
+| `field:note:question-is-not-a-statement` | `Давайте проверим.` | formal `давайте` |
+| `field:query:arithmetic-must-not-escape` | `Похоже у вас есть интерес к математике! … а вы можете продолжить? Или вам нужны советы по образованию?` | formal `вас`, `вы`, `вам` three times |
+
+The audit caught `Хорошо, сохранил` the same way. The check exists, passes in the
+eval, and is not on the path the owner hears.
+
+### The act path extracts a preposition as the target
+
+Three unrelated utterances produced the same reply, in under 60ms, without the
+resident model being asked:
+
+```
+Q  перезапусти контейнер с базой        A  «с» — не знаю такой цели. назови её как в системе.
+Q  выключи свет в спальне               A  «с» — не знаю такой цели. назови её как в системе.
+Q  покажи что запущено в докере         A  «с» — не знаю такой цели. назови её как в системе.
+```
+
+The extracted target is `с`, a one-letter Russian preposition, for all three,
+including the two that do not contain the word. The eco-trace readback shows no
+new Hexis call for any of them.
+
+The refusal is correct behaviour for the wrong reason. Nexus holds no entities,
+so no act naming a target can resolve, and `CLAUDE.md` requires free text to
+resolve to a canonical entity id before any mutating call. It does refuse. But
+it refuses having decided that the target is `с`, which means the extraction
+step is not doing what its message claims, and the safety here rests on Nexus
+being empty rather than on the resolution.
+
+### The Praxis lifecycle path
+
+```
+Q  что требует моего внимания?          A  Нет ничего нового.
+Q  отметь первое как выполненное        A  Такую команду я не знаю.
+```
+
+Praxis holds nothing, so the mutation had no referent and the second turn never
+reached `praxisItemAction.handle`. **The architecture pass's finding that the
+path has no tier and no confirm turn is neither confirmed nor refuted by this
+run.** It stays a code-reading claim. Seeding Praxis is what would settle it.
+
+### The reaches
+
+One reminder was set two minutes out, carrying the marker `MVNPROBE`, and fired.
+
+| reach | result | evidence |
+| --- | --- | --- |
+| telegram | **sent** | attempt 16344, `reminder:ea93acef…`, 01:14:05 |
+| ntfy | **failed**, then telegram took it in the same second | attempt 16343, same delivery group |
+| voice | not exercised by this probe | no listener on the box |
+
+A failed delivery retrying into another reach works. The audit could not confirm
+this; here ntfy failed and telegram carried the same delivery group immediately.
+
+The 200 most recent attempts, spanning 2026-08-16 to now:
+
+| channel | status | rows |
+| --- | ---: | --- |
+| voice | failed | 156 |
+| telegram | sent | 28 |
+| drop | dropped | 12 |
+| ntfy | failed | 4 |
+
+**149 of those 156 voice failures are one rule, `netdata_critical`.** It retried
+once a minute into a reach that has never had a listener, for about three hours:
+151 rows from `2026-08-16T22:17:20` to `2026-08-17T01:19:20`, then it stopped.
+A bounded burst, not a storm still running. It is the same shape as the ntfy
+failure the audit watched run until 03:05. The audit closed V-715 on the
+reminder path retrying correctly, and the nudge path is a separate path.
+
+`ntfy.disabled` is `true` in the config and an ntfy attempt row was still
+written and still failed. Whatever `disabled` turns off, it is not the attempt.
+
+ntfy was deliberately not enabled for this baseline. `docs/spec.md` makes a
+write-scoped `NTFY_TOKEN` a precondition of re-enabling, and the owner confirmed
+that stands. Its reach verdict is `blocked`, reason `configuration missing`.
+
+### The fact store is not a model of him
+
+13,041 facts. By key:
+
+| key | rows | writer |
+| --- | ---: | --- |
+| `desk_active` | 12274 | `infer:hyprland` |
+| `page_heartbeat` | 491 | `infer:heartbeat` |
+| `netdata_alarm` | 111 | `poll:netdata` |
+| `rss:latest:lwn` | 69 | `poll:rss` |
+| everything else | 96 | mixed |
+
+By source, **56 facts in 13,041 came from him**: 48 `tap:voice` and 8
+`tap:text`. `desk_active` alone is 94.1%, written every 65 seconds.
+
+`docs/spec.md` files facts under "memory, model of you". At this ratio the table
+is a desk-presence log with a model of him in the noise, and the four-row Memory
+cluster having no living doc is the reason nobody decided otherwise.
+
+And the probe that should have added to those 56 did not:
+
+```
+Q  меня зовут Ками
+A  У тебя есть 35 сообщений.
+```
+
+No facts row was written. The 20 most recent facts after the turn are all
+`desk_active` and `netdata_alarm`. A `name` fact **does** exist, id 506, written
+`2026-08-01` from `tap:voice`, so the path worked once. The audit's finding that
+she confirms a write that never happened is unchanged, and this run shows the
+same failure without even the false confirmation.
+
+`field:fact:supersede` never got as far as superseding. All three turns,
+including the two plain statements, were claimed by the `personal` query source
+and answered `не знаю — не нашла у тебя такой записи`. **Statements are being
+routed as questions.**
+
+## Routing: what the decision traces show
+
+Claim ladders are in `docs/capabilities/out/field.raw.jsonl` under
+`readback.decisions`. 34 turns ran and every one returned a trace id. **22
+ladders were read back**, because the decision ring holds 25 and the probes'
+own `отмена` resets consumed the rest. Of the 22, **15 reached the route stage**
+and **11 reached the query stage**. The other 7 were decided at pre-route or by
+a stage 0 grammar.
+
+**The classifier answered zero turns.** All 15 traces that carry a classifier
+claim read `never_asked`, with the reason `the routing heads answered` or `the
+LLM router answered`. `CLAUDE.md` calls it the floor rather than dead code. It is
+the floor, and this run never reached it. That is the correct outcome and it
+also means this baseline says nothing about whether the floor still works.
+
+**Stage 0 decided six turns**, and every one of the six is among the correct
+answers: `reminder-wakeword` twice, `agenda-query` twice, `task-capture`,
+`narrative-query`.
+
+Four misroutes explain four of the failures outright.
+
+| utterance | routed to | should have been | decided by |
+| --- | --- | --- | --- |
+| `меня зовут Ками` | intent `chat` | `remember` | llm-router, score 1.0, after the heads declined at 0.569 |
+| `что ты помнишь обо мне?` | intent `chat` | `query` | routing-heads, score 0.866 |
+| `что требует моего внимания?` | intent `chat` | `query`, then Praxis | routing-heads, score 0.723 |
+| `Самара` | intent `act` | the parked weather clarify | routing-heads thinned at 0.247, then `action:action-handler` |
+
+The first is why no fact was written for his own name. The second is the audit's
+misroute, moved: the audit had it going to `remember`, and now it goes to
+`chat`. Two of seven audit probes failed on this shape and the spec makes fixing
+it a DoD criterion; it is not fixed, it is different.
+
+The third is why Praxis was never asked. `PraxisGrammars()` is the only path to
+Praxis, the `praxis-attention` grammar declined with `pattern did not match`,
+and an intent of `chat` never reaches a query source at all.
+
+The fourth is the weather follow-up. The audit saw `Самара` die with `Я тебя не
+разобрала` and this run reproduces it exactly, with the cause visible: the bare
+city name scored `act` and went to the action handler, so the parked weather
+clarify was never offered it.
+
+Two more traces are worth naming.
+
+**`расскажи про Байкал` was taken by the stage 0 `narrative-query` grammar** and
+routed to `query:memory`, which answered from notes and invented a URL. Kiwix
+was `never_asked`. The spec's DoD says a Russian question lands on the Russian
+book; a stage 0 grammar takes the turn before the question can reach one.
+
+**`сколько будет два плюс два?` reached external search.** The stage 0
+`arithmetic-query` grammar declined with `pattern did not match`, the LLM router
+scored `query` at 1.0, and the answer came back from SearXNG as a chatty
+non-answer in formal Russian. `2 + 2` left the box.
+
+## The wake word has been deaf for seven hours
+
+Found while checking a verdict, not by a probe. `mavwaked` runs on workpc under
+a user unit and was not running during this baseline:
+
+```
+Active: inactive (dead) since Tue 2026-08-25 18:21:35 +04; 7h ago
+ Duration: 2h 45min 33.323s
+  Process: ExecStart=/home/kami/.local/bin/mavwaked -device mavmic ... (code=exited, status=0/SUCCESS)
+
+Aug 25 18:21:35 bugmachine mavwaked[2535262]: arecord: pcm_read:2285: read error: No such device
+```
+
+The microphone went away, `arecord` stopped, and `mavwaked` **exited zero**.
+systemd read a clean exit and did not restart it. Nothing on either box noticed,
+and nothing would have: the always-on listener going silent looks exactly like
+the always-on listener having nothing to report.
+
+`docs/spec.md` says under Hearing that no capture client ships (V-514). **A
+capture client does ship and it is `mavwaked`**: it spawns `arecord` for 16kHz
+mono PCM, runs silero VAD and the wake head, and sends `PushToTalk` frames to
+mavend's voice port. What is absent is `mavenclient`. That line in the spec is
+out of date.
+
+## The speech path was reachable and was not probed
+
+`POST /api/ptt` is registered on the same `mavweb` mux this baseline drove 58
+turns through (`cmd/mavweb/main.go:241`) and proxies raw PCM onto mavend's voice
+port (`cmd/mavweb/voiceproxy.go:47`). It takes audio and runs a real
+transcribe, route, reply turn.
+
+**Nothing in this run posted audio to it.** Every speech and senses criterion
+therefore reads `untested`, reason `scenario missing`, and not `deployment
+missing`: the deployment is present and the probe was never written. Recording
+that as a deployment problem would have sent the next session to the wrong file.
+
+Two facts about that path were established while correcting it:
+
+- **Both workstation endpoints refuse.** `192.168.1.105:8080` and `:8081` return
+  no HTTP status from workpc. `workstation.model_disabled` is also `true`. So
+  mavend's `stt.Pair` has already fallen to the `mavsttd` floor, and the floor
+  is the only transcriber in service right now.
+- **`internal/ttsnorm` is compiled into `mavend`, not `mavttsd`.**
+  `ttsnorm.Speakable` runs on the voice reply path and on nudge text. The
+  deployed mavend carries it on the 2026-08-19 image.
+
+## What the run does not establish
+
+- **The voice reach was not exercised.** No listener runs on workpc, so
+  `voicesink` records `blocked, no listener` and nothing here tests it. 156 of
+  the last 200 delivery attempts are that reach failing.
+- **The Praxis lifecycle gate is untested.** Praxis holds nothing, so the
+  mutation had no referent. The architecture pass's claim that
+  `praxisItemAction.handle` calls through with no tier stands as a code reading.
+- **The `mavsttd` and `mavttsd` arms were not exercised**, though they were
+  reachable. See the section above: no audio probe was written.
+- **Telegram arrival was not confirmed by the owner.** The attempt row says
+  `sent`; that the message appeared on his phone is not in this file.
+- **The 14-day routing-trace retention was not exercised.** That retention
+  covers the traces `correct` writes against, which are a table. The decision
+  ring measured above is a different thing and is capped at 25 turns in memory.
+
+## Row counts after the field run
+
+| store | before | after | delta |
+| --- | ---: | ---: | ---: |
+| facts | 13018 | 13041 | +23 |
+| notes | 180 | 185 | +5 |
+| reminders | 95 | 98 | +3 |
+| tasks, live | 5 | 6 | +1 |
+| decision ring | 0 | 25 | ring full |
+| events | 34 | 62 | +28 |
+| ecosystem traces | 86 | 115 | +29 |
+| nudges | 5 | 5 | 0 |
+| tools | 13 | 13 | 0 |
+
+**All 23 new facts are ambient.** 34 probe turns, including one that stated the
+owner's name and two that stated where he works, added nothing to the fact
+store. The +23 is `desk_active` and `page_heartbeat` continuing at their own
+rate through the seven minutes the run took.
+
+The +5 notes are four RSS items and one captured note. That note is stored as
+`запиши: ключи от гаража лежат в верхнем ящике стола`, imperative prefix
+included, so the note text is the command rather than the content.
+
+The +3 reminders are two identical `позвонить в клинику` rows, one from each
+run, and the `MVNPROBE` delivery probe.
+
+## Configuration and deployment, read directly
+
+These criteria are not observable through a turn. Chasing them through
+`POST /api/chat` would measure the router instead, so they were read from the
+config, the container and the startup log.
+
+### The web UI has no notes page and no facts page
+
+Fourteen pages answer 200, the slowest in 28ms.
+
+`/`, `/dash`, `/history`, `/trace`, `/notifications`, `/reminders`, `/morning`,
+`/events`, `/tasks`, `/chat`, `/ecosystem`, `/tools`, `/routines`, `/models`.
+
+`docs/spec.md` requires a page for every capability with a surface and names
+four: reminders, notes, tasks, facts. **`/notes` and `/facts` do not exist**, and
+`cmd/mavweb/main.go` registers no handler for either. The 2026-08-13 audit's
+"all ten pages answered 200" was true of the ten that exist.
+
+This settles the open half of the Notes DoD as well. A note cannot be deleted
+from the web UI because there is no page from which to delete one (V-494).
+
+`/auth/passkey` returns 404, consistent with WebAuthn being unconfigured.
+
+### Every step-up gate is fail-open
+
+`mavweb` says so itself, at startup, unprompted:
+
+```
+SECURITY WARNING: step-up verification is DISABLED (-webauthn-origin/-webauthn-rpid unset).
+These surfaces are UNGUARDED:
+  POST /tools        defines arbitrary argv via name+cmd, which internal/tool then EXECUTES
+  POST /routines     accepting schedules recurring firing
+  POST /models       chooses the resident model that routes and words every turn
+  POST /api/revert   voids the latest fact for a key
+  POST /api/chat     reaches the router, the LLM and, through applyAction, the act path
+  POST /api/ptt      the same, from audio
+```
+
+Six surfaces, and this baseline drove 58 turns through the fifth of them without
+authenticating. V-683, unchanged and now measured rather than read.
+
+### What is configured correctly
+
+| criterion | evidence |
+| --- | --- |
+| the voice port stays on homesrv loopback | `docker port` maps `9100/tcp -> 127.0.0.1:9110`. `voice.bind` is `0.0.0.0:9100`, which is the container's own namespace; the publish is what makes it loopback. |
+| the database is encrypted at rest, working copy in tmpfs | `/var/lib/maven/maven.db.enc`, 9.2 MB, mode 0600. Plaintext copy in `/dev/shm`, which is tmpfs. |
+| the embedder loads at 384 dimensions with the marker check passing | `voice: onnx embedder loaded (384 dim)`, then `voice: embedder marker ok (model_quantized@384/tok2)` |
+| the routing heads load from their own file | `router_heads.onnx`, not `model_path`. Refused at config load since V-692. |
+
+### What is not configured at all
+
+**There is no `weather` block in `deploy/mavend.json`.** Not a wrong value, not
+a disabled flag: the key is absent, so the provider loads as a stub. The audit
+found this and it has not changed. `какая сейчас погода?` answers `для какого
+города?` and then cannot use the answer, which is the same two-turn failure the
+audit recorded, reproduced here with its routing cause visible above.
+
+### Tests and analyzers
+
+`make test` is **green** across `./internal/...` and `./cmd/...`, with `-race`
+and `-coverprofile`. `cmd/mavend` took 223.8s at 70.0% coverage and
+`internal/store` 81.0s at 70.8%.
+
+**It does not set `MAVEN_ONNX_LIB`.** `Makefile:196` is the whole recipe and the
+variable is not in it. Only `make t` and the four `eval-*` targets set it. So
+every `TestONNX*` measurement self-skips inside `make test`, and the run prints
+`ok` anyway, which is the failure mode `CLAUDE.md` names in as many words.
+
+Run under the `test` target's own environment, one package:
+
+```
+--- SKIP: TestONNXPersonalBoundaryStratified (0.00s)
+--- SKIP: TestONNXPersonalBoundary (0.00s)
+--- SKIP: TestONNXPersonalBoundaryFourFold (0.00s)
+--- SKIP: TestONNXPersonalBoundarySemanticGroupHoldout (0.00s)
+--- SKIP: TestONNXPersonalBoundaryChallenge (0.00s)
+--- SKIP: TestONNXPersonalBoundaryPostRetuneChallenge (0.00s)
+--- SKIP: TestONNXPersonalBoundaryLatency (0.00s)
+--- SKIP: TestONNXPersonalBoundaryFrozenHeadMatchesCorpusFit (0.00s)
+PASS
+ok  	github.com/kami/maven/cmd/mavend	1.045s
+```
+
+Grepping the `make test` output for `skip` returns nothing, because `go test`
+prints no SKIP line without `-v`. A green run and a run where the measurements
+never executed are the same eight characters.
+
+The measurements do pass when they are given the library. Under `make t`, which
+sets it and does not use coverage:
+
+```
+--- PASS: TestONNXPersonalBoundary (5.68s)
+--- PASS: TestONNXPersonalBoundaryFourFold (26.30s)
+--- PASS: TestONNXPersonalBoundarySemanticGroupHoldout (37.97s)
+--- PASS: TestONNXPersonalBoundaryChallenge (5.23s)
+--- PASS: TestONNXPersonalBoundaryPostRetuneChallenge (5.35s)
+--- PASS: TestONNXPersonalBoundaryLatency (5.17s)
+--- PASS: TestONNXPersonalBoundaryFrozenHeadMatchesCorpusFit (13.45s)
+--- SKIP: TestONNXPersonalBoundaryStratified (0.00s)
+```
+
+The latency test V-718 describes as failing only under coverage passed here in
+5.17s, in a run that carries no coverage. **This baseline does not reproduce
+V-718 and does not refute it.** The one invocation that does use coverage,
+`make test`, is the one where this test self-skips.
+
+**`make analyze` does not pass.** `staticcheck` and `deadcode` produced nothing
+over their baselines. `govulncheck` reports seven vulnerabilities, every one in
+the standard library, every one fixed in `go1.25.13`, and the vendored toolchain
+is `go1.25.12`:
+
+```
+Your code is affected by 7 vulnerabilities from the Go standard library.
+make: *** [Makefile:119: vuln] Error 3
+```
+
+Reachable ones include `internal/kiwix/client.go:165` through
+`encoding/xml`, `internal/netaddr/netaddr.go:228` through `encoding/asn1`, and
+`internal/vision/vision.go:277` through `net/http`. This is a toolchain bump,
+not a code fix.
+
+**This is the point the spec was written to make**, and the suite made it twice
+over. It is green while 50 of 146 v1 criteria fail on the running box. It is
+also green while the four measurements it is supposed to carry are not running
+at all. A green suite has never been evidence that a capability works.
+
+`mavwaked` was not queried for its build. It runs on workpc under systemd,
+outside this stack, and the measuring box could not reach it.
+
+## Undesigned in v1, by inspection
+
+Nine capabilities have no design. Their criteria were settled by reading the
+deployed artifacts, not by probing, and three readings changed what the spec
+says about them.
+
+**Email and calendar are recorded decisions, not open questions.**
+`docker-compose.yml:145` and `:175` each carry a commented service with the
+reasoning beside it. The mail block names the blocker (no IMAP account), the
+security shape (password from a file, core never sees it, nothing there can
+create a reminder) and the steps to enable it. It also records what triage
+means: task extraction into candidates he reviews on `/tasks`, explicitly not
+the acting variant. The calendar block says outright that mavcaldav "was built,
+listed in `make build`, and deployed nowhere, which is the worst of the three
+states, this block records the decision instead", then writes out what the
+absence costs. Both capabilities' "in compose, or its absence is deliberate and
+recorded" criterion **passes on the second branch**.
+
+**The box has no inbound HTTP intake at all.**
+`internal/delivery/telegramsink/intake.go` long-polls `getUpdates` outbound,
+precisely because nothing can connect inward and it reaches `api.telegram.org`
+through a socks relay. It is not "Telegram's own inbound webhook".
+
+**Command chaining is half built and live.** `voice.llm_router` is `true` on the
+deployed box, the router's grammar contract already returns an array of actions
+for a compound utterance, and `parseActions` builds all of them. Nothing
+dispatches past the first. The seam is `internal/router/llmrouter.go`, not a
+missing package.
+
+**Learning from mistakes has its stores.** The `nudges` table holds an outcome
+per nudge, `store.RecentOutcomes` reads the last N per rule, and
+`loop.TuneCooldown` turns a high ignored rate into a longer cooldown. Route
+repair is stored twice, as a `routing_labels` row and as a classifier example,
+and there are two correction paths, not one: `POST /api/correct` and the spoken
+`cmd/mavend/repair.go` (V-455). `routing_labels` held 2 rows before the wipe.
+What has no store is a corrected phrasing.
+
+What genuinely does not exist: summaries as a requestable capability, webhooks in
+either direction, any style-learning store, and any document relating the three
+schedulers to each other.
+
+## The tally
+
+146 v1 criteria across 46 capabilities. The five deferred capabilities keep
+their ten criteria at `untested`, reason `deferred past v1`, and were not
+probed.
+
+| verdict | criteria |
+| --- | ---: |
+| pass | 26 |
+| fail | 50 |
+| blocked | 15 |
+| untested | 51 |
+| unknown | 4 |
+
+`pass` was only ever available to `live` evidence. `untested` is the largest
+bucket and most of it is honest scope: a wall-clock trigger a probe cannot
+reach, a workpc daemon the measuring box cannot see, an external service that
+would have to be taken down on purpose.
+
+Per capability, in `docs/capabilities/ledger.yaml`. Nothing here is ranked.
+Ranking is session 2's job and ranking these numbers without the implementation
+mapping behind them would be the reverse of the causal order the plan sets out.
+
+## What this baseline expires on
+
+Any of these invalidates every number above.
+
+- The resident model moving off `maven-instruct-b2-Q4_K_XL`.
+- `deploy/mavend.json` changing, including committing the model switch that is
+  currently uncommitted.
+- `docker compose up -d --force-recreate mavsttd mavttsd mavpoll`, which is
+  outstanding from 2026-08-13 and would close the image drift measured here.
+- Seeding Nexus, which would move every `blocked, external dependency
+  unavailable` verdict on the act path.
+- A voice listener appearing on workpc.
+- `systemctl --user restart mavwaked` on workpc, once the microphone is back.
+  The wake word and hearing verdicts are all measured against a dead process.
+
+## The store was wiped afterwards
+
+The plan calls for it and the owner confirmed it, knowing the count. Two copies
+of the encrypted file were taken first, both outside the repo on homesrv, so the
+decision is reversible:
+
+- `~/maven-preswipe-2026-08-26.db.enc`, the 23:50 seal, before this session.
+- `~/maven-preswipe-final-2026-08-26.db.enc`, taken after stopping mavend.
+
+```
+wiped. 30899 rows gone, the schema is intact, mavend knows nobody.
+```
+
+Config, models, passkeys and the encryption key are files and were not touched.
+Forty seconds after the restart the store held 1 fact, 4 notes, 4 events and 12
+tools: `desk_active` had already fired once, the RSS poller had run, and the tool
+registry had re-seeded itself.
+
+**Every measurement in this file is now unreproducible against the same data.**
+That is what a frozen eval is for.
+
+## Where the raw evidence is
+
+| file | what it holds |
+| --- | --- |
+| `docs/capabilities/out/field.transcript.tsv` | 34 turns: probe id, utterance, reply, claiming source, seconds |
+| `docs/capabilities/out/field.raw.jsonl` | the same, plus every readback, including the full claim ladder per turn |
+| `docs/capabilities/out/field.contaminated.jsonl` | the first run, which measured itself. Kept because the leak is a finding |
+| `docs/capabilities/out/counts_after_field.json` | store counts after the probes |
+| `docs/capabilities/out/counts_after_wipe.json` | store counts forty seconds after the restart |
+
+**The transcript carries his real data**: the task list, the note captured
+during the run, and the utterances the probes spoke. The store it came from no
+longer exists, so this is now the only record of those rows. It sits in the repo
+under the same rule as `2026-08-07-week-of-usage-transcript.md`: the transcript
+is the evidence and is not summarised anywhere else.
+
+## How the verdicts were checked
+
+Every verdict was audited by an independent pass told to refute it, one auditor
+per spec section, with `pass` attacked hardest. It found real errors and they
+are corrected above rather than argued with. The ones worth naming, because the
+same mistakes are easy to repeat:
+
+- **`make test` was scored `pass` on the `MAVEN_ONNX_LIB` clause.** The recipe
+  does not set it. Grepping the output for `skip` returned nothing, which is
+  what a self-skipping test looks like without `-v`. This was the exact trap
+  `CLAUDE.md` describes, walked into while measuring whether other things had
+  walked into it.
+- **"eleven consecutive turns" was wrong.** The park reached five, turns 9
+  through 13, and was released by a path other than `отмена`. The wrong count
+  had already propagated into two other files.
+- **"25 traces" was wrong.** 22 were read back, 15 reached the route stage and
+  11 reached the query stage. Claims of the form "in every trace" were false for
+  the seven turns that never routed.
+- **The voice retries were called ongoing.** They are a bounded three-hour burst
+  on 2026-08-16, 151 rows, then silence.
+- **`POST /api/ptt` was called unreachable.** It is on the same mux this
+  baseline used 58 times. Four speech criteria were filed as `deployment
+  missing` when the deployment is present and the probe was never written.
+- **`internal/worker` was read for Hexis calls.** It is the speech offload wire.
+  Digestion is `cmd/mavend/tick_digest.go` and `internal/loop`.
+- **The masculine reply came from the discarded run**, not from the 34 scored
+  turns.
+
+Sixteen verdicts carried an evidence path pointing at a section of this file
+that did not exist. `build_ledger.py` now refuses to build when an evidence path
+or a `§` heading does not resolve.
+
+The corrections moved the tally by nine: four passes withdrawn, and five
+criteria that had been filed `untested` turned out to be already settled.

docs/evals/CLAUDE.md

@@ -45,6 +45,7 @@ A pair in `docs/routing.md` went stale unnoticed. Its source predated the
 | [MASSIVE Russian warm-start for the routing heads](2026-08-08-massive-warm-start.md) | live |
 | [gemma-4-E4B against gemma-4-12B on the routing fixture](2026-08-09-e4b-vs-12b-routing.md) | live |
 | [The classifier baseline after the tokenizer fix](2026-08-11-classifier-baseline-after-tokenizer-fix.md) | live |
+| [The CPT+SFT Qwen3-1.7B routes better and cannot hold a sentence](2026-08-19-maven-model-cpt-sft.md) | live |
 
 `docs/routing.md` holds the arm table these feed. Cite from there, not from here.
 
@@ -90,6 +91,7 @@ A pair in `docs/routing.md` went stale unnoticed. Its source predated the
 | [Talk fixture against the resident model](2026-08-05-talk-fixture-resident.md) | live |
 | [Talk temperature sweep: Qwen3-1.7B, 4 temperatures times 3 runs](2026-08-05-temperature-sweep.md) | live |
 | [gemma-4-E4B on the phrasing and talk fixtures](2026-08-09-e4b-phrasing.md) | live |
+| [The CPT+SFT Qwen3-1.7B routes better and cannot hold a sentence](2026-08-19-maven-model-cpt-sft.md) | live |
 
 ## World: search and Kiwix
 
@@ -131,6 +133,13 @@ evidence and is not summarised anywhere else.
 | measurement | state |
 | --- | --- |
 | [Repository deep-audit report](2026-08-10-repo-audit.md) | live |
+| [What 39 capabilities actually did on the box](2026-08-13-capability-audit.md) | superseded by 2026-08-26 |
+| [Capability baseline: what the deployed Maven actually does](2026-08-26-capability-baseline.md) | live |
+
+The 2026-08-26 baseline scores all 146 v1 DoD criteria in `docs/spec.md` and is
+cited by every `verified` cell in `docs/capabilities/ledger.yaml`. It measures
+`maven-instruct-b2-Q4_K_XL`, not the Qwen3-1.7B `CLAUDE.md` names, and it
+expires when the model or `deploy/mavend.json` moves.
 
 Its open findings live in `docs/caveats/`, one entry each with a revisit
 trigger. Read the index there, not this file, for what is still broken.

docs/plans/26-capability-ledger-and-baseline.md

@@ -0,0 +1,276 @@
+# 26. The capability ledger and the empirical baseline
+
+V-725. Written 2026-08-26 against `5cae33a`, filed after the fact.
+
+Frozen once session 1 starts. Changes of mind go to the handoff, not back here.
+
+## The question this answers
+
+How much of the Maven described by `docs/spec.md` exists today, and where does
+the current architecture support or obstruct that target.
+
+## What this is not
+
+- Not a redesign and not another architecture pass.
+- No fixes. This pass produces the map used to decide what to build next.
+- `docs/spec.md` is not edited. It is the authoritative statement of intent.
+- A package, type or function existing is not proof a capability works.
+
+## The causal order
+
+```text
+spec says what should happen
+        ↓
+the empirical run says what actually happens
+        ↓
+code and architecture explain why
+        ↓
+priority says what to fix
+```
+
+The reverse order is what the capability spec was written to prevent. Its
+predecessor audit had a green suite while 22 of 39 capabilities were not live.
+
+## The target Maven
+
+A persistent personal agent. Request and response is one input mode, not the
+shape of the system. The target is drawn around capabilities, never packages.
+
+Eight domains:
+
+| domain | holds |
+| --- | --- |
+| perception/context | presence, device state, time, environment, current activity, conversation state |
+| memory/model of you | facts, preferences, relationships, history, commitments, notes, routines, inferred context |
+| attention | what matters now, unfinished things, reminders, deadlines, anomalies, things worth surfacing |
+| deliberation | interpret requests, resolve ambiguity, connect current events to past context, decide to act, query, ask or wait |
+| initiative | nudges, follow-ups, missed-task recovery, opportunistic suggestions, background checks |
+| action | local tools, home automation, other services, information retrieval, document and email workflows |
+| interaction | voice, web, notifications, telegram or matrix, with continuity across surfaces |
+| governance | permissions, confidence, confirmation, privacy, reversibility, non-autonomous propose-then-enable |
+
+A ninth bucket, `operations`, holds what the spec files under Operations. It is
+infrastructure, not agent behavior, and a forced fit would hide that.
+
+## The five vertical slices
+
+The slices the field probes exercise. Each is end to end, never one turn.
+
+1. **reminder**: create, clarify time, correct, persist, fire, acknowledge.
+2. **fact/note**: record, correct or supersede, retrieve later, answer with current truth.
+3. **query**: understand, choose source, preserve follow-up context, answer.
+4. **action**: understand target, confirm only when needed, execute, report the actual result.
+5. **proactive**: detect the condition, decide whether to interrupt, deliver on the right channel.
+
+## Three sessions
+
+The baseline is perishable. It measures one model on one config, so a config
+change invalidates it. The viewer is presentation over data that does not exist
+yet.
+
+| session | produces |
+| --- | --- |
+| 1 | `docs/capabilities/ledger.yaml` target side, then the empirical baseline as a dated eval |
+| 2 | implementation mapping, `docs/capabilities/invariants.md`, `docs/capabilities/gaps.md`, the ranked list |
+| 3 | the `capabilities` mode in the architecture viewer |
+
+## Session 1, step 1: the skeleton
+
+Mechanical extraction from `docs/spec.md` into `docs/capabilities/ledger.yaml`.
+No implementation judgment, no verification status, no ranking.
+
+Preserved per capability: id, section, `v1` or `deferred` scope, state
+references, every DoD criterion, scenario names, and the findings the spec
+already carries.
+
+Added at extraction time:
+
+- `domain`, at most two, primary first. More than two means it is two capabilities.
+- A stable criterion id, `<capability-slug>#<4 hex of the criterion text>`. A
+  positional id shifts when the spec gains a criterion, and the frozen eval
+  would then cite the wrong one.
+
+The 51-row capability-to-domain table goes to the owner once, before any probe
+runs.
+
+The five deferred capabilities enter the skeleton and are not probed. Their
+criteria read `untested`, reason `deferred past v1`.
+
+## Session 1, step 2: the empirical baseline
+
+### Where it runs
+
+Against the live `maven-mavend-1`, then `mavend -wipe -confirm-wipe` after the
+run. A dry run without the confirm flag comes first and its row counts are the
+eval's first artifact.
+
+The live resident model is `maven-instruct-b2-Q4_K_XL`, not the Qwen3-1.7B that
+`CLAUDE.md` still names. `deploy/mavend.json` carries the switch uncommitted.
+Every number in the baseline is attributable to b2.
+
+### Transport
+
+`POST /api/chat` on `127.0.0.1:9201` drives a real turn through the deployed
+stack. The reply comes back in the redirect `Location` as `?q=…&r=…&t=<trace id>`.
+No new binary and no audio needed, and it covers the web reach.
+
+### Readback
+
+`cmd/e2eprobe`, built in a one-off `golang:1.25-trixie` container and copied in
+with `docker cp`. Both images are trixie, so glibc matches. It gives typed IPC
+JSON for `decisions`, `facts`, `notes`, `reminders`, `nudges`, `tools` and
+`delivery-attempts`.
+
+Not the sqlite file. The plaintext copy at `/dev/shm/maven-plain.db` bypasses the
+contract the ledger exists to measure. Not the mavweb pages either: HTML is a
+second-hand rendering.
+
+### Two probe origins
+
+- `dod:<criterion id>`, derived from the ledger. Only these set a DoD verdict.
+- `field:<slice>`, the owner's real week. 25 multi-turn probes, drafted from the
+  five slices, the three ugly conversations verbatim, the five existing
+  scenarios, and what the box is configured for.
+
+A failing `field` probe becomes an unresolved product question in
+`invariants.md` where the spec never defined the behavior. It becomes a
+missing-criterion finding against `docs/spec.md` where the spec should have
+covered it. Neither edits the spec in this pass.
+
+### Three evidence kinds
+
+| kind | what it is | may set `pass` |
+| --- | --- | --- |
+| `live` | `e2eprobe` and `/api/chat` against the deployed build, real model, real store rows | yes |
+| `replay` | the scenario harness, model faked, clock controlled | no |
+| `simulated` | faked clock, real code path, no deployed process | no |
+
+A green `replay` with no live probe reads `verified: untested`, with the replay
+recorded as implementation evidence. The scenario harness scripts both `route`
+and `reply`, so a pass proves the wiring around the model and not the turn.
+
+`simulated` is allowed only where the trigger is anchored to a wall-clock hour
+or date the pass cannot reach. The morning digest hour, the 14-day trace
+retention sweep, a weekly routine. Everything else uses a compressed live
+horizon, because `TickInterval` defaults to 60s and no override is configured.
+
+### Reaches
+
+`reachable` is per reach. Inbound: web, ipc. Outbound: `ntfysink`,
+`telegramsink`, `voicesink`.
+
+One delivery per outbound reach, three notifications total, each carrying a fixed
+marker so a probe is not read as a real nudge. `reachable: pass` needs the
+`delivery-attempts` row plus the owner confirming arrival. `voicesink` needs a
+connected client on workpc, and records `blocked, no listener` when there is
+none.
+
+### Per-criterion verdict
+
+Every DoD criterion gets `pass`, `fail`, `blocked`, `untested` or `unknown`, and
+a reason distinguishing why it is not passing: code missing, wiring missing,
+configuration missing, deployment missing, external dependency unavailable,
+scenario missing, scenario fails, or implementation exists with no runtime proof.
+
+Where a scenario covers a criterion, the exact step or assertion is named. Where
+none exists, the spec's `(to write)` state stands. No evidence is invented.
+
+Every generated claim carries `path:line`, or runtime or scenario evidence.
+`unknown` where evidence is insufficient.
+
+### Stop condition
+
+Session 1 ends when every v1 DoD criterion carries a verdict with evidence
+attached, and the eval is written. No mapping, no gaps, no ranking.
+
+A baseline that stops halfway leaves a ledger that looks measured and is not.
+
+## Session 2: the explanation
+
+Implementation mapping onto the ledger, as independent dimensions, never
+collapsed into one `implemented` boolean: `designed`, `code_present`, `wired`,
+`configured`, `deployed`, `reachable`, `verified`.
+
+`docs/capabilities/invariants.md` extracts the cross-cutting rules the 51
+capabilities imply and do not state. Continuity across turns and across
+reaches, memory and correction semantics, current context and presence,
+proactive attention, interruption policy, clarification and follow-up ownership,
+degradation and honesty, authority and confirmation, privacy boundaries,
+learning from outcomes, capability composition, persistence across restart.
+
+Each invariant is marked `explicit`, `implied` or `unresolved`, with evidence.
+Nothing desired is invented where the sources do not define it. An unresolved
+invariant is a product question, not a defect.
+
+`docs/capabilities/gaps.md` compares responsibilities, never package names.
+Classes: capability missing, capability partial, capability exists but
+unreachable, capability exists but unverified, duplicated mechanism, missing
+shared mechanism, current architecture conflicts with target behavior, and
+architecture concern with no current product impact.
+
+Every architecture concern names the capability or invariant it affects. One
+affecting none is marked non-blocking cleanup explicitly.
+
+### Prioritization
+
+One final list, ranked:
+
+1. Prevents intended everyday use today.
+2. Makes existing behavior incorrect or unreliable.
+3. Blocks multiple capabilities.
+4. Prevents verification.
+5. Architectural cleanup with no present user impact.
+
+An unwired or unreachable future defect never outranks a live user-visible
+failure because its architecture is ugly.
+
+## Session 3: the viewer
+
+A `capabilities` mode in the architecture viewer. The primary view is a matrix of
+capability against `designed`, `coded`, `wired`, `configured`, `deployed`,
+`reachable`, `verified`.
+
+Clicking a capability shows the target DoD, implementation evidence,
+verification evidence, affected components, scenarios, blockers and unresolved
+product questions.
+
+An `invariants` view shows which components participate in each cross-cutting
+rule. Target, implementation and runtime verification are distinguished visually.
+
+## Where the artifacts live
+
+`docs/capabilities/` becomes a declared tier in `docs/CLAUDE.md`: generated,
+regenerated from `docs/spec.md` plus a named eval, never hand-edited. The same
+row legitimises `docs/architecture/`, which is currently an undeclared
+directory.
+
+The empirical run lands as one dated eval, `docs/evals/2026-08-26-capability-baseline.md`,
+frozen on the day. Every `verified` cell in the ledger cites it by path, so no
+status is an opinion.
+
+## Decided, do not re-ask
+
+- Three sessions, split on the causal order above.
+- Target side of the ledger first, with no implementation or verification status.
+- Two verified columns plus `simulated`. Only `live` sets `pass`.
+- Probes run against the live container, with the store wiped afterwards.
+- Row counts are read with a `mavend -wipe` dry run before anything else.
+- Readback is `e2eprobe`, not sqlite and not the web pages.
+- Both probe origins, `dod:` and `field:`, tagged.
+- Deferred capabilities get the skeleton only.
+- All three outbound reaches get one real delivery.
+- Domain is a second axis beside the spec section.
+- No fixes land in this pass.
+
+## Findings recorded while planning
+
+Live and reproduced, not inferred. They belong to the baseline, not to this plan.
+
+- `POST /api/chat` with `что ты помнишь обо мне?` answered
+  `Я не знаю вас или как вы себя называете`. Formal `вас` and `вы` on the wire,
+  where `CLAUDE.md` requires informal singular `ты`. The phrasing eval passes.
+- Vikunja was never down. `vikunja-mcp` publishes `127.0.0.1:9100` only, so the
+  LAN address never answers from workpc. Three sessions read a refused
+  connection as an outage and filed nothing.
+- The deployed resident model is `maven-instruct-b2-Q4_K_XL`. `CLAUDE.md` still
+  names Qwen3-1.7B.

internal/decision/decision.go

@@ -68,6 +68,16 @@ type Record struct {
 	Winner    string    `json:"winner"`
 	Claims    []Claim   `json:"claims"`
 
+	// InputSource — which channel the utterance arrived on (tap:voice or
+	// tap:text). Carried for observability so a trace can distinguish a voice
+	// turn from a text turn without re-deriving it from surrounding claims.
+	InputSource string `json:"input_source,omitempty"`
+
+	// RouteProducer — which cascade stage produced the routing decision.
+	// Carried for observability so a trace names the winning component directly
+	// rather than requiring a scan of the claims list.
+	RouteProducer string `json:"route_producer,omitempty"`
+
 	mu      sync.Mutex
 	rosters []roster
 }
@@ -152,9 +162,10 @@ func (r *Record) Finish(now time.Time) *Record {
 type recorderKey struct{}
 
 // With returns a context carrying a fresh record, and the record to read after
-// the turn has answered.
-func With(ctx context.Context, utterance string) (context.Context, *Record) {
-	rec := &Record{Utterance: utterance}
+// the turn has answered. inputSource identifies the channel the utterance
+// arrived on; pass empty if unknown.
+func With(ctx context.Context, utterance string, inputSource string) (context.Context, *Record) {
+	rec := &Record{Utterance: utterance, InputSource: inputSource}
 	return context.WithValue(ctx, recorderKey{}, rec), rec
 }
 

internal/router/actioncandidate.go

@@ -0,0 +1,95 @@
+package router
+
+// ActionCandidate — the result of action resolution, produced before execution.
+// It replaces the implicit ownership split where the router filled Slots.Fn/Args
+// and actionAct re-matched when they were absent. One candidate is produced per
+// IntentAct decision, carrying the resolved function, its arguments, and where
+// the resolution came from.
+type ActionCandidate struct {
+	// Fn — the resolved function/tool identity. Empty when no match was found.
+	Fn string
+
+	// Args — positional arguments passed to the tool. May be nil when Fn is
+	// empty or when the match produced no arguments.
+	Args []string
+
+	// Source — where the resolution came from. Typed enum, not free-form.
+	Source ActionSource
+
+	// Producer — which cascade stage produced the routing decision that led
+	// here. Carried for observability; not used for dispatch.
+	Producer RouteProducer
+
+	// Confidence — the routing confidence from the decision. Carried for
+	// observability; not used for dispatch.
+	Confidence float64
+}
+
+// ActionSource — where action resolution came from. Two values: the router
+// resolved the function upstream (stage-0 grammar or stage-2 extraction), or
+// the fallback matcher ran because the router did not fill Fn.
+type ActionSource string
+
+const (
+	// ActionSourceRoute — Fn/Args were already resolved in the routing
+	// cascade (stage-0 grammar match, stage-2 extractor, or LLM slot
+	// backfill). The matcher was not invoked.
+	ActionSourceRoute ActionSource = "route"
+
+	// ActionSourceMatcher — the router left Fn empty, so the fallback
+	// matcher ran against the text slot and produced the match.
+	ActionSourceMatcher ActionSource = "matcher"
+)
+
+// ActionResolved reports whether the candidate resolved to a function.
+func (c ActionCandidate) ActionResolved() bool { return c.Fn != "" }
+
+// ResolveActionCandidate produces an ActionCandidate from a routing decision.
+// It is the single boundary between routing and action resolution: everything
+// downstream consumes the candidate rather than re-resolving the function.
+//
+// Resolution rules:
+//   - Non-act intents: candidate is not applicable (Fn empty, source empty).
+//   - Act with Slots.HasFn: the router already resolved the function upstream
+//     (stage-0 grammar, stage-2 extractor, or LLM slot backfill). Candidate
+//     source is ActionSourceRoute.
+//   - Act without Fn: the fallback matcher runs against the text slot.
+//     Candidate source is ActionSourceMatcher on match, or Fn stays empty.
+//
+// The matcher algorithm, enabled-tool set, alias behavior, fuzzy-prefix
+// behavior, and ordering are unchanged — this is a mechanical extraction of
+// the same matching call that actionAct previously owned.
+func ResolveActionCandidate(dec Decision, m ActMatcher) ActionCandidate {
+	if dec.Intent != IntentAct {
+		return ActionCandidate{}
+	}
+
+	// Router resolved the function upstream.
+	if dec.Slots.HasFn {
+		return ActionCandidate{
+			Fn:         dec.Slots.Fn,
+			Args:       dec.Slots.Args,
+			Source:     ActionSourceRoute,
+			Producer:   dec.Producer,
+			Confidence: dec.Confidence,
+		}
+	}
+
+	// Fallback: invoke the matcher against the text slot.
+	if dec.Slots.Text != "" && m != nil {
+		if fn, args, ok := m.Match(dec.Slots.Text); ok {
+			return ActionCandidate{
+				Fn:         fn,
+				Args:       args,
+				Source:     ActionSourceMatcher,
+				Producer:   dec.Producer,
+				Confidence: dec.Confidence,
+			}
+		}
+	}
+
+	return ActionCandidate{
+		Producer:   dec.Producer,
+		Confidence: dec.Confidence,
+	}
+}

internal/router/actioncandidate_test.go

@@ -0,0 +1,151 @@
+package router
+
+import (
+	"testing"
+)
+
+// TestResolveActionCandidate_RouteSource pins that an act with HasFn=true
+// produces a candidate from the route, not the matcher.
+func TestResolveActionCandidate_RouteSource(t *testing.T) {
+	dec := Decision{
+		Intent: IntentAct,
+		Slots:  Slots{Fn: "restart", Args: []string{"nginx"}, HasFn: true},
+	}
+	c := ResolveActionCandidate(dec, nil)
+	if !c.ActionResolved() {
+		t.Fatal("expected resolved candidate")
+	}
+	if c.Fn != "restart" {
+		t.Errorf("Fn = %q, want restart", c.Fn)
+	}
+	if len(c.Args) != 1 || c.Args[0] != "nginx" {
+		t.Errorf("Args = %v, want [nginx]", c.Args)
+	}
+	if c.Source != ActionSourceRoute {
+		t.Errorf("Source = %q, want route", c.Source)
+	}
+}
+
+// TestResolveActionCandidate_MatcherSource pins that an act without Fn
+// invokes the matcher and produces a candidate from it.
+func TestResolveActionCandidate_MatcherSource(t *testing.T) {
+	m := DefaultActMatcher{Fns: []string{"restart", "stop"}}
+	dec := Decision{
+		Intent: IntentAct,
+		Slots:  Slots{Text: "restart nginx"},
+	}
+	c := ResolveActionCandidate(dec, m)
+	if !c.ActionResolved() {
+		t.Fatal("expected resolved candidate")
+	}
+	if c.Fn != "restart" {
+		t.Errorf("Fn = %q, want restart", c.Fn)
+	}
+	if c.Source != ActionSourceMatcher {
+		t.Errorf("Source = %q, want matcher", c.Source)
+	}
+}
+
+// TestResolveActionCandidate_MatcherMiss pins that a matcher miss produces
+// an unresolved candidate.
+func TestResolveActionCandidate_MatcherMiss(t *testing.T) {
+	m := DefaultActMatcher{Fns: []string{"restart", "stop"}}
+	dec := Decision{
+		Intent: IntentAct,
+		Slots:  Slots{Text: "deploy the thing"},
+	}
+	c := ResolveActionCandidate(dec, m)
+	if c.ActionResolved() {
+		t.Fatal("expected unresolved candidate")
+	}
+	if c.Fn != "" {
+		t.Errorf("Fn = %q, want empty", c.Fn)
+	}
+	if c.Source != "" {
+		t.Errorf("Source = %q, want empty", c.Source)
+	}
+}
+
+// TestResolveActionCandidate_NonAct pins that a non-act decision produces
+// an empty candidate.
+func TestResolveActionCandidate_NonAct(t *testing.T) {
+	dec := Decision{
+		Intent: IntentFact,
+		Slots:  Slots{Key: "water", Value: "drank", HasKey: true},
+	}
+	c := ResolveActionCandidate(dec, nil)
+	if c.ActionResolved() {
+		t.Fatal("expected unresolved candidate for non-act")
+	}
+}
+
+// TestResolveActionCandidate_Stage0Match pins that a stage-0 act (which
+// sets HasFn=true) produces a route-sourced candidate.
+func TestResolveActionCandidate_Stage0Match(t *testing.T) {
+	dec := Decision{
+		Intent:     IntentAct,
+		Stage:      0,
+		Confidence: 1.0,
+		Slots:      Slots{Fn: "restart", Args: []string{"nginx"}, HasFn: true},
+		Producer:   RouteProducerGrammar,
+	}
+	c := ResolveActionCandidate(dec, nil)
+	if !c.ActionResolved() {
+		t.Fatal("expected resolved candidate")
+	}
+	if c.Source != ActionSourceRoute {
+		t.Errorf("Source = %q, want route", c.Source)
+	}
+	if c.Producer != RouteProducerGrammar {
+		t.Errorf("Producer = %q, want grammar", c.Producer)
+	}
+	if c.Confidence != 1.0 {
+		t.Errorf("Confidence = %f, want 1.0", c.Confidence)
+	}
+}
+
+// TestResolveActionCandidate_LearnedRouterNoFn pins that a learned-router
+// act without Fn falls through to the matcher.
+func TestResolveActionCandidate_LearnedRouterNoFn(t *testing.T) {
+	m := DefaultActMatcher{Fns: []string{"restart", "stop"}}
+	dec := Decision{
+		Intent:     IntentAct,
+		Stage:      1,
+		Confidence: 0.85,
+		Slots:      Slots{Text: "restart the server"},
+		Producer:   RouteProducerLLM,
+	}
+	c := ResolveActionCandidate(dec, m)
+	if !c.ActionResolved() {
+		t.Fatal("expected resolved candidate from matcher fallback")
+	}
+	if c.Fn != "restart" {
+		t.Errorf("Fn = %q, want restart", c.Fn)
+	}
+	if c.Source != ActionSourceMatcher {
+		t.Errorf("Source = %q, want matcher", c.Source)
+	}
+}
+
+// TestResolveActionCandidate_AliasMatch pins that aliases resolve through
+// the matcher path.
+func TestResolveActionCandidate_AliasMatch(t *testing.T) {
+	m := DefaultActMatcher{
+		Fns:     []string{"restart"},
+		Aliases: map[string][]string{"restart": {"перезагрузи"}},
+	}
+	dec := Decision{
+		Intent: IntentAct,
+		Slots:  Slots{Text: "перезагрузи роутер"},
+	}
+	c := ResolveActionCandidate(dec, m)
+	if !c.ActionResolved() {
+		t.Fatal("expected resolved candidate from alias match")
+	}
+	if c.Fn != "restart" {
+		t.Errorf("Fn = %q, want restart", c.Fn)
+	}
+	if len(c.Args) != 1 || c.Args[0] != "роутер" {
+		t.Errorf("Args = %v, want [роутер]", c.Args)
+	}
+}

internal/router/boundary_test.go

@@ -0,0 +1,157 @@
+package router
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+// TestNormalizedInputIsMinimalValueObject — the typed ingress boundary carries
+// text and source and nothing else. This test pins the shape so a future slice
+// cannot add fields without updating every construction site.
+func TestNormalizedInputIsMinimalValueObject(t *testing.T) {
+	input := NormalizedInput{Text: "привет", Source: InputSourceVoice}
+	if input.Text != "привет" {
+		t.Errorf("Text = %q, want %q", input.Text, "привет")
+	}
+	if input.Source != InputSourceVoice {
+		t.Errorf("Source = %q, want %q", input.Source, InputSourceVoice)
+	}
+	// Empty zero value is usable.
+	var zero NormalizedInput
+	if zero.Text != "" || zero.Source != "" {
+		t.Errorf("zero value is not empty: %+v", zero)
+	}
+}
+
+// TestInputSourceConstants — the two channel values the daemon uses.
+func TestInputSourceConstants(t *testing.T) {
+	if InputSourceVoice != "tap:voice" {
+		t.Errorf("InputSourceVoice = %q, want %q", InputSourceVoice, "tap:voice")
+	}
+	if InputSourceText != "tap:text" {
+		t.Errorf("InputSourceText = %q, want %q", InputSourceText, "tap:text")
+	}
+}
+
+// TestRouteProducerConstants — the four cascade stages that produce a decision.
+func TestRouteProducerConstants(t *testing.T) {
+	wanted := map[RouteProducer]string{
+		RouteProducerGrammar:    "grammar",
+		RouteProducerHeads:      "heads",
+		RouteProducerLLM:        "llm",
+		RouteProducerClassifier: "classifier",
+	}
+	for got, want := range wanted {
+		if string(got) != want {
+			t.Errorf("RouteProducer(%q) = %q", got, want)
+		}
+	}
+}
+
+// TestStage0SetsGrammarProducer — a stage-0 grammar win carries the grammar
+// producer, not one of the statistical stages.
+func TestStage0SetsGrammarProducer(t *testing.T) {
+	r := buildTestRouter(t)
+	now := time.Now()
+	// "напомни позвонить маме завтра" — a reminder grammar match.
+	d, err := r.Route(context.Background(), "напомни позвонить маме завтра", now)
+	if err != nil {
+		t.Fatalf("Route: %v", err)
+	}
+	if d.Producer != RouteProducerGrammar {
+		t.Errorf("Producer = %q, want %q (stage 0 grammar)", d.Producer, RouteProducerGrammar)
+	}
+	if d.Stage != 0 {
+		t.Errorf("Stage = %d, want 0", d.Stage)
+	}
+}
+
+// TestClassifierSetsProducer — when no grammar matches and no model is wired,
+// the classifier is the floor and its producer is recorded.
+func TestClassifierSetsProducer(t *testing.T) {
+	r := buildTestRouterNoModel(t)
+	now := time.Now()
+	// "как дела" — a free-form chat utterance that no grammar matches.
+	d, err := r.Route(context.Background(), "как дела", now)
+	if err != nil {
+		t.Fatalf("Route: %v", err)
+	}
+	if d.Producer != RouteProducerClassifier {
+		t.Errorf("Producer = %q, want %q (classifier floor)", d.Producer, RouteProducerClassifier)
+	}
+}
+
+// TestClarifyProducerIsClassifier — a clarification below threshold still
+// carries the classifier as the producer, because the classifier produced
+// the decision that was then gated.
+func TestClarifyProducerIsClassifier(t *testing.T) {
+	r := buildTestRouterNoModel(t)
+	now := time.Now()
+	// "привет как дела что нового" — a long ambiguous utterance that no
+	// grammar matches and the classifier scores below the clarify threshold.
+	d, err := r.Route(context.Background(), "привет как дела что нового", now)
+	if err != nil {
+		t.Fatalf("Route: %v", err)
+	}
+	if d.Producer != RouteProducerClassifier {
+		t.Errorf("Producer = %q, want %q", d.Producer, RouteProducerClassifier)
+	}
+	// Whether it clarifies or not, the producer is the classifier.
+	_ = d.Clarify
+}
+
+// TestStage0ProducerOnEveryGrammar — every grammar win must set
+// RouteProducerGrammar. This is a property test over the stage-0 set rather
+// than a test of one utterance.
+func TestStage0ProducerOnEveryGrammar(t *testing.T) {
+	r := buildTestRouter(t)
+	now := time.Now()
+	// One utterance per grammar that we know matches at stage 0.
+	utterances := []struct {
+		text string
+		name string
+	}{
+		{"напомни позвонить маме", "reminder"},
+		{"который час", "system-time"},
+	}
+	for _, u := range utterances {
+		d, err := r.Route(context.Background(), u.text, now)
+		if err != nil {
+			t.Errorf("%s: Route: %v", u.name, err)
+			continue
+		}
+		if d.Stage != 0 {
+			t.Errorf("%s: Stage = %d, want 0 (grammar should win)", u.name, d.Stage)
+			continue
+		}
+		if d.Producer != RouteProducerGrammar {
+			t.Errorf("%s: Producer = %q, want %q", u.name, d.Producer, RouteProducerGrammar)
+		}
+	}
+}
+
+// buildTestRouter creates a minimal router with stage-0 grammars and a seeded
+// classifier, matching the daemon's cascade without the LLM or heads.
+func buildTestRouter(t *testing.T) *Router {
+	t.Helper()
+	emb := NewHashEmbedder(1024)
+	cls := NewClassifier(emb)
+	// Seed with enough examples so the classifier can answer.
+	for _, intent := range []Intent{IntentChat, IntentQuery, IntentFact} {
+		_ = cls.AddExample(context.Background(), intent, string(intent)+" example")
+	}
+	return New(Config{
+		Grammars:   StageZeroGrammars(DefaultActMatcher{Fns: []string{"перезапусти"}}),
+		Classifier: cls,
+		Extractor:  Extractor{Time: StubDateTimeParser{}, Facts: DefaultFactParser{}},
+		Threshold:  0.55,
+	})
+}
+
+// buildTestRouterNoModel creates a router with no LLM and no heads, so only
+// the grammar and classifier floors are available.
+func buildTestRouterNoModel(t *testing.T) *Router {
+	t.Helper()
+	return buildTestRouter(t)
+}

internal/router/eval/reach.go

@@ -121,7 +121,7 @@ var PraxisAliases = map[string]string{
 //  1. A clarified act with a named entity target and no fn reaches Hexis before the clarify
 //     question is ever asked. That path runs on the raw slots, so the matcher
 //     does not get to fill fn first.
-//  2. Otherwise the act matcher may earn a fn from the text slot.
+//  2. Otherwise the act resolver produces an ActionCandidate from the route or matcher.
 //  3. A fn that is a Praxis capability alias dispatches to Praxis.
 //  4. An act with a named entity target reaches Hexis.
 //  5. Anything else stays inside Maven.
@@ -137,14 +137,9 @@ func Reach(d router.Decision, m router.ActMatcher) (Service, string) {
 		}
 		return ServiceNone, ""
 	}
-	fn, hasFn := d.Slots.Fn, d.Slots.HasFn
-	if !hasFn && d.Slots.Text != "" && m != nil {
-		if matched, _, ok := m.Match(d.Slots.Text); ok {
-			fn, hasFn = matched, true
-		}
-	}
-	if hasFn {
-		if capability, ok := PraxisAliases[strings.ToLower(strings.TrimSpace(fn))]; ok {
+	candidate := router.ResolveActionCandidate(d, m)
+	if candidate.ActionResolved() {
+		if capability, ok := PraxisAliases[strings.ToLower(strings.TrimSpace(candidate.Fn))]; ok {
 			return ServicePraxis, capability
 		}
 	}

internal/router/intent.go

@@ -35,6 +35,18 @@ package router
 
 import "time"
 
+// RouteProducer — which stage of the cascade produced the routing decision.
+// Recorded for observability so a trace can name the winning component without
+// re-deriving it from the stage number and surrounding claims.
+type RouteProducer string
+
+const (
+	RouteProducerGrammar    RouteProducer = "grammar"
+	RouteProducerHeads      RouteProducer = "heads"
+	RouteProducerLLM        RouteProducer = "llm"
+	RouteProducerClassifier RouteProducer = "classifier"
+)
+
 // Intent — the seven save-where labels from docs/design.md's routing table. The
 // discriminator is "does the loop evaluate a predicate against it?":
 //
@@ -105,6 +117,10 @@ type Decision struct {
 	Slots      Slots
 	Clarify    bool // stage 3: below threshold — ask, don't guess
 
+	// Producer — which cascade stage produced this decision. Recorded for
+	// observability so a trace can name the winning component directly.
+	Producer RouteProducer
+
 	// Source — where the answer lives, for a query. The second half of the
 	// route, and empty on every other intent. SourceUnknown means no decider
 	// named one and the daemon walks its whole chain, which is what shipped

internal/router/router.go

@@ -97,6 +97,7 @@ func (r *Router) Route(ctx context.Context, utterance string, now time.Time) (De
 			continue // grammar matched shape but not content → fall through
 		}
 		d.Utterance = utterance
+		d.Producer = RouteProducerGrammar
 		// A literal pattern named that destination, which is the one provenance
 		// allowed to take the personal boundary off a turn (V-666). Set here and
 		// nowhere else, so no other arm of the cascade can claim it.
@@ -138,6 +139,7 @@ func (r *Router) Route(ctx context.Context, utterance string, now time.Time) (De
 				Confidence: res.Confidence,
 				Source:     res.Source,
 				Clarify:    res.Clarify,
+				Producer:   RouteProducerHeads,
 			}
 			r.fillSlots(ctx, &d, now)
 			// The clarify head relearned the English assumption that one word
@@ -180,6 +182,7 @@ func (r *Router) Route(ctx context.Context, utterance string, now time.Time) (De
 	if r.llm != nil {
 		if d, ok, err := r.llm.Route(ctx, utterance, now); err == nil && ok {
 			d.Utterance = utterance
+			d.Producer = RouteProducerLLM
 			r.fillSlots(ctx, &d, now)
 			before := d.Confidence
 			r.gateLLMDecision(&d)
@@ -239,6 +242,7 @@ func (r *Router) Route(ctx context.Context, utterance string, now time.Time) (De
 		Intent:     best.Intent,
 		Confidence: best.Score,
 		Slots:      r.extractor.Extract(ctx, best.Intent, utterance, now),
+		Producer:   RouteProducerClassifier,
 	}
 
 	// stage 3 — confidence gate. Below threshold ⇒ clarify, don't guess.

internal/router/source.go

@@ -76,3 +76,26 @@ func ValidSource(s Source) bool {
 	}
 	return false
 }
+
+// InputSource — which channel this utterance arrived on. The same provenance
+// vocabulary facts use (internal/event). Threaded through the turn because a
+// turn can write a fact, and a fact that lies about where it came from is
+// worse than no fact: provenance is the first column read when asking why a
+// daemon-wide setting is the way it is.
+type InputSource string
+
+const (
+	// InputSourceVoice — a real microphone (PushToTalk).
+	InputSourceVoice InputSource = "tap:voice"
+	// InputSourceText — mavweb /api/chat, telegram, or any text entry point.
+	InputSourceText InputSource = "tap:text"
+)
+
+// NormalizedInput — the typed ingress boundary for a turn. Text is the raw
+// utterance after STT (voice) or as typed (text). Source identifies the
+// channel. This slice performs no new linguistic normalization: text and voice
+// paths continue to converge onto the same turn path as they did before.
+type NormalizedInput struct {
+	Text   string
+	Source InputSource
+}

internal/store/migrations.go

@@ -385,6 +385,11 @@ ALTER TABLE reminders ADD COLUMN next_fire_ts INTEGER;`, // #2
 	 CREATE UNIQUE INDEX IF NOT EXISTS idx_digest_entries_live_candidate
 	   ON digest_entries (rule, candidate_fingerprint)
 	   WHERE status = 'pending' AND candidate_fingerprint <> '';`,
+
+	// #27 — route_producer on routing_traces. Records which cascade stage
+	// (grammar, heads, llm, classifier) produced the routing decision, so a
+	// trace can name the winning component directly.
+	`ALTER TABLE routing_traces ADD COLUMN route_producer TEXT NOT NULL DEFAULT '';`,
 }
 
 // migrate applies every migration with a number greater than the DB's current

internal/store/routingtraces.go

@@ -30,6 +30,9 @@ type RoutingTrace struct {
 	Source    string    `json:"source"`
 	Winner    string    `json:"winner"`
 	Intent    string    `json:"intent"`
+	// RouteProducer — which cascade stage produced the routing decision.
+	// grammar, heads, llm, or classifier. Empty on pre-route turns.
+	RouteProducer string `json:"route_producer,omitempty"`
 	// ClaimedBeforeHead — stage 0 or a pre-route resolver answered, so the turn
 	// teaches nothing about the classifier. It is a large share of real traffic,
 	// and counting those turns as training signal would fit the head to the
@@ -56,10 +59,10 @@ func (s *Store) WriteRoutingTrace(ctx context.Context, tr RoutingTrace) (int64,
 	}
 	res, err := s.db.ExecContext(ctx, `
 		INSERT INTO routing_traces
-		       (ts, utterance, source, winner, intent, claimed_before_head, encoder_id, outcome, correction, claims)
-		VALUES (?,?,?,?,?,?,?,?,?,?)`,
+		       (ts, utterance, source, winner, intent, route_producer, claimed_before_head, encoder_id, outcome, correction, claims)
+		VALUES (?,?,?,?,?,?,?,?,?,?,?)`,
 		tr.Ts.UnixMilli(), tr.Utterance, tr.Source, tr.Winner, tr.Intent,
-		tr.ClaimedBeforeHead, tr.EncoderID, tr.Outcome, tr.Correction, claims)
+		tr.RouteProducer, tr.ClaimedBeforeHead, tr.EncoderID, tr.Outcome, tr.Correction, claims)
 	if err != nil {
 		return 0, fmt.Errorf("write routing trace: %w", err)
 	}
@@ -91,8 +94,8 @@ func (s *Store) PruneRoutingTraces(ctx context.Context, before time.Time) error
 // RecentRoutingTraces returns the newest n turns, newest first.
 func (s *Store) RecentRoutingTraces(ctx context.Context, n int) ([]RoutingTrace, error) {
 	rows, err := s.db.QueryContext(ctx, `
-		SELECT id, ts, utterance, source, winner, intent, claimed_before_head,
-		       encoder_id, outcome, correction, claims
+		SELECT id, ts, utterance, source, winner, intent, route_producer,
+		       claimed_before_head, encoder_id, outcome, correction, claims
 		  FROM routing_traces
 		 ORDER BY id DESC
 		 LIMIT ?`, n)
@@ -106,8 +109,8 @@ func (s *Store) RecentRoutingTraces(ctx context.Context, n int) ([]RoutingTrace,
 		var tsMilli int64
 		var claims string
 		if err := rows.Scan(&tr.ID, &tsMilli, &tr.Utterance, &tr.Source, &tr.Winner,
-			&tr.Intent, &tr.ClaimedBeforeHead, &tr.EncoderID, &tr.Outcome,
-			&tr.Correction, &claims); err != nil {
+			&tr.Intent, &tr.RouteProducer, &tr.ClaimedBeforeHead, &tr.EncoderID,
+			&tr.Outcome, &tr.Correction, &claims); err != nil {
 			return nil, err
 		}
 		tr.Ts = time.UnixMilli(tsMilli).UTC()