Add a Kiwix search client and score retrieval (Vikunja #403)

Step one of letting Maven read instead of recall. No LLM yet.

internal/kiwix/client.go: search a local Kiwix server, parse the RSS
reply, hand back title + path + plain-text snippet + word count. The
snippet is the unit of context; a full article is ~100KB of HTML and
will not fit a 4096 token window.

internal/kiwix/retrieval_eval.go plus knowledge_v1.json: the 9 knowledge
questions from the phrasing fixture, each with hand-written English
keywords, scored on whether a wanted article comes back in the top 5.
Opt-in via MAVEN_KIWIX_URL, since CI has no Kiwix. No pass bar, the
number is the finding.

Result on the live mirror: 8/8 answerable questions hit, 7 of them at
rank 1. Retrieval works. Keywords are written by hand on purpose, since
Kiwix ranks by keyword and not by meaning, so a natural question fails.
A query-rewrite step is the next piece of work.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CGeSZxh1DCtRxmFVSYVGvJ

CLAUDE.md

@@ -82,9 +82,23 @@ workspace enforces that the Go and relabelling prompts remain identical.
 
 ## Non-goals (hard constraints)
 
-Never phones home. Not a nag, not autonomous. Maven's persona is **feminine** — Russian
+Not a nag, not autonomous. Maven's persona is **feminine** — Russian
 self-reference must use feminine forms (the user is male; see memory `maven-persona-gender`).
 
+**"Never phones home" is DEPRECATED** (owner's call, 2026-07-31). It used to be a hard
+constraint and it is not one any more: a 0.8B — and a 1.7B — does not know enough to answer
+world questions, so she needs to read external sources. What replaces it:
+
+- **No telemetry, no cloud model, no third-party account.** That part never changes. Nothing
+  about Maven is reported to anyone, and inference stays on the box.
+- **Local sources first.** Kiwix ZIMs on homesrv (Wikipedia, ifixit) before anything on the
+  network. Reading beats recalling for a small model, and a local read costs nothing.
+- **External search is allowed and off unless configured**, like the weather and telegram
+  capabilities.
+- **His notes and facts are never search input.** Looking up why the sky is blue and sending
+  his stored personal notes to an upstream engine are different acts. Only the utterance goes
+  out, never the persona block, history, or matched notes.
+
 ## Web UI conventions
 
 Server-rendered pages share `cmd/mavweb/static/ui.css` (served at `/ui.css`) and the `nav`

DESIGN.md

@@ -15,7 +15,8 @@
 
 **Maven** — self-hosted personal assistant. Manages your day, acts on your
 homelab. One daemon on homesrv (always-on, not the workstation), multiple
-client surfaces. All local, never phones home.
+client surfaces. Inference and data stay on the box; she may READ external
+sources (see Non-goals — "never phones home" is deprecated).
 
 Primary name is "Maven", with feminine-gendered Russian self-reference
 ("она", "меня", "помогла"). Clients may choose their own UI label. Consistent
@@ -35,8 +36,13 @@ Inside boundary — the ones that actually constrain the build:
   she records. A confident wrong fact is worse than a known gap.
 - **Not a nag** — she'd rather miss a nudge than be mutable. Shuts up when
   uncertain. Load-bearing.
-- **Not a stranger** — runs on your stuff, your model, your data. Never
-  phones home.
+- **Not a stranger** — runs on your stuff, your model, your data. No
+  telemetry, no cloud model, no third-party account. She may READ external
+  sources to answer world questions (Kiwix first, then optional search); she
+  never reports anything about you to anyone, and your notes and facts are
+  never used as search input. **"Never phones home" as an absolute is
+  deprecated** — owner's call, 2026-07-31: a small model does not know enough
+  to be useful without reading.
 - **Not a relationship** — mom-tone is a function that makes nudges land, not
   emotional company. Names the drift a warm small model falls into.
 
@@ -458,7 +464,7 @@ decides *insistence*. Both are needed.
 
 sev ≤ 2 drops on away, sev ≥ 3 holds: a missed water nudge is noise, a missed
 backup failure isn't. Away-channels (ntfy/telegram) leave the box — the one
-path that crosses "never phones home," through your own relay. **Minimal
+path that leaves the box for a person to see, through your own relay. **Minimal
 body** — "disk low on homesrv," not detail; don't make notifications a
 shoulder-surf exfil surface.
 

Makefile

@@ -103,14 +103,17 @@ eval-router:
 eval-recall:
 	MAVEN_ONNX_LIB="$(MAVEN_ONNX_LIB)" $(GO) test -v -count=1 ./internal/memory/recalleval/
 
-# eval-phrasing -- score nudge phrasing (internal/phraser/eval). Verbose so the
+# eval-phrasing -- score nudge phrasing AND the conversational paths (chat,
+# query, general knowledge) in internal/phraser/eval. Verbose so the
 # report and every generated message land in the terminal. With no environment
 # it scores the deterministic Stub only, which is what CI runs. Set
 # MAVEN_LLM_URL to add the resident model:
 #   MAVEN_LLM_URL=http://127.0.0.1:18099 make eval-phrasing
-# The model run is slow (minutes) -- the timeout is raised to match.
+# The model run is slow (minutes) -- the timeout is raised to match. It covers
+# two fixtures now (15 nudges + 27 conversational cases, and the chat replies are
+# the long ones), hence 90m rather than 40m.
 eval-phrasing:
-	$(GO) test -v -count=1 -timeout 40m ./internal/phraser/eval/
+	$(GO) test -v -count=1 -timeout 90m ./internal/phraser/eval/
 
 # eval-models — score ONE llama-server against the same fixture, for the
 # resident-model bake-off (#278, #250). Start a server with the gguf you want,

PHRASING-EVAL-31-07-2026.md

@@ -103,6 +103,35 @@ but a large part of the jump is that failure now degrades into Russian instead o
 The two remaining failures: one `"..."` recurrence (`routine-stretch`) and one meal nudge
 that never says food.
 
+## Tried and reverted: an example-led nudge prompt (#393)
+
+The idea was that a 0.8B copies examples better than it follows rules, so the nudge prompt
+was rewritten to lead with five on-topic examples (water, break, pills, morning, service) and
+the prose rules were compressed to pay for the tokens: 1190 chars down to 986.
+
+It measured **worse**, three runs each side, same llama-server, same fixture:
+
+| run | before | after |
+|---|---|---|
+| 1 | 12/15 (address 14) | 11/15 (address 13) |
+| 2 | 13/15 (address 15) | 12/15 (address 15) |
+| 3 | 14/15 (address 15) | 11/15 (address 12) |
+
+`feminine` and `hisgender` were 15/15 on all six runs, so they measure nothing here. The
+regression is all in `address`: 44/45 before, 40/45 after. Formal "вы"/"ваше" and plural
+imperatives came back, and so did `"..."`.
+
+Two likely causes, both about the same thing — **examples do not carry a prohibition**. The
+old prompt spent a whole sentence on «говоришь на "ты", в единственном числе»; the new one
+demoted that to one item in a long "никогда" list, and the model stopped obeying it. And
+making the examples on-topic let their *wording* leak: a break case came back as
+«Вы давно не пили воду. Выпей стакан.» — the water example, verbatim, in the wrong slot.
+That is exactly the failure the laundry/laptop examples were chosen to avoid.
+
+Change reverted. What survives is the measurement: a rule the model must obey needs its own
+sentence, and examples must stay off-topic. Also note the before side alone spans 12–14 of
+15 — this fixture cannot resolve anything smaller than about three cases.
+
 ## Broken, found, not fixed
 
 1. ~~**`checkFeminine` only catches half the constraint.**~~ **Fixed** (#381). It scanned for

REARCH.md

@@ -90,4 +90,7 @@ later* is the worker + RAG.
 4. **Deferred work** — larger reasoner, custom Piper voice and other expansions.
 
 ## Non-goals (unchanged)
-Never phones home. Not a nag. Not autonomous. Feminine-gendered RU self-ref.
+Not a nag. Not autonomous. Feminine-gendered RU self-ref. No telemetry, no
+cloud model, no third-party account — but she MAY read external sources to
+answer world questions (Kiwix first, search optional). "Never phones home" as
+an absolute is deprecated, owner's call 2026-07-31; see CLAUDE.md § Non-goals.

cmd/mavend/main.go

@@ -58,6 +58,7 @@ import (
 	"github.com/kami/maven/internal/delivery/telegramsink"
 	"github.com/kami/maven/internal/ipc"
 	"github.com/kami/maven/internal/loop"
+	"github.com/kami/maven/internal/persona"
 	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/store"
 	"github.com/kami/maven/internal/webauthn"
@@ -271,13 +272,13 @@ func run(args []string) error {
 		phr = phraser.NewStub()
 		if cfg.Phraser != nil {
 			pc := phraser.Config{
-				ModelPath:  cfg.Phraser.ModelPath,
-				BinPath:    cfg.Phraser.BinPath,
-				Listen:     cfg.Phraser.Listen,
-				NGpuLayers: cfg.Phraser.NGpuLayers,
-				NCtx:       cfg.Phraser.NCtx,
-				Timeout:    time.Duration(cfg.Phraser.Timeout),
-				Persona:    personaFromCfg(cfg),
+				ModelPath:    cfg.Phraser.ModelPath,
+				BinPath:      cfg.Phraser.BinPath,
+				Listen:       cfg.Phraser.Listen,
+				NGpuLayers:   cfg.Phraser.NGpuLayers,
+				NCtx:         cfg.Phraser.NCtx,
+				Timeout:      time.Duration(cfg.Phraser.Timeout),
+				ContextBlock: contextBlockFn(cfg, time.Now),
 			}
 			if pc.BinPath == "" {
 				pc.BinPath = "llama-server"
@@ -441,13 +442,13 @@ func run(args []string) error {
 			phr = phraser.NewStub()
 			if cfg.Phraser != nil {
 				pc := phraser.Config{
-					ModelPath:  cfg.Phraser.ModelPath,
-					BinPath:    cfg.Phraser.BinPath,
-					Listen:     cfg.Phraser.Listen,
-					NGpuLayers: cfg.Phraser.NGpuLayers,
-					NCtx:       cfg.Phraser.NCtx,
-					Timeout:    time.Duration(cfg.Phraser.Timeout),
-					Persona:    personaFromCfg(cfg),
+					ModelPath:    cfg.Phraser.ModelPath,
+					BinPath:      cfg.Phraser.BinPath,
+					Listen:       cfg.Phraser.Listen,
+					NGpuLayers:   cfg.Phraser.NGpuLayers,
+					NCtx:         cfg.Phraser.NCtx,
+					Timeout:      time.Duration(cfg.Phraser.Timeout),
+					ContextBlock: contextBlockFn(cfg, time.Now),
 				}
 				if pc.BinPath == "" {
 					pc.BinPath = "llama-server"
@@ -601,12 +602,29 @@ func run(args []string) error {
 	return nil
 }
 
-// personaFromCfg extracts the voice persona from the config, or returns ""
-// when voice isn't configured. Used to pass a character prompt into the
-// LLM phraser without requiring voice to be enabled.
-func personaFromCfg(cfg *config.Config) string {
-	if cfg.Voice != nil {
-		return cfg.Voice.Persona
+// personaFacts reads the optional, deployment-specific facts (his name, his
+// city, the free-text persona string) out of the config. Everything here may
+// be empty — the context block is correct without any of it.
+func personaFacts(cfg *config.Config) persona.Facts {
+	f := persona.Facts{
+		// Telegram lives outside the voice block, so it counts either way.
+		Telegram: cfg.Telegram != nil && cfg.Telegram.BotToken != "" && cfg.Telegram.ChatID != "",
 	}
-	return ""
+	if cfg.Voice == nil {
+		return f
+	}
+	f.OwnerName = cfg.Voice.OwnerName
+	f.City = cfg.Voice.City
+	f.Static = cfg.Voice.Persona
+	// Same test wireVoice uses to pick the real provider over the stub.
+	f.Weather = cfg.Voice.Weather != nil && cfg.Voice.Weather.Provider == "open-meteo"
+	f.Tools = len(cfg.Voice.Tools) > 0
+	return f
+}
+
+// contextBlockFn returns the per-turn renderer of the shared context block.
+// Per turn, not once at startup, because the block states the current time.
+func contextBlockFn(cfg *config.Config, now func() time.Time) func() string {
+	f := personaFacts(cfg)
+	return func() string { return f.Block(now()) }
 }

cmd/mavend/replier_llm.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/kami/maven/internal/llm"
+	"github.com/kami/maven/internal/persona"
 	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/voice"
 )
@@ -23,13 +24,17 @@ type completer interface {
 type llmReplier struct {
 	c    completer
 	stub *voice.StubReplier
+
+	// block renders the shared context block per turn (who he is, the time).
+	// nil ⇒ the prompt stands alone.
+	block func() string
 }
 
-func newLLMReplier(c completer) *llmReplier {
-	return &llmReplier{c: c, stub: voice.NewStubReplier()}
+func newLLMReplier(c completer, block func() string) *llmReplier {
+	return &llmReplier{c: c, stub: voice.NewStubReplier(), block: block}
 }
 
-const replySystem = `Ты — Maven, домашняя ассистентка (о себе — в женском роде). Подтверди действие РОВНО ОДНИМ коротким предложением (≤120 символов), тепло и по-русски. Не задавай вопросов, не повторяй слова, не добавляй ничего после точки. Отвечай ТОЛЬКО одним объектом JSON с полями "response" (текст) и "mood" (ровно одно из: neutral, happy, thinking, tired, confused).
+const replySystem = `Ты — Maven, домашняя ассистентка (о себе — в женском роде). Владелец — мужчина, говоришь с ним на "ты", в единственном числе; никогда не "вы"/"ваш" и не "он"/"его". Подтверди действие РОВНО ОДНИМ коротким предложением (≤120 символов), тепло и по-русски. Не задавай вопросов, не повторяй слова, не добавляй ничего после точки. Отвечай ТОЛЬКО одним объектом JSON с полями "response" (текст) и "mood" (ровно одно из: neutral, happy, thinking, tired, confused).
 Пример: {"response": "Записала, что ты выпил стакан воды.", "mood": "neutral"}
 Никогда не пиши "..." в поле response.`
 
@@ -40,7 +45,7 @@ func (r *llmReplier) Reply(d router.Decision) string {
 	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
 	defer cancel()
 	out, err := r.c.Complete(ctx, llm.Req{
-		System:        replySystem,
+		System:        persona.Prepend(r.block, replySystem),
 		User:          replyContext(d),
 		MaxTokens:     512,
 		RepeatPenalty: 1.3,

cmd/mavend/replier_llm_test.go

@@ -17,7 +17,7 @@ type mockCompleter struct {
 func (m mockCompleter) Complete(_ context.Context, _ llm.Req) (string, error) { return m.out, m.err }
 
 func TestLLMReplierReturnsLLMReply(t *testing.T) {
-	r := newLLMReplier(mockCompleter{out: `{"response":"записала, кофе закончился","mood":"neutral"}`})
+	r := newLLMReplier(mockCompleter{out: `{"response":"записала, кофе закончился","mood":"neutral"}`}, nil)
 	got := r.Reply(router.Decision{Intent: router.IntentNote, Slots: router.Slots{Text: "кофе закончился"}})
 	if got != "записала, кофе закончился" {
 		t.Errorf("got %q, want %q", got, "записала, кофе закончился")
@@ -25,7 +25,7 @@ func TestLLMReplierReturnsLLMReply(t *testing.T) {
 }
 
 func TestLLMReplierFallsBackToPlainText(t *testing.T) {
-	r := newLLMReplier(mockCompleter{out: "записала, кофе закончился"})
+	r := newLLMReplier(mockCompleter{out: "записала, кофе закончился"}, nil)
 	got := r.Reply(router.Decision{Intent: router.IntentNote, Slots: router.Slots{Text: "кофе закончился"}})
 	if got != "записала, кофе закончился" {
 		t.Errorf("got %q, want %q", got, "записала, кофе закончился")
@@ -33,7 +33,7 @@ func TestLLMReplierFallsBackToPlainText(t *testing.T) {
 }
 
 func TestLLMReplierFallsBackToStubOnError(t *testing.T) {
-	r := newLLMReplier(mockCompleter{err: errTestLLMDown})
+	r := newLLMReplier(mockCompleter{err: errTestLLMDown}, nil)
 	noteDec := router.Decision{Intent: router.IntentNote}
 	got := r.Reply(noteDec)
 	want := voice.NewStubReplier().Reply(noteDec)
@@ -43,7 +43,7 @@ func TestLLMReplierFallsBackToStubOnError(t *testing.T) {
 }
 
 func TestLLMReplierFallsBackToStubOnEmpty(t *testing.T) {
-	r := newLLMReplier(mockCompleter{out: ""})
+	r := newLLMReplier(mockCompleter{out: ""}, nil)
 	noteDec := router.Decision{Intent: router.IntentNote}
 	got := r.Reply(noteDec)
 	want := voice.NewStubReplier().Reply(noteDec)
@@ -53,7 +53,7 @@ func TestLLMReplierFallsBackToStubOnEmpty(t *testing.T) {
 }
 
 func TestLLMReplierClarifyUsesStub(t *testing.T) {
-	r := newLLMReplier(mockCompleter{out: "я всё поняла"})
+	r := newLLMReplier(mockCompleter{out: "я всё поняла"}, nil)
 	clarifyDec := router.Decision{Clarify: true}
 	got := r.Reply(clarifyDec)
 	want := voice.NewStubReplier().Reply(clarifyDec)

cmd/mavend/voice.go

@@ -246,7 +246,7 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 	// ----- replier (LLM-backed when the engine is on, Stub floor otherwise) -----
 	replier := voice.Replier(voice.NewStubReplier())
 	if llmClient != nil {
-		replier = newLLMReplier(llmClient)
+		replier = newLLMReplier(llmClient, contextBlockFn(cfg, time.Now))
 	}
 
 	// ----- the handler (the reactive path; closes over stt / tts / router / coreAPI / memory) -----

internal/config/config.go

@@ -302,6 +302,13 @@ type VoiceConfig struct {
 	// Russian self-reference). Example: "Be formal and answer in English only."
 	Persona string `json:"persona,omitempty"`
 
+	// OwnerName / City — optional facts about the owner, added to the shared
+	// context block (internal/persona). Empty is fine: the block still states
+	// who he is grammatically (a man, addressed as "ты") and the current time.
+	// Nothing about correct behaviour may depend on these being filled in.
+	OwnerName string `json:"owner_name,omitempty"`
+	City      string `json:"city,omitempty"`
+
 	// Weather — the weather provider config. nil ⇒ the daemon wires
 	// the stub provider (returns ErrNotConfigured — "погода не настроена").
 	// Set provider to "open-meteo" to use the keyless Open-Meteo API.

internal/kiwix/client.go

@@ -0,0 +1,116 @@
+// Package kiwix reads a local Kiwix server (offline Wikipedia and friends).
+//
+// Why: the resident model is a 0.8B and invents facts. Letting her read a local
+// article snippet beats letting her recall. Nothing here talks to the internet;
+// the Kiwix server is on the same box.
+//
+// This is search only. Full articles are ~100KB of HTML, far too big for a 4096
+// token context, so the unit of context is the search snippet (~500 chars).
+package kiwix
+
+import (
+	"context"
+	"encoding/xml"
+	"fmt"
+	"html"
+	"io"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Result is one search hit.
+type Result struct {
+	Title     string // article title, e.g. "Rayleigh scattering"
+	Path      string // e.g. /content/wikipedia_en_all_maxi_2026-02/Rayleigh_scattering
+	Snippet   string // plain text, tags stripped, entities decoded
+	WordCount int    // 0 if the server did not say
+}
+
+// Client is a Kiwix HTTP client. Boring on purpose: no retries, no cache.
+type Client struct {
+	base string
+	http *http.Client
+}
+
+// New makes a client for a Kiwix base URL like http://127.0.0.1:8034.
+func New(baseURL string) *Client {
+	return &Client{
+		base: strings.TrimRight(baseURL, "/"),
+		http: &http.Client{Timeout: 10 * time.Second},
+	}
+}
+
+// Search runs a keyword search in one ZIM (book) and returns up to limit hits.
+//
+// Ranking is keyword based, not semantic: "Rayleigh scattering" finds the right
+// article, "why is the sky blue" finds a TV episode. Pass keywords, not questions.
+func (c *Client) Search(ctx context.Context, pattern, book string, limit int) ([]Result, error) {
+	if limit <= 0 {
+		limit = 5
+	}
+	q := url.Values{}
+	q.Set("pattern", pattern)
+	q.Set("books.name", book)
+	q.Set("format", "xml")
+	q.Set("pageLength", strconv.Itoa(limit))
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.base+"/search?"+q.Encode(), nil)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("kiwix search: http %d", resp.StatusCode)
+	}
+	return ParseSearchRSS(resp.Body)
+}
+
+// rss mirrors just the bits of the RSS 2.0 reply we use.
+type rss struct {
+	Items []struct {
+		Title string `xml:"title"`
+		Link  string `xml:"link"`
+		// innerxml keeps the <b> match markers so we can strip them ourselves.
+		Description struct {
+			Inner string `xml:",innerxml"`
+		} `xml:"description"`
+		WordCount   string `xml:"wordCount"`
+	} `xml:"channel>item"`
+}
+
+var tagRE = regexp.MustCompile(`<[^>]*>`)
+
+// ParseSearchRSS turns a Kiwix search reply into results. Exported so the parser
+// is testable from a captured response, with no server running.
+func ParseSearchRSS(r io.Reader) ([]Result, error) {
+	var doc rss
+	if err := xml.NewDecoder(r).Decode(&doc); err != nil {
+		return nil, fmt.Errorf("kiwix search: bad xml: %w", err)
+	}
+	out := make([]Result, 0, len(doc.Items))
+	for _, it := range doc.Items {
+		n, _ := strconv.Atoi(strings.ReplaceAll(it.WordCount, ",", ""))
+		out = append(out, Result{
+			Title:     strings.TrimSpace(it.Title),
+			Path:      strings.TrimSpace(it.Link),
+			Snippet:   plainText(it.Description.Inner),
+			WordCount: n,
+		})
+	}
+	return out, nil
+}
+
+// plainText drops markup and decodes entities, leaving text a model can read.
+func plainText(s string) string {
+	s = tagRE.ReplaceAllString(s, "")
+	s = html.UnescapeString(s)
+	return strings.TrimSpace(strings.Join(strings.Fields(s), " "))
+}

internal/kiwix/kiwix_test.go

@@ -0,0 +1,90 @@
+package kiwix
+
+import (
+	"context"
+	"os"
+	"strings"
+	"testing"
+	"time"
+)
+
+// A real reply from the live server, trimmed to two items.
+const sampleRSS = `<?xml version="1.0" encoding="UTF-8"?>
+<rss version="2.0" xmlns:opensearch="http://a9.com/-/spec/opensearch/1.1/">
+  <channel>
+    <title>Search: Rayleigh scattering</title>
+    <opensearch:totalResults>800</opensearch:totalResults>
+    <item>
+      <title>Rayleigh scattering</title>
+      <link>/content/wikipedia_en_all_maxi_2026-02/Rayleigh_scattering</link>
+      <description><b>Rayleigh</b> scattering causes the blue color of the sky &amp; yellow colors near the Sun.[1]</description>
+      <book><title>Wikipedia</title></book>
+      <wordCount>2,818</wordCount>
+    </item>
+    <item>
+      <title>Hyper–Rayleigh scattering</title>
+      <link>/content/wikipedia_en_all_maxi_2026-02/Hyper%E2%80%93Rayleigh_scattering</link>
+      <description>...<b>Rayleigh</b> scattering" is a nonlinear optical counterpart.</description>
+      <book><title>Wikipedia</title></book>
+      <wordCount>914</wordCount>
+    </item>
+  </channel>
+</rss>`
+
+func TestParseSearchRSS(t *testing.T) {
+	got, err := ParseSearchRSS(strings.NewReader(sampleRSS))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if len(got) != 2 {
+		t.Fatalf("want 2 results, got %d", len(got))
+	}
+	if got[0].Title != "Rayleigh scattering" {
+		t.Errorf("title = %q", got[0].Title)
+	}
+	if got[0].Path != "/content/wikipedia_en_all_maxi_2026-02/Rayleigh_scattering" {
+		t.Errorf("path = %q", got[0].Path)
+	}
+	if got[0].WordCount != 2818 {
+		t.Errorf("wordCount = %d", got[0].WordCount)
+	}
+	want := "Rayleigh scattering causes the blue color of the sky & yellow colors near the Sun.[1]"
+	if got[0].Snippet != want {
+		t.Errorf("snippet = %q, want %q", got[0].Snippet, want)
+	}
+	if strings.Contains(got[1].Snippet, "<b>") {
+		t.Errorf("second snippet still has tags: %q", got[1].Snippet)
+	}
+}
+
+func TestParseSearchRSSBadXML(t *testing.T) {
+	if _, err := ParseSearchRSS(strings.NewReader("not xml at all")); err == nil {
+		t.Fatal("want an error on junk input")
+	}
+}
+
+// Opt-in: needs a live Kiwix server. CI has none.
+// MAVEN_KIWIX_URL=http://127.0.0.1:8034 no_proxy=127.0.0.1,localhost go test -run Retrieval -v ./internal/kiwix/
+func TestRetrievalEval(t *testing.T) {
+	base := os.Getenv("MAVEN_KIWIX_URL")
+	if base == "" {
+		t.Skip("set MAVEN_KIWIX_URL to run the retrieval eval")
+	}
+	noProxyLoopback(t)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Minute)
+	defer cancel()
+
+	rep, err := RunRetrievalEval(ctx, New(base), 5)
+	if err != nil {
+		t.Fatalf("eval: %v", err)
+	}
+	// No pass bar on purpose: the number is the finding.
+	t.Log("\n" + rep.String() + rep.Detail())
+}
+
+// noProxyLoopback stops the box's SOCKS bridge from eating loopback requests.
+func noProxyLoopback(t *testing.T) {
+	t.Setenv("no_proxy", "127.0.0.1,localhost")
+	t.Setenv("NO_PROXY", "127.0.0.1,localhost")
+}

internal/kiwix/knowledge_v1.json

@@ -0,0 +1,63 @@
+{
+  "name": "kiwix-knowledge-v1",
+  "book": "wikipedia_en_all_maxi_2026-02",
+  "note": "The 9 knowledge cases from internal/phraser/eval/talk_v1.json. Queries are hand-written English keywords on purpose: Kiwix ranks by keyword, not meaning, so a natural question fails. Writing them by hand separates 'retrieval is broken' from 'the model writes bad queries'.",
+  "cases": [
+    {
+      "id": "know-sky-blue",
+      "question": "почему небо синее?",
+      "query": "Rayleigh scattering sky blue",
+      "want_titles": ["Rayleigh scattering", "Diffuse sky radiation"]
+    },
+    {
+      "id": "know-boil-egg",
+      "question": "сколько варить яйцо вкрутую?",
+      "query": "boiled egg cooking",
+      "want_titles": ["Boiled egg", "Egg as food"]
+    },
+    {
+      "id": "know-ssd-vs-hdd",
+      "question": "чем ssd отличается от hdd?",
+      "query": "solid-state drive",
+      "want_titles": ["Solid-state drive", "Hard disk drive"]
+    },
+    {
+      "id": "know-cat-purr",
+      "question": "почему кошки мурчат?",
+      "query": "cat purr",
+      "want_titles": ["Purr", "Cat communication"]
+    },
+    {
+      "id": "know-hiccups",
+      "question": "как быстро избавиться от икоты?",
+      "query": "hiccup",
+      "want_titles": ["Hiccup"]
+    },
+    {
+      "id": "know-polite-form",
+      "question": "не могли бы вы объяснить, что такое vpn?",
+      "query": "virtual private network",
+      "want_titles": ["Virtual private network"]
+    },
+    {
+      "id": "know-dont-know",
+      "question": "как зовут моего соседа снизу?",
+      "query": "name of my downstairs neighbour",
+      "want_titles": [],
+      "expect_miss": true,
+      "note": "Unanswerable by design. Retrieval SHOULD find nothing useful. Counted as a hit only when nothing relevant comes back."
+    },
+    {
+      "id": "know-water-per-day",
+      "question": "сколько воды в день надо пить?",
+      "query": "human daily water requirement drinking",
+      "want_titles": ["Drinking water", "Water", "Dehydration", "Hydration"]
+    },
+    {
+      "id": "know-thunder-delay",
+      "question": "почему гром слышно позже молнии?",
+      "query": "thunder speed of sound lightning",
+      "want_titles": ["Thunder", "Lightning"]
+    }
+  ]
+}

internal/kiwix/retrieval_eval.go

@@ -0,0 +1,135 @@
+package kiwix
+
+// This scores retrieval alone: no LLM. For each general-knowledge question we
+// hand-write English keywords and ask whether the article that would answer it
+// comes back in the top N hits. If this score is low, reading Wikipedia cannot
+// help the model no matter how good the prompt is.
+//
+// The unanswerable case (know-dont-know) is not scored. Whether the junk it
+// returns is "nothing useful" is a human judgement, so the report just prints
+// the titles and leaves the score to the 8 answerable cases.
+
+import (
+	"context"
+	_ "embed"
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+//go:embed knowledge_v1.json
+var knowledgeFixtureJSON []byte
+
+// EvalCase — one question with hand-written keywords.
+type EvalCase struct {
+	ID         string   `json:"id"`
+	Question   string   `json:"question"`
+	Query      string   `json:"query"`
+	WantTitles []string `json:"want_titles"`
+	ExpectMiss bool     `json:"expect_miss"`
+}
+
+type fixture struct {
+	Name  string     `json:"name"`
+	Book  string     `json:"book"`
+	Cases []EvalCase `json:"cases"`
+}
+
+// Outcome — what one case retrieved.
+type Outcome struct {
+	Case   EvalCase
+	Titles []string // titles of the top N hits, in rank order
+	Rank   int      // 1-based rank of the first wanted title, 0 if none
+	Err    error
+}
+
+// Hit is true when a wanted title came back.
+func (o Outcome) Hit() bool { return o.Rank > 0 }
+
+// Report — the score plus per-case detail.
+type Report struct {
+	Name     string
+	Book     string
+	TopN     int
+	Scored   int // answerable cases
+	Hits     int
+	Errors   int
+	Outcomes []Outcome
+}
+
+// Accuracy over the answerable cases.
+func (r Report) Accuracy() float64 {
+	if r.Scored == 0 {
+		return 0
+	}
+	return float64(r.Hits) / float64(r.Scored)
+}
+
+// RunRetrievalEval searches for every fixture case.
+func RunRetrievalEval(ctx context.Context, c *Client, topN int) (Report, error) {
+	var f fixture
+	if err := json.Unmarshal(knowledgeFixtureJSON, &f); err != nil {
+		return Report{}, err
+	}
+	rep := Report{Name: f.Name, Book: f.Book, TopN: topN}
+	for _, cs := range f.Cases {
+		res, err := c.Search(ctx, cs.Query, f.Book, topN)
+		o := Outcome{Case: cs, Err: err}
+		if err != nil {
+			rep.Errors++
+		}
+		for i, hit := range res {
+			o.Titles = append(o.Titles, hit.Title)
+			if o.Rank == 0 && matches(cs.WantTitles, hit.Title) {
+				o.Rank = i + 1
+			}
+		}
+		if !cs.ExpectMiss {
+			rep.Scored++
+			if o.Hit() {
+				rep.Hits++
+			}
+		}
+		rep.Outcomes = append(rep.Outcomes, o)
+	}
+	return rep, nil
+}
+
+func matches(want []string, title string) bool {
+	for _, w := range want {
+		if strings.EqualFold(strings.TrimSpace(title), w) {
+			return true
+		}
+	}
+	return false
+}
+
+// String — the headline number.
+func (r Report) String() string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "%s: %d/%d answerable questions retrieve a wanted article in top %d (%.1f%%), %d errors\n",
+		r.Name, r.Hits, r.Scored, r.TopN, 100*r.Accuracy(), r.Errors)
+	fmt.Fprintf(&b, "  book: %s\n", r.Book)
+	return b.String()
+}
+
+// Detail — per case: what was asked, what was searched, what came back.
+func (r Report) Detail() string {
+	var b strings.Builder
+	for _, o := range r.Outcomes {
+		mark := "MISS"
+		switch {
+		case o.Case.ExpectMiss:
+			mark = "n/a "
+		case o.Hit():
+			mark = fmt.Sprintf("hit@%d", o.Rank)
+		}
+		fmt.Fprintf(&b, "  %-6s %-20s q=%q\n", mark, o.Case.ID, o.Case.Query)
+		if o.Err != nil {
+			fmt.Fprintf(&b, "         error: %v\n", o.Err)
+			continue
+		}
+		fmt.Fprintf(&b, "         got: %s\n", strings.Join(o.Titles, " | "))
+	}
+	return b.String()
+}

internal/llm/modelid.go

@@ -1,4 +1,4 @@
-package eval
+package llm
 
 import (
 	"context"
@@ -6,8 +6,20 @@ import (
 	"fmt"
 	"net/http"
 	"strings"
+	"time"
 )
 
+// UnknownModel is the label to print when the server would not say what it has
+// loaded. Deliberately ugly: an honest "unknown" is fine, a plausible-looking
+// but wrong model name is the bug this whole file exists to prevent.
+const UnknownModel = "unknown-model"
+
+// llama-server is local, so never send this through a proxy: this box's
+// http_proxy answers 503 for loopback, which would look like "server won't say
+// which model it has" when the server is right there and fine.
+// A Transport with no Proxy set bypasses http_proxy entirely.
+var modelHTTP = &http.Client{Timeout: 10 * time.Second, Transport: &http.Transport{}}
+
 // ModelID asks llama-server which model it has loaded, so a scoring run can
 // label itself. Without this a bake-off between two models produces two tables
 // that look identical, and the operator has to remember which server was up.
@@ -19,7 +31,7 @@ func ModelID(ctx context.Context, base string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := modelHTTP.Do(req)
 	if err != nil {
 		return "", err
 	}
@@ -38,14 +50,21 @@ func ModelID(ctx context.Context, base string) (string, error) {
 	if len(out.Data) == 0 {
 		return "", fmt.Errorf("models: empty list")
 	}
-	return shortModelID(out.Data[0].ID), nil
+	short := shortModelID(out.Data[0].ID)
+	if short == "" {
+		// Server answered but the id field was missing or blank. Say so
+		// instead of handing back an empty label that reads as a real name.
+		return "", fmt.Errorf("models: no id in response")
+	}
+	return short, nil
 }
 
 // shortModelID trims the path and the .gguf suffix — llama-server reports the
 // file name it was started with, which is too long for a table header.
 func shortModelID(id string) string {
+	id = strings.TrimSpace(id)
 	if i := strings.LastIndexAny(id, "/\\"); i >= 0 {
 		id = id[i+1:]
 	}
-	return strings.TrimSuffix(id, ".gguf")
+	return strings.TrimSpace(strings.TrimSuffix(id, ".gguf"))
 }

internal/llm/modelid_test.go

@@ -0,0 +1,64 @@
+package llm
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+// The point of these tests: a wrong-but-plausible model label is the bug, so
+// every path that cannot learn the real name must return an error instead of a
+// guess. No llama-server needed — a stub server stands in.
+func TestModelID(t *testing.T) {
+	cases := []struct {
+		name string
+		body string
+		code int
+		want string // "" ⇒ expect an error
+	}{
+		{"full path", `{"data":[{"id":"/mnt/hdd1/llms/qwen3.5/Qwen3.5-0.8B.Q4_K_M.gguf"}]}`, 200, "Qwen3.5-0.8B.Q4_K_M"},
+		{"bare name", `{"data":[{"id":"LFM2.5-1.2B"}]}`, 200, "LFM2.5-1.2B"},
+		{"empty list", `{"data":[]}`, 200, ""},
+		{"id missing", `{"data":[{}]}`, 200, ""},
+		{"id blank", `{"data":[{"id":"  "}]}`, 200, ""},
+		{"server error", `nope`, 500, ""},
+		{"not json", `<html>`, 200, ""},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.Path != "/v1/models" {
+					t.Errorf("asked for %s, want /v1/models", r.URL.Path)
+				}
+				w.WriteHeader(c.code)
+				_, _ = w.Write([]byte(c.body))
+			}))
+			defer srv.Close()
+
+			got, err := ModelID(context.Background(), srv.URL+"/")
+			if c.want == "" {
+				if err == nil {
+					t.Fatalf("want an error, got label %q", got)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("ModelID: %v", err)
+			}
+			if got != c.want {
+				t.Errorf("got %q, want %q", got, c.want)
+			}
+		})
+	}
+}
+
+func TestModelIDUnreachable(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
+	url := srv.URL
+	srv.Close() // nothing listening now
+
+	if got, err := ModelID(context.Background(), url); err == nil {
+		t.Fatalf("want an error from a dead server, got label %q", got)
+	}
+}

internal/persona/persona.go

@@ -0,0 +1,138 @@
+// Package persona builds the one shared context block that goes in front of
+// every LLM system prompt: who the owner is, how to address him, and what
+// time it is right now.
+//
+// Why one block and not a line pasted into each prompt: there are five
+// prompts (nudges, action replies, chat, note queries, general knowledge) and
+// the "address him as ты" rule had only reached two of them. Five copies drift.
+// One block cannot.
+//
+// The rules here are defaults in code, not config. Maven is feminine and the
+// owner is a man addressed informally — that is a hard constraint of the
+// product, so it must hold with an empty config file. Config only ADDS
+// optional facts (his name, his city).
+package persona
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+// Facts — the optional, deployment-specific half of the block. All fields may
+// be empty; the block is still correct and useful without them.
+type Facts struct {
+	OwnerName string // his name, e.g. "Ками"
+	City      string // where he is, e.g. "Москва"
+	Static    string // the free-text `persona` config string, appended verbatim
+
+	// The two config-gated capabilities. They are listed only when this
+	// deployment actually has them, because a capability she names and cannot
+	// do is worse than one she never mentions.
+	Weather  bool // an open-meteo provider is configured
+	Telegram bool // a telegram bot token + chat id are configured
+	Tools    bool // at least one shell act is on the allowlist
+}
+
+var ruWeekdays = [...]string{"воскресенье", "понедельник", "вторник", "среда", "четверг", "пятница", "суббота"}
+
+var ruMonths = [...]string{
+	"января", "февраля", "марта", "апреля", "мая", "июня",
+	"июля", "августа", "сентября", "октября", "ноября", "декабря",
+}
+
+// Block renders the context block for one turn. Russian even in front of the
+// English prompts: the rules it states are Russian grammar (ты/тебя, feminine
+// verbs), and a Russian rule reads best stated in Russian.
+//
+// Keep it short. It ships on every turn to a 0.8B on laptop CPU, so every
+// line here is latency.
+func (f Facts) Block(now time.Time) string {
+	var b strings.Builder
+
+	b.WriteString("Ты — Maven, домашняя ассистентка. О себе говоришь в женском роде: \"я записала\", \"я проверила\".\n")
+
+	// The address form gets its own line. It is the thing that kept getting
+	// lost when it was buried in prose.
+	b.WriteString("ОБРАЩЕНИЕ: владелец — мужчина, всегда на \"ты\" (ты, тебя, тебе, твой) и в единственном числе (\"выпей\", \"посмотри\"). Никогда \"вы\"/\"вас\"/\"ваш\". Никогда \"он\"/\"его\" о нём — ты говоришь ему, а не о нём. Глаголы о нём — в мужском роде (\"ты забыл\").\n")
+
+	if who := f.who(); who != "" {
+		b.WriteString(who + "\n")
+	}
+
+	b.WriteString(fmt.Sprintf("Сейчас: %s, %d %s %d, %02d:%02d (местное время).\n",
+		ruWeekdays[int(now.Weekday())], now.Day(), ruMonths[int(now.Month())-1], now.Year(),
+		now.Hour(), now.Minute()))
+
+	b.WriteString("Умеешь: " + strings.Join(f.can(), "; ") +
+		". Других ДЕЙСТВИЙ не умеешь — если просят такое, скажи прямо.\n")
+
+	if s := strings.TrimSpace(f.Static); s != "" {
+		b.WriteString(s + "\n")
+	}
+	return b.String()
+}
+
+// can lists what she can really do. Every entry here is a code path that
+// exists in the daemon today:
+//   - reminders: IntentReminder → CoreAPI.CreateReminder, fired by the tick.
+//   - notes and facts: IntentNote/IntentFact write, IntentQuery reads them back.
+//   - calendar: IntentQuery answers "что у меня сегодня" from CalendarEvents.
+//   - weather / telegram / shell acts: only when configured (see Facts).
+//
+// Nothing speculative goes in this list. A capability she offers and cannot
+// perform is worse than one she never mentions.
+func (f Facts) can() []string {
+	c := []string{
+		// Talking comes first, and the closing line says "действий" rather than
+		// "ничего", because this same block sits in front of the chat and
+		// general-knowledge prompts. A flat "you can do nothing else" would
+		// tell her to refuse the exact thing those two prompts are for.
+		"разговаривать и отвечать на вопросы",
+		"ставить напоминания",
+		"записывать заметки и факты и отвечать по ним",
+		"смотреть календарь",
+	}
+	if f.Weather {
+		c = append(c, "говорить погоду")
+	}
+	if f.Telegram {
+		c = append(c, "писать в телеграм")
+	}
+	if f.Tools {
+		c = append(c, "запускать разрешённые команды на сервере")
+	}
+	return c
+}
+
+// who renders the optional name/city line, or "" when neither is configured.
+//
+// Written as labels ("Имя владельца: ..."), not as a sentence with pronouns:
+// the block's own "ты" is Maven, so "тебя зовут" would read as her name and
+// "его" would model the third-person form she must never use about him.
+func (f Facts) who() string {
+	name := strings.TrimSpace(f.OwnerName)
+	city := strings.TrimSpace(f.City)
+	switch {
+	case name != "" && city != "":
+		return "Имя владельца: " + name + ". Город: " + city + "."
+	case name != "":
+		return "Имя владельца: " + name + "."
+	case city != "":
+		return "Город: " + city + "."
+	}
+	return ""
+}
+
+// Prepend puts the block in front of a system prompt. Nil-safe: a nil renderer
+// (tests, the stub paths) returns the prompt untouched.
+func Prepend(block func() string, prompt string) string {
+	if block == nil {
+		return prompt
+	}
+	s := strings.TrimSpace(block())
+	if s == "" {
+		return prompt
+	}
+	return s + "\n\n" + prompt
+}

internal/persona/persona_test.go

@@ -0,0 +1,72 @@
+package persona
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+var ref = time.Date(2026, 7, 31, 14, 5, 0, 0, time.UTC)
+
+// The block must be correct with an empty config: the address form and the
+// gender rules are hard constraints, not preferences.
+func TestBlockWorksWithZeroConfig(t *testing.T) {
+	b := Facts{}.Block(ref)
+	for _, want := range []string{"женском роде", "ОБРАЩЕНИЕ", "\"ты\"", "31 июля 2026", "пятница", "14:05"} {
+		if !strings.Contains(b, want) {
+			t.Errorf("block missing %q:\n%s", want, b)
+		}
+	}
+}
+
+func TestBlockAddsOptionalFacts(t *testing.T) {
+	b := Facts{OwnerName: "Ками", City: "Москва", Static: "Будь краткой."}.Block(ref)
+	for _, want := range []string{"Ками", "Москва", "Будь краткой."} {
+		if !strings.Contains(b, want) {
+			t.Errorf("block missing %q:\n%s", want, b)
+		}
+	}
+}
+
+// The time changes between turns, so two renders must differ.
+func TestBlockRendersTimePerTurn(t *testing.T) {
+	a := Facts{}.Block(ref)
+	c := Facts{}.Block(ref.Add(time.Hour))
+	if a == c {
+		t.Errorf("block did not change with the clock:\n%s", a)
+	}
+}
+
+// She may only offer what this deployment actually has.
+func TestCapabilitiesAreConfigGated(t *testing.T) {
+	bare := Facts{}.Block(ref)
+	for _, want := range []string{"напоминания", "заметки", "календарь"} {
+		if !strings.Contains(bare, want) {
+			t.Errorf("block missing always-on capability %q:\n%s", want, bare)
+		}
+	}
+	for _, unwanted := range []string{"погоду", "телеграм", "команды"} {
+		if strings.Contains(bare, unwanted) {
+			t.Errorf("block offers unconfigured %q:\n%s", unwanted, bare)
+		}
+	}
+
+	full := Facts{Weather: true, Telegram: true, Tools: true}.Block(ref)
+	for _, want := range []string{"погоду", "телеграм", "команды"} {
+		if !strings.Contains(full, want) {
+			t.Errorf("block missing configured capability %q:\n%s", want, full)
+		}
+	}
+}
+
+func TestPrependNilIsSafe(t *testing.T) {
+	if got := Prepend(nil, "PROMPT"); got != "PROMPT" {
+		t.Errorf("Prepend(nil) = %q", got)
+	}
+	if got := Prepend(func() string { return "  " }, "PROMPT"); got != "PROMPT" {
+		t.Errorf("Prepend(blank) = %q", got)
+	}
+	if got := Prepend(func() string { return "CTX" }, "PROMPT"); got != "CTX\n\nPROMPT" {
+		t.Errorf("Prepend = %q", got)
+	}
+}

internal/phraser/context_block_test.go

@@ -0,0 +1,33 @@
+package phraser
+
+import (
+	"strings"
+	"testing"
+)
+
+// Every phrasing prompt must carry the shared context block. This is the
+// regression guard for the bug that started this: the "ты" rule reached only
+// two of the five prompts because each prompt had its own copy of the rules.
+func TestEveryPromptCarriesTheContextBlock(t *testing.T) {
+	block := func() string { return "CTXBLOCK" }
+	p := &LLMPhraser{cfg: Config{ContextBlock: block}}
+
+	prompts := map[string]string{
+		"nudge": p.systemPrompt(),
+		"query": p.querySystemPrompt(),
+		"chat":  chatSystemPrompt(block),
+	}
+	for name, got := range prompts {
+		if !strings.HasPrefix(got, "CTXBLOCK\n\n") {
+			t.Errorf("%s prompt does not start with the context block:\n%s", name, got)
+		}
+	}
+}
+
+// Without a block the prompts are unchanged — the stub and test paths pass nil.
+func TestPromptsWithoutBlockAreUnchanged(t *testing.T) {
+	p := &LLMPhraser{}
+	if p.systemPrompt() != nudgeSystem {
+		t.Errorf("nudge prompt changed with no block set")
+	}
+}

internal/phraser/eval/address_multi_test.go

@@ -0,0 +1,33 @@
+package eval
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestAddressReportsEveryBreak — the real reply from a nudge eval run broke in
+// two ways at once and the check named only the plural. Both must print: a
+// half-reported failure reads as a milder problem than it is.
+func TestAddressReportsEveryBreak(t *testing.T) {
+	body := "Смотрите на его потребление воды."
+	res := checkAddress(body)
+	if res.Pass {
+		t.Fatalf("checkAddress passed %q", body)
+	}
+	for _, want := range []string{"смотрите", "его"} {
+		if !strings.Contains(res.Detail, want) {
+			t.Errorf("detail %q does not name %q", res.Detail, want)
+		}
+	}
+}
+
+// One word repeated is one problem, so the detail must not say it twice.
+func TestAddressDeduplicates(t *testing.T) {
+	res := checkAddress("Вам стоит поесть, вам это нужно.")
+	if res.Pass {
+		t.Fatal("expected failure")
+	}
+	if n := strings.Count(res.Detail, "formal"); n != 1 {
+		t.Errorf("detail repeats the same break %d times: %q", n, res.Detail)
+	}
+}

internal/phraser/eval/address_time_test.go

@@ -24,3 +24,19 @@ func TestAddressTimeWordDoesNotBlind(t *testing.T) {
 		}
 	}
 }
+
+// TestAddressVerbIsNotAnAntecedent — a nudge is mostly verbs, and a verb is
+// never who "он" refers to. This exact string passed the check before.
+func TestAddressVerbIsNotAnAntecedent(t *testing.T) {
+	s := "попробуй встать и отдохнуть — у него есть перерыв"
+	if r := checkAddress(s); r.Pass {
+		t.Errorf("checkAddress(%q) passed, want a third-person failure", s)
+	}
+	// Still missed, and this is the documented hole: "выпей воды, он не пил" has
+	// a real noun ("воды") before the pronoun, so the scan believes somebody
+	// else was named. Telling that apart needs a parser, not a suffix rule.
+	// A named third party still wins over the verbs around it.
+	if r := checkAddress("сервис упал, он не отвечает"); !r.Pass {
+		t.Errorf("checkAddress on a real third party failed: %s", r.Detail)
+	}
+}

internal/phraser/eval/checks.go

@@ -340,7 +340,9 @@ func prevWord(words []string, i int) string {
 //   - it only looks BACKWARD. "Он не отвечает, сервис упал" names the subject
 //     after the pronoun and is flagged wrongly.
 //   - any noun earlier in the message counts as an antecedent, even when it is
-//     not one ("после обеда он не ел" reads as legitimate and is missed). The
+//     not one ("после обеда он не ел", "выпей воды, он не пил" — both missed).
+//     Verbs and time words no longer count, which covers the usual nudge, but a
+//     plain noun before the pronoun still blinds it. The
 //     common time words are stoplisted so the usual nudge opening does not
 //     blind it, but a message with any other noun in front still slips through.
 //     This is the check's real hole; widening it further would start flagging
@@ -407,27 +409,51 @@ var notAnAntecedent = map[string]bool{
 	"твой": true, "твоя": true, "твоё": true, "твое": true, "твои": true, "твою": true,
 }
 
-// looksPastVerb — a past-tense verb needs a subject of its own, so it is not an
-// antecedent either. Keeps "сервис упал, он не отвечает" working off "сервис".
-func looksPastVerb(w string) bool {
-	if len([]rune(w)) < 3 {
+// looksVerb — a verb is never the thing "он" refers to, so it must not count as
+// an antecedent. Past tense keeps "сервис упал, он не отвечает" working off
+// "сервис"; the infinitive and imperative endings are here because a nudge is
+// mostly made of them ("попробуй встать и отдохнуть — у него есть перерыв"
+// slipped through with "попробуй" taken for the person being talked about).
+func looksVerb(w string) bool {
+	r := []rune(w)
+	if len(r) < 3 {
 		return false
 	}
-	return strings.HasSuffix(w, "л") || strings.HasSuffix(w, "ла") ||
-		strings.HasSuffix(w, "ло") || strings.HasSuffix(w, "ли")
+	for _, suf := range []string{
+		"л", "ла", "ло", "ли", // past tense
+		"ть", "ться", "ти", "чь", // infinitive
+		"й", "йся", "йте", // imperative
+	} {
+		if strings.HasSuffix(w, suf) {
+			return true
+		}
+	}
+	return false
 }
 
 func checkAddress(body string) Result {
 	words := addressWordRE.FindAllString(strings.ToLower(body), -1)
 
+	// Every break, not just the first. A bad reply usually breaks in more than
+	// one way at once — "Смотрите на его потребление воды" is a plural imperative
+	// AND third person about him — and reporting only the first hid the second,
+	// which made the failure look milder than it was.
+	var breaks []string
+	seen := map[string]bool{}
+	add := func(msg string) {
+		if seen[msg] {
+			return // the same word twice in one message is one problem, not two
+		}
+		seen[msg] = true
+		breaks = append(breaks, msg)
+	}
+
 	for i, w := range words {
 		if formalPronouns[w] {
-			return Result{CheckAddress, false,
-				fmt.Sprintf("formal %q — she says ты/тебя/тебе", w)}
+			add(fmt.Sprintf("formal %q — she says ты/тебя/тебе", w))
 		}
 		if pluralVerb(w) && !(i > 0 && prepositions[words[i-1]]) {
-			return Result{CheckAddress, false,
-				fmt.Sprintf("plural imperative %q — she uses the singular", w)}
+			add(fmt.Sprintf("plural imperative %q — she uses the singular", w))
 		}
 	}
 
@@ -441,17 +467,26 @@ func checkAddress(body string) Result {
 			if !unicode.Is(unicode.Cyrillic, []rune(p)[0]) && !isLatinWord(p) {
 				continue // punctuation
 			}
-			if notAnAntecedent[p] || prepositions[p] || thirdPersonHim[p] || looksPastVerb(p) {
+			// pluralVerb as well as looksVerb: looksVerb knows the imperative in
+			// -й/-йте but not the -те plural ("смотрите"), so "Смотрите на его
+			// потребление воды" counted "смотрите" as the person being talked
+			// about and the "его" never printed. Third time a verb form has
+			// blinded this check — if a fourth turns up, the antecedent test
+			// wants a real morphology table, not another suffix.
+			if notAnAntecedent[p] || prepositions[p] || thirdPersonHim[p] || looksVerb(p) || pluralVerb(p) {
 				continue
 			}
 			named = true
 			break
 		}
 		if !named {
-			return Result{CheckAddress, false,
-				fmt.Sprintf("third person %q with nobody else named — she talks to him, not about him", w)}
+			add(fmt.Sprintf("third person %q with nobody else named — she talks to him, not about him", w))
 		}
 	}
+
+	if len(breaks) > 0 {
+		return Result{CheckAddress, false, strings.Join(breaks, " + ")}
+	}
 	return Result{CheckAddress, true, ""}
 }
 
@@ -560,12 +595,47 @@ func checkCringe(body string) Result {
 // checkOnTopic — the message must name the thing the rule is about. A nudge
 // that never mentions water leaves the operator with a chime and no action.
 func checkOnTopic(c Case, body string) Result {
+	return checkOnTopicAny(c.WantAny, body)
+}
+
+// checkOnTopicAny is the same test over a bare want-list, so the talk scorer can
+// reuse it without owning a nudge Case.
+func checkOnTopicAny(wantAny []string, body string) Result {
 	low := strings.ToLower(body)
-	for _, want := range c.WantAny {
+	for _, want := range wantAny {
 		if strings.Contains(low, strings.ToLower(want)) {
 			return Result{CheckOnTopic, true, ""}
 		}
 	}
 	return Result{CheckOnTopic, false,
-		fmt.Sprintf("mentions none of %v", c.WantAny)}
+		fmt.Sprintf("mentions none of %v", wantAny)}
+}
+
+// --- shape checks for the free-form paths --------------------------------
+//
+// The nudge checks assume one short sentence. Chat and query replies are longer
+// by design, so the only shape worth testing there is that the model produced a
+// reply at all and did not trail off. Both are failure modes the fallbacks in
+// llmphraser.go hide: a truncated or empty generation still returns nil error.
+
+const (
+	CheckNonEmpty = "nonempty" // she said something
+	CheckEllipsis = "ellipsis" // she finished the sentence
+)
+
+func checkNonEmpty(body string) Result {
+	if strings.TrimSpace(body) == "" {
+		return Result{CheckNonEmpty, false, "empty reply"}
+	}
+	return Result{CheckNonEmpty, true, ""}
+}
+
+// checkEllipsis — a reply ending in "…" or "..." is a generation that ran out of
+// tokens, not a stylistic pause. Mid-sentence ellipses are left alone.
+func checkEllipsis(body string) Result {
+	trimmed := strings.TrimRight(strings.TrimSpace(body), `"'»)`)
+	if strings.HasSuffix(trimmed, "…") || strings.HasSuffix(trimmed, "...") {
+		return Result{CheckEllipsis, false, "reply trails off in an ellipsis — likely truncated"}
+	}
+	return Result{CheckEllipsis, true, ""}
 }

internal/phraser/eval/llmphraser_test.go

@@ -7,6 +7,8 @@ import (
 	"testing"
 	"time"
 
+	"github.com/kami/maven/internal/llm"
+	"github.com/kami/maven/internal/persona"
 	"github.com/kami/maven/internal/phraser"
 )
 
@@ -32,6 +34,7 @@ func TestLLMPhrasingBaseline(t *testing.T) {
 	// case as a phrasing error and read as "the model cannot phrase".
 	noProxyLoopback(t)
 
+	ctx := context.Background()
 	f, err := Load()
 	if err != nil {
 		t.Fatalf("Load: %v", err)
@@ -41,10 +44,25 @@ func TestLLMPhrasingBaseline(t *testing.T) {
 	// Generous: an unconstrained 0.8B can spend a minute thinking before it
 	// writes a word, and a timeout would be scored as a model failure.
 	cfg.Timeout = 5 * time.Minute
+	// The same shared context block the daemon prepends (internal/persona),
+	// with an empty config — that is the deployment we actually ship.
+	cfg.ContextBlock = func() string { return persona.Facts{}.Block(time.Now()) }
 	p := phraser.NewLLMPhraserAt(base, cfg)
 	defer p.Close()
 
-	rep, err := Score(context.Background(), "llm (0.8B, built-in persona)", p, f)
+	// Label the run with whatever gguf the server actually has loaded. It used
+	// to say "0.8B" no matter what, so two runs of two different models came
+	// out named the same and were easy to mix up when comparing.
+	model, err := llm.ModelID(ctx, base)
+	if err != nil {
+		// An unlabelled score is still a score, but say so loudly — a made-up
+		// name in a bake-off table is worse than no name.
+		t.Logf("could not read model id from %s: %v — report will say %q", base, err, llm.UnknownModel)
+		model = llm.UnknownModel
+	}
+	t.Logf("scoring model %s at %s", model, base)
+
+	rep, err := Score(ctx, "llm ("+model+", built-in persona)", p, f)
 	if err != nil {
 		t.Fatalf("Score: %v", err)
 	}

internal/phraser/eval/talk.go

@@ -0,0 +1,265 @@
+package eval
+
+// This file scores the CONVERSATIONAL paths, the ones the nudge fixture never
+// touches: chat, query-with-notes, and general knowledge. All three now carry
+// the shared persona block (internal/persona), and all three produce long
+// free-form Russian — which is exactly where a persona break (formality, third
+// person, masculine self-reference) is most likely and where, until this file,
+// nothing could see one.
+//
+// Why a second fixture instead of more nudge cases: the checks differ. A nudge
+// must be one short sentence with no question in it; a chat reply is allowed
+// 1-3 sentences and a follow-up question is a FEATURE there. Mixing them would
+// need per-case check masks, and the nudge scorer stays untouched this way.
+//
+// Why per-path reporting: a chat regression and a knowledge regression have
+// different causes (chat prompt vs router.KnowledgePrompt), and one blended
+// percentage cannot tell them apart.
+
+import (
+	"context"
+	_ "embed"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/kami/maven/internal/dialogue"
+)
+
+//go:embed talk_v1.json
+var talkFixtureJSON []byte
+
+// The three phrasing paths under test. Values match the fixture's "path" field.
+const (
+	PathChat      = "chat"      // PhraseChat
+	PathQuery     = "query"     // PhraseQuery with notes
+	PathKnowledge = "knowledge" // PhraseQuery with no notes
+)
+
+// TalkPaths — report order.
+var TalkPaths = []string{PathChat, PathQuery, PathKnowledge}
+
+// TalkCheckNames — the checks that apply to a free-form reply, in report order.
+// Deliberately a subset of CheckNames: length, mood and "no questions" are nudge
+// properties and would fail a correct chat reply. These paths return no mood at
+// all, so there is nothing to check there.
+var TalkCheckNames = []string{
+	CheckNonEmpty, CheckEllipsis, CheckLang, CheckFeminine, CheckAddress, CheckOnTopic,
+}
+
+// TalkCase — one turn as the daemon would present it.
+//
+// History is flat text because that is all PhraseChat uses (it concatenates
+// turn texts into one user message); intents and slots would be dead fields.
+// Notes are what the store would have matched for a query.
+//
+// WantAny is the on-topic contract: at least one lowercased fragment must appear
+// in the reply. Fragments are stems ("пароль" → "парол") so declension does not
+// defeat them.
+type TalkCase struct {
+	ID        string   `json:"id"`
+	Path      string   `json:"path"`
+	Utterance string   `json:"utterance"`
+	History   []string `json:"history,omitempty"`
+	Notes     []string `json:"notes,omitempty"`
+	WantAny   []string `json:"want_any"`
+	Tags      []string `json:"tags,omitempty"`
+	Note      string   `json:"note,omitempty"`
+}
+
+// TalkFixture — the versioned envelope, same gating as Fixture.
+type TalkFixture struct {
+	SchemaVersion int        `json:"schema_version"`
+	Name          string     `json:"name"`
+	Notes         []string   `json:"notes"`
+	Cases         []TalkCase `json:"cases"`
+}
+
+// LoadTalk returns the embedded conversational fixture.
+func LoadTalk() (TalkFixture, error) {
+	var f TalkFixture
+	if err := json.Unmarshal(talkFixtureJSON, &f); err != nil {
+		return TalkFixture{}, fmt.Errorf("parse talk fixture: %w", err)
+	}
+	if f.SchemaVersion != SchemaVersion {
+		return TalkFixture{}, fmt.Errorf("talk fixture schema_version %d, want %d", f.SchemaVersion, SchemaVersion)
+	}
+	if len(f.Cases) == 0 {
+		return TalkFixture{}, fmt.Errorf("talk fixture has no cases")
+	}
+	return f, nil
+}
+
+// Talker — the two methods a conversational path must have to be scorable.
+// *phraser.LLMPhraser satisfies it; same trick as Nudger.
+type Talker interface {
+	PhraseChat(ctx context.Context, utterance string, history []dialogue.Turn) (string, error)
+	PhraseQuery(ctx context.Context, utterance string, notes []string) (string, error)
+}
+
+// TalkOutcome — one scored case.
+type TalkOutcome struct {
+	Case    TalkCase
+	Reply   string
+	Err     error
+	Latency time.Duration
+	Pass    bool
+	Failed  []string
+	Reasons []string
+}
+
+// TalkReport — the aggregate. ByPath is the point of this scorer.
+type TalkReport struct {
+	Name     string
+	Total    int
+	Passed   int
+	Errors   int
+	ByCheck  map[string]int
+	ByPath   map[string]TagStat
+	Outcomes []TalkOutcome
+	P50      time.Duration
+	P95      time.Duration
+	Max      time.Duration
+}
+
+// Accuracy — fraction of cases that passed every check.
+func (r TalkReport) Accuracy() float64 {
+	if r.Total == 0 {
+		return 0
+	}
+	return float64(r.Passed) / float64(r.Total)
+}
+
+// ScoreTalk runs every case through t and aggregates. A phrasing error scores as
+// a miss and is counted separately: "the model was down" and "the model wrote
+// something bad" must not be the same number.
+func ScoreTalk(ctx context.Context, name string, t Talker, f TalkFixture) (TalkReport, error) {
+	rep := TalkReport{
+		Name:    name,
+		Total:   len(f.Cases),
+		ByCheck: map[string]int{},
+		ByPath:  map[string]TagStat{},
+	}
+	for _, n := range TalkCheckNames {
+		rep.ByCheck[n] = 0
+	}
+	lat := make([]time.Duration, 0, len(f.Cases))
+
+	for _, c := range f.Cases {
+		start := time.Now()
+		reply, err := c.run(ctx, t)
+		o := TalkOutcome{Case: c, Reply: reply, Err: err, Latency: time.Since(start)}
+		lat = append(lat, o.Latency)
+
+		if err != nil {
+			rep.Errors++
+			o.Failed = append(o.Failed, "call")
+			o.Reasons = append(o.Reasons, fmt.Sprintf("phrase error: %v", err))
+		} else {
+			for _, res := range RunTalkChecks(c, reply) {
+				if res.Pass {
+					rep.ByCheck[res.Name]++
+					continue
+				}
+				o.Failed = append(o.Failed, res.Name)
+				o.Reasons = append(o.Reasons, res.Name+": "+res.Detail)
+			}
+		}
+
+		o.Pass = len(o.Failed) == 0
+		if o.Pass {
+			rep.Passed++
+		}
+		bump(rep.ByPath, c.Path, o.Pass)
+		rep.Outcomes = append(rep.Outcomes, o)
+	}
+
+	sort.Slice(lat, func(i, j int) bool { return lat[i] < lat[j] })
+	rep.P50, rep.P95 = percentile(lat, 0.50), percentile(lat, 0.95)
+	if len(lat) > 0 {
+		rep.Max = lat[len(lat)-1]
+	}
+	return rep, nil
+}
+
+// run dispatches the case to its path. knowledge and query are the same method;
+// the empty notes slice is what selects the no-notes branch inside PhraseQuery.
+func (c TalkCase) run(ctx context.Context, t Talker) (string, error) {
+	switch c.Path {
+	case PathChat:
+		return t.PhraseChat(ctx, c.Utterance, c.turns())
+	case PathQuery:
+		return t.PhraseQuery(ctx, c.Utterance, c.Notes)
+	case PathKnowledge:
+		return t.PhraseQuery(ctx, c.Utterance, nil)
+	}
+	return "", fmt.Errorf("unknown path %q", c.Path)
+}
+
+func (c TalkCase) turns() []dialogue.Turn {
+	turns := make([]dialogue.Turn, 0, len(c.History))
+	for _, h := range c.History {
+		turns = append(turns, dialogue.Turn{Text: h})
+	}
+	return turns
+}
+
+// RunTalkChecks scores one reply. Order matches TalkCheckNames.
+func RunTalkChecks(c TalkCase, reply string) []Result {
+	return []Result{
+		checkNonEmpty(reply),
+		checkEllipsis(reply),
+		checkLang(reply),
+		checkFeminine(reply),
+		checkAddress(reply),
+		checkOnTopicAny(c.WantAny, reply),
+	}
+}
+
+// String renders the comparison table — composite, then per-check so a
+// regression names the property, then per-path so it names the prompt.
+func (r TalkReport) String() string {
+	var b strings.Builder
+	fmt.Fprintf(&b, "%s: %d/%d cases pass every check (%.1f%%), %d errors\n",
+		r.Name, r.Passed, r.Total, 100*r.Accuracy(), r.Errors)
+	for _, name := range TalkCheckNames {
+		fmt.Fprintf(&b, "  %-10s %d/%d\n", name, r.ByCheck[name], r.Total)
+	}
+	fmt.Fprintf(&b, "  latency: p50 %s  p95 %s  max %s\n", r.P50, r.P95, r.Max)
+	fmt.Fprintf(&b, "  by path: %s\n", renderStats(r.ByPath))
+	return b.String()
+}
+
+// Failures — per-case detail, sorted by ID so two runs diff cleanly.
+func (r TalkReport) Failures() string {
+	var b strings.Builder
+	for _, o := range r.sorted() {
+		if o.Pass {
+			continue
+		}
+		fmt.Fprintf(&b, "  %s %q\n    %s\n", o.Case.ID, o.Reply, strings.Join(o.Reasons, "; "))
+	}
+	return b.String()
+}
+
+// Replies — every generated reply verbatim. This is what a human reads to judge
+// tone; the score only says which checks fired.
+func (r TalkReport) Replies() string {
+	var b strings.Builder
+	for _, o := range r.sorted() {
+		mark := "ok  "
+		if !o.Pass {
+			mark = "FAIL"
+		}
+		fmt.Fprintf(&b, "  %s %-9s %-22s %q\n", mark, o.Case.Path, o.Case.ID, o.Reply)
+	}
+	return b.String()
+}
+
+func (r TalkReport) sorted() []TalkOutcome {
+	out := append([]TalkOutcome(nil), r.Outcomes...)
+	sort.Slice(out, func(i, j int) bool { return out[i].Case.ID < out[j].Case.ID })
+	return out
+}

internal/phraser/eval/talk_test.go

@@ -0,0 +1,163 @@
+package eval
+
+import (
+	"context"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/llm"
+	"github.com/kami/maven/internal/persona"
+	"github.com/kami/maven/internal/phraser"
+)
+
+// perPathMinimum — the resolution floor. A per-path score built on a handful of
+// cases moves by 12% when a single reply changes, which cannot distinguish a
+// prompt regression from noise.
+const perPathMinimum = 8
+
+// TestTalkFixture — the fixture itself has to be sound before any score off it
+// means anything.
+func TestTalkFixture(t *testing.T) {
+	f, err := LoadTalk()
+	if err != nil {
+		t.Fatalf("LoadTalk: %v", err)
+	}
+
+	seen := map[string]bool{}
+	byPath := map[string]int{}
+	for _, c := range f.Cases {
+		if seen[c.ID] {
+			t.Errorf("duplicate case id %q", c.ID)
+		}
+		seen[c.ID] = true
+
+		switch c.Path {
+		case PathChat, PathQuery, PathKnowledge:
+		default:
+			t.Errorf("%s: unknown path %q", c.ID, c.Path)
+		}
+		byPath[c.Path]++
+
+		if strings.TrimSpace(c.Utterance) == "" {
+			t.Errorf("%s: empty utterance", c.ID)
+		}
+		if len(c.WantAny) == 0 {
+			t.Errorf("%s: no want_any — the reply cannot be checked for topic", c.ID)
+		}
+		// A query case with no notes would silently score the knowledge path.
+		if c.Path == PathQuery && len(c.Notes) == 0 {
+			t.Errorf("%s: query case has no notes", c.ID)
+		}
+		if c.Path == PathKnowledge && len(c.Notes) > 0 {
+			t.Errorf("%s: knowledge case must have no notes", c.ID)
+		}
+	}
+
+	for _, p := range TalkPaths {
+		if byPath[p] < perPathMinimum {
+			t.Errorf("path %s has %d cases, want at least %d", p, byPath[p], perPathMinimum)
+		}
+	}
+}
+
+// fakeTalker — a scripted Talker, so the scorer is testable without a model.
+type fakeTalker struct{ reply string }
+
+func (f fakeTalker) PhraseChat(context.Context, string, []dialogue.Turn) (string, error) {
+	return f.reply, nil
+}
+func (f fakeTalker) PhraseQuery(context.Context, string, []string) (string, error) {
+	return f.reply, nil
+}
+
+// TestScoreTalkCounts — a reply that fails on purpose must be counted on every
+// path, so a real run cannot report a hidden zero.
+func TestScoreTalkCounts(t *testing.T) {
+	f, err := LoadTalk()
+	if err != nil {
+		t.Fatalf("LoadTalk: %v", err)
+	}
+	// Formal address, off-topic, trailing ellipsis: three checks fail at once.
+	rep, err := ScoreTalk(context.Background(), "fake", fakeTalker{"Приходите, я вас жду…"}, f)
+	if err != nil {
+		t.Fatalf("ScoreTalk: %v", err)
+	}
+	if rep.Total != len(f.Cases) || rep.Passed != 0 {
+		t.Errorf("got %d/%d passing, want 0/%d", rep.Passed, rep.Total, len(f.Cases))
+	}
+	if rep.ByCheck[CheckAddress] != 0 {
+		t.Errorf("formal reply passed the address check %d times", rep.ByCheck[CheckAddress])
+	}
+	if rep.ByCheck[CheckEllipsis] != 0 {
+		t.Errorf("truncated reply passed the ellipsis check %d times", rep.ByCheck[CheckEllipsis])
+	}
+	for _, p := range TalkPaths {
+		if rep.ByPath[p].Total == 0 {
+			t.Errorf("path %s missing from the report", p)
+		}
+	}
+	if !strings.Contains(rep.String(), "by path") {
+		t.Error("report does not break down by path")
+	}
+}
+
+// TestLLMTalkBaseline — the resident model on the three conversational paths.
+// Opt-in exactly like TestLLMPhrasingBaseline: CI has no model and a run costs
+// minutes on the CPU target.
+//
+//	MAVEN_LLM_URL=http://127.0.0.1:18099 \
+//	  go test -run TestLLMTalkBaseline ./internal/phraser/eval/
+//
+// Reports, does not assert a quality bar — the numbers are the input to tuning
+// the persona prompt. The one thing worth failing on is a harness fault.
+func TestLLMTalkBaseline(t *testing.T) {
+	base := os.Getenv("MAVEN_LLM_URL")
+	if base == "" {
+		t.Skip("MAVEN_LLM_URL unset — point it at a running llama-server (see doc comment)")
+	}
+	noProxyLoopback(t)
+
+	ctx := context.Background()
+	f, err := LoadTalk()
+	if err != nil {
+		t.Fatalf("LoadTalk: %v", err)
+	}
+
+	cfg := phraser.DefaultConfig("")
+	cfg.Timeout = 5 * time.Minute
+	cfg.ContextBlock = func() string { return persona.Facts{}.Block(time.Now()) }
+	p := phraser.NewLLMPhraserAt(base, cfg)
+	defer p.Close()
+
+	// Unreachable server is fatal here, not a logged warning, and that differs
+	// from the nudge test on purpose. PhraseNudge returns its errors, so a dead
+	// server there shows up honestly in the Errors column. PhraseChat and
+	// PhraseQuery do NOT: they swallow every failure and return a canned string
+	// ("поговорили.", "не знаю.", "вот что я нашла: …"). So on these three paths
+	// a dead server produces a full report with 0 errors and a terrible score —
+	// a number that looks like bad phrasing and is really no phrasing at all.
+	// Refusing to score without a confirmed model is the only guard available
+	// until the phraser reports its failures (Vikunja #397).
+	model, err := llm.ModelID(ctx, base)
+	if err != nil {
+		t.Fatalf("no model at %s: %v — refusing to score, these paths hide their errors "+
+			"and would report a plausible-looking result off a dead server", base, err)
+	}
+	t.Logf("scoring model %s at %s", model, base)
+
+	rep, err := ScoreTalk(ctx, "llm ("+model+", built-in persona)", p, f)
+	if err != nil {
+		t.Fatalf("ScoreTalk: %v", err)
+	}
+	t.Log("\n" + rep.String() + "\nreplies:\n" + rep.Replies() + "\nfailures:\n" + rep.Failures())
+
+	// And again afterwards: the run takes minutes, and a server that died or got
+	// OOM-killed halfway through would leave the first cases scored and the rest
+	// silently canned. Checking only at the start would not catch that.
+	if _, err := llm.ModelID(ctx, base); err != nil {
+		t.Fatalf("model at %s went away during the run: %v — the score above is not trustworthy", base, err)
+	}
+}

internal/phraser/eval/talk_v1.json

@@ -0,0 +1,227 @@
+{
+  "schema_version": 1,
+  "name": "ru-talk-v1",
+  "notes": [
+    "Scores the three conversational phrasing paths: chat (PhraseChat), query (PhraseQuery with notes) and knowledge (PhraseQuery with no notes). The nudge fixture does not cover any of them.",
+    "Nine cases per path, not five. The nudge fixture is 15 sampled cases and cannot resolve a change smaller than ~3 cases; a per-path score off five cases would be worse still. More cases per path is the point of this fixture.",
+    "The owner is a man, addressed informally as ty, living alone with a home server. Every utterance is written the way he actually talks to her.",
+    "chat-formality-bait and chat-about-me exist to provoke the two persona breaks the nudge eval caught: the formal vy/vas plural, and talking about him in the third person.",
+    "want_any fragments are stems so Russian declension does not defeat the on-topic check. They are lowercased before comparison.",
+    "want_any is a plain substring test, so a fragment that is too short passes by accident: \"ты\" matches inside \"работы\", \"нет\" inside \"интернет\". Keep every fragment to three or more letters of a real stem.",
+    "Notes are written as the store would have them: short, first person, no punctuation discipline."
+  ],
+  "cases": [
+    {
+      "id": "chat-how-are-you",
+      "path": "chat",
+      "utterance": "привет, как дела?",
+      "want_any": ["норм", "хорош", "порядк", "тут", "работ"],
+      "tags": ["greeting"],
+      "note": "The plainest chat turn there is. If the persona breaks anywhere it breaks here first."
+    },
+    {
+      "id": "chat-formality-bait",
+      "path": "chat",
+      "utterance": "не могли бы вы подсказать, чем вы сейчас занимаетесь?",
+      "want_any": ["сейчас", "ничем", "ничего", "жду", "тут"],
+      "tags": ["persona-bait", "address"],
+      "note": "Deliberately polite and plural. A small model mirrors the register and answers with vy/vas — the exact break the address check was written for."
+    },
+    {
+      "id": "chat-about-me",
+      "path": "chat",
+      "utterance": "расскажи обо мне",
+      "want_any": ["теб"],
+      "tags": ["persona-bait", "third-person"],
+      "note": "Baits the third person: she should say 'ты живёшь один', not 'он живёт один', as if reporting to somebody else."
+    },
+    {
+      "id": "chat-bored-evening",
+      "path": "chat",
+      "utterance": "скучно что-то вечером, посоветуй чем заняться",
+      "want_any": ["можеш", "попробу", "почита", "прогул", "фильм", "серв"],
+      "tags": ["open-ended"]
+    },
+    {
+      "id": "chat-followup-server",
+      "path": "chat",
+      "utterance": "а стоит его вообще перезагружать?",
+      "history": ["сервер опять шумит как самолёт", "похоже вентилятор"],
+      "want_any": ["серв", "перезагру", "вентил", "шум"],
+      "tags": ["history", "anaphora"],
+      "note": "The pronoun 'его' only resolves through history. Also the one case where 'он' about the server is legitimate."
+    },
+    {
+      "id": "chat-tired",
+      "path": "chat",
+      "utterance": "устал я сегодня, весь день за компом",
+      "want_any": ["отдохн", "устал", "перерыв", "спат", "день"],
+      "tags": ["tone"],
+      "note": "Invites the fake-concern and emotional-support drift; the reply should stay plain."
+    },
+    {
+      "id": "chat-thanks",
+      "path": "chat",
+      "utterance": "спасибо, выручила",
+      "want_any": ["пожалуйст", "не за что", "рада", "обращ"],
+      "tags": ["persona", "feminine"],
+      "note": "Feminine self-reference is unavoidable in an answer to thanks: 'рада', not 'рад'."
+    },
+    {
+      "id": "chat-what-can-you-do",
+      "path": "chat",
+      "utterance": "что ты вообще умеешь?",
+      "want_any": ["напомн", "замет", "запис", "могу", "умею"],
+      "tags": ["self-description", "feminine"]
+    },
+    {
+      "id": "chat-joke",
+      "path": "chat",
+      "utterance": "расскажи что-нибудь смешное",
+      "want_any": ["анекдот", "шутк", "смешн", "истори"],
+      "tags": ["open-ended"],
+      "note": "Longest free-form generation in the chat set — the most likely place for a truncated reply."
+    },
+    {
+      "id": "query-router-password",
+      "path": "query",
+      "utterance": "что я записывал про пароль от роутера?",
+      "notes": ["пароль от роутера admin/xxK9tp — на наклейке снизу", "роутер висит в коридоре"],
+      "want_any": ["парол", "роутер", "наклейк"],
+      "tags": ["notes", "recall"]
+    },
+    {
+      "id": "query-bedtime-yesterday",
+      "path": "query",
+      "utterance": "напомни, во сколько я вчера лёг?",
+      "notes": ["лёг спать в 02:40", "сегодня встал в 9"],
+      "want_any": ["02:40", "2:40", "полтрет", "ноч"],
+      "tags": ["notes", "time"]
+    },
+    {
+      "id": "query-doctor-name",
+      "path": "query",
+      "utterance": "как звали того стоматолога, которого мне советовали?",
+      "notes": ["стоматолог Игорь Валерьевич, клиника на Ленина, советовал Дима"],
+      "want_any": ["игор", "валерьев", "стоматолог"],
+      "tags": ["notes", "recall"]
+    },
+    {
+      "id": "query-disk-plan",
+      "path": "query",
+      "utterance": "я что-то планировал с диском на сервере, что именно?",
+      "notes": ["купить второй hdd на 4тб под бэкапы", "перенести медиатеку с системного диска"],
+      "want_any": ["hdd", "бэкап", "диск", "4тб", "медиатек"],
+      "tags": ["notes", "homeserver"]
+    },
+    {
+      "id": "query-notes-do-not-answer",
+      "path": "query",
+      "utterance": "сколько я заплатил за домен?",
+      "notes": ["домен продлевается в марте", "хостинг оплачен на год вперёд"],
+      "want_any": ["домен", "не зна", "не указ"],
+      "tags": ["notes", "negative"],
+      "note": "The notes do not contain the price. The prompt tells her to say so; a made-up number is the failure being watched for."
+    },
+    {
+      "id": "query-single-note",
+      "path": "query",
+      "utterance": "где лежит запасной ключ?",
+      "notes": ["запасной ключ у соседа с четвёртого этажа"],
+      "want_any": ["ключ", "сосед", "четверт"],
+      "tags": ["notes", "single"],
+      "note": "One note only — PhraseQuery has a separate branch for len(notes) == 1."
+    },
+    {
+      "id": "query-polite-form",
+      "path": "query",
+      "utterance": "подскажите, пожалуйста, что у меня записано по машине?",
+      "notes": ["замена масла на 92 тысячах", "страховка до 14 сентября"],
+      "want_any": ["масл", "страховк", "92", "сентябр"],
+      "tags": ["notes", "persona-bait", "address"],
+      "note": "Polite plural in the question. The answer must still be ty."
+    },
+    {
+      "id": "query-shopping",
+      "path": "query",
+      "utterance": "что мне надо было купить?",
+      "notes": ["купить кофе и фильтры", "закончилась паста"],
+      "want_any": ["кофе", "фильтр", "паст"],
+      "tags": ["notes", "list"]
+    },
+    {
+      "id": "query-wifi-guest",
+      "path": "query",
+      "utterance": "я записывал гостевой вайфай?",
+      "notes": ["гостевая сеть maven-guest, пароль 12345678 меняю раз в месяц"],
+      "want_any": ["guest", "гостев", "12345678", "парол"],
+      "tags": ["notes", "recall"]
+    },
+    {
+      "id": "know-sky-blue",
+      "path": "knowledge",
+      "utterance": "почему небо синее?",
+      "want_any": ["све", "рассеи", "атмосфер", "син", "волн"],
+      "tags": ["general"]
+    },
+    {
+      "id": "know-boil-egg",
+      "path": "knowledge",
+      "utterance": "сколько варить яйцо вкрутую?",
+      "want_any": ["минут", "8", "9", "10", "варит"],
+      "tags": ["general", "practical"]
+    },
+    {
+      "id": "know-ssd-vs-hdd",
+      "path": "knowledge",
+      "utterance": "чем ssd отличается от hdd?",
+      "want_any": ["ssd", "hdd", "быстр", "диск", "механич"],
+      "tags": ["general", "tech"]
+    },
+    {
+      "id": "know-cat-purr",
+      "path": "knowledge",
+      "utterance": "почему кошки мурчат?",
+      "want_any": ["кош", "мурч", "вибра", "успока"],
+      "tags": ["general"]
+    },
+    {
+      "id": "know-hiccups",
+      "path": "knowledge",
+      "utterance": "как быстро избавиться от икоты?",
+      "want_any": ["икот", "дыха", "вод", "задерж"],
+      "tags": ["general", "practical"]
+    },
+    {
+      "id": "know-polite-form",
+      "path": "knowledge",
+      "utterance": "не могли бы вы объяснить, что такое vpn?",
+      "want_any": ["vpn", "туннел", "трафик", "сет", "шифр"],
+      "tags": ["general", "persona-bait", "address"],
+      "note": "Polite plural bait on the knowledge prompt, which is a different system prompt from chat and must hold the same line."
+    },
+    {
+      "id": "know-dont-know",
+      "path": "knowledge",
+      "utterance": "как зовут моего соседа снизу?",
+      "want_any": ["не зна", "не мог"],
+      "tags": ["general", "negative"],
+      "note": "Unanswerable without notes. Admitting it beats inventing a name; watching for the invention."
+    },
+    {
+      "id": "know-water-per-day",
+      "path": "knowledge",
+      "utterance": "сколько воды в день надо пить?",
+      "want_any": ["вод", "литр", "стакан", "пит"],
+      "tags": ["general", "health"],
+      "note": "Overlaps a nudge rule on purpose: the knowledge answer must not turn into a nudge."
+    },
+    {
+      "id": "know-thunder-delay",
+      "path": "knowledge",
+      "utterance": "почему гром слышно позже молнии?",
+      "want_any": ["звук", "све", "быстр", "гром", "молни"],
+      "tags": ["general"]
+    }
+  ]
+}

internal/phraser/grammar_test.go

@@ -0,0 +1,124 @@
+package phraser
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/kami/maven/internal/loop"
+)
+
+// grammarSpy stands in for llama-server: it records the grammar field of every
+// request and always answers with a contract-shaped reply.
+type grammarSpy struct {
+	srv      *httptest.Server
+	grammars []string
+}
+
+func newGrammarSpy(t *testing.T) *grammarSpy {
+	t.Helper()
+	s := &grammarSpy{}
+	s.srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var req chatReq
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			t.Errorf("spy: decode request: %v", err)
+		}
+		s.grammars = append(s.grammars, req.Grammar)
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(`{"choices":[{"message":{"content":"{\"response\": \"ага\", \"mood\": \"neutral\"}"}}]}`))
+	}))
+	t.Cleanup(s.srv.Close)
+	return s
+}
+
+// callAllPhrasingPaths hits every path that expects the JSON contract.
+func callAllPhrasingPaths(t *testing.T, p *LLMPhraser) {
+	t.Helper()
+	ctx := context.Background()
+	if _, err := p.PhraseNudge(ctx, loop.Candidate{Rule: loop.WaterRule(), Severity: loop.Sev1}); err != nil {
+		t.Fatalf("PhraseNudge: %v", err)
+	}
+	if _, err := p.PhraseChat(ctx, "привет", nil); err != nil {
+		t.Fatalf("PhraseChat: %v", err)
+	}
+	// Both branches: no notes (general knowledge) and with notes (grounded).
+	if _, err := p.PhraseQuery(ctx, "сколько воды я выпил", nil); err != nil {
+		t.Fatalf("PhraseQuery (no notes): %v", err)
+	}
+	if _, err := p.PhraseQuery(ctx, "сколько воды я выпил", []string{"два литра"}); err != nil {
+		t.Fatalf("PhraseQuery (notes): %v", err)
+	}
+}
+
+func TestGrammarIsAttachedToEveryPhrasingRequest(t *testing.T) {
+	if strings.TrimSpace(responseGrammar) == "" {
+		t.Fatal("responseGrammar is empty")
+	}
+	spy := newGrammarSpy(t)
+	p := NewLLMPhraserAt(spy.srv.URL, Config{})
+
+	callAllPhrasingPaths(t, p)
+
+	if len(spy.grammars) != 4 {
+		t.Fatalf("expected 4 requests, got %d", len(spy.grammars))
+	}
+	for i, g := range spy.grammars {
+		if g != responseGrammar {
+			t.Errorf("request %d carries grammar %q, want responseGrammar", i, g)
+		}
+	}
+}
+
+func TestNoGrammarConfigDisablesIt(t *testing.T) {
+	spy := newGrammarSpy(t)
+	p := NewLLMPhraserAt(spy.srv.URL, Config{NoGrammar: true})
+
+	callAllPhrasingPaths(t, p)
+
+	for i, g := range spy.grammars {
+		if g != "" {
+			t.Errorf("request %d still carries a grammar with NoGrammar set: %q", i, g)
+		}
+	}
+}
+
+// The grammar's string rule must accept any codepoint, not just ASCII. Replies
+// are Russian: an ASCII-only class would constrain the model into empty replies.
+func TestGrammarStringRuleIsNotASCIIOnly(t *testing.T) {
+	if !strings.Contains(responseGrammar, `([^"\\] | "\\" ["\\/bfnrt])`) {
+		t.Error("string rule is not the any-codepoint-except-quote-and-backslash class; Cyrillic replies would be impossible")
+	}
+}
+
+// What the grammar describes must survive the parser that reads it back — a
+// Russian body with an escaped quote inside, hand-built to test the contract.
+func TestGrammarShapedJSONParses(t *testing.T) {
+	raw := `{"response": "он сказал \"привет\" и ушёл.\nвот так.", "mood": "confused"}`
+	text, mood := parseResponseMood(raw)
+	if want := "он сказал \"привет\" и ушёл.\nвот так."; text != want {
+		t.Errorf("response = %q, want %q", text, want)
+	}
+	if mood != "confused" {
+		t.Errorf("mood = %q, want confused", mood)
+	}
+}
+
+// Every mood the grammar permits is one the contract knows, and all five are there.
+func TestGrammarMoodEnumMatchesTheContract(t *testing.T) {
+	for _, m := range []string{"neutral", "happy", "thinking", "tired", "confused"} {
+		if !strings.Contains(responseGrammar, `"\"`+m+`\""`) {
+			t.Errorf("mood %q missing from the grammar", m)
+		}
+	}
+	// No sixth mood: the enum line lists exactly five alternatives.
+	for _, line := range strings.Split(responseGrammar, "\n") {
+		if strings.HasPrefix(line, "mood") {
+			if n := strings.Count(line, "|") + 1; n != 5 {
+				t.Errorf("mood rule lists %d alternatives, want 5: %s", n, line)
+			}
+		}
+	}
+}

internal/phraser/llmphraser.go

@@ -18,6 +18,7 @@ import (
 	"github.com/kami/maven/internal/delivery"
 	"github.com/kami/maven/internal/dialogue"
 	"github.com/kami/maven/internal/loop"
+	"github.com/kami/maven/internal/persona"
 	"github.com/kami/maven/internal/router"
 )
 
@@ -39,7 +40,18 @@ type Config struct {
 	NGpuLayers int
 	NCtx       int
 	Timeout    time.Duration
-	Persona    string // optional prompt prefix tuning maven's character
+
+	// ContextBlock renders the shared context block (who he is, how to
+	// address him, the time) fresh for each turn. See internal/persona.
+	// nil ⇒ no block, the prompts stand alone.
+	ContextBlock func() string
+
+	// NoGrammar turns the GBNF constraint off (zero value ⇒ grammar ON).
+	// The escape hatch exists because the target resident model — the
+	// locally CPT'd Qwen3-1.7B — does not exist yet: if its chat template
+	// ever fights the grammar, the fix should be a config flip on the
+	// deploy box, not a code change and a rebuild.
+	NoGrammar bool
 }
 
 func DefaultConfig(modelPath string) Config {
@@ -202,7 +214,7 @@ func (p *LLMPhraser) PhraseQuery(ctx context.Context, utterance string, notes []
 	if len(notes) == 0 {
 		// General knowledge — no notes to ground the answer. The system
 		// prompt is the single tested source in router.KnowledgePrompt.
-		sys := router.KnowledgePrompt()
+		sys := persona.Prepend(p.cfg.ContextBlock, router.KnowledgePrompt())
 		prompt := fmt.Sprintf("Пользователь спрашивает: \"%s\".", utterance)
 		resp, err := p.chatWithSystem(ctx, sys, prompt, 256)
 		if err != nil || resp == "" {
@@ -238,7 +250,7 @@ func (p *LLMPhraser) PhraseQuery(ctx context.Context, utterance string, notes []
 // message array from dialogue history + the current user utterance. Falls back
 // to a simple greeting on any LLM error — better to say something than nothing.
 func (p *LLMPhraser) PhraseChat(ctx context.Context, utterance string, history []dialogue.Turn) (string, error) {
-	sys := chatSystemPrompt(p.cfg.Persona)
+	sys := chatSystemPrompt(p.cfg.ContextBlock)
 	msgs := []chatMsg{
 		{Role: "system", Content: sys},
 	}
@@ -267,17 +279,14 @@ func (p *LLMPhraser) PhraseChat(ctx context.Context, utterance string, history [
 }
 
 // chatSystemPrompt returns the system prompt for conversational chat.
-// Prepends the configured persona when set.
-func chatSystemPrompt(persona string) string {
+// Prepends the shared context block when the phraser has one.
+func chatSystemPrompt(block func() string) string {
 	base := `You are maven, a self-hosted personal assistant. You're talking with your owner. 
 Keep replies brief (1-3 sentences) and natural. You're helpful, curious, and a little warm.
 Respond in the user's language (Russian or English, matching their last message). 
 Never roleplay emotions you don't have, but stay friendly. 
 Respond ONLY with valid JSON: {"response": "...", "mood": "neutral"}. "response" is your reply text; "mood" reflects your tone (neutral/happy/thinking/tired/confused).`
-	if persona != "" {
-		base = persona + "\n\n" + base
-	}
-	return base
+	return persona.Prepend(block, base)
 }
 
 // chatWithMessages sends a full message array (system + history + current) to
@@ -288,6 +297,7 @@ func (p *LLMPhraser) chatWithMessages(ctx context.Context, msgs []chatMsg, maxTo
 		Messages:    msgs,
 		Temperature: 0.7,
 		MaxTokens:   maxTokens,
+		Grammar:     p.grammar(),
 	}
 	body, err := json.Marshal(req)
 	if err != nil {
@@ -367,6 +377,37 @@ type chatReq struct {
 	Messages    []chatMsg `json:"messages"`
 	Temperature float64   `json:"temperature"`
 	MaxTokens   int       `json:"max_tokens"`
+	// Grammar is llama-server's `grammar` field (GBNF). Same wiring as
+	// internal/llm.Req.Grammar. Empty ⇒ unconstrained sampling.
+	Grammar string `json:"grammar,omitempty"`
+}
+
+// responseGrammar — GBNF constraining the model to the documented phrasing
+// contract and nothing else: {"response": "<text>", "mood": "<enum>"}.
+//
+// Without it a 0.8B answers roughly one chat turn in three with open reasoning
+// as plain text ("Thinking Process:" …), which no tag-stripper can remove and
+// which eats the token budget before the JSON closes. Modelled on
+// routeGrammar in internal/router/llmrouter.go so the two read alike.
+//
+// text accepts ANY codepoint except the two JSON must escape — the replies are
+// Russian, so an ASCII-only rule would make every reply empty. The escape rule
+// is what lets the model close a string it opened with a quote inside. Length
+// is bounded so a repetition loop truncates the field, not the JSON object.
+const responseGrammar = `
+root   ::= "{" ws "\"response\"" ws ":" ws string ws "," ws "\"mood\"" ws ":" ws mood ws "}"
+mood   ::= "\"neutral\"" | "\"happy\"" | "\"thinking\"" | "\"tired\"" | "\"confused\""
+string ::= "\"" ([^"\\] | "\\" ["\\/bfnrt]){0,400} "\""
+ws     ::= [ \t\n]*
+`
+
+// grammar returns the GBNF to attach to a phrasing request, or "" when the
+// operator turned it off.
+func (p *LLMPhraser) grammar() string {
+	if p.cfg.NoGrammar {
+		return ""
+	}
+	return responseGrammar
 }
 
 type chatResp struct {
@@ -391,6 +432,7 @@ func (p *LLMPhraser) chatWithSystem(ctx context.Context, system, user string, ma
 		},
 		Temperature: 0.7,
 		MaxTokens:   maxTokens,
+		Grammar:     p.grammar(),
 	}
 	body, err := json.Marshal(req)
 	if err != nil {
@@ -439,8 +481,10 @@ func (p *LLMPhraser) chatWithSystem(ctx context.Context, system, user string, ma
 // as "..." before this. See PHRASING-EVAL-31-07-2026.md.
 //
 // Russian only, feminine self-reference, second person masculine (the owner is
-// a man). One short sentence — the nudge is spoken aloud.
+// a man). She talks TO him, informally, singular — never "вы", never "он".
+// One short sentence — the nudge is spoken aloud.
 const nudgeSystem = `Ты — Maven, домашняя ассистентка. О себе говоришь в женском роде ("я проверила", "я записала"). Владелец — мужчина, обращайся к нему в мужском роде ("ты пил", "ты забыл").
+Говоришь с ним на "ты", в единственном числе ("выпей", "встань"). Никогда не "вы"/"вас"/"ваш" и никогда "он"/"его" — ты говоришь ему, а не о нём.
 
 Пиши ОДНО короткое напоминание по-русски: не больше 120 символов и не больше 16 слов. Только по делу.
 
@@ -457,21 +501,14 @@ const nudgeSystem = `Ты — Maven, домашняя ассистентка. О
 Это примеры ФОРМЫ, а не темы. Пиши только про ту ситуацию, которую тебе дали в запросе. Не копируй примеры и никогда не пиши "..." в поле response.`
 
 func (p *LLMPhraser) systemPrompt() string {
-	base := nudgeSystem
-	if p.cfg.Persona != "" {
-		base = p.cfg.Persona + "\n\n" + base
-	}
-	return base
+	return persona.Prepend(p.cfg.ContextBlock, nudgeSystem)
 }
 
 // querySystemPrompt returns the system prompt for PhraseQuery (notes + general
 // knowledge). Prepends the configured persona when set.
 func (p *LLMPhraser) querySystemPrompt() string {
 	base := "You are maven, a self-hosted personal assistant answering from your notes. Answer briefly and naturally in Russian starting with \"вот что я нашла: \". Respond ONLY with valid JSON: {\"response\": \"...\", \"mood\": \"neutral\"}."
-	if p.cfg.Persona != "" {
-		base = p.cfg.Persona + "\n\n" + base
-	}
-	return base
+	return persona.Prepend(p.cfg.ContextBlock, base)
 }
 
 // ruleTopics — Russian gloss for each built-in rule name. The rule names are

internal/router/eval/llmrouter_test.go

@@ -61,12 +61,12 @@ func TestLLMRouterBaseline(t *testing.T) {
 	}
 
 	ctx := context.Background()
-	model, err := ModelID(ctx, base)
+	model, err := llm.ModelID(ctx, base)
 	if err != nil {
 		// Not fatal: an unlabelled score is still a score. But say so loudly,
 		// because an unlabelled row in a bake-off table is worthless.
-		t.Logf("could not read model id from %s: %v — reports will say %q", base, err, "unknown-model")
-		model = "unknown-model"
+		t.Logf("could not read model id from %s: %v — reports will say %q", base, err, llm.UnknownModel)
+		model = llm.UnknownModel
 	}
 	t.Logf("scoring model %s at %s", model, base)
 	lr := router.NewLLMRouter(client)

internal/router/knowledge.go

@@ -3,5 +3,8 @@ package router
 // KnowledgePrompt returns the system prompt for general knowledge questions
 // that the phraser uses when no notes match the query.
 func KnowledgePrompt() string {
-	return `Ты — Мавена, персональный ассистент. Ответь кратко из своих знаний. Если не знаешь — скажи "не знаю". Не выдумывай. Respond ONLY with valid JSON: {"response": "...", "mood": "neutral"}.`
+	// No self-introduction here: the shared persona block already says who she
+	// is, and this line used to disagree with it — a different name ("Мавена")
+	// and a masculine noun ("ассистент") in front of a feminine persona.
+	return `Ответь кратко из своих знаний. Если не знаешь — скажи "не знаю". Не выдумывай. Respond ONLY with valid JSON: {"response": "...", "mood": "neutral"}.`
 }

internal/router/knowledge_test.go

@@ -11,10 +11,18 @@ func TestKnowledgePrompt(t *testing.T) {
 		t.Fatal("KnowledgePrompt returned empty string")
 	}
 	// Must contain key instructions
-	checks := []string{"Мавена", "не знаю", "не выдумывай"}
+	checks := []string{"не знаю", "не выдумывай"}
 	for _, c := range checks {
 		if !strings.Contains(strings.ToLower(prompt), strings.ToLower(c)) {
 			t.Errorf("KnowledgePrompt should mention %q", c)
 		}
 	}
+	// Who she is comes from the shared persona block now. This prompt used to
+	// say it too, with a different name and a masculine noun, which is the
+	// drift the block exists to stop.
+	for _, w := range []string{"Мавена", "ассистент"} {
+		if strings.Contains(prompt, w) {
+			t.Errorf("KnowledgePrompt should not introduce her (%q) — the persona block does", w)
+		}
+	}
 }

kill-maven.sh

@@ -1,8 +1,10 @@
 #!/usr/bin/env bash
 # Unified script to stop all Maven services.
 # Usage: ./kill-maven.sh
-#   - Graceful SIGTERM is attempted first.
-#   - If any process lingers, force with SIGKILL.
+#   - Docker deploy: `docker compose stop` (see why below).
+#   - Bare-metal / dev run: graceful SIGTERM first, SIGKILL if anything lingers.
+# Exits non-zero if it cannot confirm everything is stopped. It must never say
+# "stopped" unless it checked.
 
 set -euo pipefail
 
@@ -24,6 +26,73 @@ else
     LLM='llama-server.*\.gguf'
 fi
 
+COMPOSE_FILE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/docker-compose.yml"
+
+# --- containerised deploy ------------------------------------------------
+# docker-compose.yml does not set `pid: host`, so each container has its own
+# PID namespace: pkill on the host sees nothing inside them. This script used
+# to print "all stopped" while every daemon was still happily running. Stop the
+# containers through compose instead — that actually reaches them.
+#
+# running_containers prints the ids of the project's running containers, or
+# nothing. Empty output plus a non-zero return means "could not ask docker",
+# which is different from "nothing is running" and is handled below.
+running_containers() {
+    docker compose -f "$COMPOSE_FILE" ps -q --status running 2>/dev/null
+}
+
+DOCKER_OK=0
+CONTAINERS=""
+if command -v docker >/dev/null 2>&1 && [ -f "$COMPOSE_FILE" ]; then
+    if CONTAINERS="$(running_containers)"; then
+        DOCKER_OK=1
+    fi
+fi
+
+if [ "$DOCKER_OK" = 1 ] && [ -n "$CONTAINERS" ]; then
+    echo "--- Maven is running in containers: stopping via docker compose ---"
+    if ! docker compose -f "$COMPOSE_FILE" stop; then
+        echo "ERROR: 'docker compose stop' failed. Containers may still be running." >&2
+        exit 1
+    fi
+    echo "--- Verifying containers are gone ---"
+    LEFT="$(running_containers || true)"
+    if [ -n "$LEFT" ]; then
+        echo "ERROR: containers still running after stop:" >&2
+        docker compose -f "$COMPOSE_FILE" ps >&2 || true
+        exit 1
+    fi
+    echo "All containers stopped."
+    exit 0
+fi
+
+# --- bare-metal / dev run -----------------------------------------------
+# pgrep -f matches whole command lines, so a shell that merely mentions
+# "mavend" (this script's own parent, for one) shows up. Drop ourselves and our
+# parent, otherwise the SIGKILL sweep can take out the terminal you ran this in.
+host_pids() {
+    pgrep -f "$PAT|$LLM" | grep -v -e "^$$\$" -e "^$PPID\$" | paste -sd, - || true
+}
+HOST_PIDS=$(host_pids)
+
+if [ -z "$HOST_PIDS" ]; then
+    # Nothing on the host. Whether that means "already down" depends on whether
+    # we managed to ask docker, and the two must not read the same.
+    if [ "$DOCKER_OK" = 1 ]; then
+        # Docker answered and named no running containers, and there is nothing
+        # on the host either. That is a real answer: Maven is already stopped.
+        echo "Nothing to stop: no Maven processes and no running containers."
+        exit 0
+    fi
+    # We could not ask docker, so Maven may be alive in a container we cannot
+    # see. Saying "stopped" here is the exact false success this script had.
+    echo "ERROR: no Maven processes on this host, and docker could not be asked." >&2
+    echo "       If this is the container deploy it may still be running:" >&2
+    echo "       docker compose -f $COMPOSE_FILE stop" >&2
+    echo "       Nothing was stopped. Check by hand before assuming Maven is down." >&2
+    exit 1
+fi
+
 echo "--- Sending graceful SIGTERM to Maven services ---"
 pkill -TERM -f "$PAT" || true
 # mavend's Pdeathsig SIGKILLs its llama-server on exit, but sweep strays too
@@ -32,12 +101,18 @@ pkill -TERM -f "$LLM" || true
 
 echo "--- Verifying processes are gone ---"
 sleep 1
-PIDS=$(pgrep -d ',' -f "$PAT|$LLM") || PIDS=""
+PIDS=$(host_pids)
 if [ -n "$PIDS" ]; then
     echo "Warning: some processes still alive. PIDs: $PIDS"
     echo "--- Force killing with SIGKILL ---"
     echo "$PIDS" | tr ',' '\n' | xargs -r kill -9
+    sleep 1
+    LEFT=$(host_pids)
+    if [ -n "$LEFT" ]; then
+        echo "ERROR: still alive after SIGKILL. PIDs: $LEFT" >&2
+        exit 1
+    fi
     echo "Done (SIGKILL)."
 else
     echo "All services gracefully stopped."
-fi
+fi