Answer "что я обычно делаю по вторникам?" by counting, not guessing (#254)

Behavioural memory, narrowed on purpose. internal/memory/behavior.go builds a
profile out of self-facts — distinct days per weekday, median time of day — and
reads it back in RU; router.ParseHabitQuery finds the weekday deterministically;
a `habits` query source answers the question.

Three things the plan doc asks for are deliberately absent, and the doc now
records why:

- The profile is COUNTED, not LLM-generated. A 1.7B asked to summarise a year of
  habits writes fluent claims about the owner's life that no row supports, and a
  wrong claim about him is the most expensive kind of wrong maven can be.
- No cached profile fact, so no "update on fact write" machinery. It is
  recomputed on the question; a cache that can disagree with its own rows is two
  truths.
- No proactive daily plan nudge. A dispatcher proposal at 08:00 every day is the
  definition of a nag. The path from "she noticed a pattern" to "she acts on it"
  already exists in internal/pattern with the proposal queue on /routines, and it
  goes through him.

A one-off is not a habit: an activity needs two distinct days before she will
call it usual, and until then she says she does not know yet. Only self-facts
count — env rows are the world, config rows are her own tuning state. The typical
time is a median so one 03:00 outlier cannot move a morning habit into the night.
An unrecognised fact key is read back verbatim rather than glossed into something
she made up.

The source sits before "calendar" in querySources, and its matcher requires a
habit marker, so "что я делаю в среду?" still reaches the calendar — answering a
question about this coming Wednesday with a statistical average would be
answering a different question.

Verified: make build and make test both exit 0.

cmd/mavcaldav/main.go

@@ -1,17 +1,24 @@
-// mavcaldav — the CalDAV poller module.
+// mavcaldav — the CalDAV module: reads calendars into facts, and renders
+// maven's own reminders back out to a calendar she owns.
 //
-// Polls a Radicale (or any CalDAV) server for today's events and writes
+// READ side (unchanged behaviour): polls a Radicale (or any CalDAV) server for
-// `facts (kind=env, source=poll:caldav)` through core's IPC socket.
+// today's events and writes `facts (kind=env, source=poll:caldav)` through
-// Key-free, restart-free, fail-independent — crashes can't touch the
+// core's IPC socket. Key-free, restart-free, fail-independent — crashes can't
-// store key, worst case a stale calendar_busy fact until the next poll.
+// touch the store key, worst case a stale calendar_busy fact until the next
+// poll. Two facts:
 //
-// Two facts written:
 //   - calendar_busy  ("true"/"false") — read by the loop gate to suppress
 //     nudges during meetings
 //   - calendar_event ("<summary> @ <start>-<end>") — per-event for query
 //
-// Append-only discipline: a fact is written only when its value CHANGED
+// Append-only discipline: a fact is written only when its value CHANGED vs the
-// vs the latest for that key+source.
+// latest for that key+source.
+//
+// RENDER side (Vikunja #127, off unless -render-url is given): publishes each
+// pending reminder as a single-event iCal resource in a collection maven owns.
+// The calendar is a view, sqlite is the store — see render.go. The render URL
+// must differ from the read URL, checked at startup, so the render target can
+// never be a calendar maven is only supposed to read.
 package main
 
 import (
@@ -27,6 +34,7 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/kami/maven/internal/calendar"
 	"github.com/kami/maven/internal/ipc"
 )
 
@@ -43,6 +51,10 @@ func run(args []string) error {
 	url := fs.String("url", "", "CalDAV calendar URL, e.g. http://localhost:5232/kami/personal (required)")
 	user := fs.String("user", "", "CalDAV basic-auth username (required)")
 	pass := fs.String("pass", "", "CalDAV basic-auth password (required)")
+	renderURL := fs.String("render-url", "", "CalDAV collection maven publishes her own reminders to; empty disables rendering")
+	renderUser := fs.String("render-user", "", "basic-auth username for -render-url (defaults to -user)")
+	renderPass := fs.String("render-pass", "", "basic-auth password for -render-url (defaults to -pass)")
+	renderDur := fs.Duration("render-duration", calendar.DefaultReminderDuration, "how long a rendered reminder occupies")
 	interval := fs.Duration("interval", 5*time.Minute, "poll cadence")
 	timeout := fs.Duration("timeout", 10*time.Second, "per-request HTTP timeout")
 	if err := fs.Parse(args); err != nil {
@@ -54,6 +66,9 @@ func run(args []string) error {
 	if *url == "" || *user == "" || *pass == "" {
 		return fmt.Errorf("-url, -user, -pass are required")
 	}
+	if err := checkRenderTarget(*url, *renderURL); err != nil {
+		return err
+	}
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
@@ -64,16 +79,36 @@ func run(args []string) error {
 	}
 	defer core.Close()
 
+	hc := &http.Client{Timeout: *timeout}
 	p := &poller{
 		core: core,
-		http: &http.Client{Timeout: *timeout},
+		http: hc,
 		url:  strings.TrimRight(*url, "/"),
 		user: *user,
 		pass: *pass,
 	}
 
+	var rend *renderer
+	if *renderURL != "" {
+		ru, rp := *renderUser, *renderPass
+		if ru == "" {
+			ru = *user
+		}
+		if rp == "" {
+			rp = *pass
+		}
+		rend = newRenderer(core, hc, *renderURL, ru, rp, *renderDur)
+		log.Printf("mavcaldav: rendering reminders to %s", *renderURL)
+	}
+
 	log.Printf("mavcaldav: polling %s every %s", *url, *interval)
-	p.pollOnce(ctx) // fire immediately
+	tick := func() {
+		p.pollOnce(ctx)
+		if rend != nil {
+			rend.renderOnce(ctx)
+		}
+	}
+	tick() // fire immediately
 	t := time.NewTicker(*interval)
 	defer t.Stop()
 	for {
@@ -82,11 +117,30 @@ func run(args []string) error {
 			log.Printf("mavcaldav: bye")
 			return nil
 		case <-t.C:
-			p.pollOnce(ctx)
+			tick()
 		}
 	}
 }
 
+// checkRenderTarget refuses a render URL that is also a read URL. This is the
+// structural half of #127's "cannot write to your work calendar": the write
+// credential and the write URL are separate flags, and the one calendar maven
+// is known to only read is rejected as a target at startup rather than trusted
+// at runtime.
+func checkRenderTarget(readURL, renderURL string) error {
+	if renderURL == "" {
+		return nil
+	}
+	if sameCollection(readURL, renderURL) {
+		return fmt.Errorf("-render-url must differ from -url: maven renders into a calendar she owns, never into one she reads")
+	}
+	return nil
+}
+
+func sameCollection(a, b string) bool {
+	return strings.EqualFold(strings.TrimRight(a, "/"), strings.TrimRight(b, "/"))
+}
+
 type poller struct {
 	core ipc.CoreAPI
 	http *http.Client
@@ -95,12 +149,6 @@ type poller struct {
 	pass string
 }
 
-type icalEvent struct {
-	start   time.Time
-	end     time.Time
-	summary string
-}
-
 func (p *poller) pollOnce(ctx context.Context) {
 	now := time.Now()
 	events, err := p.fetchEvents(ctx, now)
@@ -109,38 +157,30 @@ func (p *poller) pollOnce(ctx context.Context) {
 		return
 	}
 
-	busy := false
-	for _, e := range events {
-		if !now.Before(e.start) && now.Before(e.end) {
-			busy = true
-			break
-		}
-	}
 	busyVal := "false"
-	if busy {
+	if calendar.Busy(events, now) {
 		busyVal = "true"
 	}
 
 	// Write calendar_busy on change.
-	if err := p.writeIfChanged(ctx, "calendar_busy", "poll:caldav", busyVal, now); err != nil {
+	if err := p.writeIfChanged(ctx, "calendar_busy", calendar.SourcePersonal, busyVal, now, 1.0); err != nil {
 		log.Printf("mavcaldav: write calendar_busy: %v", err)
 		return
 	}
 
-	// Write per-event facts (one per event, keyed by event summary + start).
+	// Write per-event facts (one per event, keyed by day + event summary).
 	// This lets the note RAG path answer "what's on my calendar" without
 	// reaching back to Radicale.
 	for _, e := range events {
-		val := fmt.Sprintf("%s @ %s-%s", e.summary, e.start.Format("15:04"), e.end.Format("15:04"))
+		key := calendar.FactKey(e)
-		eventKey := fmt.Sprintf("calendar_event_%s_%s", e.start.Format("20060102"), safeKey(e.summary))
+		if err := p.writeIfChanged(ctx, key, calendar.SourcePersonal, calendar.FactValue(e), e.Start, 1.0); err != nil {
-		if err := p.writeIfChanged(ctx, eventKey, "poll:caldav", val, e.start); err != nil {
+			log.Printf("mavcaldav: write %s: %v", key, err)
-			log.Printf("mavcaldav: write %s: %v", eventKey, err)
 		}
 	}
 }
 
 // fetchEvents GETs the calendar URL and parses VEVENTs from the iCal response.
-func (p *poller) fetchEvents(ctx context.Context, now time.Time) ([]icalEvent, error) {
+func (p *poller) fetchEvents(ctx context.Context, now time.Time) ([]calendar.Event, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, p.url, nil)
 	if err != nil {
 		return nil, err
@@ -162,120 +202,11 @@ func (p *poller) fetchEvents(ctx context.Context, now time.Time) ([]icalEvent, e
 		return nil, fmt.Errorf("GET %s: %s", p.url, resp.Status)
 	}
 
-	return parseICal(body, now), nil
+	return calendar.ParseICalDay(body, now), nil
-}
-
-// parseICal scans iCal text for VEVENT components. Returns events that overlap
-// with today (UTC day boundaries) to keep the response manageable.
-func parseICal(body []byte, now time.Time) []icalEvent {
-	todayStart := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, time.UTC)
-	todayEnd := todayStart.AddDate(0, 0, 1)
-
-	var events []icalEvent
-	text := string(body)
-	for {
-		veventStart := strings.Index(text, "BEGIN:VEVENT")
-		if veventStart < 0 {
-			break
-		}
-		text = text[veventStart+len("BEGIN:VEVENT"):]
-		veventEnd := strings.Index(text, "END:VEVENT")
-		if veventEnd < 0 {
-			break
-		}
-		block := text[:veventEnd]
-		text = text[veventEnd+len("END:VEVENT"):]
-
-		e := parseVEVENT(block)
-		if e == nil {
-			continue
-		}
-		// Only keep events overlapping today.
-		if e.end.After(todayStart) && e.start.Before(todayEnd) {
-			events = append(events, *e)
-		}
-	}
-	return events
-}
-
-// parseVEVENT extracts start, end, summary from a VEVENT block.
-// Supports both UTC (DTEND:20260703T100000Z) and local (DTSTART;TZID=...:...)
-// formats. Returns nil for all-day events (no DTSTART/DTEND time component) or
-// parse failures.
-func parseVEVENT(block string) *icalEvent {
-	var e icalEvent
-	lines := strings.Split(block, "\n")
-	for _, line := range lines {
-		line = strings.TrimSpace(line)
-		switch {
-		case strings.HasPrefix(line, "DTSTART"):
-			if t, ok := parseDT(line); ok {
-				e.start = t
-			}
-		case strings.HasPrefix(line, "DTEND"):
-			if t, ok := parseDT(line); ok {
-				e.end = t
-			}
-		case strings.HasPrefix(line, "SUMMARY"):
-			if idx := strings.Index(line, ":"); idx >= 0 {
-				e.summary = strings.TrimSpace(line[idx+1:])
-			}
-		}
-	}
-	if e.start.IsZero() || e.end.IsZero() {
-		return nil
-	}
-	return &e
-}
-
-// parseDT parses a DTSTART/DTEND value. Supports:
-//   - UTC: DTEND:20260703T100000Z
-//   - Local: DTSTART;TZID=Europe/Moscow:20260703T130000
-//   - Value-date (all-day): DTSTART;VALUE=DATE:20260703 (returns zero time)
-func parseDT(line string) (time.Time, bool) {
-	if strings.Contains(line, "VALUE=DATE:") {
-		return time.Time{}, false // all-day, skip
-	}
-	idx := strings.LastIndex(line, ":")
-	if idx < 0 {
-		return time.Time{}, false
-	}
-	val := line[idx+1:]
-	val = strings.TrimSuffix(val, "Z")
-
-	// Try UTC first (has Z suffix, or ended in Z before TrimSuffix).
-	if strings.HasSuffix(line, "Z") {
-		t, err := time.Parse("20060102T150405", val)
-		if err != nil {
-			return time.Time{}, false
-		}
-		return t.UTC(), true
-	}
-
-	// Local time — treat as UTC for simplicity (CalDAV server and poller
-	// run in the same timezone; the gate only needs busy/not-busy accuracy).
-	t, err := time.Parse("20060102T150405", val)
-	if err != nil {
-		return time.Time{}, false
-	}
-	return t.UTC(), true
-}
-
-// safeKey makes an event summary safe to use as a fact key (alphanumeric + dash).
-func safeKey(s string) string {
-	var b strings.Builder
-	for _, r := range s {
-		if (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || r == '-' {
-			b.WriteRune(r)
-		} else if r == ' ' || r == '_' {
-			b.WriteRune('-')
-		}
-	}
-	return b.String()
 }
 
 // writeIfChanged writes a fact only when the value differs from the latest.
-func (p *poller) writeIfChanged(ctx context.Context, key, source, val string, ts time.Time) error {
+func (p *poller) writeIfChanged(ctx context.Context, key, source, val string, ts time.Time, confidence float64) error {
 	prev, err := p.core.LatestFactBySource(ctx, key, source)
 	switch {
 	case err == nil && prev.Value == val:
@@ -289,7 +220,7 @@ func (p *poller) writeIfChanged(ctx context.Context, key, source, val string, ts
 		Key:        key,
 		Value:      val,
 		Source:     source,
-		Confidence: 1.0,
+		Confidence: confidence,
 	})
 	if err != nil {
 		return fmt.Errorf("write %s: %w", key, err)

cmd/mavcaldav/main_test.go

@@ -51,165 +51,6 @@ func (f *fakeCore) WriteFact(_ context.Context, req ipc.WriteFactReq) (int64, er
 	return int64(len(f.writeLog)), nil
 }
 
-// ---------------------------------------------------------------------------
-// Parsing tests
-// ---------------------------------------------------------------------------
-
-func TestParseICal(t *testing.T) {
-	now := time.Date(2026, 7, 3, 12, 0, 0, 0, time.UTC)
-
-	body := []byte(`BEGIN:VCALENDAR
-BEGIN:VEVENT
-DTSTART:20260703T090000Z
-DTEND:20260703T100000Z
-SUMMARY:Morning standup
-END:VEVENT
-BEGIN:VEVENT
-DTSTART:20260703T140000Z
-DTEND:20260703T150000Z
-SUMMARY:Team sync
-END:VEVENT
-BEGIN:VEVENT
-DTSTART:20260702T140000Z
-DTEND:20260702T150000Z
-SUMMARY:Yesterday retro
-END:VEVENT
-BEGIN:VEVENT
-DTSTART:20260704T090000Z
-DTEND:20260704T100000Z
-SUMMARY:Tomorrow standup
-END:VEVENT
-BEGIN:VEVENT
-DTSTART;VALUE=DATE:20260704
-DTEND;VALUE=DATE:20260705
-SUMMARY:All-day event
-END:VEVENT
-END:VCALENDAR`)
-
-	events := parseICal(body, now)
-
-	if len(events) != 2 {
-		t.Fatalf("got %d events, want 2 (today events, no all-day/past/future)", len(events))
-	}
-
-	// Morning standup — overlaps today.
-	if events[0].summary != "Morning standup" {
-		t.Errorf("events[0].summary = %q, want %q", events[0].summary, "Morning standup")
-	}
-	wantStart0 := time.Date(2026, 7, 3, 9, 0, 0, 0, time.UTC)
-	if !events[0].start.Equal(wantStart0) {
-		t.Errorf("events[0].start = %v, want %v", events[0].start, wantStart0)
-	}
-	wantEnd0 := time.Date(2026, 7, 3, 10, 0, 0, 0, time.UTC)
-	if !events[0].end.Equal(wantEnd0) {
-		t.Errorf("events[0].end = %v, want %v", events[0].end, wantEnd0)
-	}
-
-	// Team sync — overlaps today.
-	if events[1].summary != "Team sync" {
-		t.Errorf("events[1].summary = %q, want %q", events[1].summary, "Team sync")
-	}
-	wantStart1 := time.Date(2026, 7, 3, 14, 0, 0, 0, time.UTC)
-	if !events[1].start.Equal(wantStart1) {
-		t.Errorf("events[1].start = %v, want %v", events[1].start, wantStart1)
-	}
-	wantEnd1 := time.Date(2026, 7, 3, 15, 0, 0, 0, time.UTC)
-	if !events[1].end.Equal(wantEnd1) {
-		t.Errorf("events[1].end = %v, want %v", events[1].end, wantEnd1)
-	}
-}
-
-func TestParseVEVENT(t *testing.T) {
-	// Normal event with TZID in DTSTART and UTC DTEND.
-	block := "DTSTART;TZID=Europe/Moscow:20260703T130000\nDTEND:20260703T140000Z\nSUMMARY:Stand up meeting"
-	e := parseVEVENT(block)
-	if e == nil {
-		t.Fatal("expected non-nil icalEvent")
-	}
-	wantStart := time.Date(2026, 7, 3, 13, 0, 0, 0, time.UTC)
-	if !e.start.Equal(wantStart) {
-		t.Errorf("start = %v, want %v", e.start, wantStart)
-	}
-	wantEnd := time.Date(2026, 7, 3, 14, 0, 0, 0, time.UTC)
-	if !e.end.Equal(wantEnd) {
-		t.Errorf("end = %v, want %v", e.end, wantEnd)
-	}
-	if e.summary != "Stand up meeting" {
-		t.Errorf("summary = %q, want %q", e.summary, "Stand up meeting")
-	}
-
-	// All-day event (VALUE=DATE) → nil.
-	allDay := "DTSTART;VALUE=DATE:20260703\nDTEND;VALUE=DATE:20260704\nSUMMARY:All-day"
-	if e2 := parseVEVENT(allDay); e2 != nil {
-		t.Error("expected nil for all-day event")
-	}
-}
-
-func TestParseDT(t *testing.T) {
-	tests := []struct {
-		name   string
-		line   string
-		want   time.Time
-		wantOK bool
-	}{
-		{
-			name:   "UTC",
-			line:   "DTEND:20260703T100000Z",
-			want:   time.Date(2026, 7, 3, 10, 0, 0, 0, time.UTC),
-			wantOK: true,
-		},
-		{
-			name:   "local time",
-			line:   "DTSTART;TZID=Europe/Moscow:20260703T130000",
-			want:   time.Date(2026, 7, 3, 13, 0, 0, 0, time.UTC),
-			wantOK: true,
-		},
-		{
-			name:   "all-day",
-			line:   "DTSTART;VALUE=DATE:20260703",
-			want:   time.Time{},
-			wantOK: false,
-		},
-		{
-			name:   "invalid",
-			line:   "DTSTART:garbage",
-			want:   time.Time{},
-			wantOK: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, ok := parseDT(tt.line)
-			if ok != tt.wantOK {
-				t.Errorf("ok = %v, want %v", ok, tt.wantOK)
-			}
-			if !got.Equal(tt.want) {
-				t.Errorf("got = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestSafeKey(t *testing.T) {
-	tests := []struct {
-		input string
-		want  string
-	}{
-		{"Stand up meeting", "Stand-up-meeting"},
-		{"Hello_World", "Hello-World"},
-		{"special@#$chars!!", "specialchars"},
-		{"ALL_CAPS_123", "ALL-CAPS-123"},
-	}
-
-	for _, tt := range tests {
-		got := safeKey(tt.input)
-		if got != tt.want {
-			t.Errorf("safeKey(%q) = %q, want %q", tt.input, got, tt.want)
-		}
-	}
-}
-
 // ---------------------------------------------------------------------------
 // Core logic tests
 // ---------------------------------------------------------------------------
@@ -221,7 +62,7 @@ func TestWriteIfChanged(t *testing.T) {
 	t.Run("no previous fact writes", func(t *testing.T) {
 		fc := &fakeCore{}
 		p := &poller{core: fc}
-		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now)
+		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now, 1.0)
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
@@ -249,7 +90,7 @@ func TestWriteIfChanged(t *testing.T) {
 			},
 		}
 		p := &poller{core: fc}
-		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now)
+		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now, 1.0)
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
@@ -265,7 +106,7 @@ func TestWriteIfChanged(t *testing.T) {
 			},
 		}
 		p := &poller{core: fc}
-		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "new", now)
+		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "new", now, 1.0)
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
@@ -280,7 +121,7 @@ func TestWriteIfChanged(t *testing.T) {
 	t.Run("read error other than ErrNoFact returns error", func(t *testing.T) {
 		fc := &fakeCore{readErr: fmt.Errorf("connection refused")}
 		p := &poller{core: fc}
-		err := p.writeIfChanged(ctx, "fail_key", "poll:caldav", "x", now)
+		err := p.writeIfChanged(ctx, "fail_key", "poll:caldav", "x", now, 1.0)
 		if err == nil {
 			t.Fatal("expected error, got nil")
 		}
@@ -292,7 +133,7 @@ func TestWriteIfChanged(t *testing.T) {
 			writeErr: fmt.Errorf("disk full"),
 		}
 		p := &poller{core: fc}
-		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now)
+		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now, 1.0)
 		if err == nil {
 			t.Fatal("expected error, got nil")
 		}

cmd/mavcaldav/render.go

@@ -0,0 +1,145 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/kami/maven/internal/calendar"
+	"github.com/kami/maven/internal/ipc"
+)
+
+// renderer is the write half of maven's own local calendar (Vikunja #127).
+//
+// It is a RENDER TARGET, not a store. sqlite stays canonical: every tick the
+// renderer reads the pending reminders out of core and publishes each one as a
+// single-event iCal resource in a CalDAV collection maven owns. Nothing is ever
+// read back from that collection, and losing it costs nothing — the next tick
+// rebuilds it.
+//
+// It structurally cannot write to a calendar maven only reads. The URL comes
+// from its own flag, checked at startup against every read URL (see
+// run in main.go), and the only paths it ever addresses carry
+// calendar.ReminderUIDPrefix — so even pointed at the wrong collection it can
+// only touch resources it created.
+type renderer struct {
+	core ipc.CoreAPI
+	http *http.Client
+	url  string
+	user string
+	pass string
+	dur  time.Duration
+
+	// published maps reminder id → the body last successfully PUT, so an
+	// unchanged reminder costs nothing. Purely an optimisation: a restart
+	// re-publishes every reminder once, which is idempotent.
+	published map[int64]string
+}
+
+func newRenderer(core ipc.CoreAPI, hc *http.Client, url, user, pass string, dur time.Duration) *renderer {
+	return &renderer{
+		core:      core,
+		http:      hc,
+		url:       strings.TrimRight(url, "/"),
+		user:      user,
+		pass:      pass,
+		dur:       dur,
+		published: make(map[int64]string),
+	}
+}
+
+// renderOnce publishes every pending reminder and withdraws the ones that are
+// no longer pending. Errors are logged and skipped: a calendar maven cannot
+// reach must never break the reminder itself, which lives in sqlite.
+func (r *renderer) renderOnce(ctx context.Context) {
+	reminders, err := r.core.ListReminders(ctx, renderMaxReminders)
+	if err != nil {
+		log.Printf("mavcaldav: list reminders: %v", err)
+		return
+	}
+
+	live := make(map[int64]bool, len(reminders))
+	for _, rem := range reminders {
+		if rem.Status != "pending" {
+			continue
+		}
+		live[rem.ID] = true
+		e := calendar.ReminderEvent(rem.ID, fireTime(rem), rem.Payload, r.dur)
+		body := calendar.RenderICal([]calendar.Event{e})
+		if r.published[rem.ID] == body {
+			continue
+		}
+		if err := r.put(ctx, calendar.ReminderPath(rem.ID), body); err != nil {
+			log.Printf("mavcaldav: render reminder %d: %v", rem.ID, err)
+			continue
+		}
+		r.published[rem.ID] = body
+		log.Printf("mavcaldav: rendered reminder %d (%s)", rem.ID, e.Summary)
+	}
+
+	for id := range r.published {
+		if live[id] {
+			continue
+		}
+		if err := r.delete(ctx, calendar.ReminderPath(id)); err != nil {
+			log.Printf("mavcaldav: withdraw reminder %d: %v", id, err)
+			continue
+		}
+		delete(r.published, id)
+		log.Printf("mavcaldav: withdrew reminder %d", id)
+	}
+}
+
+// renderMaxReminders bounds the read. Reminders past this count are older than
+// anything a calendar view is useful for.
+const renderMaxReminders = 200
+
+// fireTime prefers NextFireTs — for a recurring reminder that is the occurrence
+// worth showing; FireTs is the original statement.
+func fireTime(rem ipc.Reminder) time.Time {
+	if !rem.NextFireTs.IsZero() {
+		return rem.NextFireTs
+	}
+	return rem.FireTs
+}
+
+func (r *renderer) put(ctx context.Context, name, body string) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodPut, r.url+"/"+name, strings.NewReader(body))
+	if err != nil {
+		return err
+	}
+	req.SetBasicAuth(r.user, r.pass)
+	req.Header.Set("Content-Type", "text/calendar; charset=utf-8")
+	return r.do(req, name)
+}
+
+func (r *renderer) delete(ctx context.Context, name string) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodDelete, r.url+"/"+name, nil)
+	if err != nil {
+		return err
+	}
+	req.SetBasicAuth(r.user, r.pass)
+	return r.do(req, name)
+}
+
+// do runs the request and treats any 2xx, plus 404 on a DELETE, as success —
+// a resource that is already gone is the state the caller wanted.
+func (r *renderer) do(req *http.Request, name string) error {
+	resp, err := r.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	io.Copy(io.Discard, io.LimitReader(resp.Body, 1<<16))
+	switch {
+	case resp.StatusCode >= 200 && resp.StatusCode < 300:
+		return nil
+	case req.Method == http.MethodDelete && resp.StatusCode == http.StatusNotFound:
+		return nil
+	}
+	return fmt.Errorf("%s %s: %s", req.Method, name, resp.Status)
+}

cmd/mavcaldav/render_test.go

@@ -0,0 +1,186 @@
+package main
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/ipc"
+)
+
+// reminderCore is a fakeCore that also answers ListReminders.
+type reminderCore struct {
+	fakeCore
+	reminders []ipc.Reminder
+	listErr   error
+}
+
+func (c *reminderCore) ListReminders(context.Context, int) ([]ipc.Reminder, error) {
+	if c.listErr != nil {
+		return nil, c.listErr
+	}
+	return c.reminders, nil
+}
+
+// calSrv records what a CalDAV collection received.
+type calSrv struct {
+	mu     sync.Mutex
+	puts   map[string]string
+	dels   []string
+	status int
+	*httptest.Server
+}
+
+func newCalSrv() *calSrv {
+	s := &calSrv{puts: map[string]string{}, status: http.StatusCreated}
+	s.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		s.mu.Lock()
+		defer s.mu.Unlock()
+		switch r.Method {
+		case http.MethodPut:
+			s.puts[strings.TrimPrefix(r.URL.Path, "/cal/")] = string(body)
+		case http.MethodDelete:
+			s.dels = append(s.dels, strings.TrimPrefix(r.URL.Path, "/cal/"))
+		}
+		w.WriteHeader(s.status)
+	}))
+	return s
+}
+
+func (s *calSrv) putCount() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return len(s.puts)
+}
+
+func TestRenderOncePublishesPendingReminders(t *testing.T) {
+	fire := time.Date(2026, 8, 1, 18, 30, 0, 0, time.UTC)
+	srv := newCalSrv()
+	defer srv.Close()
+
+	core := &reminderCore{reminders: []ipc.Reminder{
+		{ID: 7, FireTs: fire, Payload: "позвонить маме", Status: "pending"},
+		{ID: 8, FireTs: fire, Payload: "уже сделано", Status: "fired"},
+		{ID: 9, FireTs: fire, Payload: "отменено", Status: "cancelled"},
+	}}
+	r := newRenderer(core, srv.Client(), srv.URL+"/cal/", "u", "p", 0)
+	r.renderOnce(context.Background())
+
+	srv.mu.Lock()
+	body, ok := srv.puts["maven-reminder-7.ics"]
+	n := len(srv.puts)
+	srv.mu.Unlock()
+
+	if n != 1 {
+		t.Fatalf("expected exactly the pending reminder to be published, got %d PUTs", n)
+	}
+	if !ok {
+		t.Fatal("pending reminder 7 was not published")
+	}
+	if !strings.Contains(body, "SUMMARY:позвонить маме") {
+		t.Errorf("payload missing from rendered body:\n%s", body)
+	}
+	if !strings.Contains(body, "UID:maven-reminder-7") {
+		t.Errorf("UID missing from rendered body:\n%s", body)
+	}
+}
+
+func TestRenderOnceSkipsUnchanged(t *testing.T) {
+	srv := newCalSrv()
+	defer srv.Close()
+	core := &reminderCore{reminders: []ipc.Reminder{
+		{ID: 1, FireTs: time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC), Payload: "выпить воды", Status: "pending"},
+	}}
+	r := newRenderer(core, srv.Client(), srv.URL+"/cal", "u", "p", 0)
+	r.renderOnce(context.Background())
+	r.renderOnce(context.Background())
+	if got := srv.putCount(); got != 1 {
+		t.Fatalf("an unchanged reminder was re-published: %d distinct PUTs", got)
+	}
+}
+
+func TestRenderOnceWithdrawsResolvedReminders(t *testing.T) {
+	srv := newCalSrv()
+	defer srv.Close()
+	core := &reminderCore{reminders: []ipc.Reminder{
+		{ID: 5, FireTs: time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC), Payload: "встреча", Status: "pending"},
+	}}
+	r := newRenderer(core, srv.Client(), srv.URL+"/cal", "u", "p", 0)
+	r.renderOnce(context.Background())
+
+	core.reminders[0].Status = "fired"
+	r.renderOnce(context.Background())
+
+	srv.mu.Lock()
+	dels := append([]string(nil), srv.dels...)
+	srv.mu.Unlock()
+	if len(dels) != 1 || dels[0] != "maven-reminder-5.ics" {
+		t.Fatalf("resolved reminder was not withdrawn: %v", dels)
+	}
+	if len(r.published) != 0 {
+		t.Errorf("published map still holds %v", r.published)
+	}
+}
+
+// A calendar maven cannot reach must never break anything: sqlite is canonical.
+func TestRenderOnceSurvivesServerErrors(t *testing.T) {
+	srv := newCalSrv()
+	srv.status = http.StatusInternalServerError
+	defer srv.Close()
+	core := &reminderCore{reminders: []ipc.Reminder{
+		{ID: 1, FireTs: time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC), Payload: "x", Status: "pending"},
+	}}
+	r := newRenderer(core, srv.Client(), srv.URL+"/cal", "u", "p", 0)
+	r.renderOnce(context.Background())
+	if len(r.published) != 0 {
+		t.Error("a failed PUT must not be recorded as published, or it never retries")
+	}
+}
+
+func TestRenderOnceUsesNextFireForRecurring(t *testing.T) {
+	srv := newCalSrv()
+	defer srv.Close()
+	next := time.Date(2026, 8, 2, 7, 0, 0, 0, time.UTC)
+	core := &reminderCore{reminders: []ipc.Reminder{{
+		ID:         3,
+		FireTs:     time.Date(2026, 8, 1, 7, 0, 0, 0, time.UTC),
+		NextFireTs: next,
+		Payload:    "зарядка",
+		Status:     "pending",
+		Cron:       "0 7 * * *",
+	}}}
+	r := newRenderer(core, srv.Client(), srv.URL+"/cal", "u", "p", 0)
+	r.renderOnce(context.Background())
+
+	srv.mu.Lock()
+	body := srv.puts["maven-reminder-3.ics"]
+	srv.mu.Unlock()
+	if !strings.Contains(body, "DTSTART:20260802T070000Z") {
+		t.Errorf("recurring reminder should render its next occurrence:\n%s", body)
+	}
+}
+
+func TestCheckRenderTargetRefusesTheCalendarItReads(t *testing.T) {
+	read := "http://localhost:5232/kami/personal"
+	if err := checkRenderTarget(read, ""); err != nil {
+		t.Fatalf("rendering off must be fine: %v", err)
+	}
+	if err := checkRenderTarget(read, "http://localhost:5232/kami/maven"); err != nil {
+		t.Fatalf("a distinct collection must be accepted: %v", err)
+	}
+	if err := checkRenderTarget(read, read); err == nil {
+		t.Error("rendering into the read calendar must be refused")
+	}
+	if err := checkRenderTarget(read, read+"/"); err == nil {
+		t.Error("a trailing slash must not defeat the check")
+	}
+	if err := checkRenderTarget(read, strings.ToUpper(read)); err == nil {
+		t.Error("case must not defeat the check")
+	}
+}

cmd/mavend/actions_query.go

@@ -5,10 +5,12 @@ import (
 	"errors"
 	"fmt"
 	"log"
+	"strings"
 	"time"
 
 	"github.com/kami/maven/internal/ipc"
 	"github.com/kami/maven/internal/memory"
+	"github.com/kami/maven/internal/morning"
 	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/weather"
 )
@@ -45,6 +47,15 @@ type querySource struct {
 // line here plus its method; where you put the line is the whole decision.
 var querySources = []querySource{
 	{"fact-by-key", (*reactiveHandler).queryFactByKey},
+	// Before "calendar" on purpose: both match "…на сегодня", and the plan is
+	// the more specific ask (its matcher requires a plan word), so the calendar
+	// listing would otherwise swallow it.
+	{"day-plan", (*reactiveHandler).queryDayPlan},
+	// Also before "calendar": "что я обычно делаю по средам?" names a weekday,
+	// and the habit question is the more specific one. Its matcher requires a
+	// habit marker ("обычно", "каждый", …), so a question about this coming
+	// Wednesday still reaches the calendar.
+	{"habits", (*reactiveHandler).queryHabits},
 	{"calendar", (*reactiveHandler).queryCalendar},
 	{"weather", (*reactiveHandler).queryWeather},
 	{"embed", (*reactiveHandler).queryEmbed},
@@ -89,6 +100,75 @@ func (h *reactiveHandler) queryFactByKey(ctx context.Context, t *queryTurn) (str
 	return "", false
 }
 
+// queryDayPlan — "какие планы на сегодня?", "что у меня по плану?", "что
+// дальше?" (Vikunja #128). Recites the day: calendar events, pending
+// reminders, and any morning checklist still outstanding.
+//
+// Read-only by construction — the plan is assembled and rendered core-side and
+// nothing here schedules or announces. "что дальше?" asks for the rest of the
+// day, so that phrasing trims what has already passed.
+func (h *reactiveHandler) queryDayPlan(ctx context.Context, t *queryTurn) (string, bool) {
+	if !router.IsDayPlanQuery(t.dec.Utterance) {
+		return "", false
+	}
+	plan, err := h.api.DayPlan(ctx)
+	if err != nil {
+		log.Printf("voice: day plan: %v", err)
+		return "не получилось собрать план.", true
+	}
+	if !isRestOfDayQuery(t.dec.Utterance) {
+		return plan.Spoken, true
+	}
+	// Rebuild the pure plan so the rest-of-day rendering is the same code that
+	// rendered the whole day — one formatter, one persona.
+	p := morning.Plan{Date: plan.Date}
+	for _, it := range plan.Items {
+		p.Items = append(p.Items, morning.PlanEntry{
+			At:        it.At,
+			Text:      it.Text,
+			Kind:      morning.PlanKind(it.Kind),
+			Uncertain: it.Uncertain,
+		})
+	}
+	return p.After(h.now()).FormatRU(), true
+}
+
+// isRestOfDayQuery — "что дальше?" and its English form, the only plan phrasing
+// that means "from now on" rather than "the whole day".
+func isRestOfDayQuery(text string) bool {
+	s := strings.ToLower(text)
+	return strings.Contains(s, "дальше") || strings.Contains(s, "next")
+}
+
+// habitFactWindow — how many recent facts the behaviour profile is counted
+// over. Enough for a season of habits without scanning the whole store on every
+// question; the profile is recomputed on read, so the bound is the cost control.
+const habitFactWindow = 2000
+
+// queryHabits — "что я обычно делаю по вторникам?" (Vikunja #254). Counts the
+// answer out of the fact log rather than asking the model to summarise a life:
+// see internal/memory/behavior.go for why nothing here is generated.
+func (h *reactiveHandler) queryHabits(ctx context.Context, t *queryTurn) (string, bool) {
+	q, ok := router.ParseHabitQuery(t.dec.Utterance)
+	if !ok {
+		return "", false
+	}
+	facts, err := h.api.RecentFacts(ctx, habitFactWindow)
+	if err != nil {
+		log.Printf("voice: habits: recent facts: %v", err)
+		return "не получилось посмотреть записи.", true
+	}
+	obs := make([]memory.Observation, 0, len(facts))
+	for _, f := range facts {
+		obs = append(obs, memory.Observation{At: f.Ts, Key: f.Key, Kind: f.Kind})
+	}
+	profile := memory.BuildProfile(obs, h.now())
+	if q.HasWeekday {
+		return profile.FormatWeekdayRU(q.Weekday), true
+	}
+	return profile.FormatOverallRU(), true
+}
+
 // queryCalendar — "что у меня сегодня?", "планы на завтра?"
 // h.now(), not time.Now(): the handler's clock is the injected one, so this
 // source can be tested at a fixed time like the rest.
@@ -102,12 +182,15 @@ func (h *reactiveHandler) queryCalendar(ctx context.Context, t *queryTurn) (stri
 		log.Printf("voice: calendar events: %v", err)
 		return "не получилось проверить календарь.", true
 	}
-	values := make([]string, len(events))
+	// Provenance travels with each event. A work meeting relayed off a phone
+	// notification (source ambient:notif, #126) is stored below full confidence
+	// and gets hedged; a CalDAV read is recited plainly.
+	entries := make([]router.CalendarEntry, len(events))
 	for i, e := range events {
-		values[i] = e.Value
+		entries[i] = router.CalendarEntry{Text: e.Value, Uncertain: e.Confidence < 1.0}
 	}
 	var f router.CalendarEventFormatter
-	return f.Format(values, date), true
+	return f.FormatEntries(entries, date), true
 }
 
 func (h *reactiveHandler) queryWeather(ctx context.Context, t *queryTurn) (string, bool) {

cmd/mavend/dayplan_test.go

@@ -0,0 +1,227 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/router"
+)
+
+// planAPI answers only DayPlan; every other call is unimplemented, which is
+// exactly the assertion that the plan source needs nothing else.
+type planAPI struct {
+	ipc.UnimplementedCoreAPI
+	plan  ipc.DayPlan
+	err   error
+	calls int
+}
+
+func (a *planAPI) DayPlan(context.Context) (ipc.DayPlan, error) {
+	a.calls++
+	if a.err != nil {
+		return ipc.DayPlan{}, a.err
+	}
+	return a.plan, nil
+}
+
+func planDay() time.Time { return time.Date(2026, 8, 3, 12, 0, 0, 0, time.UTC) }
+
+func samplePlan() ipc.DayPlan {
+	day := planDay()
+	mid := time.Date(2026, 8, 3, 0, 0, 0, 0, time.UTC)
+	return ipc.DayPlan{
+		Date: mid,
+		Items: []ipc.DayPlanItem{
+			{At: day.Add(-2 * time.Hour), Text: "Standup @ 10:00-10:30", Kind: "event"},
+			{At: day.Add(2 * time.Hour), Text: "Планёрка @ 14:00-14:30", Kind: "event", Uncertain: true},
+			{At: day.Add(6 * time.Hour), Text: "позвонить маме", Kind: "reminder"},
+		},
+		Spoken: "план на 03.08.2026: 10:00 — Standup @ 10:00-10:30; " +
+			"похоже, 14:00 — Планёрка @ 14:00-14:30; 18:00 — позвонить маме.",
+	}
+}
+
+func planHandler(api ipc.CoreAPI) *reactiveHandler {
+	return &reactiveHandler{api: api, now: planDay}
+}
+
+func TestQueryDayPlanRecitesTheDay(t *testing.T) {
+	api := &planAPI{plan: samplePlan()}
+	h := planHandler(api)
+	reply, ok := h.queryDayPlan(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "какие планы на сегодня?"},
+	})
+	if !ok {
+		t.Fatal("the plan source must claim a plan question")
+	}
+	if reply != api.plan.Spoken {
+		t.Errorf("reply = %q, want the core's spoken plan %q", reply, api.plan.Spoken)
+	}
+}
+
+// "что дальше?" is the rest of the day, not the whole day: what has already
+// happened is not a plan.
+func TestQueryDayPlanTrimsToRestOfDay(t *testing.T) {
+	h := planHandler(&planAPI{plan: samplePlan()})
+	reply, ok := h.queryDayPlan(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "что дальше?"},
+	})
+	if !ok {
+		t.Fatal("expected the plan source to claim it")
+	}
+	if strings.Contains(reply, "Standup") {
+		t.Errorf("a passed item must not be read back: %q", reply)
+	}
+	if !strings.Contains(reply, "Планёрка") || !strings.Contains(reply, "позвонить маме") {
+		t.Errorf("the rest of the day is missing: %q", reply)
+	}
+	// Provenance survives the trim.
+	if !strings.Contains(reply, "похоже,") {
+		t.Errorf("a relayed event must stay hedged: %q", reply)
+	}
+}
+
+// A question that is not about the plan must fall through, or the plan buries
+// the calendar listing and the weather behind it.
+func TestQueryDayPlanPassesOnEverythingElse(t *testing.T) {
+	for _, q := range []string{
+		"что у меня сегодня?",
+		"какие планы на завтра?",
+		"когда планёрка?",
+		"какая погода?",
+		"",
+	} {
+		api := &planAPI{plan: samplePlan()}
+		reply, ok := planHandler(api).queryDayPlan(context.Background(), &queryTurn{
+			dec: router.Decision{Intent: router.IntentQuery, Utterance: q},
+		})
+		if ok {
+			t.Errorf("%q was claimed by the plan source (reply %q)", q, reply)
+		}
+		if api.calls != 0 {
+			t.Errorf("%q hit the core for a plan it does not want", q)
+		}
+	}
+}
+
+func TestQueryDayPlanCoreFailure(t *testing.T) {
+	h := planHandler(&planAPI{err: errors.New("socket closed")})
+	reply, ok := h.queryDayPlan(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "план на сегодня"},
+	})
+	if !ok {
+		t.Fatal("a failed plan read must still answer, not fall through to RAG")
+	}
+	if reply != "не получилось собрать план." {
+		t.Errorf("reply = %q", reply)
+	}
+}
+
+// The day plan must sit before the calendar listing: both match "…на сегодня",
+// and the more specific matcher has to get first refusal (see #373 for what
+// happens when the order is wrong).
+func TestDayPlanSourcePrecedesCalendar(t *testing.T) {
+	plan, cal := -1, -1
+	for i, s := range querySources {
+		switch s.name {
+		case "day-plan":
+			plan = i
+		case "calendar":
+			cal = i
+		}
+	}
+	if plan < 0 || cal < 0 {
+		t.Fatalf("sources missing: day-plan=%d calendar=%d", plan, cal)
+	}
+	if plan > cal {
+		t.Errorf("day-plan at %d must come before calendar at %d", plan, cal)
+	}
+}
+
+// habitAPI answers only RecentFacts — the whole input the behaviour profile
+// needs (Vikunja #254). Nothing is asked of the LLM, so nothing else is wired.
+type habitAPI struct {
+	ipc.UnimplementedCoreAPI
+	facts []ipc.Fact
+	err   error
+	calls int
+}
+
+func (a *habitAPI) RecentFacts(_ context.Context, _ int) ([]ipc.Fact, error) {
+	a.calls++
+	return a.facts, a.err
+}
+
+// tuesdayFacts — n weekly Tuesday rows for key, ending before now.
+func tuesdayFacts(key string, hh, weeks int, now time.Time) []ipc.Fact {
+	d := now
+	for d.Weekday() != time.Tuesday {
+		d = d.AddDate(0, 0, -1)
+	}
+	var out []ipc.Fact
+	for i := 0; i < weeks; i++ {
+		day := d.AddDate(0, 0, -7*i)
+		out = append(out, ipc.Fact{
+			Ts:   time.Date(day.Year(), day.Month(), day.Day(), hh, 0, 0, 0, now.Location()),
+			Kind: "self",
+			Key:  key,
+		})
+	}
+	return out
+}
+
+func TestQueryHabitsAnswersFromCountedFacts(t *testing.T) {
+	now := planDay() // a Monday
+	api := &habitAPI{facts: tuesdayFacts("workout", 19, 4, now)}
+	h := &reactiveHandler{api: api, now: func() time.Time { return now }}
+
+	reply, ok := h.queryHabits(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "что я обычно делаю по вторникам?"},
+	})
+	if !ok {
+		t.Fatal("the habit source must claim a habit question")
+	}
+	if want := "по вторникам ты обычно тренируешься около 19:00."; reply != want {
+		t.Errorf("reply = %q, want %q", reply, want)
+	}
+}
+
+func TestQueryHabitsPassesOnEverythingElse(t *testing.T) {
+	now := planDay()
+	for _, q := range []string{"что я делаю в среду?", "что у меня сегодня?", "какие планы на сегодня?", ""} {
+		api := &habitAPI{}
+		h := &reactiveHandler{api: api, now: func() time.Time { return now }}
+		if reply, ok := h.queryHabits(context.Background(), &queryTurn{
+			dec: router.Decision{Intent: router.IntentQuery, Utterance: q},
+		}); ok {
+			t.Errorf("%q was claimed by the habit source (reply %q)", q, reply)
+		}
+		if api.calls != 0 {
+			t.Errorf("%q scanned the fact log for a profile it does not want", q)
+		}
+	}
+}
+
+// Both specific sources must precede the calendar listing, which matches any
+// utterance naming a day.
+func TestHabitSourcePrecedesCalendar(t *testing.T) {
+	habits, cal := -1, -1
+	for i, s := range querySources {
+		switch s.name {
+		case "habits":
+			habits = i
+		case "calendar":
+			cal = i
+		}
+	}
+	if habits < 0 || cal < 0 {
+		t.Fatalf("sources missing: habits=%d calendar=%d", habits, cal)
+	}
+	if habits > cal {
+		t.Errorf("habits at %d must come before calendar at %d", habits, cal)
+	}
+}

cmd/mavend/main.go

@@ -270,6 +270,7 @@ func run(args []string) error {
 			CoreAPI:          ipc.NewStoreAPI(st),
 			getTrace:         tl.trace,
 			getMorningStatus: func(ctx context.Context) []ipc.MorningRoutineStatus { return tl.morningStatus(ctx, time.Now()) },
+			getDayPlan:       func(ctx context.Context) ipc.DayPlan { return tl.dayPlan(ctx, time.Now()) },
 		}
 		if voiceW != nil && voiceW.handler != nil {
 			api := coreAPI.(*daemonAPI)
@@ -449,6 +450,7 @@ func run(args []string) error {
 				CoreAPI:          ipc.NewStoreAPI(st),
 				getTrace:         tl.trace,
 				getMorningStatus: func(ctx context.Context) []ipc.MorningRoutineStatus { return tl.morningStatus(ctx, time.Now()) },
+				getDayPlan:       func(ctx context.Context) ipc.DayPlan { return tl.dayPlan(ctx, time.Now()) },
 			}
 			if voiceW != nil && voiceW.handler != nil {
 				newAPI.chatFn = voiceW.handler.handleText

cmd/mavend/tick.go

@@ -789,6 +789,77 @@ func (t *tickLoop) morningStatus(ctx context.Context, now time.Time) []ipc.Morni
 	return out
 }
 
+// dayPlan is the read-only "what does today hold" query (Vikunja #128). It is
+// the impure half of morning.BuildPlan: it reads the calendar events, the
+// pending reminders and the checklist facts, and the pure builder orders them.
+//
+// It never dispatches. Asking for the plan is a query like any other; the only
+// unprompted delivery in maven stays with the morning nudge and the
+// dispatcher's policy.
+func (t *tickLoop) dayPlan(ctx context.Context, now time.Time) ipc.DayPlan {
+	y, m, d := now.Date()
+	dayStart := time.Date(y, m, d, 0, 0, 0, 0, now.Location())
+	dayEnd := dayStart.AddDate(0, 0, 1)
+
+	var events []morning.PlanEntry
+	facts, err := t.store.CalendarEvents(ctx, dayStart, dayEnd)
+	if err != nil {
+		log.Printf("tick: day plan: calendar events: %v", err)
+	}
+	for _, f := range facts {
+		events = append(events, morning.PlanEntry{
+			At:   f.Ts,
+			Text: f.Value,
+			Kind: morning.PlanEvent,
+			// Provenance below a calendar read (an ambient relay, #126) is
+			// hedged rather than recited as fact.
+			Uncertain: f.Confidence < 1.0,
+		})
+	}
+
+	var reminders []morning.PlanEntry
+	rems, err := t.store.ListReminders(ctx, dayPlanMaxReminders)
+	if err != nil {
+		log.Printf("tick: day plan: list reminders: %v", err)
+	}
+	for _, r := range rems {
+		if r.Status != "pending" {
+			continue
+		}
+		fire := r.NextFireTs
+		if fire.IsZero() {
+			fire = r.FireTs
+		}
+		reminders = append(reminders, morning.PlanEntry{
+			At:   fire,
+			Text: strings.TrimSpace(r.Payload),
+			Kind: morning.PlanReminder,
+		})
+	}
+
+	var checklistFacts map[string]store.Fact
+	if len(t.morningRoutines) > 0 {
+		checklistFacts = t.gatherMorningFacts(ctx)
+	}
+	plan := morning.BuildPlan(t.morningRoutines, checklistFacts, events, reminders, now)
+
+	out := ipc.DayPlan{Date: plan.Date, Spoken: plan.FormatRU()}
+	out.Items = make([]ipc.DayPlanItem, len(plan.Items))
+	for i, it := range plan.Items {
+		out.Items[i] = ipc.DayPlanItem{
+			At:        it.At,
+			Text:      it.Text,
+			Kind:      string(it.Kind),
+			Uncertain: it.Uncertain,
+		}
+	}
+	return out
+}
+
+// dayPlanMaxReminders bounds the reminder scan. The plan covers one day; a
+// pending queue longer than this is a bug elsewhere, not a plan to recite.
+const dayPlanMaxReminders = 500
+
 // tune — the feedback auto-tuner's impure step. runs on a slow cadence
 // (autotuneInterval, see run) so it doesn't write a fact every tick. for each
 // rule:
@@ -868,6 +939,7 @@ type daemonAPI struct {
 	ipc.CoreAPI
 	getTrace         func() *loop.TickTrace
 	getMorningStatus func(ctx context.Context) []ipc.MorningRoutineStatus
+	getDayPlan       func(ctx context.Context) ipc.DayPlan
 	chatFn           func(ctx context.Context, text string) string
 }
 
@@ -893,6 +965,13 @@ func (d *daemonAPI) MorningStatus(ctx context.Context) ([]ipc.MorningRoutineStat
 	return d.getMorningStatus(ctx), nil
 }
 
+func (d *daemonAPI) DayPlan(ctx context.Context) (ipc.DayPlan, error) {
+	if d.getDayPlan == nil {
+		return ipc.DayPlan{}, errors.New("mavend: day plan not available")
+	}
+	return d.getDayPlan(ctx), nil
+}
+
 func toIPCTickTrace(t loop.TickTrace) ipc.TickTrace {
 	rules := make([]ipc.RuleTrace, len(t.RuleTraces))
 	for i, r := range t.RuleTraces {

cmd/mavweb/ambient.go

@@ -0,0 +1,135 @@
+package main
+
+import (
+	"crypto/subtle"
+	"encoding/json"
+	"errors"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+
+	"github.com/kami/maven/internal/calendar"
+	"github.com/kami/maven/internal/ipc"
+)
+
+// POST /api/ambient — the work calendar read (Vikunja #126).
+//
+// Maven does not hold a work credential. A corp mail or calendar session on the
+// homelab ties the box's blast radius to the employer's data, so the work
+// calendar is read as a SIGNAL instead: an Android notification-listener on the
+// owner's phone posts meeting notifications here over wg/LAN, and the ones that
+// clearly describe a meeting become calendar events at source=ambient:notif,
+// confidence below 1.0. Mail as a notification signal, not a mailbox.
+//
+// Off unless configured: no -ambient-token, no route. The token is a shared
+// secret because the poster is a phone service, not a browser — WebAuthn has no
+// answer for a background Android service. The endpoint is write-only and
+// accepts exactly one shape of write; it cannot read anything back out.
+//
+// A notification with no recognisable clock reading stores NOTHING. Maven is
+// not a guesser-of-truth, and a mailbox of noise rendered as invented meetings
+// is worse than a gap.
+
+// ambientMaxBody bounds the request. A notification is two short lines.
+const ambientMaxBody = 8 << 10
+
+type ambientResp struct {
+	Stored bool   `json:"stored"`
+	Key    string `json:"key,omitempty"`
+	Reason string `json:"reason,omitempty"`
+}
+
+// handleAmbient ingests one relayed notification. token is the configured
+// shared secret; an empty token means the capability is off and the handler is
+// never registered, so it is treated as a hard failure here too.
+func handleAmbient(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, token string) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		return
+	}
+	if token == "" {
+		http.Error(w, "ambient ingest disabled (no -ambient-token)", http.StatusServiceUnavailable)
+		return
+	}
+	if !ambientAuthorized(r, token) {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	if core == nil {
+		http.Error(w, "ambient ingest disabled (no -core)", http.StatusServiceUnavailable)
+		return
+	}
+
+	var n calendar.Notification
+	body, err := io.ReadAll(io.LimitReader(r.Body, ambientMaxBody))
+	if err != nil {
+		http.Error(w, "read failed", http.StatusBadRequest)
+		return
+	}
+	if err := json.Unmarshal(body, &n); err != nil {
+		http.Error(w, "bad json", http.StatusBadRequest)
+		return
+	}
+	if n.Posted.IsZero() {
+		writeAmbient(w, http.StatusBadRequest, ambientResp{Reason: "posted_at is required"})
+		return
+	}
+
+	ev, ok := calendar.EventFromNotification(n)
+	if !ok {
+		// Not an event. 202: the relay did its job, there is just nothing here
+		// worth remembering, and it must not retry.
+		writeAmbient(w, http.StatusAccepted, ambientResp{Reason: "no meeting time in notification"})
+		return
+	}
+
+	key := calendar.FactKey(ev)
+	val := calendar.FactValue(ev)
+
+	// Append-only discipline, same as cmd/mavcaldav: a phone reposts the same
+	// notification many times, and each repost is the same event.
+	if prev, err := core.LatestFactBySource(r.Context(), key, calendar.SourceAmbient); err == nil && prev.Value == val {
+		writeAmbient(w, http.StatusOK, ambientResp{Stored: false, Key: key, Reason: "unchanged"})
+		return
+	} else if err != nil && !errors.Is(err, ipc.ErrNoFact) {
+		log.Printf("ambient: read %s: %v", key, err)
+		http.Error(w, "read failed", http.StatusBadGateway)
+		return
+	}
+
+	// kind=env: an observation about the world, never a self-fact — a passive
+	// signal does not write truth about the owner. Confidence below 1.0 is the
+	// honest part: this is a notification about a meeting, not a reading of a
+	// calendar, and the query path hedges when it recites one.
+	if _, err := core.WriteFact(r.Context(), ipc.WriteFactReq{
+		Ts:         ev.Start,
+		Kind:       "env",
+		Key:        key,
+		Value:      val,
+		Source:     calendar.SourceAmbient,
+		Confidence: calendar.AmbientConfidence,
+	}); err != nil {
+		log.Printf("ambient: write %s: %v", key, err)
+		http.Error(w, "write failed", http.StatusBadGateway)
+		return
+	}
+	log.Printf("ambient: %s=%s (%s, pkg=%s)", key, val, calendar.SourceAmbient, n.Package)
+	writeAmbient(w, http.StatusCreated, ambientResp{Stored: true, Key: key})
+}
+
+// ambientAuthorized accepts the token as a bearer header or as an X-Maven-Token
+// header, compared in constant time.
+func ambientAuthorized(r *http.Request, token string) bool {
+	got := strings.TrimSpace(strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer"))
+	if got == "" {
+		got = strings.TrimSpace(r.Header.Get("X-Maven-Token"))
+	}
+	return subtle.ConstantTimeCompare([]byte(got), []byte(token)) == 1
+}
+
+func writeAmbient(w http.ResponseWriter, code int, resp ambientResp) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(code)
+	json.NewEncoder(w).Encode(resp)
+}

cmd/mavweb/ambient_test.go

@@ -0,0 +1,223 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/calendar"
+	"github.com/kami/maven/internal/ipc"
+)
+
+const ambientTestToken = "s3cret"
+
+// ambientCore adds provenance-scoped reads to fakeCore, which the dedupe path
+// needs.
+type ambientCore struct {
+	fakeCore
+	latest  map[string]ipc.Fact // "key|source" → fact
+	readErr error
+}
+
+func (c *ambientCore) LatestFactBySource(_ context.Context, key, source string) (ipc.Fact, error) {
+	if c.readErr != nil {
+		return ipc.Fact{}, c.readErr
+	}
+	f, ok := c.latest[key+"|"+source]
+	if !ok {
+		return ipc.Fact{}, ipc.ErrNoFact
+	}
+	return f, nil
+}
+
+func postAmbient(t *testing.T, core ipc.CoreAPI, token string, n calendar.Notification) (*httptest.ResponseRecorder, ambientResp) {
+	t.Helper()
+	body, err := json.Marshal(n)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest(http.MethodPost, "/api/ambient", strings.NewReader(string(body)))
+	req.Header.Set("Authorization", "Bearer "+ambientTestToken)
+	rr := httptest.NewRecorder()
+	handleAmbient(rr, req, core, token)
+	var resp ambientResp
+	json.Unmarshal(rr.Body.Bytes(), &resp)
+	return rr, resp
+}
+
+func meetingNotification() calendar.Notification {
+	return calendar.Notification{
+		Package: "com.google.android.gm",
+		Title:   "Планёрка",
+		Text:    "10:00-10:30",
+		Posted:  time.Date(2026, 8, 3, 9, 40, 0, 0, time.UTC),
+	}
+}
+
+func TestHandleAmbientStoresMeeting(t *testing.T) {
+	core := &ambientCore{}
+	rr, resp := postAmbient(t, core, ambientTestToken, meetingNotification())
+
+	if rr.Code != http.StatusCreated {
+		t.Fatalf("status = %d, want 201: %s", rr.Code, rr.Body)
+	}
+	if !resp.Stored {
+		t.Errorf("resp = %+v, want stored", resp)
+	}
+	if len(core.writeLog) != 1 {
+		t.Fatalf("expected 1 fact write, got %d", len(core.writeLog))
+	}
+	got := core.writeLog[0]
+	if got.Source != calendar.SourceAmbient {
+		t.Errorf("source = %q, want %q", got.Source, calendar.SourceAmbient)
+	}
+	if got.Confidence >= 1.0 {
+		t.Errorf("confidence = %v — a notification is not a calendar read", got.Confidence)
+	}
+	if got.Confidence != calendar.AmbientConfidence {
+		t.Errorf("confidence = %v, want %v", got.Confidence, calendar.AmbientConfidence)
+	}
+	if got.Kind != "env" {
+		t.Errorf("kind = %q — a passive signal never writes a self-fact", got.Kind)
+	}
+	if want := "calendar_event_20260803_"; !strings.HasPrefix(got.Key, want) {
+		t.Errorf("key = %q, want prefix %q", got.Key, want)
+	}
+	if got.Value != "Планёрка @ 10:00-10:30" {
+		t.Errorf("value = %q", got.Value)
+	}
+}
+
+// A phone reposts the same notification many times. Each repost is the same
+// event, and the append-only log must not fill with duplicates.
+func TestHandleAmbientDedupesReposts(t *testing.T) {
+	core := &ambientCore{}
+	postAmbient(t, core, ambientTestToken, meetingNotification())
+	if len(core.writeLog) != 1 {
+		t.Fatalf("first post did not write")
+	}
+	w := core.writeLog[0]
+	core.latest = map[string]ipc.Fact{w.Key + "|" + w.Source: {Value: w.Value}}
+
+	rr, resp := postAmbient(t, core, ambientTestToken, meetingNotification())
+	if rr.Code != http.StatusOK {
+		t.Errorf("status = %d, want 200 for an unchanged repost", rr.Code)
+	}
+	if resp.Stored {
+		t.Error("a repost must not be stored again")
+	}
+	if len(core.writeLog) != 1 {
+		t.Errorf("wrote %d facts, want 1", len(core.writeLog))
+	}
+}
+
+// The conservative half: noise stores nothing at all.
+func TestHandleAmbientIgnoresNonMeetings(t *testing.T) {
+	core := &ambientCore{}
+	rr, resp := postAmbient(t, core, ambientTestToken, calendar.Notification{
+		Package: "com.google.android.gm",
+		Title:   "3 новых письма",
+		Posted:  time.Now(),
+	})
+	if rr.Code != http.StatusAccepted {
+		t.Errorf("status = %d, want 202 (accepted, nothing to store — the relay must not retry)", rr.Code)
+	}
+	if resp.Stored {
+		t.Error("a notification with no meeting time must store nothing")
+	}
+	if len(core.writeLog) != 0 {
+		t.Fatalf("wrote %d facts for a non-meeting", len(core.writeLog))
+	}
+}
+
+func TestHandleAmbientAuth(t *testing.T) {
+	body := `{"title":"Планёрка 10:00","posted_at":"2026-08-03T09:40:00Z"}`
+
+	newReq := func(hdr, val string) *http.Request {
+		r := httptest.NewRequest(http.MethodPost, "/api/ambient", strings.NewReader(body))
+		if hdr != "" {
+			r.Header.Set(hdr, val)
+		}
+		return r
+	}
+
+	t.Run("no token rejected", func(t *testing.T) {
+		core := &ambientCore{}
+		rr := httptest.NewRecorder()
+		handleAmbient(rr, newReq("", ""), core, ambientTestToken)
+		if rr.Code != http.StatusUnauthorized {
+			t.Errorf("status = %d, want 401", rr.Code)
+		}
+		if len(core.writeLog) != 0 {
+			t.Error("an unauthorized post must not write")
+		}
+	})
+
+	t.Run("wrong token rejected", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		handleAmbient(rr, newReq("Authorization", "Bearer nope"), &ambientCore{}, ambientTestToken)
+		if rr.Code != http.StatusUnauthorized {
+			t.Errorf("status = %d, want 401", rr.Code)
+		}
+	})
+
+	t.Run("X-Maven-Token accepted", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		handleAmbient(rr, newReq("X-Maven-Token", ambientTestToken), &ambientCore{}, ambientTestToken)
+		if rr.Code != http.StatusCreated {
+			t.Errorf("status = %d, want 201: %s", rr.Code, rr.Body)
+		}
+	})
+
+	t.Run("capability off", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		handleAmbient(rr, newReq("Authorization", "Bearer "+ambientTestToken), &ambientCore{}, "")
+		if rr.Code != http.StatusServiceUnavailable {
+			t.Errorf("status = %d, want 503 when no token is configured", rr.Code)
+		}
+	})
+
+	t.Run("GET rejected", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/api/ambient", nil)
+		handleAmbient(rr, r, &ambientCore{}, ambientTestToken)
+		if rr.Code != http.StatusMethodNotAllowed {
+			t.Errorf("status = %d, want 405 — the ingest is write-only", rr.Code)
+		}
+	})
+}
+
+func TestHandleAmbientBadInput(t *testing.T) {
+	t.Run("bad json", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/ambient", strings.NewReader("{nope"))
+		req.Header.Set("X-Maven-Token", ambientTestToken)
+		rr := httptest.NewRecorder()
+		handleAmbient(rr, req, &ambientCore{}, ambientTestToken)
+		if rr.Code != http.StatusBadRequest {
+			t.Errorf("status = %d, want 400", rr.Code)
+		}
+	})
+
+	t.Run("missing posted_at", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/ambient", strings.NewReader(`{"title":"Планёрка 10:00"}`))
+		req.Header.Set("X-Maven-Token", ambientTestToken)
+		rr := httptest.NewRecorder()
+		handleAmbient(rr, req, &ambientCore{}, ambientTestToken)
+		if rr.Code != http.StatusBadRequest {
+			t.Errorf("status = %d, want 400", rr.Code)
+		}
+	})
+
+	t.Run("read error surfaces", func(t *testing.T) {
+		core := &ambientCore{readErr: fmt.Errorf("socket closed")}
+		rr, _ := postAmbient(t, core, ambientTestToken, meetingNotification())
+		if rr.Code != http.StatusBadGateway {
+			t.Errorf("status = %d, want 502", rr.Code)
+		}
+	})
+}

cmd/mavweb/main.go

@@ -334,6 +334,10 @@ func main() {
 	nexusURL := flag.String("nexus", "", "Nexus base URL for the /ecosystem panel (empty = not configured)")
 	praxisURL := flag.String("praxis", "", "Praxis base URL for the /ecosystem panel (empty = not configured)")
 	hexisURL := flag.String("hexis", "", "Hexis base URL for the /ecosystem panel (empty = not configured)")
+	// Shared secret for POST /api/ambient, the notification-relay ingest that
+	// reads the work calendar as a signal instead of holding a work credential
+	// (see ambient.go). Empty ⇒ the route is not registered at all.
+	ambientToken := flag.String("ambient-token", "", "shared secret for POST /api/ambient notification ingest (empty = ingest disabled, route not registered)")
 	flag.Parse()
 
 	var core ipc.CoreAPI
@@ -381,6 +385,14 @@ func main() {
 	mux.HandleFunc("/api/signal", func(w http.ResponseWriter, r *http.Request) {
 		handleSignal(w, r, core)
 	})
+	// Off unless configured: no token, no route — an unconfigured ingest is not
+	// a 503 waiting to be probed, it does not exist.
+	if *ambientToken != "" {
+		mux.HandleFunc("/api/ambient", func(w http.ResponseWriter, r *http.Request) {
+			handleAmbient(w, r, core, *ambientToken)
+		})
+		log.Printf("mavweb: ambient notification ingest enabled at POST /api/ambient")
+	}
 	mux.HandleFunc("/dash", func(w http.ResponseWriter, r *http.Request) {
 		handleDash(w, r, core)
 	})
@@ -947,12 +959,32 @@ func handleMorning(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 		http.Error(w, "core read failed", http.StatusBadGateway)
 		return
 	}
+	view := morningView{Routines: status}
+	// The day plan (#128) shows on this page because it is the same question at
+	// a different scale. A plan read that fails must not take the checklist
+	// down with it — the page degrades to what it had before.
+	plan, err := core.DayPlan(ctx)
+	if err != nil {
+		log.Printf("morning: day plan: %v", err)
+		view.PlanErr = err.Error()
+	} else {
+		view.Plan = &plan
+	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := morningTmpl.Execute(w, status); err != nil {
+	if err := morningTmpl.Execute(w, view); err != nil {
 		log.Printf("morning render: %v", err)
 	}
 }
 
+// morningView — what /morning renders: today's plan on top, the checklist
+// state under it. PlanErr is set instead of Plan when the core could not build
+// a plan, so the page says so rather than showing an empty day.
+type morningView struct {
+	Plan     *ipc.DayPlan
+	PlanErr  string
+	Routines []ipc.MorningRoutineStatus
+}
+
 func handleVoice(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	if err := voiceTmpl.Execute(w, nil); err != nil {

cmd/mavweb/morning.html

@@ -1,9 +1,27 @@
 {{template "shellTop" "morning"}}
+<h1>Today</h1>
+{{with .Plan}}
+<div class=hint>{{.Date.Format "02.01.2006"}}</div>
+{{if not .Items}}
+<div class=hint>nothing planned</div>
+{{else}}
+<div class=scroll><table class=mono>
+<tr><th>at<th>kind<th>what</tr>
+{{range .Items}}<tr>
+<td>{{.At.Format "15:04"}}</td>
+<td class=gray>{{.Kind}}</td>
+<td>{{if .Uncertain}}<span class=hint title="relayed notification, not a calendar read">похоже,</span> {{end}}{{.Text}}</td>
+</tr>{{end}}
+</table></div>
+{{end}}
+{{end}}
+{{if .PlanErr}}<div class=hint>plan unavailable: {{.PlanErr}}</div>{{end}}
+
 <h1>Morning Routines</h1>
-{{if not .}}
+{{if not .Routines}}
 <div class=hint>no morning routines configured</div>
 {{else}}
-{{range .}}
+{{range .Routines}}
 <div class="mb-4">
   <div><strong>{{.Name}}</strong>
     <span class={{if .Active}}green{{else}}gray{{end}}>{{if .Active}}active now{{else}}outside window{{end}}</span>

docs/plans/09-behavioral-memory.md

@@ -27,3 +27,36 @@
 6. Wire voice query — `"что я обычно делаю?"` routes to `IntentQuery` → behavior profile lookup → LLM-phrased answer
 7. Add IPC read method `MethodGetBehaviorProfile` so mavweb can display it on `/dash`
 8. Test with synthetic fact history — verify weekly schedule is correctly inferred
+
+---
+
+## Status (2026-08-01) — partially shipped, deliberately narrowed
+
+Shipped on `overnight/behavior-profile`:
+
+- `internal/memory/behavior.go` — `BuildProfile` counts habits per weekday out of
+  self-facts: distinct-day counts (`MinHabitDays = 2`), a median time-of-day, and
+  `FormatWeekdayRU` / `FormatOverallRU` for the spoken answer.
+- `internal/router/habit.go` — `ParseHabitQuery`, which requires a habit marker
+  ("обычно", "каждую", "привычки", …) and parses the weekday deterministically.
+- `cmd/mavend/actions_query.go` — a `habits` query source, so "что я обычно делаю
+  по вторникам?" is answered.
+
+**Not shipped, and not to be shipped as written:**
+
+- *Step 3, LLM-generated profile stored as a fact.* The profile is COUNTED, not
+  generated. A 1.7B asked to summarise a year of habits produces fluent claims
+  about the owner's life that no row supports, and a wrong claim about him is the
+  most expensive kind of wrong maven can be. Counting is verifiable and cheap.
+- *Step 5, incremental updates on fact write.* There is no cache to keep fresh —
+  the profile is recomputed on the question, so a new fact is already in the next
+  answer. A cached profile that can disagree with its own rows is two truths.
+- *Step 4, proactive daily plan proposals via the dispatcher.* Maven is not a nag,
+  and a nudge at 08:00 every day proposing the day is the definition of one. The
+  sanctioned path from "she noticed a pattern" to "she acts on it" already exists:
+  `internal/pattern/detector.go` proposes a routine, and the owner accepts it on
+  `/routines`. It goes through him.
+
+Still open, if wanted later: `MethodGetBehaviorProfile` + a `/dash` panel (step 7).
+The counted profile needs no new IPC method to be *asked* about — the query source
+reads `RecentFacts` over the existing surface — so this is a display concern only.

internal/calendar/ambient.go

@@ -0,0 +1,221 @@
+package calendar
+
+import (
+	"strings"
+	"time"
+	"unicode"
+)
+
+// Ambient events — the work calendar read (Vikunja #126).
+//
+// The work calendar is not read by holding a work credential. A corp mail or
+// calendar session living on the homelab ties the box's blast radius to the
+// employer's data, which is the thing the task exists to refuse. What maven
+// reads instead is the SIGNAL: an Android notification-listener on the owner's
+// phone relays meeting notifications over wg/LAN, and maven turns the ones that
+// clearly describe a meeting into calendar events.
+//
+// That makes the provenance honest. A notification is evidence about an event,
+// not a reading of the calendar, so it is stored under SourceAmbient at
+// AmbientConfidence — never indistinguishable from a real CalDAV read, and the
+// query path hedges when it recites one.
+//
+// The parse is deliberately conservative. A notification with no recognisable
+// clock reading produces nothing at all: maven is not a guesser-of-truth, and a
+// mailbox full of noise turned into invented events is worse than a gap. Mail
+// as a notification signal, not a mailbox.
+
+// Notification — one relayed Android notification. Package is the posting app
+// (for the log and for the owner to see where a wrong event came from), Title
+// and Text are the notification's two text lines, Posted is when the phone
+// showed it. Nothing else off the notification is kept.
+type Notification struct {
+	Package string    `json:"package"`
+	Title   string    `json:"title"`
+	Text    string    `json:"text"`
+	Posted  time.Time `json:"posted_at"`
+}
+
+// EventFromNotification turns a notification into the event it describes, or
+// reports false when it does not clearly describe one.
+//
+// It needs two things: a clock reading, and a summary that is not just that
+// clock reading. Everything else is defaulted — the date is Posted's day (a
+// meeting notification is about today or it would not be firing now), and a
+// bare start time gets DefaultReminderDuration.
+func EventFromNotification(n Notification) (Event, bool) {
+	if n.Posted.IsZero() {
+		return Event{}, false
+	}
+	line := strings.TrimSpace(n.Title + " " + n.Text)
+	start, end, ok := parseTimeRange(line)
+	if !ok {
+		return Event{}, false
+	}
+	summary := notificationSummary(n)
+	if summary == "" {
+		return Event{}, false
+	}
+
+	y, m, d := n.Posted.Date()
+	loc := n.Posted.Location()
+	s := time.Date(y, m, d, start.hour, start.min, 0, 0, loc)
+	var e time.Time
+	if end != nil {
+		e = time.Date(y, m, d, end.hour, end.min, 0, 0, loc)
+		// A range that ends before it starts crossed midnight.
+		if !e.After(s) {
+			e = e.AddDate(0, 0, 1)
+		}
+	} else {
+		e = s.Add(DefaultReminderDuration)
+	}
+	return Event{Summary: summary, Start: s, End: e}, true
+}
+
+// notificationSummary picks the text that names the meeting: the title when it
+// carries words, otherwise the body. The clock reading is stripped out — it
+// already lives in the times, and FactValue renders it again.
+func notificationSummary(n Notification) string {
+	for _, cand := range []string{n.Title, n.Text} {
+		s := strings.TrimSpace(stripClock(cand))
+		s = strings.Trim(s, " \t-–—,;:@|·")
+		s = strings.Join(strings.Fields(s), " ")
+		if hasLetters(s) {
+			return s
+		}
+	}
+	return ""
+}
+
+type clock struct{ hour, min int }
+
+// parseTimeRange finds the first clock reading in s, and a second one if the
+// text spells a range. Accepted separators between hours and minutes are ":"
+// and "."; between the two ends of a range, "-", "–", "—" or "до".
+//
+// Bare hours ("в 14") are NOT accepted. Loose digits in a notification are far
+// more often a count, a date or an unread badge than a meeting time, and an
+// invented event is worse than no event.
+func parseTimeRange(s string) (start clock, end *clock, ok bool) {
+	first, _, firstEnd, ok := nextClock(s, 0)
+	if !ok {
+		return clock{}, nil, false
+	}
+	sep := strings.TrimLeft(s[firstEnd:], " \t")
+	for _, p := range []string{"-", "–", "—", "до "} {
+		if !strings.HasPrefix(sep, p) {
+			continue
+		}
+		if second, _, _, ok2 := nextClock(strings.TrimPrefix(sep, p), 0); ok2 {
+			return first, &second, true
+		}
+		break
+	}
+	return first, nil, true
+}
+
+// nextClock scans s from byte offset `from` for the first HH:MM (or HH.MM) and
+// returns it with the byte range it occupied. Digits and separators are ASCII,
+// so byte offsets are safe over Cyrillic text.
+func nextClock(s string, from int) (c clock, start, end int, ok bool) {
+	for i := from; i < len(s); i++ {
+		if !isDigit(s[i]) {
+			continue
+		}
+		j := i
+		for j < len(s) && isDigit(s[j]) {
+			j++
+		}
+		// A run longer than two digits is a year, an id or an unread count.
+		if j-i > 2 {
+			i = j
+			continue
+		}
+		if j >= len(s) || (s[j] != ':' && s[j] != '.') {
+			i = j
+			continue
+		}
+		k := j + 1
+		for k < len(s) && isDigit(s[k]) {
+			k++
+		}
+		if k-(j+1) != 2 {
+			i = j
+			continue
+		}
+		// Reject a group that is a link in a longer dotted or colon chain:
+		// "2026.08.15" would otherwise offer "08.15" as 08:15, and a deadline
+		// date invented as a meeting time is exactly the wrong kind of guess.
+		// A trailing ":ss" is fine — that is a time with seconds.
+		if i > 0 && (s[i-1] == '.' || s[i-1] == ':' || isDigit(s[i-1])) {
+			i = k
+			continue
+		}
+		if k < len(s) && s[k] == '.' && k+1 < len(s) && isDigit(s[k+1]) {
+			i = k
+			continue
+		}
+		hour, min := atoi(s[i:j]), atoi(s[j+1:k])
+		if hour > 23 || min > 59 {
+			i = k
+			continue
+		}
+		return clock{hour, min}, i, k, true
+	}
+	return clock{}, 0, 0, false
+}
+
+func isDigit(b byte) bool { return b >= '0' && b <= '9' }
+
+func atoi(s string) int {
+	n := 0
+	for i := 0; i < len(s); i++ {
+		n = n*10 + int(s[i]-'0')
+	}
+	return n
+}
+
+// stripClock removes every clock reading from a summary candidate, along with
+// the preposition or separator that introduced it.
+func stripClock(s string) string {
+	for {
+		_, start, end, ok := nextClock(s, 0)
+		if !ok {
+			return s
+		}
+		head := trimTrailingPreposition(strings.TrimRight(s[:start], "0123456789:.-–— \t"))
+		s = strings.TrimSpace(strings.TrimSpace(head) + " " + strings.TrimSpace(s[end:]))
+	}
+}
+
+// trimTrailingPreposition drops the word that introduced a clock reading, so
+// "Встреча в 14:00" becomes "Встреча" and "с 11:30 до 12:15 Созвон" does not
+// keep a dangling "с". It repeats, because a range has two of them.
+func trimTrailingPreposition(s string) string {
+	preps := []string{"в", "с", "до", "от", "at", "from", "to"}
+	for again := true; again; {
+		again = false
+		s = strings.TrimRight(s, " \t")
+		for _, p := range preps {
+			if s == p {
+				return ""
+			}
+			if strings.HasSuffix(s, " "+p) {
+				s = s[:len(s)-len(p)-1]
+				again = true
+				break
+			}
+		}
+	}
+	return s
+}
+
+func hasLetters(s string) bool {
+	for _, r := range s {
+		if unicode.IsLetter(r) {
+			return true
+		}
+	}
+	return false
+}

internal/calendar/ambient_test.go

@@ -0,0 +1,148 @@
+package calendar
+
+import (
+	"testing"
+	"time"
+)
+
+func TestEventFromNotification(t *testing.T) {
+	posted := time.Date(2026, 8, 3, 9, 40, 0, 0, time.FixedZone("+04", 4*3600))
+
+	tests := []struct {
+		name        string
+		title, text string
+		wantOK      bool
+		wantSummary string
+		wantStart   string // "15:04"
+		wantEnd     string
+	}{
+		{
+			name:        "range in the body",
+			title:       "Планёрка",
+			text:        "10:00-10:30",
+			wantOK:      true,
+			wantSummary: "Планёрка",
+			wantStart:   "10:00", wantEnd: "10:30",
+		},
+		{
+			name:        "russian preposition and single time",
+			title:       "Встреча с подрядчиком в 14:00",
+			wantOK:      true,
+			wantSummary: "Встреча с подрядчиком",
+			wantStart:   "14:00", wantEnd: "14:30",
+		},
+		{
+			name:        "en dash range",
+			title:       "Sprint review",
+			text:        "Today 16:00 – 17:00, Meet",
+			wantOK:      true,
+			wantSummary: "Sprint review",
+			wantStart:   "16:00", wantEnd: "17:00",
+		},
+		{
+			name:        "до as a range separator",
+			title:       "Созвон",
+			text:        "с 11:30 до 12:15",
+			wantOK:      true,
+			wantSummary: "Созвон",
+			wantStart:   "11:30", wantEnd: "12:15",
+		},
+		{
+			name:        "dotted clock",
+			title:       "Обед 13.00",
+			wantOK:      true,
+			wantSummary: "Обед",
+			wantStart:   "13:00", wantEnd: "13:30",
+		},
+		{
+			name:        "range crossing midnight",
+			title:       "Ночной релиз",
+			text:        "23:30-00:30",
+			wantOK:      true,
+			wantSummary: "Ночной релиз",
+			wantStart:   "23:30", wantEnd: "00:30",
+		},
+		// The conservative half: no clock reading, no event.
+		{name: "no time at all", title: "3 новых письма", wantOK: false},
+		{name: "bare hour is not a time", title: "Планёрка в 14", wantOK: false},
+		{name: "unread count", title: "Входящие", text: "12 непрочитанных", wantOK: false},
+		{name: "a date is not a clock", title: "Отчёт", text: "срок 2026.08.15", wantOK: false},
+		{name: "time but nothing named", title: "10:00-10:30", wantOK: false},
+		{name: "impossible clock", title: "Смена 99:99", wantOK: false},
+		{name: "empty", wantOK: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ev, ok := EventFromNotification(Notification{
+				Package: "com.google.android.gm",
+				Title:   tt.title,
+				Text:    tt.text,
+				Posted:  posted,
+			})
+			if ok != tt.wantOK {
+				t.Fatalf("ok = %v, want %v (event %+v)", ok, tt.wantOK, ev)
+			}
+			if !ok {
+				return
+			}
+			if ev.Summary != tt.wantSummary {
+				t.Errorf("summary = %q, want %q", ev.Summary, tt.wantSummary)
+			}
+			if got := ev.Start.Format("15:04"); got != tt.wantStart {
+				t.Errorf("start = %s, want %s", got, tt.wantStart)
+			}
+			if got := ev.End.Format("15:04"); got != tt.wantEnd {
+				t.Errorf("end = %s, want %s", got, tt.wantEnd)
+			}
+			if !ev.End.After(ev.Start) {
+				t.Errorf("end %v must be after start %v", ev.End, ev.Start)
+			}
+			// The event lands on the day the phone showed it, in the phone's
+			// location — not shifted into UTC.
+			if ev.Start.Location() != posted.Location() {
+				t.Errorf("location = %v, want %v", ev.Start.Location(), posted.Location())
+			}
+			if y, m, d := ev.Start.Date(); y != 2026 || m != time.August || d != 3 {
+				t.Errorf("date = %d-%02d-%02d, want 2026-08-03", y, m, d)
+			}
+		})
+	}
+}
+
+func TestEventFromNotificationNeedsPostedAt(t *testing.T) {
+	if _, ok := EventFromNotification(Notification{Title: "Планёрка 10:00"}); ok {
+		t.Error("a notification with no posted_at has no date to sit on")
+	}
+}
+
+// An ambient event must never be indistinguishable from a calendar read.
+func TestAmbientEventsAreStoredAtReducedConfidence(t *testing.T) {
+	ev, ok := EventFromNotification(Notification{
+		Title:  "Планёрка 10:00-10:30",
+		Posted: time.Date(2026, 8, 3, 9, 0, 0, 0, time.UTC),
+	})
+	if !ok {
+		t.Fatal("expected an event")
+	}
+	if FactKey(ev) == "" || FactValue(ev) == "" {
+		t.Fatal("ambient events must use the shared fact encoding")
+	}
+	if AmbientConfidence >= 1.0 {
+		t.Fatal("ambient confidence must be below a calendar read's")
+	}
+}
+
+func TestStripClock(t *testing.T) {
+	tests := []struct{ in, want string }{
+		{"Встреча в 14:00", "Встреча"},
+		{"Планёрка 10:00-10:30", "Планёрка"},
+		{"с 11:30 до 12:15 Созвон", "Созвон"},
+		{"Ничего", "Ничего"},
+	}
+	for _, tt := range tests {
+		if got := stripClock(tt.in); got != tt.want {
+			t.Errorf("stripClock(%q) = %q, want %q", tt.in, got, tt.want)
+		}
+	}
+}

internal/calendar/calendar.go

@@ -0,0 +1,129 @@
+// Package calendar is the one calendar data model the rest of maven shares:
+// an Event, the iCal text it is parsed from and rendered to, and the fact
+// encoding that puts it in the store.
+//
+// It exists because three separate features read or write the same events and
+// must agree on their shape: the CalDAV read side (cmd/mavcaldav, Vikunja
+// #126/#127), the write-only render target that publishes maven's own
+// reminders as a calendar (#127), and the day plan that recites them (#128).
+// Before this package the parse lived inline in cmd/mavcaldav and the fact key
+// format was a Sprintf in two places.
+//
+// The package is pure: no HTTP, no store, no clock of its own. Callers own the
+// impurity, the way internal/morning and internal/loop do.
+package calendar
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+)
+
+// Fact sources. A calendar event reaches the store as a
+// `facts (kind=env, key=calendar_event_..., source=<one of these>)` row, and
+// the source is the whole provenance story:
+//
+//   - SourcePersonal — maven's own Radicale, read AND rendered to. Canonical
+//     state stays in sqlite; the calendar is a render target (#127).
+//   - SourceWork — a work calendar, read-only by definition (#126). Nothing in
+//     maven ever writes to it: no code path pairs this source with a PUT.
+//   - SourceAmbient — inferred from an Android notification-listener relay
+//     rather than read from a server (#126). Confidence is below 1.0 because a
+//     notification is a signal about an event, not the event.
+const (
+	SourcePersonal = "poll:caldav"
+	SourceWork     = "poll:caldav:work"
+	SourceAmbient  = "ambient:notif"
+)
+
+// AmbientConfidence — the confidence a notification-derived event is stored
+// with. A parsed notification line is evidence, not a reading of the calendar,
+// so it must never be indistinguishable from one (#126).
+const AmbientConfidence = 0.6
+
+// Sources lists every source a calendar event may legitimately carry, for the
+// store query that reads the calendar back out. Ordered from most to least
+// trusted.
+func Sources() []string {
+	return []string{SourcePersonal, SourceWork, SourceAmbient}
+}
+
+// ReadOnlySource reports whether events from this source may never be written
+// back. The work calendar is read-only by definition — see #126: maven holding
+// a credential that can write to an employer's calendar is the thing the task
+// exists to avoid.
+func ReadOnlySource(source string) bool {
+	return source == SourceWork || source == SourceAmbient
+}
+
+// Event — one calendar entry. UID is the iCal UID when the event was parsed
+// from a server and the identity maven renders under when it publishes one;
+// Start/End are instants. All-day events are not modelled: the busy gate and
+// the day plan both need a time of day, and an all-day marker answers neither.
+type Event struct {
+	UID     string
+	Summary string
+	Start   time.Time
+	End     time.Time
+}
+
+// FactKey is the store key for an event: one key per day per summary, stable
+// across polls so re-reading an unchanged calendar rewrites nothing.
+//
+// The date prefix is load-bearing — store.CalendarEvents selects a day range
+// by key prefix, not by a timestamp column.
+func FactKey(e Event) string {
+	return fmt.Sprintf("calendar_event_%s_%s", e.Start.Format("20060102"), safeKey(e.Summary))
+}
+
+// FactValue is the human-readable rendering stored as the fact value, and the
+// string the day plan and the query path read back.
+func FactValue(e Event) string {
+	return fmt.Sprintf("%s @ %s-%s", e.Summary, e.Start.Format("15:04"), e.End.Format("15:04"))
+}
+
+// KeyPrefixForDay is the fact-key prefix covering one calendar day. The store
+// range-scans between two of these.
+func KeyPrefixForDay(day time.Time) string {
+	return fmt.Sprintf("calendar_event_%s", day.Format("20060102"))
+}
+
+// Busy reports whether any event covers the instant now — the read the loop
+// gate uses to suppress nudges during a meeting.
+func Busy(events []Event, now time.Time) bool {
+	for _, e := range events {
+		if !now.Before(e.Start) && now.Before(e.End) {
+			return true
+		}
+	}
+	return false
+}
+
+// Overlapping returns the events intersecting [from, to), sorted by start.
+func Overlapping(events []Event, from, to time.Time) []Event {
+	var out []Event
+	for _, e := range events {
+		if e.End.After(from) && e.Start.Before(to) {
+			out = append(out, e)
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Start.Before(out[j].Start) })
+	return out
+}
+
+// safeKey makes a summary safe to use inside a fact key (ASCII alphanumerics
+// and dashes). Non-Latin summaries collapse to their punctuation, which is why
+// the day prefix carries the identity and this only disambiguates within a day.
+func safeKey(s string) string {
+	var b strings.Builder
+	for _, r := range s {
+		switch {
+		case (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || r == '-':
+			b.WriteRune(r)
+		case r == ' ' || r == '_':
+			b.WriteRune('-')
+		}
+	}
+	return b.String()
+}

internal/calendar/calendar_test.go

@@ -0,0 +1,202 @@
+package calendar
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestParseICalDayKeepsOnlyToday(t *testing.T) {
+	now := time.Date(2026, 7, 3, 12, 0, 0, 0, time.UTC)
+
+	body := []byte(`BEGIN:VCALENDAR
+BEGIN:VEVENT
+UID:a@example
+DTSTART:20260703T090000Z
+DTEND:20260703T100000Z
+SUMMARY:Morning standup
+END:VEVENT
+BEGIN:VEVENT
+DTSTART:20260703T140000Z
+DTEND:20260703T150000Z
+SUMMARY:Team sync
+END:VEVENT
+BEGIN:VEVENT
+DTSTART:20260702T140000Z
+DTEND:20260702T150000Z
+SUMMARY:Yesterday retro
+END:VEVENT
+BEGIN:VEVENT
+DTSTART:20260704T090000Z
+DTEND:20260704T100000Z
+SUMMARY:Tomorrow standup
+END:VEVENT
+BEGIN:VEVENT
+DTSTART;VALUE=DATE:20260704
+DTEND;VALUE=DATE:20260705
+SUMMARY:All-day event
+END:VEVENT
+END:VCALENDAR`)
+
+	events := ParseICalDay(body, now)
+	if len(events) != 2 {
+		t.Fatalf("got %d events, want 2 (today only, no all-day/past/future)", len(events))
+	}
+	if events[0].Summary != "Morning standup" || events[0].UID != "a@example" {
+		t.Errorf("events[0] = %+v", events[0])
+	}
+	if !events[0].Start.Equal(time.Date(2026, 7, 3, 9, 0, 0, 0, time.UTC)) {
+		t.Errorf("events[0].Start = %v", events[0].Start)
+	}
+	if !events[0].End.Equal(time.Date(2026, 7, 3, 10, 0, 0, 0, time.UTC)) {
+		t.Errorf("events[0].End = %v", events[0].End)
+	}
+	if events[1].Summary != "Team sync" {
+		t.Errorf("events[1].Summary = %q", events[1].Summary)
+	}
+}
+
+// Regression: "today" is the owner's day, in the owner's location. Taking the
+// day number off a local clock but building the boundaries in UTC made the
+// evening fall outside the window on any box east of Greenwich.
+func TestParseICalDayUsesOwnersDay(t *testing.T) {
+	plus4 := time.FixedZone("+04", 4*60*60)
+	// 01:00 on Aug 1 local is 21:00 on Jul 31 UTC.
+	now := time.Date(2026, 8, 1, 1, 0, 0, 0, plus4)
+	body := []byte("BEGIN:VCALENDAR\nBEGIN:VEVENT\n" +
+		"DTSTART:20260731T195406Z\nDTEND:20260731T235406Z\nSUMMARY:Current meeting\n" +
+		"END:VEVENT\nEND:VCALENDAR")
+
+	events := ParseICalDay(body, now)
+	if len(events) != 1 {
+		t.Fatalf("got %d events, want the in-progress one", len(events))
+	}
+	if !Busy(events, now.UTC()) {
+		t.Error("an event in progress right now must read as busy")
+	}
+}
+
+func TestParseVEVENT(t *testing.T) {
+	block := "DTSTART;TZID=Europe/Moscow:20260703T130000\nDTEND:20260703T140000Z\nSUMMARY:Stand up meeting"
+	e, ok := parseVEVENT(block)
+	if !ok {
+		t.Fatal("expected a parsed event")
+	}
+	if !e.Start.Equal(time.Date(2026, 7, 3, 13, 0, 0, 0, time.UTC)) {
+		t.Errorf("start = %v", e.Start)
+	}
+	if !e.End.Equal(time.Date(2026, 7, 3, 14, 0, 0, 0, time.UTC)) {
+		t.Errorf("end = %v", e.End)
+	}
+	if e.Summary != "Stand up meeting" {
+		t.Errorf("summary = %q", e.Summary)
+	}
+
+	allDay := "DTSTART;VALUE=DATE:20260703\nDTEND;VALUE=DATE:20260704\nSUMMARY:All-day"
+	if _, ok := parseVEVENT(allDay); ok {
+		t.Error("all-day event should be rejected")
+	}
+}
+
+func TestParseDT(t *testing.T) {
+	tests := []struct {
+		name   string
+		line   string
+		want   time.Time
+		wantOK bool
+	}{
+		{"UTC", "DTEND:20260703T100000Z", time.Date(2026, 7, 3, 10, 0, 0, 0, time.UTC), true},
+		{"local", "DTSTART;TZID=Europe/Moscow:20260703T130000", time.Date(2026, 7, 3, 13, 0, 0, 0, time.UTC), true},
+		{"all-day", "DTSTART;VALUE=DATE:20260703", time.Time{}, false},
+		{"garbage", "DTSTART:garbage", time.Time{}, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, ok := parseDT(tt.line)
+			if ok != tt.wantOK {
+				t.Errorf("ok = %v, want %v", ok, tt.wantOK)
+			}
+			if !got.Equal(tt.want) {
+				t.Errorf("got %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSafeKey(t *testing.T) {
+	tests := []struct{ in, want string }{
+		{"Stand up meeting", "Stand-up-meeting"},
+		{"Hello_World", "Hello-World"},
+		{"special@#$chars!!", "specialchars"},
+		{"ALL_CAPS_123", "ALL-CAPS-123"},
+	}
+	for _, tt := range tests {
+		if got := safeKey(tt.in); got != tt.want {
+			t.Errorf("safeKey(%q) = %q, want %q", tt.in, got, tt.want)
+		}
+	}
+}
+
+func TestFactKeyAndValue(t *testing.T) {
+	e := Event{
+		Summary: "Team sync",
+		Start:   time.Date(2026, 7, 3, 14, 0, 0, 0, time.UTC),
+		End:     time.Date(2026, 7, 3, 15, 0, 0, 0, time.UTC),
+	}
+	if got, want := FactKey(e), "calendar_event_20260703_Team-sync"; got != want {
+		t.Errorf("FactKey = %q, want %q", got, want)
+	}
+	if got, want := FactValue(e), "Team sync @ 14:00-15:00"; got != want {
+		t.Errorf("FactValue = %q, want %q", got, want)
+	}
+	if got, want := KeyPrefixForDay(e.Start), "calendar_event_20260703"; got != want {
+		t.Errorf("KeyPrefixForDay = %q, want %q", got, want)
+	}
+	if !strings.HasPrefix(FactKey(e), KeyPrefixForDay(e.Start)) {
+		t.Error("FactKey must start with the day prefix the store range-scans on")
+	}
+}
+
+func TestBusyAndOverlapping(t *testing.T) {
+	base := time.Date(2026, 7, 3, 0, 0, 0, 0, time.UTC)
+	events := []Event{
+		{Summary: "late", Start: base.Add(15 * time.Hour), End: base.Add(16 * time.Hour)},
+		{Summary: "early", Start: base.Add(9 * time.Hour), End: base.Add(10 * time.Hour)},
+	}
+	if !Busy(events, base.Add(9*time.Hour+30*time.Minute)) {
+		t.Error("should be busy inside the early event")
+	}
+	if Busy(events, base.Add(12*time.Hour)) {
+		t.Error("should be free at noon")
+	}
+	// Half-open: the end instant is free.
+	if Busy(events, base.Add(10*time.Hour)) {
+		t.Error("the end instant should not count as busy")
+	}
+	got := Overlapping(events, base.Add(8*time.Hour), base.Add(11*time.Hour))
+	if len(got) != 1 || got[0].Summary != "early" {
+		t.Fatalf("Overlapping = %+v", got)
+	}
+	all := Overlapping(events, base, base.AddDate(0, 0, 1))
+	if len(all) != 2 || all[0].Summary != "early" {
+		t.Fatalf("Overlapping must sort by start: %+v", all)
+	}
+}
+
+func TestSourceTrust(t *testing.T) {
+	if ReadOnlySource(SourcePersonal) {
+		t.Error("the personal calendar is the one maven may render to")
+	}
+	if !ReadOnlySource(SourceWork) {
+		t.Error("the work calendar must be read-only")
+	}
+	if !ReadOnlySource(SourceAmbient) {
+		t.Error("an ambient notification is not a writable calendar")
+	}
+	if AmbientConfidence >= 1.0 {
+		t.Error("ambient events must be less trusted than a calendar read")
+	}
+	if len(Sources()) != 3 {
+		t.Errorf("Sources() = %v", Sources())
+	}
+}

internal/calendar/ical.go

@@ -0,0 +1,145 @@
+package calendar
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+// ParseICal scans iCal text for VEVENT components and returns the events
+// overlapping [from, to). All-day events are skipped: parseDT reports no time
+// for a VALUE=DATE value, and an event with no clock reading answers neither
+// the busy gate nor the day plan.
+func ParseICal(body []byte, from, to time.Time) []Event {
+	var events []Event
+	text := string(body)
+	for {
+		i := strings.Index(text, "BEGIN:VEVENT")
+		if i < 0 {
+			break
+		}
+		text = text[i+len("BEGIN:VEVENT"):]
+		j := strings.Index(text, "END:VEVENT")
+		if j < 0 {
+			break
+		}
+		block := text[:j]
+		text = text[j+len("END:VEVENT"):]
+
+		e, ok := parseVEVENT(block)
+		if !ok {
+			continue
+		}
+		if e.End.After(from) && e.Start.Before(to) {
+			events = append(events, e)
+		}
+	}
+	return events
+}
+
+// ParseICalDay is ParseICal over the calendar day containing now, in now's own
+// location — the window cmd/mavcaldav polls.
+//
+// The location matters. The old inline version took the day number off a local
+// clock reading but built the boundaries in UTC, so east of Greenwich the
+// window was shifted by the offset and part of the evening fell outside
+// "today": on a +04 box after 20:00 UTC the poller saw an empty calendar. The
+// owner's day is the day the day plan and the busy gate mean.
+func ParseICalDay(body []byte, now time.Time) []Event {
+	y, m, d := now.Date()
+	start := time.Date(y, m, d, 0, 0, 0, 0, now.Location())
+	return ParseICal(body, start, start.AddDate(0, 0, 1))
+}
+
+// parseVEVENT extracts UID, start, end and summary from a VEVENT block.
+// Reports false for all-day events and parse failures.
+func parseVEVENT(block string) (Event, bool) {
+	var e Event
+	for _, line := range strings.Split(block, "\n") {
+		line = strings.TrimSpace(line)
+		switch {
+		case strings.HasPrefix(line, "DTSTART"):
+			if t, ok := parseDT(line); ok {
+				e.Start = t
+			}
+		case strings.HasPrefix(line, "DTEND"):
+			if t, ok := parseDT(line); ok {
+				e.End = t
+			}
+		case strings.HasPrefix(line, "SUMMARY"):
+			e.Summary = afterColon(line)
+		case strings.HasPrefix(line, "UID"):
+			e.UID = afterColon(line)
+		}
+	}
+	if e.Start.IsZero() || e.End.IsZero() {
+		return Event{}, false
+	}
+	return e, true
+}
+
+func afterColon(line string) string {
+	if i := strings.Index(line, ":"); i >= 0 {
+		return strings.TrimSpace(line[i+1:])
+	}
+	return ""
+}
+
+// parseDT parses a DTSTART/DTEND value:
+//
+//   - UTC:      DTEND:20260703T100000Z
+//   - Local:    DTSTART;TZID=Europe/Moscow:20260703T130000
+//   - All-day:  DTSTART;VALUE=DATE:20260703  (rejected)
+//
+// A local time is read as UTC, the behaviour cmd/mavcaldav has always had: the
+// CalDAV server and the poller run in the same timezone, and the busy gate only
+// needs busy/not-busy to be right.
+func parseDT(line string) (time.Time, bool) {
+	if strings.Contains(line, "VALUE=DATE:") {
+		return time.Time{}, false
+	}
+	i := strings.LastIndex(line, ":")
+	if i < 0 {
+		return time.Time{}, false
+	}
+	val := strings.TrimSuffix(strings.TrimSpace(line[i+1:]), "Z")
+	t, err := time.Parse("20060102T150405", val)
+	if err != nil {
+		return time.Time{}, false
+	}
+	return t.UTC(), true
+}
+
+// RenderICal wraps events in a VCALENDAR body suitable for PUTting to a CalDAV
+// collection. One event per file is the CalDAV convention, so callers normally
+// pass a single event.
+//
+// This is the write half of #127 and it only ever renders: the canonical state
+// is sqlite, the calendar is a view of it. Nothing reads a rendered file back.
+func RenderICal(events []Event) string {
+	var b strings.Builder
+	b.WriteString("BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//maven//local calendar//RU\r\n")
+	for _, e := range events {
+		b.WriteString("BEGIN:VEVENT\r\n")
+		fmt.Fprintf(&b, "UID:%s\r\n", escapeText(e.UID))
+		fmt.Fprintf(&b, "DTSTAMP:%s\r\n", e.Start.UTC().Format("20060102T150405Z"))
+		fmt.Fprintf(&b, "DTSTART:%s\r\n", e.Start.UTC().Format("20060102T150405Z"))
+		fmt.Fprintf(&b, "DTEND:%s\r\n", e.End.UTC().Format("20060102T150405Z"))
+		fmt.Fprintf(&b, "SUMMARY:%s\r\n", escapeText(e.Summary))
+		b.WriteString("END:VEVENT\r\n")
+	}
+	b.WriteString("END:VCALENDAR\r\n")
+	return b.String()
+}
+
+// escapeText applies RFC 5545 TEXT escaping and strips the line breaks that
+// would otherwise let a reminder payload inject iCal properties.
+func escapeText(s string) string {
+	s = strings.ReplaceAll(s, "\\", "\\\\")
+	s = strings.ReplaceAll(s, ";", "\\;")
+	s = strings.ReplaceAll(s, ",", "\\,")
+	s = strings.ReplaceAll(s, "\r\n", "\\n")
+	s = strings.ReplaceAll(s, "\n", "\\n")
+	s = strings.ReplaceAll(s, "\r", "\\n")
+	return s
+}

internal/calendar/ical_render_test.go

@@ -0,0 +1,69 @@
+package calendar
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestRenderICalRoundTrips(t *testing.T) {
+	e := ReminderEvent(7, time.Date(2026, 8, 1, 18, 30, 0, 0, time.UTC), "позвонить маме", 0)
+	if e.UID != "maven-reminder-7" {
+		t.Errorf("UID = %q", e.UID)
+	}
+	if got := e.End.Sub(e.Start); got != DefaultReminderDuration {
+		t.Errorf("duration = %v, want %v", got, DefaultReminderDuration)
+	}
+	if got, want := ReminderPath(7), "maven-reminder-7.ics"; got != want {
+		t.Errorf("ReminderPath = %q, want %q", got, want)
+	}
+
+	body := RenderICal([]Event{e})
+	if !strings.HasPrefix(body, "BEGIN:VCALENDAR\r\n") || !strings.HasSuffix(body, "END:VCALENDAR\r\n") {
+		t.Fatalf("not a VCALENDAR body:\n%s", body)
+	}
+
+	back := ParseICal([]byte(body), e.Start.Add(-time.Hour), e.Start.Add(time.Hour))
+	if len(back) != 1 {
+		t.Fatalf("got %d events back, want 1:\n%s", len(back), body)
+	}
+	if back[0].UID != e.UID || back[0].Summary != e.Summary {
+		t.Errorf("round trip lost identity: %+v", back[0])
+	}
+	if !back[0].Start.Equal(e.Start) || !back[0].End.Equal(e.End) {
+		t.Errorf("round trip lost times: %+v", back[0])
+	}
+}
+
+func TestRenderICalIsDeterministic(t *testing.T) {
+	e := ReminderEvent(1, time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC), "выпить воды", 0)
+	if RenderICal([]Event{e}) != RenderICal([]Event{e}) {
+		t.Error("the same reminder must render byte-identically, or every poll re-PUTs it")
+	}
+}
+
+// A reminder payload is owner-supplied text. It must not be able to close the
+// VEVENT and inject properties of its own.
+func TestRenderICalEscapesInjection(t *testing.T) {
+	e := ReminderEvent(2, time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC),
+		"обед\r\nEND:VEVENT\r\nBEGIN:VEVENT\r\nSUMMARY:injected", 0)
+	body := RenderICal([]Event{e})
+	// Count line-initial occurrences: the escaped text still contains the
+	// characters "BEGIN:VEVENT", it just can no longer start a line.
+	if n := strings.Count(body, "\r\nBEGIN:VEVENT\r\n"); n != 1 {
+		t.Fatalf("payload injected a second VEVENT (%d):\n%s", n, body)
+	}
+	if n := strings.Count(body, "\r\nEND:VEVENT\r\n"); n != 1 {
+		t.Fatalf("payload closed the VEVENT early (%d):\n%s", n, body)
+	}
+	if !strings.Contains(body, `SUMMARY:обед\nEND:VEVENT`) {
+		t.Errorf("newlines should be escaped, not dropped:\n%s", body)
+	}
+}
+
+func TestReminderEventEmptyPayload(t *testing.T) {
+	e := ReminderEvent(3, time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC), "   ", 0)
+	if e.Summary != "напоминание" {
+		t.Errorf("Summary = %q, want the neutral RU fallback", e.Summary)
+	}
+}

internal/calendar/reminder.go

@@ -0,0 +1,45 @@
+package calendar
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+// ReminderUIDPrefix namespaces every event maven publishes. Two reasons it is a
+// fixed prefix and not a random UUID: the render is idempotent (the same
+// reminder always lands on the same UID, so re-rendering overwrites instead of
+// duplicating), and everything maven owns in the target collection is
+// identifiable at a glance — she never touches a file she did not create.
+const ReminderUIDPrefix = "maven-reminder-"
+
+// DefaultReminderDuration — how long a rendered reminder occupies. A reminder
+// is an instant, a calendar entry is a span, so one has to be invented; 30
+// minutes reads as a block in a calendar app without swallowing the afternoon.
+const DefaultReminderDuration = 30 * time.Minute
+
+// ReminderEvent maps a reminder to the event that represents it. id and fire
+// come from the store; payload is the RU text as the owner said it, rendered
+// verbatim as the summary — the calendar is a view of sqlite, not a place to
+// rephrase.
+func ReminderEvent(id int64, fire time.Time, payload string, dur time.Duration) Event {
+	if dur <= 0 {
+		dur = DefaultReminderDuration
+	}
+	summary := strings.TrimSpace(payload)
+	if summary == "" {
+		summary = "напоминание"
+	}
+	return Event{
+		UID:     fmt.Sprintf("%s%d", ReminderUIDPrefix, id),
+		Summary: summary,
+		Start:   fire,
+		End:     fire.Add(dur),
+	}
+}
+
+// ReminderPath is the collection-relative filename for a rendered reminder.
+// One event per resource, per the CalDAV convention.
+func ReminderPath(id int64) string {
+	return fmt.Sprintf("%s%d.ics", ReminderUIDPrefix, id)
+}

internal/ipc/api.go

@@ -306,6 +306,14 @@ type CoreAPI interface {
 	// TickTrace.
 	MorningStatus(ctx context.Context) ([]MorningRoutineStatus, error)
 
+	// DayPlan returns today's ordered plan — calendar events, pending
+	// reminders and any morning checklist still outstanding (see
+	// internal/morning.BuildPlan) — plus the spoken RU rendering of it.
+	// Read-only: asking for the plan never dispatches or schedules anything.
+	// The store adapter returns an error (the plan needs the daemon's routine
+	// config) — same shape as TickTrace and MorningStatus.
+	DayPlan(ctx context.Context) (DayPlan, error)
+
 	// Chat routes a text utterance through the reactive handler's core path
 	// (router → dialogue → action → replier) and returns the reply text.
 	// No audio or stt/tts — for text channels (mavweb, telegram).
@@ -359,6 +367,26 @@ type MorningRoutineStatus struct {
 	Items       []MorningRoutineItem `json:"items"`
 }
 
+// DayPlanItem — one line of the day plan. Kind is "event", "reminder" or
+// "checklist"; Uncertain marks an item whose provenance is below a full
+// calendar read (a meeting relayed off a phone notification), so a UI can hedge
+// the same way the spoken form does.
+type DayPlanItem struct {
+	At        time.Time `json:"at"`
+	Text      string    `json:"text"`
+	Kind      string    `json:"kind"`
+	Uncertain bool      `json:"uncertain,omitempty"`
+}
+
+// DayPlan — the plan for one calendar day. Spoken is the RU sentence maven
+// says when asked, rendered core-side so the voice reply and the web view can
+// never drift apart.
+type DayPlan struct {
+	Date   time.Time     `json:"date"`
+	Items  []DayPlanItem `json:"items"`
+	Spoken string        `json:"spoken"`
+}
+
 // storeEncryptionKeyReq — passkey credential public key for wrapping the store
 // encryption key at enrollment time. Called by mavweb after RegisterFinish.
 type storeEncryptionKeyReq struct {

internal/ipc/client.go

@@ -71,6 +71,7 @@ var readOnlyMethods = map[Method]bool{
 	MethodListProposedRoutines: true,
 	MethodTickTrace:            true,
 	MethodMorningStatus:        true,
+	MethodDayPlan:              true,
 }
 
 // Dial connects to a core socket at path and returns a Client. The module
@@ -458,6 +459,14 @@ func (c *Client) MorningStatus(ctx context.Context) ([]MorningRoutineStatus, err
 	return s, nil
 }
 
+func (c *Client) DayPlan(ctx context.Context) (DayPlan, error) {
+	var p DayPlan
+	if err := c.call(ctx, MethodDayPlan, nil, &p); err != nil {
+		return DayPlan{}, err
+	}
+	return p, nil
+}
+
 func (c *Client) RevertFact(ctx context.Context, key string) (int64, error) {
 	var result struct {
 		NewID int64 `json:"new_id"`

internal/ipc/server.go

@@ -211,6 +211,10 @@ func (a *storeAPI) MorningStatus(ctx context.Context) ([]MorningRoutineStatus, e
 	return nil, errors.New("store: morning status not available via direct store API")
 }
 
+func (a *storeAPI) DayPlan(ctx context.Context) (DayPlan, error) {
+	return DayPlan{}, errors.New("store: day plan not available via direct store API")
+}
+
 func (a *storeAPI) ListTools(ctx context.Context, status string) ([]Tool, error) {
 	ts, err := a.s.ListTools(ctx, status)
 	if err != nil {
@@ -729,6 +733,9 @@ var methodTable = map[Method]handlerFunc{
 	// MorningStatus intentionally has no nil→[]T{} normalization here — the
 	// pre-table arm marshaled api.MorningStatus's result as-is (a nil slice
 	// serializes as JSON null), and this preserves that exact wire shape.
+	MethodDayPlan: withoutParams(func(ctx context.Context, api CoreAPI) (DayPlan, error) {
+		return api.DayPlan(ctx)
+	}),
 	MethodMorningStatus: withoutParams(func(ctx context.Context, api CoreAPI) ([]MorningRoutineStatus, error) {
 		return api.MorningStatus(ctx)
 	}),

internal/ipc/unimplemented.go

@@ -113,6 +113,9 @@ func (UnimplementedCoreAPI) TickTrace(ctx context.Context) (TickTrace, error) {
 func (UnimplementedCoreAPI) MorningStatus(ctx context.Context) ([]MorningRoutineStatus, error) {
 	return nil, ErrNotImplemented
 }
+func (UnimplementedCoreAPI) DayPlan(ctx context.Context) (DayPlan, error) {
+	return DayPlan{}, ErrNotImplemented
+}
 func (UnimplementedCoreAPI) Chat(ctx context.Context, text string) (string, error) {
 	return "", ErrNotImplemented
 }

internal/ipc/wire.go

@@ -45,6 +45,7 @@ const (
 	MethodRevertFact             Method = "revert_fact"
 	MethodTickTrace              Method = "tick_trace"
 	MethodMorningStatus          Method = "morning_status"
+	MethodDayPlan                Method = "day_plan"
 	MethodChat                   Method = "chat"
 )
 

internal/memory/behavior.go

@@ -0,0 +1,254 @@
+package memory
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+)
+
+// Behavioural memory — "what do I usually do?" (Vikunja #254).
+//
+// The profile is COUNTED, not generated. docs/plans/09-behavioral-memory.md
+// asks for an LLM to write a behaviour profile daily and store it as a fact;
+// this does not do that, on purpose. A 1.7B asked to summarise a year of habits
+// will produce fluent claims about the owner's life that no row in the store
+// supports, and a wrong claim about him is the most expensive kind of wrong
+// maven can be. Counting distinct days per weekday is verifiable, cheap enough
+// to run on the question, and cannot invent a habit he does not have.
+//
+// Recomputed on read rather than cached as a fact for the same reason the store
+// is append-only: a cached profile can disagree with the rows it came from, and
+// then there are two truths. The plan's step 5 ("profile updates on fact write")
+// exists to keep a cache fresh; there is no cache, so a new fact is already in
+// the next answer.
+//
+// It is also read-only and unprompted-free. The plan's step 4 — a morning
+// dispatcher nudge proposing the day — is deliberately NOT here: maven is not a
+// nag, and proposing plans at 08:00 every day is the definition of one. Pattern
+// inference that leads to a routine the owner accepts already exists in
+// internal/pattern with the proposal queue on /routines; that is the sanctioned
+// path from "she noticed" to "she acts", and it goes through him.
+
+// Observation — one thing the owner was recorded doing, reduced to what a habit
+// needs: when, and what. Facts arrive as store/ipc rows; the caller maps them
+// so this package stays free of both.
+type Observation struct {
+	At   time.Time
+	Key  string
+	Kind string // "self" | "env" | "config"
+}
+
+// Activity — one recurring thing, as counted. Days is the number of DISTINCT
+// days it was observed on, which is the number that decides whether something
+// is a habit; Count can be inflated by one busy day.
+//
+// TypicalAt is the median time of day it happens at, rounded to the minute — a
+// median and not a mean, so one 03:00 outlier does not move "он обычно пьёт
+// воду утром" into the night.
+type Activity struct {
+	Key       string
+	Days      int
+	Count     int
+	TypicalAt time.Duration
+}
+
+// Profile — the counted behaviour model. Weekly holds the activities that
+// recur on a given weekday, Overall the ones that recur at all.
+type Profile struct {
+	Since  time.Time
+	Until  time.Time
+	Weekly map[time.Weekday][]Activity
+	All    []Activity
+}
+
+// MinHabitDays — how many distinct days an activity must appear on before maven
+// will call it usual. Two is the smallest number that can distinguish a habit
+// from a one-off; below that she says she does not know yet, which is true.
+const MinHabitDays = 2
+
+// nonBehaviouralKeyPrefixes — keys that are machinery or one-shot records, not
+// behaviour. Calendar events carry the day in the key so they can never repeat;
+// cooldown and quiet rows are maven's own tuning state, not his habits.
+var nonBehaviouralKeyPrefixes = []string{
+	"calendar_event_",
+	"cooldown:",
+	"quiet",
+	"behavior_profile",
+}
+
+// BuildProfile counts habits out of observations. now bounds the window's upper
+// end and supplies the location every day boundary is taken in — a habit is
+// "on Tuesdays" in the owner's timezone or it is nothing.
+//
+// Only self-facts count. An env row is the world (weather, a relayed meeting),
+// and a config row is maven's own state; neither says anything about what he
+// usually does.
+func BuildProfile(obs []Observation, now time.Time) Profile {
+	loc := now.Location()
+	p := Profile{Until: now, Weekly: map[time.Weekday][]Activity{}}
+
+	type bucket struct {
+		days  map[string]struct{}
+		count int
+		mins  []int
+	}
+	// key → bucket, and (weekday, key) → bucket.
+	all := map[string]*bucket{}
+	weekly := map[time.Weekday]map[string]*bucket{}
+
+	for _, o := range obs {
+		if o.Kind != "self" {
+			continue
+		}
+		key := strings.TrimSpace(o.Key)
+		if key == "" || nonBehavioural(key) {
+			continue
+		}
+		at := o.At.In(loc)
+		if at.IsZero() || at.After(now) {
+			continue
+		}
+		if p.Since.IsZero() || at.Before(p.Since) {
+			p.Since = at
+		}
+		day := at.Format("2006-01-02")
+		minute := at.Hour()*60 + at.Minute()
+
+		bump := func(m map[string]*bucket) {
+			b := m[key]
+			if b == nil {
+				b = &bucket{days: map[string]struct{}{}}
+				m[key] = b
+			}
+			b.days[day] = struct{}{}
+			b.count++
+			b.mins = append(b.mins, minute)
+		}
+		bump(all)
+		wd := at.Weekday()
+		if weekly[wd] == nil {
+			weekly[wd] = map[string]*bucket{}
+		}
+		bump(weekly[wd])
+	}
+
+	harvest := func(m map[string]*bucket) []Activity {
+		var out []Activity
+		for key, b := range m {
+			if len(b.days) < MinHabitDays {
+				continue
+			}
+			out = append(out, Activity{
+				Key:       key,
+				Days:      len(b.days),
+				Count:     b.count,
+				TypicalAt: time.Duration(medianInt(b.mins)) * time.Minute,
+			})
+		}
+		// Most-established first, then earliest in the day, then by key so the
+		// same history always reads back the same way.
+		sort.Slice(out, func(i, j int) bool {
+			if out[i].Days != out[j].Days {
+				return out[i].Days > out[j].Days
+			}
+			if out[i].TypicalAt != out[j].TypicalAt {
+				return out[i].TypicalAt < out[j].TypicalAt
+			}
+			return out[i].Key < out[j].Key
+		})
+		return out
+	}
+
+	p.All = harvest(all)
+	for wd, m := range weekly {
+		if acts := harvest(m); len(acts) > 0 {
+			p.Weekly[wd] = acts
+		}
+	}
+	return p
+}
+
+func nonBehavioural(key string) bool {
+	for _, p := range nonBehaviouralKeyPrefixes {
+		if strings.HasPrefix(key, p) {
+			return true
+		}
+	}
+	return false
+}
+
+// medianInt — the middle value, averaging the two middles on an even count.
+func medianInt(xs []int) int {
+	if len(xs) == 0 {
+		return 0
+	}
+	s := make([]int, len(xs))
+	copy(s, xs)
+	sort.Ints(s)
+	mid := len(s) / 2
+	if len(s)%2 == 1 {
+		return s[mid]
+	}
+	return (s[mid-1] + s[mid]) / 2
+}
+
+// weekdayRU — accusative, as "по вторникам" and "в среду" both need it read
+// back. Index is time.Weekday.
+var weekdayRU = [...]string{"воскресеньям", "понедельникам", "вторникам", "средам", "четвергам", "пятницам", "субботам"}
+
+// activityRU glosses the loop's known fact keys. An unknown key is read back
+// verbatim: it is what the store holds, and inventing a Russian phrase for a key
+// maven does not recognise would be putting words in his mouth.
+var activityRU = map[string]string{
+	"water":   "пьёшь воду",
+	"meal":    "ешь",
+	"sleep":   "спишь",
+	"break":   "делаешь перерыв",
+	"shower":  "принимаешь душ",
+	"walk":    "гуляешь",
+	"pills":   "пьёшь витамины",
+	"workout": "тренируешься",
+}
+
+// FormatWeekdayRU reads back what he usually does on a given weekday.
+// Second person singular and informal, as she speaks TO him.
+func (p Profile) FormatWeekdayRU(wd time.Weekday) string {
+	acts := p.Weekly[wd]
+	day := weekdayRU[int(wd)%7]
+	if len(acts) == 0 {
+		return fmt.Sprintf("по %s у меня пока нет ничего постоянного.", day)
+	}
+	return fmt.Sprintf("по %s ты обычно %s.", day, joinActivities(acts))
+}
+
+// FormatOverallRU reads back the habits that hold across the whole week.
+func (p Profile) FormatOverallRU() string {
+	if len(p.All) == 0 {
+		return "я ещё не набрала достаточно записей, чтобы говорить о привычках."
+	}
+	return fmt.Sprintf("обычно ты %s.", joinActivities(p.All))
+}
+
+// maxRecited bounds a spoken profile. A list of fifteen habits read aloud is
+// not an answer; the most established few are.
+const maxRecited = 5
+
+func joinActivities(acts []Activity) string {
+	if len(acts) > maxRecited {
+		acts = acts[:maxRecited]
+	}
+	parts := make([]string, len(acts))
+	for i, a := range acts {
+		gloss, ok := activityRU[a.Key]
+		if !ok {
+			gloss = a.Key
+		}
+		parts[i] = fmt.Sprintf("%s около %02d:%02d", gloss,
+			int(a.TypicalAt.Hours()), int(a.TypicalAt.Minutes())%60)
+	}
+	if len(parts) == 1 {
+		return parts[0]
+	}
+	return strings.Join(parts[:len(parts)-1], ", ") + " и " + parts[len(parts)-1]
+}

internal/memory/behavior_test.go

@@ -0,0 +1,163 @@
+package memory
+
+import (
+	"strings"
+	"testing"
+	"time"
+	"unicode"
+)
+
+// habitHistory — n weeks of the same weekday, at the given local time.
+func habitHistory(key string, wd time.Weekday, hh, mm, weeks int, from time.Time) []Observation {
+	var out []Observation
+	d := from
+	for d.Weekday() != wd {
+		d = d.AddDate(0, 0, -1)
+	}
+	for i := 0; i < weeks; i++ {
+		day := d.AddDate(0, 0, -7*i)
+		out = append(out, Observation{
+			At:   time.Date(day.Year(), day.Month(), day.Day(), hh, mm, 0, 0, from.Location()),
+			Key:  key,
+			Kind: "self",
+		})
+	}
+	return out
+}
+
+func behaviorNow() time.Time {
+	// A Monday, so "по вторникам" is a past weekday and not today.
+	return time.Date(2026, 8, 3, 20, 0, 0, 0, time.UTC)
+}
+
+func TestBuildProfileCountsWeekdayHabits(t *testing.T) {
+	now := behaviorNow()
+	obs := append(
+		habitHistory("workout", time.Tuesday, 19, 0, 4, now),
+		habitHistory("water", time.Tuesday, 9, 0, 3, now)...,
+	)
+	p := BuildProfile(obs, now)
+
+	tue := p.Weekly[time.Tuesday]
+	if len(tue) != 2 {
+		t.Fatalf("got %d tuesday activities, want 2: %+v", len(tue), tue)
+	}
+	// Most-established first.
+	if tue[0].Key != "workout" || tue[0].Days != 4 {
+		t.Errorf("first = %+v, want workout on 4 days", tue[0])
+	}
+	if tue[0].TypicalAt != 19*time.Hour {
+		t.Errorf("typical at %v, want 19:00", tue[0].TypicalAt)
+	}
+	if len(p.Weekly[time.Wednesday]) != 0 {
+		t.Errorf("wednesday must be empty: %+v", p.Weekly[time.Wednesday])
+	}
+	if len(p.All) != 2 {
+		t.Errorf("the week-wide list should hold both: %+v", p.All)
+	}
+}
+
+// A one-off is not a habit. Saying "ты обычно X" off a single row is a
+// confidently wrong claim about his life.
+func TestBuildProfileNeedsMoreThanOneDay(t *testing.T) {
+	now := behaviorNow()
+	obs := habitHistory("workout", time.Tuesday, 19, 0, 1, now)
+	// Three rows, same day — a busy Tuesday, not a habit.
+	obs = append(obs, Observation{At: obs[0].At.Add(time.Hour), Key: "workout", Kind: "self"})
+	obs = append(obs, Observation{At: obs[0].At.Add(2 * time.Hour), Key: "workout", Kind: "self"})
+
+	p := BuildProfile(obs, now)
+	if len(p.All) != 0 || len(p.Weekly) != 0 {
+		t.Fatalf("one day of rows must produce no habit: %+v / %+v", p.All, p.Weekly)
+	}
+	if got := p.FormatOverallRU(); !strings.Contains(got, "не набрала достаточно") {
+		t.Errorf("empty profile reads %q", got)
+	}
+}
+
+// Only self-facts describe him. Env rows are the world and config rows are
+// maven's own tuning state; counting either as a habit would be a category
+// error the owner would then be told about.
+func TestBuildProfileIgnoresNonSelfAndMachineryKeys(t *testing.T) {
+	now := behaviorNow()
+	var obs []Observation
+	for _, o := range habitHistory("water", time.Tuesday, 9, 0, 3, now) {
+		o.Kind = "env"
+		obs = append(obs, o)
+	}
+	for _, o := range habitHistory("cooldown:water", time.Tuesday, 9, 0, 3, now) {
+		obs = append(obs, o) // kind=self, but a machinery key
+	}
+	for _, o := range habitHistory("calendar_event_20260804_standup", time.Tuesday, 10, 0, 3, now) {
+		obs = append(obs, o)
+	}
+	if p := BuildProfile(obs, now); len(p.All) != 0 {
+		t.Fatalf("nothing here is a habit of his: %+v", p.All)
+	}
+}
+
+// The median, not the mean: one 03:00 outlier must not move a morning habit
+// into the night.
+func TestBuildProfileTypicalTimeIsMedian(t *testing.T) {
+	now := behaviorNow()
+	obs := habitHistory("water", time.Tuesday, 9, 0, 4, now)
+	obs = append(obs, Observation{At: obs[0].At.AddDate(0, 0, -28).Add(-6 * time.Hour), Key: "water", Kind: "self"})
+	p := BuildProfile(obs, now)
+	if len(p.All) != 1 {
+		t.Fatalf("got %+v", p.All)
+	}
+	if p.All[0].TypicalAt != 9*time.Hour {
+		t.Errorf("typical at %v, want 09:00 despite the outlier", p.All[0].TypicalAt)
+	}
+}
+
+func TestProfileFormatRUPersona(t *testing.T) {
+	now := behaviorNow()
+	obs := append(
+		habitHistory("workout", time.Tuesday, 19, 0, 4, now),
+		habitHistory("water", time.Tuesday, 9, 5, 3, now)...,
+	)
+	p := BuildProfile(obs, now)
+
+	got := p.FormatWeekdayRU(time.Tuesday)
+	want := "по вторникам ты обычно тренируешься около 19:00 и пьёшь воду около 09:05."
+	if got != want {
+		t.Errorf("got  %q\nwant %q", got, want)
+	}
+	if empty := p.FormatWeekdayRU(time.Thursday); !strings.Contains(empty, "ничего постоянного") {
+		t.Errorf("an unknown weekday reads %q", empty)
+	}
+	// Persona: she addresses him informally, never in the masculine about
+	// herself, and never with a pet name.
+	for _, s := range []string{got, p.FormatOverallRU(), p.FormatWeekdayRU(time.Thursday)} {
+		// Whole words: "ничего" contains "его", and a substring test would
+		// call a correct sentence a persona violation.
+		for _, tok := range strings.FieldsFunc(strings.ToLower(s), func(r rune) bool {
+			return !unicode.IsLetter(r)
+		}) {
+			switch tok {
+			case "рад", "понял", "вы", "ваш", "ваши", "милый", "дорогой", "он", "его":
+				t.Errorf("%q uses %q", s, tok)
+			}
+		}
+	}
+}
+
+// An unrecognised key is read back verbatim rather than glossed into something
+// maven made up.
+func TestProfileUnknownKeyReadBackVerbatim(t *testing.T) {
+	now := behaviorNow()
+	p := BuildProfile(habitHistory("починил кран", time.Tuesday, 12, 0, 2, now), now)
+	if got := p.FormatOverallRU(); !strings.Contains(got, "починил кран") {
+		t.Errorf("got %q", got)
+	}
+}
+
+// A future-dated row is a clock problem, not a habit.
+func TestBuildProfileIgnoresFutureRows(t *testing.T) {
+	now := behaviorNow()
+	obs := habitHistory("water", time.Tuesday, 9, 0, 3, now.AddDate(0, 2, 0))
+	if p := BuildProfile(obs, now); len(p.All) != 0 {
+		t.Fatalf("future rows counted: %+v", p.All)
+	}
+}

internal/morning/plan.go

@@ -0,0 +1,165 @@
+package morning
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/kami/maven/internal/store"
+)
+
+// The day plan (Vikunja #128).
+//
+// It lives here, with the morning routine engine, because it is the same
+// question asked at a different scale: the routine knows what is still missing
+// from a window, the plan knows what the whole day holds. A parallel system
+// would have to re-read the same facts and re-decide what "today" means.
+//
+// It is pure, like the rest of this package: the daemon reads the calendar,
+// the reminders and the checklist facts, and BuildPlan puts them in order.
+//
+// It is also NOT a nag. A plan she can recite when asked is the whole feature;
+// nothing here fires, schedules or announces. Unprompted delivery stays with
+// the existing morning nudge and the dispatcher's policy.
+
+// PlanKind — where a plan line came from. It survives into the reply and the
+// web view because the three read differently: an event is something happening
+// to the owner, a reminder is something he asked for, a checklist item is
+// something he has not done yet.
+type PlanKind string
+
+const (
+	PlanEvent     PlanKind = "event"
+	PlanReminder  PlanKind = "reminder"
+	PlanChecklist PlanKind = "checklist"
+)
+
+// PlanEntry — one timed thing on the day, as the daemon read it out of the
+// store. Text is rendered verbatim; the plan does not rephrase.
+//
+// Uncertain marks provenance below a full-confidence read — a work meeting
+// relayed off a phone notification (#126). It travels through to the reply so
+// she hedges instead of reciting a guess as fact.
+type PlanEntry struct {
+	At        time.Time
+	Text      string
+	Kind      PlanKind
+	Uncertain bool
+}
+
+// Plan — the ordered day. Date is the calendar day it describes.
+type Plan struct {
+	Date  time.Time
+	Items []PlanEntry
+}
+
+// BuildPlan orders everything known about the day Now falls on: calendar
+// events, pending reminders, and one line per morning routine that still has
+// unfinished items.
+//
+// Entries outside that calendar day are dropped — a plan for today that
+// includes tomorrow's meeting is wrong in a way that is worse than terse.
+// Ordering is by time, then by kind, then by text, so the same day always reads
+// the same way.
+func BuildPlan(routines []Routine, facts map[string]store.Fact, events, reminders []PlanEntry, now time.Time) Plan {
+	y, m, d := now.Date()
+	dayStart := time.Date(y, m, d, 0, 0, 0, 0, now.Location())
+	dayEnd := dayStart.AddDate(0, 0, 1)
+
+	p := Plan{Date: dayStart}
+	for _, group := range [][]PlanEntry{events, reminders} {
+		for _, e := range group {
+			at := e.At.In(now.Location())
+			if at.Before(dayStart) || !at.Before(dayEnd) {
+				continue
+			}
+			if strings.TrimSpace(e.Text) == "" {
+				continue
+			}
+			e.At = at
+			p.Items = append(p.Items, e)
+		}
+	}
+	p.Items = append(p.Items, checklistEntries(routines, facts, now)...)
+
+	sort.SliceStable(p.Items, func(i, j int) bool {
+		a, b := p.Items[i], p.Items[j]
+		if !a.At.Equal(b.At) {
+			return a.At.Before(b.At)
+		}
+		if a.Kind != b.Kind {
+			return a.Kind < b.Kind
+		}
+		return a.Text < b.Text
+	})
+	return p
+}
+
+// checklistEntries renders one line per routine with work left in it, placed at
+// the routine's nudge time — where the checklist actually matters in the day.
+// A routine that does not apply today, is not in its window, or is already
+// complete contributes nothing: the plan says what is left, not what was done.
+func checklistEntries(routines []Routine, facts map[string]store.Fact, now time.Time) []PlanEntry {
+	var out []PlanEntry
+	for _, r := range routines {
+		st := Evaluate(r, facts, now)
+		if !st.Active || len(st.Missing) == 0 {
+			continue
+		}
+		labels := make([]string, 0, len(st.Missing))
+		for _, it := range st.Missing {
+			label := it.Label
+			if label == "" {
+				label = it.Key
+			}
+			labels = append(labels, label)
+		}
+		at := r.NudgeAt
+		if at == "" {
+			at = r.WindowEnd
+		}
+		when, ok := todayAt(at, now)
+		if !ok {
+			continue
+		}
+		out = append(out, PlanEntry{
+			At:   when,
+			Text: fmt.Sprintf("%s — осталось: %s", r.Name, strings.Join(labels, ", ")),
+			Kind: PlanChecklist,
+		})
+	}
+	return out
+}
+
+// After returns the part of the plan that has not happened yet — the answer to
+// "что дальше?" as opposed to "какие планы на сегодня?". The Date is kept, so an
+// empty result still knows which day it is empty for.
+func (p Plan) After(now time.Time) Plan {
+	out := Plan{Date: p.Date}
+	for _, it := range p.Items {
+		if it.At.Before(now) {
+			continue
+		}
+		out.Items = append(out.Items, it)
+	}
+	return out
+}
+
+// FormatRU renders the plan as maven says it. Feminine self-reference,
+// informal address, no pet names — and no exhortation: she reads the day back,
+// she does not tell him to get on with it.
+func (p Plan) FormatRU() string {
+	if len(p.Items) == 0 {
+		return fmt.Sprintf("на %s ничего не запланировано.", p.Date.Format("02.01.2006"))
+	}
+	parts := make([]string, len(p.Items))
+	for i, it := range p.Items {
+		line := fmt.Sprintf("%s — %s", it.At.Format("15:04"), it.Text)
+		if it.Uncertain {
+			line = "похоже, " + line
+		}
+		parts[i] = line
+	}
+	return fmt.Sprintf("план на %s: %s.", p.Date.Format("02.01.2006"), strings.Join(parts, "; "))
+}

internal/morning/plan_test.go

@@ -0,0 +1,169 @@
+package morning
+
+import (
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/store"
+)
+
+// planAt is at() for the plan tests' day (2026-08-03, a Monday); the existing
+// at() in morning_test.go is pinned to a different date.
+func planAt(now time.Time, hh, mm int) time.Time {
+	y, m, d := now.Date()
+	return time.Date(y, m, d, hh, mm, 0, 0, now.Location())
+}
+
+func planFixture(t *testing.T) (Plan, time.Time) {
+	t.Helper()
+	now := time.Date(2026, 8, 3, 9, 0, 0, 0, time.UTC)
+	routines := []Routine{{
+		Name:        "утро",
+		WindowStart: "07:00",
+		WindowEnd:   "11:00",
+		NudgeAt:     "10:30",
+		Items: []Item{
+			{Key: "water", FactKey: "drank_water", Label: "выпить воды"},
+			{Key: "pills", FactKey: "took_pills", Label: "витамины"},
+		},
+	}}
+	facts := map[string]store.Fact{
+		"drank_water": {Ts: planAt(now, 8, 0)},
+	}
+	events := []PlanEntry{
+		{At: planAt(now, 14, 0), Text: "Планёрка @ 14:00-14:30", Kind: PlanEvent, Uncertain: true},
+		{At: planAt(now, 10, 0), Text: "Standup @ 10:00-10:30", Kind: PlanEvent},
+	}
+	reminders := []PlanEntry{
+		{At: planAt(now, 18, 30), Text: "позвонить маме", Kind: PlanReminder},
+	}
+	return BuildPlan(routines, facts, events, reminders, now), now
+}
+
+func TestBuildPlanOrdersTheDay(t *testing.T) {
+	p, now := planFixture(t)
+
+	if !p.Date.Equal(planAt(now, 0, 0)) {
+		t.Errorf("Date = %v, want midnight of now's day", p.Date)
+	}
+	want := []struct {
+		hhmm string
+		kind PlanKind
+	}{
+		{"10:00", PlanEvent},
+		{"10:30", PlanChecklist},
+		{"14:00", PlanEvent},
+		{"18:30", PlanReminder},
+	}
+	if len(p.Items) != len(want) {
+		t.Fatalf("got %d items, want %d: %+v", len(p.Items), len(want), p.Items)
+	}
+	for i, w := range want {
+		if got := p.Items[i].At.Format("15:04"); got != w.hhmm {
+			t.Errorf("item %d at %s, want %s", i, got, w.hhmm)
+		}
+		if p.Items[i].Kind != w.kind {
+			t.Errorf("item %d kind %q, want %q", i, p.Items[i].Kind, w.kind)
+		}
+	}
+}
+
+// The checklist line says what is LEFT. An item already evidenced today must
+// not be read back as outstanding.
+func TestBuildPlanChecklistListsOnlyMissing(t *testing.T) {
+	p, _ := planFixture(t)
+	var line string
+	for _, it := range p.Items {
+		if it.Kind == PlanChecklist {
+			line = it.Text
+		}
+	}
+	if line == "" {
+		t.Fatal("no checklist line in the plan")
+	}
+	if !strings.Contains(line, "витамины") {
+		t.Errorf("missing item not listed: %q", line)
+	}
+	if strings.Contains(line, "выпить воды") {
+		t.Errorf("a completed item must not be read back as outstanding: %q", line)
+	}
+	if !strings.HasPrefix(line, "утро — осталось:") {
+		t.Errorf("line = %q", line)
+	}
+}
+
+func TestBuildPlanSkipsCompleteAndInactiveRoutines(t *testing.T) {
+	now := time.Date(2026, 8, 3, 9, 0, 0, 0, time.UTC)
+	routines := []Routine{
+		{
+			Name: "утро", WindowStart: "07:00", WindowEnd: "11:00",
+			Items: []Item{{Key: "water", FactKey: "drank_water", Label: "выпить воды"}},
+		},
+		{
+			// Not in its window at 09:00.
+			Name: "вечер", WindowStart: "20:00", WindowEnd: "23:00",
+			Items: []Item{{Key: "walk", FactKey: "walked", Label: "прогулка"}},
+		},
+	}
+	facts := map[string]store.Fact{"drank_water": {Ts: planAt(now, 8, 0)}}
+	p := BuildPlan(routines, facts, nil, nil, now)
+	if len(p.Items) != 0 {
+		t.Fatalf("a complete routine and an out-of-window one must contribute nothing: %+v", p.Items)
+	}
+	if got, want := p.FormatRU(), "на 03.08.2026 ничего не запланировано."; got != want {
+		t.Errorf("got  %q\nwant %q", got, want)
+	}
+}
+
+// A plan for today that includes tomorrow's meeting is worse than terse.
+func TestBuildPlanDropsOtherDays(t *testing.T) {
+	now := time.Date(2026, 8, 3, 9, 0, 0, 0, time.UTC)
+	events := []PlanEntry{
+		{At: planAt(now, 10, 0), Text: "today", Kind: PlanEvent},
+		{At: planAt(now, 10, 0).AddDate(0, 0, 1), Text: "tomorrow", Kind: PlanEvent},
+		{At: planAt(now, 10, 0).AddDate(0, 0, -1), Text: "yesterday", Kind: PlanEvent},
+		{At: planAt(now, 12, 0), Text: "  ", Kind: PlanEvent},
+	}
+	p := BuildPlan(nil, nil, events, nil, now)
+	if len(p.Items) != 1 || p.Items[0].Text != "today" {
+		t.Fatalf("got %+v", p.Items)
+	}
+}
+
+func TestPlanFormatRU(t *testing.T) {
+	p, _ := planFixture(t)
+	got := p.FormatRU()
+	want := "план на 03.08.2026: 10:00 — Standup @ 10:00-10:30; " +
+		"10:30 — утро — осталось: витамины; " +
+		"похоже, 14:00 — Планёрка @ 14:00-14:30; " +
+		"18:30 — позвонить маме."
+	if got != want {
+		t.Errorf("got  %q\nwant %q", got, want)
+	}
+	// Persona: she recites, she does not exhort, and she never speaks of
+	// herself in the masculine or addresses him formally.
+	for _, bad := range []string{"рад ", "понял", "вы ", "ваш", "милый", "дорогой", "давай же", "не забудь"} {
+		if strings.Contains(strings.ToLower(got), bad) {
+			t.Errorf("plan text contains %q: %q", bad, got)
+		}
+	}
+}
+
+func TestPlanAfter(t *testing.T) {
+	p, now := planFixture(t)
+	rest := p.After(planAt(now, 11, 0))
+	if len(rest.Items) != 2 {
+		t.Fatalf("got %d items, want the 14:00 and 18:30 ones: %+v", len(rest.Items), rest.Items)
+	}
+	if !rest.Date.Equal(p.Date) {
+		t.Error("After must keep the date, so an empty rest-of-day still knows which day")
+	}
+	empty := p.After(planAt(now, 23, 0))
+	if len(empty.Items) != 0 {
+		t.Errorf("got %+v", empty.Items)
+	}
+	if !strings.Contains(empty.FormatRU(), "ничего не запланировано") {
+		t.Errorf("empty plan reads %q", empty.FormatRU())
+	}
+}

internal/router/calendar.go

@@ -4,16 +4,112 @@ import (
 	"fmt"
 	"strings"
 	"time"
+	"unicode"
 )
 
 // CalendarEventFormatter formats calendar events into a Russian reply string.
 type CalendarEventFormatter struct{}
 
-// Format returns a Russian reply for the given calendar events on the given date.
+// CalendarEntry — one event to recite. Uncertain marks an event maven did not
-func (CalendarEventFormatter) Format(events []string, date time.Time) string {
+// read off a calendar server: the work calendar arrives as relayed phone
+// notifications (Vikunja #126), stored below full confidence, and she says so
+// rather than reciting a guess as fact.
+type CalendarEntry struct {
+	Text      string
+	Uncertain bool
+}
+
+// dayPlanWords — the tokens that ask for the day as a whole rather than for a
+// calendar listing. Whole words, not substrings: "планёрка" is a MEETING, and a
+// notification about one must not be mistaken for a request for the plan.
+var dayPlanWords = []string{
+	"план", "плана", "плану", "плане", "планом",
+	"планы", "планов", "планам", "планах",
+	"расписание", "расписании", "распорядок", "распорядке",
+	"plan", "plans", "schedule", "agenda",
+}
+
+// otherDayWords — a day that is not today. The plan is built for the clock's
+// own day only, so an utterance naming another one belongs to the calendar
+// listing instead. Claiming it here would answer the wrong day, which is worse
+// than answering more tersely.
+var otherDayWords = []string{
+	"завтра", "послезавтра", "вчера", "позавчера",
+	"tomorrow", "yesterday",
+}
+
+// IsDayPlanQuery reports whether an utterance asks for today's plan (Vikunja
+// #128) — "какие планы на сегодня?", "что у меня по плану?", "что дальше?".
+//
+// Deliberately narrow. The calendar listing already answers "что у меня
+// сегодня?" and a plan that hijacks every date-bearing question would bury the
+// events under checklist lines. Only a plan-shaped ask, and only about today.
+func IsDayPlanQuery(text string) bool {
+	toks := planTokens(text)
+	for _, t := range toks {
+		for _, w := range otherDayWords {
+			if t == w {
+				return false
+			}
+		}
+	}
+	for _, t := range toks {
+		for _, w := range dayPlanWords {
+			if t == w {
+				return true
+			}
+		}
+	}
+	// "что дальше?" / "what's next?" — the rest of the day, with no plan word
+	// in it. Both tokens rather than adjacency, because "what's" splits into
+	// "what" and "s" and because "и что потом дальше" is the same question.
+	return (hasTok(toks, "что") && hasTok(toks, "дальше")) ||
+		(hasTok(toks, "what") && hasTok(toks, "next"))
+}
+
+func hasTok(toks []string, w string) bool {
+	for _, t := range toks {
+		if t == w {
+			return true
+		}
+	}
+	return false
+}
+
+// planTokens lowercases and splits on everything that is not a letter or a
+// digit, so "планы?" and "что-дальше" tokenize like the plain words do.
+func planTokens(text string) []string {
+	return strings.FieldsFunc(strings.ToLower(text), func(r rune) bool {
+		return !unicode.IsLetter(r) && !unicode.IsDigit(r)
+	})
+}
+
+// Format returns a Russian reply for the given calendar events on the given
+// date. Every event is treated as certain — use FormatEntries when provenance
+// differs between them.
+func (f CalendarEventFormatter) Format(events []string, date time.Time) string {
+	entries := make([]CalendarEntry, len(events))
+	for i, e := range events {
+		entries[i] = CalendarEntry{Text: e}
+	}
+	return f.FormatEntries(entries, date)
+}
+
+// FormatEntries returns a Russian reply, hedging the entries maven is not sure
+// about. "похоже" and not "возможно": the notification did arrive, what is
+// uncertain is whether it describes the meeting correctly.
+func (CalendarEventFormatter) FormatEntries(entries []CalendarEntry, date time.Time) string {
 	dateStr := date.Format("02.01.2006")
-	if len(events) == 0 {
+	if len(entries) == 0 {
 		return fmt.Sprintf("на %s ничего нет.", dateStr)
 	}
-	return fmt.Sprintf("на %s: %s", dateStr, strings.Join(events, "; "))
+	parts := make([]string, len(entries))
+	for i, e := range entries {
+		if e.Uncertain {
+			parts[i] = "похоже, " + e.Text
+			continue
+		}
+		parts[i] = e.Text
+	}
+	return fmt.Sprintf("на %s: %s", dateStr, strings.Join(parts, "; "))
 }

internal/router/calendar_test.go

@@ -24,3 +24,60 @@ func TestCalendarEventFormatter(t *testing.T) {
 		t.Errorf("multiple: got %q", got)
 	}
 }
+
+func TestCalendarEventFormatterHedgesUncertainEntries(t *testing.T) {
+	f := CalendarEventFormatter{}
+	date := time.Date(2026, 7, 6, 0, 0, 0, 0, time.UTC)
+
+	// An event relayed off a phone notification is not a calendar read, and she
+	// says so instead of reciting a guess as fact.
+	got := f.FormatEntries([]CalendarEntry{
+		{Text: "Standup @ 10:00-10:30"},
+		{Text: "Планёрка @ 14:00-14:30", Uncertain: true},
+	}, date)
+	want := "на 06.07.2026: Standup @ 10:00-10:30; похоже, Планёрка @ 14:00-14:30"
+	if got != want {
+		t.Errorf("got  %q\nwant %q", got, want)
+	}
+
+	// Format is FormatEntries with everything certain.
+	if got := f.FormatEntries(nil, date); got != "на 06.07.2026 ничего нет." {
+		t.Errorf("empty: got %q", got)
+	}
+}
+
+func TestIsDayPlanQuery(t *testing.T) {
+	yes := []string{
+		"какие планы на сегодня?",
+		"что у меня по плану",
+		"расскажи план",
+		"мой распорядок на сегодня",
+		"расписание?",
+		"что дальше?",
+		"what's next",
+		"what is my plan today",
+	}
+	for _, s := range yes {
+		if !IsDayPlanQuery(s) {
+			t.Errorf("IsDayPlanQuery(%q) = false, want true", s)
+		}
+	}
+
+	no := []string{
+		// The calendar listing owns these.
+		"что у меня сегодня?",
+		"какие планы на завтра?",
+		"план на послезавтра",
+		"что было вчера",
+		// "планёрка" is a meeting, not a request for the plan.
+		"когда планёрка?",
+		"запиши планёрку на 14:00",
+		"какая погода?",
+		"",
+	}
+	for _, s := range no {
+		if IsDayPlanQuery(s) {
+			t.Errorf("IsDayPlanQuery(%q) = true, want false", s)
+		}
+	}
+}

internal/router/habit.go

@@ -0,0 +1,73 @@
+package router
+
+import "time"
+
+// Habit queries — "что я обычно делаю по вторникам?" (Vikunja #254).
+//
+// Deterministic matching, like the calendar and plan matchers: the LLM router
+// classifies the intent, but WHICH weekday was asked about is a lookup, not a
+// generation. A model that answers "по вторникам" for a question about Thursday
+// gives a confidently wrong account of the owner's own life.
+
+// HabitQuery — a parsed "what do I usually do" question. Weekday is set only
+// when the utterance names one; otherwise the answer covers the whole week.
+type HabitQuery struct {
+	Weekday    time.Weekday
+	HasWeekday bool
+}
+
+// habitMarkers — the words that make a question about habit rather than about
+// today. Without one of these, "что я делаю" is a question about right now, and
+// the recall path owns it.
+var habitMarkers = []string{
+	"обычно", "обычное", "чаще", "постоянно", "привычки", "привычка", "привычках",
+	"регулярно", "каждый", "каждую", "каждое", "usually", "habits", "habit",
+	"typically", "normally",
+}
+
+// weekdayWords — every form of a weekday name maven needs to recognise,
+// including the "по …ам" plural the question is usually phrased in.
+var weekdayWords = map[string]time.Weekday{
+	"понедельник": time.Monday, "понедельникам": time.Monday,
+	"вторник": time.Tuesday, "вторникам": time.Tuesday,
+	"среда": time.Wednesday, "среду": time.Wednesday, "средам": time.Wednesday,
+	"четверг": time.Thursday, "четвергам": time.Thursday,
+	"пятница": time.Friday, "пятницу": time.Friday, "пятницам": time.Friday,
+	"суббота": time.Saturday, "субботу": time.Saturday, "субботам": time.Saturday,
+	"воскресенье": time.Sunday, "воскресеньям": time.Sunday,
+	"monday": time.Monday, "mondays": time.Monday,
+	"tuesday": time.Tuesday, "tuesdays": time.Tuesday,
+	"wednesday": time.Wednesday, "wednesdays": time.Wednesday,
+	"thursday": time.Thursday, "thursdays": time.Thursday,
+	"friday": time.Friday, "fridays": time.Friday,
+	"saturday": time.Saturday, "saturdays": time.Saturday,
+	"sunday": time.Sunday, "sundays": time.Sunday,
+}
+
+// ParseHabitQuery reports whether an utterance asks what the owner usually
+// does, and on which weekday if it names one.
+//
+// A habit marker is required. "что я делаю в среду?" without one is a question
+// about this coming Wednesday — the calendar's job — and answering it with a
+// statistical average would be answering a different question.
+func ParseHabitQuery(text string) (HabitQuery, bool) {
+	toks := planTokens(text)
+	marked := false
+	for _, t := range toks {
+		for _, m := range habitMarkers {
+			if t == m {
+				marked = true
+				break
+			}
+		}
+	}
+	if !marked {
+		return HabitQuery{}, false
+	}
+	for _, t := range toks {
+		if wd, ok := weekdayWords[t]; ok {
+			return HabitQuery{Weekday: wd, HasWeekday: true}, true
+		}
+	}
+	return HabitQuery{}, true
+}

internal/router/habit_test.go

@@ -0,0 +1,45 @@
+package router
+
+import (
+	"testing"
+	"time"
+)
+
+func TestParseHabitQuery(t *testing.T) {
+	tests := []struct {
+		in    string
+		ok    bool
+		wd    time.Weekday
+		hasWD bool
+	}{
+		{"что я обычно делаю по вторникам?", true, time.Tuesday, true},
+		{"что я обычно делаю?", true, 0, false},
+		{"какие у меня привычки", true, 0, false},
+		{"что я каждую пятницу делаю", true, time.Friday, true},
+		{"what do i usually do on mondays?", true, time.Monday, true},
+		// No habit marker: this is a question about the coming Wednesday, and
+		// the calendar owns it. Answering with an average answers the wrong
+		// question.
+		{"что я делаю в среду?", false, 0, false},
+		{"что у меня сегодня?", false, 0, false},
+		{"какие планы на сегодня?", false, 0, false},
+		{"", false, 0, false},
+	}
+	for _, tt := range tests {
+		q, ok := ParseHabitQuery(tt.in)
+		if ok != tt.ok {
+			t.Errorf("ParseHabitQuery(%q) ok = %v, want %v", tt.in, ok, tt.ok)
+			continue
+		}
+		if !ok {
+			continue
+		}
+		if q.HasWeekday != tt.hasWD {
+			t.Errorf("ParseHabitQuery(%q) hasWeekday = %v, want %v", tt.in, q.HasWeekday, tt.hasWD)
+			continue
+		}
+		if q.HasWeekday && q.Weekday != tt.wd {
+			t.Errorf("ParseHabitQuery(%q) weekday = %v, want %v", tt.in, q.Weekday, tt.wd)
+		}
+	}
+}

internal/store/facts.go

@@ -6,7 +6,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
+
+	"github.com/kami/maven/internal/calendar"
 )
 
 // WriteFact appends a fact row. confidence must be 1.0 for taps and (0,1) for
@@ -79,17 +82,29 @@ func (s *Store) RecentFacts(ctx context.Context, n int) ([]Fact, error) {
 	return out, rows.Err()
 }
 
-// CalendarEvents returns caldav facts whose key date falls within [from, to).
+// CalendarEvents returns calendar facts whose key date falls within [from, to).
 // Calendar event keys have the format calendar_event_YYYYMMDD_<summary>.
+//
+// Every calendar source is included, not just the personal CalDAV poll: the work
+// calendar arrives as ambient:notif notifications (Vikunja #126) and belongs in
+// the same answer. The source stays on each Fact, along with its confidence, so
+// the caller can hedge a reading it did not get from a calendar server —
+// filtering by source here would have thrown that judgement away.
 func (s *Store) CalendarEvents(ctx context.Context, from, to time.Time) ([]Fact, error) {
-	prefixFrom := fmt.Sprintf("calendar_event_%s", from.Format("20060102"))
+	prefixFrom := calendar.KeyPrefixForDay(from)
-	prefixTo := fmt.Sprintf("calendar_event_%s", to.Format("20060102"))
+	prefixTo := calendar.KeyPrefixForDay(to)
+	sources := calendar.Sources()
+	args := make([]any, 0, len(sources)+2)
+	for _, src := range sources {
+		args = append(args, src)
+	}
+	args = append(args, prefixFrom, prefixTo)
 	rows, err := s.db.QueryContext(ctx, `
         SELECT id, ts, kind, key, value, source, confidence, voids_id
           FROM facts
-         WHERE source = 'poll:caldav'
+         WHERE source IN (`+placeholders(len(sources))+`)
            AND key >= ? AND key < ?
-         ORDER BY key`, prefixFrom, prefixTo)
+         ORDER BY key`, args...)
 	if err != nil {
 		return nil, fmt.Errorf("calendar events: %w", err)
 	}
@@ -254,3 +269,8 @@ func scanFact(r rowScanner) (Fact, error) {
 	f.VoidsID = voids
 	return f, nil
 }
+
+// placeholders renders n comma-separated SQL bind markers.
+func placeholders(n int) string {
+	return strings.TrimSuffix(strings.Repeat("?,", n), ",")
+}

internal/store/store_test.go

@@ -8,6 +8,8 @@ import (
 	"path/filepath"
 	"testing"
 	"time"
+
+	"github.com/kami/maven/internal/calendar"
 )
 
 func newTestStore(t *testing.T) *Store {
@@ -378,3 +380,47 @@ func TestCalendarEvents(t *testing.T) {
 		t.Fatalf("expected 0 events on July 8, got %d", len(events))
 	}
 }
+
+// The work calendar arrives as relayed phone notifications, not a CalDAV read
+// (Vikunja #126). Those events belong in the same day's answer, and their
+// provenance has to survive the query so the caller can hedge them.
+func TestCalendarEventsIncludesAmbientSource(t *testing.T) {
+	store := newTestStore(t)
+	defer store.Close()
+
+	ctx := context.Background()
+	day := time.Date(2026, 8, 3, 0, 0, 0, 0, time.UTC)
+
+	store.WriteFact(ctx, day.Add(10*time.Hour), KindEnv, "calendar_event_20260803_Aaa-personal",
+		`"Aaa personal @ 10:00-10:30"`, calendar.SourcePersonal, 1.0, sql.NullInt64{})
+	store.WriteFact(ctx, day.Add(14*time.Hour), KindEnv, "calendar_event_20260803_Bbb-work",
+		`"Bbb work @ 14:00-14:30"`, calendar.SourceAmbient, calendar.AmbientConfidence, sql.NullInt64{})
+	// A fact that merely looks like one must still be excluded by source.
+	store.WriteFact(ctx, day.Add(16*time.Hour), KindEnv, "calendar_event_20260803_Ccc-forged",
+		`"Ccc forged @ 16:00-16:30"`, "tap:voice", 1.0, sql.NullInt64{})
+
+	events, err := store.CalendarEvents(ctx, day, day.AddDate(0, 0, 1))
+	if err != nil {
+		t.Fatalf("CalendarEvents: %v", err)
+	}
+	if len(events) != 2 {
+		t.Fatalf("got %d events, want the personal and the ambient one: %+v", len(events), events)
+	}
+	bySource := map[string]Fact{}
+	for _, e := range events {
+		bySource[e.Source] = e
+	}
+	if _, ok := bySource[calendar.SourcePersonal]; !ok {
+		t.Error("the personal CalDAV event is missing")
+	}
+	amb, ok := bySource[calendar.SourceAmbient]
+	if !ok {
+		t.Fatal("the ambient work event is missing")
+	}
+	if amb.Confidence >= 1.0 {
+		t.Errorf("ambient confidence = %v, must stay below a calendar read's", amb.Confidence)
+	}
+	if _, ok := bySource["tap:voice"]; ok {
+		t.Error("a non-calendar source must not be read as a calendar event")
+	}
+}