Ship voice enrolment, and report recognition as blocked (#255)

Maven can now be told who someone is. She cannot yet tell who is speaking,
and this commit is careful to say so rather than pretend otherwise.

What works: profiles are enrolled from several deliberately recorded samples,
listed, and deleted. They live in the existing memory_vectors table under a
"speaker:" id prefix, so there is no migration; what that needed was a wider
interface than memory.Store, hence memory.Catalog with ByPrefix and Delete.
Delete is the load-bearing half — a voiceprint someone asked to be rid of has
to actually go, and a search-only store cannot do that. InMemoryStore.Insert
became an upsert by id to match what the persistent store already did.

What does not work, and why it is not faked: there is no speaker-embedding
model on this box. Sixteen ggufs in /mnt/hdd1/llms, all text; no ECAPA, no
x-vector, no titanet, no wespeaker, no .onnx anywhere under /mnt/hdd1. So
newSpeakerEmbedder returns nil, internal/speaker falls back to
speaker.Disabled, Identify answers ErrDisabled, and the daemon logs which
half is off at startup. The plan's "simple MFCC + GMM" floor is refused in
the package comment: MFCC cosine distance detects channel and loudness as
much as voice, and a biometric that is confidently wrong writes false claims
about named people into his memory. A bad floor is worse than none here.

Refused as well, and the reason is in enroll.go's doc comment: the plan asked
for unknown speakers to be enrolled on first interaction with a TTS "кто
это?". There is no request shape in the protocol that could express that.
Taking a biometric of whoever walks past the microphone does it to guests who
are not party to the exchange, and a synthesised question into a room is not
consent from whoever answers.

Authority: enrolment is AuthStepUp, because it is a deliberate sit-down act
that writes a biometric of a named person and never something done by voice
mid-conversation. Deletion is one rung lower at AuthWrite, deliberately
inverting the usual pattern — getting rid of a biometric must never be the
harder half. Listing is AuthRead and never returns the vectors themselves.

Off unless configured: no speaker block means the three methods answer
ErrUnknownMethod, so a default box has no wire path that takes a voiceprint.

make build and make test pass.

Vikunja #255

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TrVSBKe3RFDF4fGYKWYQnX

.gitignore

@@ -7,6 +7,8 @@
 /mavpoll
 /mavcaldav
 /mavwaked
+/mavmaild
+/mavupdate
 
 # Certs (private keys, don't commit)
 certs/
@@ -34,6 +36,10 @@ deps
 deploy/db_key.env
 # Deploy secret (telegram bot token + chat id) — never commit
 deploy/telegram.env
+# zenmoney API token, read by mavpoll (never in argv, never committed)
+deploy/zenmoney.token
+# IMAP password, read by mavmaild (never in argv, never committed)
+deploy/imap.password
 
 # Temp files
 /tmp/

CLAUDE.md

@@ -34,7 +34,7 @@ CGO daemons (`mavend`, `mavsttd`, `mavttsd`, `mavenclient`) need the vendored to
 and libs wired through the Makefile — **do not** call `go build` on them bare, use `make`:
 
 ```sh
-make build          # all 8 binaries
+make build          # all 9 binaries
 make build-web      # single daemon (pure-Go ones: web/waked/poll/caldav build without CGO)
 make test           # go test -race across ./internal/... ./cmd/... with CGO env set
 ```
@@ -62,6 +62,7 @@ Pure-Go packages (`router`, `memory`, `mavweb`, …) run under a plain `go test
 | `mavenclient` | Voice loop client (mic → stt → core → tts). |
 | `mavpoll` | Telegram long-poll reach. |
 | `mavcaldav` | CalDAV calendar sync. |
+| `mavmaild` | Mail reader (IMAP, read-only). Holds the IMAP password; core never sees it. |
 
 Daemons are wired socket-to-socket, not linked. `internal/ipc` is the client/server wire
 protocol; the config in `deploy/mavend.json` (with `${VAR}` env expansion from gitignored

Dockerfile

@@ -51,7 +51,8 @@ RUN go build -o /out/mavend    ./cmd/mavend    && \
     go build -o /out/mavttsd   ./cmd/mavttsd   && \
     go build -o /out/mavweb    ./cmd/mavweb    && \
     go build -o /out/mavpoll   ./cmd/mavpoll   && \
-    go build -o /out/mavcaldav ./cmd/mavcaldav
+    go build -o /out/mavcaldav ./cmd/mavcaldav && \
+    go build -o /out/mavmaild  ./cmd/mavmaild
 
 # llama.cpp Vulkan build — the phraser/router LFM engine (llama-server). Built
 # from source (not a prebuilt vendored blob) so the binary's glibc/GLIBCXX match

Makefile

@@ -20,7 +20,7 @@ PIPER_ESPEAK  := $(shell pwd)/deps/piper/espeak-ng-data
 
 all: build
 
-build: build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav
+build: build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav build-mail build-update
 
 build-stt:
 	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
@@ -50,6 +50,15 @@ build-poll:
 build-caldav:
 	$(GO) build $(GOFLAGS) -o mavcaldav ./cmd/mavcaldav/
 
+build-mail:
+	$(GO) build $(GOFLAGS) -o mavmaild ./cmd/mavmaild/
+
+# mavupdate is an operator CLI, not a daemon: nothing runs it but a human on the
+# box. It is built with the rest so a broken update path is caught by `make
+# build` rather than the first time it is needed.
+build-update:
+	$(GO) build $(GOFLAGS) -o mavupdate ./cmd/mavupdate/
+
 run-web: build-web
 	./mavweb -addr :9200 -voice 127.0.0.1:9100
 
@@ -185,4 +194,4 @@ download-embedder:
 	@echo '  sudo cp onnxruntime-linux-x64-1.15.1/lib/libonnxruntime.so* /usr/local/lib/'
 
 clean:
-	rm -f mavend mavenclient mavsttd mavttsd mavweb mavpoll mavcaldav mavwaked
+	rm -f mavend mavenclient mavsttd mavttsd mavweb mavpoll mavcaldav mavwaked mavmaild

cmd/mavcaldav/main.go

@@ -1,17 +1,24 @@
-// mavcaldav — the CalDAV poller module.
+// mavcaldav — the CalDAV module: reads calendars into facts, and renders
+// maven's own reminders back out to a calendar she owns.
 //
-// Polls a Radicale (or any CalDAV) server for today's events and writes
-// `facts (kind=env, source=poll:caldav)` through core's IPC socket.
-// Key-free, restart-free, fail-independent — crashes can't touch the
-// store key, worst case a stale calendar_busy fact until the next poll.
+// READ side (unchanged behaviour): polls a Radicale (or any CalDAV) server for
+// today's events and writes `facts (kind=env, source=poll:caldav)` through
+// core's IPC socket. Key-free, restart-free, fail-independent — crashes can't
+// touch the store key, worst case a stale calendar_busy fact until the next
+// poll. Two facts:
 //
-// Two facts written:
 //   - calendar_busy  ("true"/"false") — read by the loop gate to suppress
 //     nudges during meetings
 //   - calendar_event ("<summary> @ <start>-<end>") — per-event for query
 //
-// Append-only discipline: a fact is written only when its value CHANGED
-// vs the latest for that key+source.
+// Append-only discipline: a fact is written only when its value CHANGED vs the
+// latest for that key+source.
+//
+// RENDER side (Vikunja #127, off unless -render-url is given): publishes each
+// pending reminder as a single-event iCal resource in a collection maven owns.
+// The calendar is a view, sqlite is the store — see render.go. The render URL
+// must differ from the read URL, checked at startup, so the render target can
+// never be a calendar maven is only supposed to read.
 package main
 
 import (
@@ -27,6 +34,7 @@ import (
 	"syscall"
 	"time"
 
+	"github.com/kami/maven/internal/calendar"
 	"github.com/kami/maven/internal/ipc"
 )
 
@@ -43,6 +51,10 @@ func run(args []string) error {
 	url := fs.String("url", "", "CalDAV calendar URL, e.g. http://localhost:5232/kami/personal (required)")
 	user := fs.String("user", "", "CalDAV basic-auth username (required)")
 	pass := fs.String("pass", "", "CalDAV basic-auth password (required)")
+	renderURL := fs.String("render-url", "", "CalDAV collection maven publishes her own reminders to; empty disables rendering")
+	renderUser := fs.String("render-user", "", "basic-auth username for -render-url (defaults to -user)")
+	renderPass := fs.String("render-pass", "", "basic-auth password for -render-url (defaults to -pass)")
+	renderDur := fs.Duration("render-duration", calendar.DefaultReminderDuration, "how long a rendered reminder occupies")
 	interval := fs.Duration("interval", 5*time.Minute, "poll cadence")
 	timeout := fs.Duration("timeout", 10*time.Second, "per-request HTTP timeout")
 	if err := fs.Parse(args); err != nil {
@@ -54,6 +66,9 @@ func run(args []string) error {
 	if *url == "" || *user == "" || *pass == "" {
 		return fmt.Errorf("-url, -user, -pass are required")
 	}
+	if err := checkRenderTarget(*url, *renderURL); err != nil {
+		return err
+	}
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
@@ -64,16 +79,36 @@ func run(args []string) error {
 	}
 	defer core.Close()
 
+	hc := &http.Client{Timeout: *timeout}
 	p := &poller{
 		core: core,
-		http: &http.Client{Timeout: *timeout},
+		http: hc,
 		url:  strings.TrimRight(*url, "/"),
 		user: *user,
 		pass: *pass,
 	}
 
+	var rend *renderer
+	if *renderURL != "" {
+		ru, rp := *renderUser, *renderPass
+		if ru == "" {
+			ru = *user
+		}
+		if rp == "" {
+			rp = *pass
+		}
+		rend = newRenderer(core, hc, *renderURL, ru, rp, *renderDur)
+		log.Printf("mavcaldav: rendering reminders to %s", *renderURL)
+	}
+
 	log.Printf("mavcaldav: polling %s every %s", *url, *interval)
-	p.pollOnce(ctx) // fire immediately
+	tick := func() {
+		p.pollOnce(ctx)
+		if rend != nil {
+			rend.renderOnce(ctx)
+		}
+	}
+	tick() // fire immediately
 	t := time.NewTicker(*interval)
 	defer t.Stop()
 	for {
@@ -82,11 +117,30 @@ func run(args []string) error {
 			log.Printf("mavcaldav: bye")
 			return nil
 		case <-t.C:
-			p.pollOnce(ctx)
+			tick()
 		}
 	}
 }
 
+// checkRenderTarget refuses a render URL that is also a read URL. This is the
+// structural half of #127's "cannot write to your work calendar": the write
+// credential and the write URL are separate flags, and the one calendar maven
+// is known to only read is rejected as a target at startup rather than trusted
+// at runtime.
+func checkRenderTarget(readURL, renderURL string) error {
+	if renderURL == "" {
+		return nil
+	}
+	if sameCollection(readURL, renderURL) {
+		return fmt.Errorf("-render-url must differ from -url: maven renders into a calendar she owns, never into one she reads")
+	}
+	return nil
+}
+
+func sameCollection(a, b string) bool {
+	return strings.EqualFold(strings.TrimRight(a, "/"), strings.TrimRight(b, "/"))
+}
+
 type poller struct {
 	core ipc.CoreAPI
 	http *http.Client
@@ -95,12 +149,6 @@ type poller struct {
 	pass string
 }
 
-type icalEvent struct {
-	start   time.Time
-	end     time.Time
-	summary string
-}
-
 func (p *poller) pollOnce(ctx context.Context) {
 	now := time.Now()
 	events, err := p.fetchEvents(ctx, now)
@@ -109,38 +157,30 @@ func (p *poller) pollOnce(ctx context.Context) {
 		return
 	}
 
-	busy := false
-	for _, e := range events {
-		if !now.Before(e.start) && now.Before(e.end) {
-			busy = true
-			break
-		}
-	}
 	busyVal := "false"
-	if busy {
+	if calendar.Busy(events, now) {
 		busyVal = "true"
 	}
 
 	// Write calendar_busy on change.
-	if err := p.writeIfChanged(ctx, "calendar_busy", "poll:caldav", busyVal, now); err != nil {
+	if err := p.writeIfChanged(ctx, "calendar_busy", calendar.SourcePersonal, busyVal, now, 1.0); err != nil {
 		log.Printf("mavcaldav: write calendar_busy: %v", err)
 		return
 	}
 
-	// Write per-event facts (one per event, keyed by event summary + start).
+	// Write per-event facts (one per event, keyed by day + event summary).
 	// This lets the note RAG path answer "what's on my calendar" without
 	// reaching back to Radicale.
 	for _, e := range events {
-		val := fmt.Sprintf("%s @ %s-%s", e.summary, e.start.Format("15:04"), e.end.Format("15:04"))
-		eventKey := fmt.Sprintf("calendar_event_%s_%s", e.start.Format("20060102"), safeKey(e.summary))
-		if err := p.writeIfChanged(ctx, eventKey, "poll:caldav", val, e.start); err != nil {
-			log.Printf("mavcaldav: write %s: %v", eventKey, err)
+		key := calendar.FactKey(e)
+		if err := p.writeIfChanged(ctx, key, calendar.SourcePersonal, calendar.FactValue(e), e.Start, 1.0); err != nil {
+			log.Printf("mavcaldav: write %s: %v", key, err)
 		}
 	}
 }
 
 // fetchEvents GETs the calendar URL and parses VEVENTs from the iCal response.
-func (p *poller) fetchEvents(ctx context.Context, now time.Time) ([]icalEvent, error) {
+func (p *poller) fetchEvents(ctx context.Context, now time.Time) ([]calendar.Event, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, p.url, nil)
 	if err != nil {
 		return nil, err
@@ -162,120 +202,11 @@ func (p *poller) fetchEvents(ctx context.Context, now time.Time) ([]icalEvent, e
 		return nil, fmt.Errorf("GET %s: %s", p.url, resp.Status)
 	}
 
-	return parseICal(body, now), nil
-}
-
-// parseICal scans iCal text for VEVENT components. Returns events that overlap
-// with today (UTC day boundaries) to keep the response manageable.
-func parseICal(body []byte, now time.Time) []icalEvent {
-	todayStart := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, time.UTC)
-	todayEnd := todayStart.AddDate(0, 0, 1)
-
-	var events []icalEvent
-	text := string(body)
-	for {
-		veventStart := strings.Index(text, "BEGIN:VEVENT")
-		if veventStart < 0 {
-			break
-		}
-		text = text[veventStart+len("BEGIN:VEVENT"):]
-		veventEnd := strings.Index(text, "END:VEVENT")
-		if veventEnd < 0 {
-			break
-		}
-		block := text[:veventEnd]
-		text = text[veventEnd+len("END:VEVENT"):]
-
-		e := parseVEVENT(block)
-		if e == nil {
-			continue
-		}
-		// Only keep events overlapping today.
-		if e.end.After(todayStart) && e.start.Before(todayEnd) {
-			events = append(events, *e)
-		}
-	}
-	return events
-}
-
-// parseVEVENT extracts start, end, summary from a VEVENT block.
-// Supports both UTC (DTEND:20260703T100000Z) and local (DTSTART;TZID=...:...)
-// formats. Returns nil for all-day events (no DTSTART/DTEND time component) or
-// parse failures.
-func parseVEVENT(block string) *icalEvent {
-	var e icalEvent
-	lines := strings.Split(block, "\n")
-	for _, line := range lines {
-		line = strings.TrimSpace(line)
-		switch {
-		case strings.HasPrefix(line, "DTSTART"):
-			if t, ok := parseDT(line); ok {
-				e.start = t
-			}
-		case strings.HasPrefix(line, "DTEND"):
-			if t, ok := parseDT(line); ok {
-				e.end = t
-			}
-		case strings.HasPrefix(line, "SUMMARY"):
-			if idx := strings.Index(line, ":"); idx >= 0 {
-				e.summary = strings.TrimSpace(line[idx+1:])
-			}
-		}
-	}
-	if e.start.IsZero() || e.end.IsZero() {
-		return nil
-	}
-	return &e
-}
-
-// parseDT parses a DTSTART/DTEND value. Supports:
-//   - UTC: DTEND:20260703T100000Z
-//   - Local: DTSTART;TZID=Europe/Moscow:20260703T130000
-//   - Value-date (all-day): DTSTART;VALUE=DATE:20260703 (returns zero time)
-func parseDT(line string) (time.Time, bool) {
-	if strings.Contains(line, "VALUE=DATE:") {
-		return time.Time{}, false // all-day, skip
-	}
-	idx := strings.LastIndex(line, ":")
-	if idx < 0 {
-		return time.Time{}, false
-	}
-	val := line[idx+1:]
-	val = strings.TrimSuffix(val, "Z")
-
-	// Try UTC first (has Z suffix, or ended in Z before TrimSuffix).
-	if strings.HasSuffix(line, "Z") {
-		t, err := time.Parse("20060102T150405", val)
-		if err != nil {
-			return time.Time{}, false
-		}
-		return t.UTC(), true
-	}
-
-	// Local time — treat as UTC for simplicity (CalDAV server and poller
-	// run in the same timezone; the gate only needs busy/not-busy accuracy).
-	t, err := time.Parse("20060102T150405", val)
-	if err != nil {
-		return time.Time{}, false
-	}
-	return t.UTC(), true
-}
-
-// safeKey makes an event summary safe to use as a fact key (alphanumeric + dash).
-func safeKey(s string) string {
-	var b strings.Builder
-	for _, r := range s {
-		if (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || r == '-' {
-			b.WriteRune(r)
-		} else if r == ' ' || r == '_' {
-			b.WriteRune('-')
-		}
-	}
-	return b.String()
+	return calendar.ParseICalDay(body, now), nil
 }
 
 // writeIfChanged writes a fact only when the value differs from the latest.
-func (p *poller) writeIfChanged(ctx context.Context, key, source, val string, ts time.Time) error {
+func (p *poller) writeIfChanged(ctx context.Context, key, source, val string, ts time.Time, confidence float64) error {
 	prev, err := p.core.LatestFactBySource(ctx, key, source)
 	switch {
 	case err == nil && prev.Value == val:
@@ -289,7 +220,7 @@ func (p *poller) writeIfChanged(ctx context.Context, key, source, val string, ts
 		Key:        key,
 		Value:      val,
 		Source:     source,
-		Confidence: 1.0,
+		Confidence: confidence,
 	})
 	if err != nil {
 		return fmt.Errorf("write %s: %w", key, err)

cmd/mavcaldav/main_test.go

@@ -51,165 +51,6 @@ func (f *fakeCore) WriteFact(_ context.Context, req ipc.WriteFactReq) (int64, er
 	return int64(len(f.writeLog)), nil
 }
 
-// ---------------------------------------------------------------------------
-// Parsing tests
-// ---------------------------------------------------------------------------
-
-func TestParseICal(t *testing.T) {
-	now := time.Date(2026, 7, 3, 12, 0, 0, 0, time.UTC)
-
-	body := []byte(`BEGIN:VCALENDAR
-BEGIN:VEVENT
-DTSTART:20260703T090000Z
-DTEND:20260703T100000Z
-SUMMARY:Morning standup
-END:VEVENT
-BEGIN:VEVENT
-DTSTART:20260703T140000Z
-DTEND:20260703T150000Z
-SUMMARY:Team sync
-END:VEVENT
-BEGIN:VEVENT
-DTSTART:20260702T140000Z
-DTEND:20260702T150000Z
-SUMMARY:Yesterday retro
-END:VEVENT
-BEGIN:VEVENT
-DTSTART:20260704T090000Z
-DTEND:20260704T100000Z
-SUMMARY:Tomorrow standup
-END:VEVENT
-BEGIN:VEVENT
-DTSTART;VALUE=DATE:20260704
-DTEND;VALUE=DATE:20260705
-SUMMARY:All-day event
-END:VEVENT
-END:VCALENDAR`)
-
-	events := parseICal(body, now)
-
-	if len(events) != 2 {
-		t.Fatalf("got %d events, want 2 (today events, no all-day/past/future)", len(events))
-	}
-
-	// Morning standup — overlaps today.
-	if events[0].summary != "Morning standup" {
-		t.Errorf("events[0].summary = %q, want %q", events[0].summary, "Morning standup")
-	}
-	wantStart0 := time.Date(2026, 7, 3, 9, 0, 0, 0, time.UTC)
-	if !events[0].start.Equal(wantStart0) {
-		t.Errorf("events[0].start = %v, want %v", events[0].start, wantStart0)
-	}
-	wantEnd0 := time.Date(2026, 7, 3, 10, 0, 0, 0, time.UTC)
-	if !events[0].end.Equal(wantEnd0) {
-		t.Errorf("events[0].end = %v, want %v", events[0].end, wantEnd0)
-	}
-
-	// Team sync — overlaps today.
-	if events[1].summary != "Team sync" {
-		t.Errorf("events[1].summary = %q, want %q", events[1].summary, "Team sync")
-	}
-	wantStart1 := time.Date(2026, 7, 3, 14, 0, 0, 0, time.UTC)
-	if !events[1].start.Equal(wantStart1) {
-		t.Errorf("events[1].start = %v, want %v", events[1].start, wantStart1)
-	}
-	wantEnd1 := time.Date(2026, 7, 3, 15, 0, 0, 0, time.UTC)
-	if !events[1].end.Equal(wantEnd1) {
-		t.Errorf("events[1].end = %v, want %v", events[1].end, wantEnd1)
-	}
-}
-
-func TestParseVEVENT(t *testing.T) {
-	// Normal event with TZID in DTSTART and UTC DTEND.
-	block := "DTSTART;TZID=Europe/Moscow:20260703T130000\nDTEND:20260703T140000Z\nSUMMARY:Stand up meeting"
-	e := parseVEVENT(block)
-	if e == nil {
-		t.Fatal("expected non-nil icalEvent")
-	}
-	wantStart := time.Date(2026, 7, 3, 13, 0, 0, 0, time.UTC)
-	if !e.start.Equal(wantStart) {
-		t.Errorf("start = %v, want %v", e.start, wantStart)
-	}
-	wantEnd := time.Date(2026, 7, 3, 14, 0, 0, 0, time.UTC)
-	if !e.end.Equal(wantEnd) {
-		t.Errorf("end = %v, want %v", e.end, wantEnd)
-	}
-	if e.summary != "Stand up meeting" {
-		t.Errorf("summary = %q, want %q", e.summary, "Stand up meeting")
-	}
-
-	// All-day event (VALUE=DATE) → nil.
-	allDay := "DTSTART;VALUE=DATE:20260703\nDTEND;VALUE=DATE:20260704\nSUMMARY:All-day"
-	if e2 := parseVEVENT(allDay); e2 != nil {
-		t.Error("expected nil for all-day event")
-	}
-}
-
-func TestParseDT(t *testing.T) {
-	tests := []struct {
-		name   string
-		line   string
-		want   time.Time
-		wantOK bool
-	}{
-		{
-			name:   "UTC",
-			line:   "DTEND:20260703T100000Z",
-			want:   time.Date(2026, 7, 3, 10, 0, 0, 0, time.UTC),
-			wantOK: true,
-		},
-		{
-			name:   "local time",
-			line:   "DTSTART;TZID=Europe/Moscow:20260703T130000",
-			want:   time.Date(2026, 7, 3, 13, 0, 0, 0, time.UTC),
-			wantOK: true,
-		},
-		{
-			name:   "all-day",
-			line:   "DTSTART;VALUE=DATE:20260703",
-			want:   time.Time{},
-			wantOK: false,
-		},
-		{
-			name:   "invalid",
-			line:   "DTSTART:garbage",
-			want:   time.Time{},
-			wantOK: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, ok := parseDT(tt.line)
-			if ok != tt.wantOK {
-				t.Errorf("ok = %v, want %v", ok, tt.wantOK)
-			}
-			if !got.Equal(tt.want) {
-				t.Errorf("got = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-func TestSafeKey(t *testing.T) {
-	tests := []struct {
-		input string
-		want  string
-	}{
-		{"Stand up meeting", "Stand-up-meeting"},
-		{"Hello_World", "Hello-World"},
-		{"special@#$chars!!", "specialchars"},
-		{"ALL_CAPS_123", "ALL-CAPS-123"},
-	}
-
-	for _, tt := range tests {
-		got := safeKey(tt.input)
-		if got != tt.want {
-			t.Errorf("safeKey(%q) = %q, want %q", tt.input, got, tt.want)
-		}
-	}
-}
-
 // ---------------------------------------------------------------------------
 // Core logic tests
 // ---------------------------------------------------------------------------
@@ -221,7 +62,7 @@ func TestWriteIfChanged(t *testing.T) {
 	t.Run("no previous fact writes", func(t *testing.T) {
 		fc := &fakeCore{}
 		p := &poller{core: fc}
-		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now)
+		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now, 1.0)
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
@@ -249,7 +90,7 @@ func TestWriteIfChanged(t *testing.T) {
 			},
 		}
 		p := &poller{core: fc}
-		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now)
+		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now, 1.0)
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
@@ -265,7 +106,7 @@ func TestWriteIfChanged(t *testing.T) {
 			},
 		}
 		p := &poller{core: fc}
-		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "new", now)
+		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "new", now, 1.0)
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
@@ -280,7 +121,7 @@ func TestWriteIfChanged(t *testing.T) {
 	t.Run("read error other than ErrNoFact returns error", func(t *testing.T) {
 		fc := &fakeCore{readErr: fmt.Errorf("connection refused")}
 		p := &poller{core: fc}
-		err := p.writeIfChanged(ctx, "fail_key", "poll:caldav", "x", now)
+		err := p.writeIfChanged(ctx, "fail_key", "poll:caldav", "x", now, 1.0)
 		if err == nil {
 			t.Fatal("expected error, got nil")
 		}
@@ -292,7 +133,7 @@ func TestWriteIfChanged(t *testing.T) {
 			writeErr: fmt.Errorf("disk full"),
 		}
 		p := &poller{core: fc}
-		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now)
+		err := p.writeIfChanged(ctx, "test_key", "poll:caldav", "hello", now, 1.0)
 		if err == nil {
 			t.Fatal("expected error, got nil")
 		}

cmd/mavcaldav/render.go

@@ -0,0 +1,145 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/kami/maven/internal/calendar"
+	"github.com/kami/maven/internal/ipc"
+)
+
+// renderer is the write half of maven's own local calendar (Vikunja #127).
+//
+// It is a RENDER TARGET, not a store. sqlite stays canonical: every tick the
+// renderer reads the pending reminders out of core and publishes each one as a
+// single-event iCal resource in a CalDAV collection maven owns. Nothing is ever
+// read back from that collection, and losing it costs nothing — the next tick
+// rebuilds it.
+//
+// It structurally cannot write to a calendar maven only reads. The URL comes
+// from its own flag, checked at startup against every read URL (see
+// run in main.go), and the only paths it ever addresses carry
+// calendar.ReminderUIDPrefix — so even pointed at the wrong collection it can
+// only touch resources it created.
+type renderer struct {
+	core ipc.CoreAPI
+	http *http.Client
+	url  string
+	user string
+	pass string
+	dur  time.Duration
+
+	// published maps reminder id → the body last successfully PUT, so an
+	// unchanged reminder costs nothing. Purely an optimisation: a restart
+	// re-publishes every reminder once, which is idempotent.
+	published map[int64]string
+}
+
+func newRenderer(core ipc.CoreAPI, hc *http.Client, url, user, pass string, dur time.Duration) *renderer {
+	return &renderer{
+		core:      core,
+		http:      hc,
+		url:       strings.TrimRight(url, "/"),
+		user:      user,
+		pass:      pass,
+		dur:       dur,
+		published: make(map[int64]string),
+	}
+}
+
+// renderOnce publishes every pending reminder and withdraws the ones that are
+// no longer pending. Errors are logged and skipped: a calendar maven cannot
+// reach must never break the reminder itself, which lives in sqlite.
+func (r *renderer) renderOnce(ctx context.Context) {
+	reminders, err := r.core.ListReminders(ctx, renderMaxReminders)
+	if err != nil {
+		log.Printf("mavcaldav: list reminders: %v", err)
+		return
+	}
+
+	live := make(map[int64]bool, len(reminders))
+	for _, rem := range reminders {
+		if rem.Status != "pending" {
+			continue
+		}
+		live[rem.ID] = true
+		e := calendar.ReminderEvent(rem.ID, fireTime(rem), rem.Payload, r.dur)
+		body := calendar.RenderICal([]calendar.Event{e})
+		if r.published[rem.ID] == body {
+			continue
+		}
+		if err := r.put(ctx, calendar.ReminderPath(rem.ID), body); err != nil {
+			log.Printf("mavcaldav: render reminder %d: %v", rem.ID, err)
+			continue
+		}
+		r.published[rem.ID] = body
+		log.Printf("mavcaldav: rendered reminder %d (%s)", rem.ID, e.Summary)
+	}
+
+	for id := range r.published {
+		if live[id] {
+			continue
+		}
+		if err := r.delete(ctx, calendar.ReminderPath(id)); err != nil {
+			log.Printf("mavcaldav: withdraw reminder %d: %v", id, err)
+			continue
+		}
+		delete(r.published, id)
+		log.Printf("mavcaldav: withdrew reminder %d", id)
+	}
+}
+
+// renderMaxReminders bounds the read. Reminders past this count are older than
+// anything a calendar view is useful for.
+const renderMaxReminders = 200
+
+// fireTime prefers NextFireTs — for a recurring reminder that is the occurrence
+// worth showing; FireTs is the original statement.
+func fireTime(rem ipc.Reminder) time.Time {
+	if !rem.NextFireTs.IsZero() {
+		return rem.NextFireTs
+	}
+	return rem.FireTs
+}
+
+func (r *renderer) put(ctx context.Context, name, body string) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodPut, r.url+"/"+name, strings.NewReader(body))
+	if err != nil {
+		return err
+	}
+	req.SetBasicAuth(r.user, r.pass)
+	req.Header.Set("Content-Type", "text/calendar; charset=utf-8")
+	return r.do(req, name)
+}
+
+func (r *renderer) delete(ctx context.Context, name string) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodDelete, r.url+"/"+name, nil)
+	if err != nil {
+		return err
+	}
+	req.SetBasicAuth(r.user, r.pass)
+	return r.do(req, name)
+}
+
+// do runs the request and treats any 2xx, plus 404 on a DELETE, as success —
+// a resource that is already gone is the state the caller wanted.
+func (r *renderer) do(req *http.Request, name string) error {
+	resp, err := r.http.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	io.Copy(io.Discard, io.LimitReader(resp.Body, 1<<16))
+	switch {
+	case resp.StatusCode >= 200 && resp.StatusCode < 300:
+		return nil
+	case req.Method == http.MethodDelete && resp.StatusCode == http.StatusNotFound:
+		return nil
+	}
+	return fmt.Errorf("%s %s: %s", req.Method, name, resp.Status)
+}

cmd/mavcaldav/render_test.go

@@ -0,0 +1,186 @@
+package main
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/ipc"
+)
+
+// reminderCore is a fakeCore that also answers ListReminders.
+type reminderCore struct {
+	fakeCore
+	reminders []ipc.Reminder
+	listErr   error
+}
+
+func (c *reminderCore) ListReminders(context.Context, int) ([]ipc.Reminder, error) {
+	if c.listErr != nil {
+		return nil, c.listErr
+	}
+	return c.reminders, nil
+}
+
+// calSrv records what a CalDAV collection received.
+type calSrv struct {
+	mu     sync.Mutex
+	puts   map[string]string
+	dels   []string
+	status int
+	*httptest.Server
+}
+
+func newCalSrv() *calSrv {
+	s := &calSrv{puts: map[string]string{}, status: http.StatusCreated}
+	s.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		body, _ := io.ReadAll(r.Body)
+		s.mu.Lock()
+		defer s.mu.Unlock()
+		switch r.Method {
+		case http.MethodPut:
+			s.puts[strings.TrimPrefix(r.URL.Path, "/cal/")] = string(body)
+		case http.MethodDelete:
+			s.dels = append(s.dels, strings.TrimPrefix(r.URL.Path, "/cal/"))
+		}
+		w.WriteHeader(s.status)
+	}))
+	return s
+}
+
+func (s *calSrv) putCount() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return len(s.puts)
+}
+
+func TestRenderOncePublishesPendingReminders(t *testing.T) {
+	fire := time.Date(2026, 8, 1, 18, 30, 0, 0, time.UTC)
+	srv := newCalSrv()
+	defer srv.Close()
+
+	core := &reminderCore{reminders: []ipc.Reminder{
+		{ID: 7, FireTs: fire, Payload: "позвонить маме", Status: "pending"},
+		{ID: 8, FireTs: fire, Payload: "уже сделано", Status: "fired"},
+		{ID: 9, FireTs: fire, Payload: "отменено", Status: "cancelled"},
+	}}
+	r := newRenderer(core, srv.Client(), srv.URL+"/cal/", "u", "p", 0)
+	r.renderOnce(context.Background())
+
+	srv.mu.Lock()
+	body, ok := srv.puts["maven-reminder-7.ics"]
+	n := len(srv.puts)
+	srv.mu.Unlock()
+
+	if n != 1 {
+		t.Fatalf("expected exactly the pending reminder to be published, got %d PUTs", n)
+	}
+	if !ok {
+		t.Fatal("pending reminder 7 was not published")
+	}
+	if !strings.Contains(body, "SUMMARY:позвонить маме") {
+		t.Errorf("payload missing from rendered body:\n%s", body)
+	}
+	if !strings.Contains(body, "UID:maven-reminder-7") {
+		t.Errorf("UID missing from rendered body:\n%s", body)
+	}
+}
+
+func TestRenderOnceSkipsUnchanged(t *testing.T) {
+	srv := newCalSrv()
+	defer srv.Close()
+	core := &reminderCore{reminders: []ipc.Reminder{
+		{ID: 1, FireTs: time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC), Payload: "выпить воды", Status: "pending"},
+	}}
+	r := newRenderer(core, srv.Client(), srv.URL+"/cal", "u", "p", 0)
+	r.renderOnce(context.Background())
+	r.renderOnce(context.Background())
+	if got := srv.putCount(); got != 1 {
+		t.Fatalf("an unchanged reminder was re-published: %d distinct PUTs", got)
+	}
+}
+
+func TestRenderOnceWithdrawsResolvedReminders(t *testing.T) {
+	srv := newCalSrv()
+	defer srv.Close()
+	core := &reminderCore{reminders: []ipc.Reminder{
+		{ID: 5, FireTs: time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC), Payload: "встреча", Status: "pending"},
+	}}
+	r := newRenderer(core, srv.Client(), srv.URL+"/cal", "u", "p", 0)
+	r.renderOnce(context.Background())
+
+	core.reminders[0].Status = "fired"
+	r.renderOnce(context.Background())
+
+	srv.mu.Lock()
+	dels := append([]string(nil), srv.dels...)
+	srv.mu.Unlock()
+	if len(dels) != 1 || dels[0] != "maven-reminder-5.ics" {
+		t.Fatalf("resolved reminder was not withdrawn: %v", dels)
+	}
+	if len(r.published) != 0 {
+		t.Errorf("published map still holds %v", r.published)
+	}
+}
+
+// A calendar maven cannot reach must never break anything: sqlite is canonical.
+func TestRenderOnceSurvivesServerErrors(t *testing.T) {
+	srv := newCalSrv()
+	srv.status = http.StatusInternalServerError
+	defer srv.Close()
+	core := &reminderCore{reminders: []ipc.Reminder{
+		{ID: 1, FireTs: time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC), Payload: "x", Status: "pending"},
+	}}
+	r := newRenderer(core, srv.Client(), srv.URL+"/cal", "u", "p", 0)
+	r.renderOnce(context.Background())
+	if len(r.published) != 0 {
+		t.Error("a failed PUT must not be recorded as published, or it never retries")
+	}
+}
+
+func TestRenderOnceUsesNextFireForRecurring(t *testing.T) {
+	srv := newCalSrv()
+	defer srv.Close()
+	next := time.Date(2026, 8, 2, 7, 0, 0, 0, time.UTC)
+	core := &reminderCore{reminders: []ipc.Reminder{{
+		ID:         3,
+		FireTs:     time.Date(2026, 8, 1, 7, 0, 0, 0, time.UTC),
+		NextFireTs: next,
+		Payload:    "зарядка",
+		Status:     "pending",
+		Cron:       "0 7 * * *",
+	}}}
+	r := newRenderer(core, srv.Client(), srv.URL+"/cal", "u", "p", 0)
+	r.renderOnce(context.Background())
+
+	srv.mu.Lock()
+	body := srv.puts["maven-reminder-3.ics"]
+	srv.mu.Unlock()
+	if !strings.Contains(body, "DTSTART:20260802T070000Z") {
+		t.Errorf("recurring reminder should render its next occurrence:\n%s", body)
+	}
+}
+
+func TestCheckRenderTargetRefusesTheCalendarItReads(t *testing.T) {
+	read := "http://localhost:5232/kami/personal"
+	if err := checkRenderTarget(read, ""); err != nil {
+		t.Fatalf("rendering off must be fine: %v", err)
+	}
+	if err := checkRenderTarget(read, "http://localhost:5232/kami/maven"); err != nil {
+		t.Fatalf("a distinct collection must be accepted: %v", err)
+	}
+	if err := checkRenderTarget(read, read); err == nil {
+		t.Error("rendering into the read calendar must be refused")
+	}
+	if err := checkRenderTarget(read, read+"/"); err == nil {
+		t.Error("a trailing slash must not defeat the check")
+	}
+	if err := checkRenderTarget(read, strings.ToUpper(read)); err == nil {
+		t.Error("case must not defeat the check")
+	}
+}

cmd/mavend/actions_act.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"log"
 
+	"github.com/kami/maven/internal/mcp"
 	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/tool"
 )
@@ -52,6 +53,12 @@ func (h *reactiveHandler) actionAct(ctx context.Context, dec router.Decision) st
 			return "выполнить «" + phrase + "»? скажи «да» или «нет»."
 		case errors.Is(err, tool.ErrNotEnabled):
 			return h.proposeGap(ctx, dec)
+		case errors.Is(err, mcp.ErrNeedsArgs):
+			// An MCP tool that wants named arguments a spoken verb cannot
+			// supply. Guessing them would be a wrong act, so she says so
+			// instead — the tool is still runnable from the authed surface,
+			// where a human types them.
+			return "этому инструменту нужны аргументы, которые я из голоса не соберу — я не буду угадывать."
 		}
 		log.Printf("voice: tool %s: %v", dec.Slots.Fn, err)
 		if out != "" {

cmd/mavend/actions_money.go

@@ -0,0 +1,78 @@
+package main
+
+import (
+	"context"
+	"log"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/zenmoney"
+)
+
+// Money questions (Vikunja #125).
+//
+// This is the whole read side: mavpoll holds the zenmoney token and writes
+// facts(kind=env, source=poll:zenmoney); core reads them back when he asks.
+// Core never sees the token, never calls zenmoney, and has no rule on these
+// keys — a total is never a reason for Maven to speak first. Maven is not a
+// nag, least of all about his money.
+//
+// Nothing here can reach the external search capability: the figures are read
+// from the store and rendered locally, and his financial data is never search
+// input.
+
+// queryMoney — "сколько я потратил сегодня?", "покажи мои траты".
+//
+// Answers only from the latest fact the poller wrote. Three honest outcomes and
+// no fourth: the figure, "the fact is old and here is its date", or "money
+// tracking is not connected". It never computes, estimates or rounds a total of
+// its own — an invented number about his money is the worst thing this could do.
+func (h *reactiveHandler) queryMoney(ctx context.Context, t *queryTurn) (string, bool) {
+	window, ok := router.ParseMoneyQuery(t.dec.Utterance)
+	if !ok {
+		return "", false
+	}
+	key, phrase := zenmoney.KeySpentMonth, "в этом месяце"
+	if window == router.MoneyToday {
+		key, phrase = zenmoney.KeySpentToday, "сегодня"
+	}
+	fact, err := h.api.LatestFactBySource(ctx, key, zenmoney.Source)
+	if err != nil {
+		// No fact at all is the normal state when the capability is off. Claim
+		// the turn anyway: falling through to recall would answer a question
+		// about money with whatever note happens to be nearest.
+		if !isNoFactErr(err) {
+			log.Printf("voice: money fact: %v", err)
+		}
+		return "я не отслеживаю траты — не подключено.", true
+	}
+	val, err := zenmoney.ParseFactValue(fact.Value)
+	if err != nil {
+		log.Printf("voice: money fact: decode: %v", err)
+		return "не получилось прочитать траты.", true
+	}
+	reply := val.FormatRU(phrase)
+	if reply == "" {
+		return "по тратам пока нечего сказать.", true
+	}
+	// A stale fact is reported as stale rather than spoken as today's number.
+	if h.now().Sub(fact.Ts) > zenmoney.StaleAfter {
+		return "данные от " + fact.Ts.Local().Format("02.01") + ": " + reply, true
+	}
+	return reply, true
+}
+
+// isNoFactErr — ErrNoFact survives the wire wrapped, so unwrap for it.
+func isNoFactErr(err error) bool {
+	for e := err; e != nil; {
+		if e == ipc.ErrNoFact {
+			return true
+		}
+		u, ok := e.(interface{ Unwrap() error })
+		if !ok {
+			return false
+		}
+		e = u.Unwrap()
+	}
+	return false
+}

cmd/mavend/actions_money_test.go

@@ -0,0 +1,139 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/zenmoney"
+)
+
+// moneyAPI answers only LatestFactBySource; everything else is unimplemented,
+// which is the assertion that answering a money question costs no model call
+// and reaches no network.
+type moneyAPI struct {
+	ipc.UnimplementedCoreAPI
+
+	fact    ipc.Fact
+	err     error
+	gotKey  string
+	gotSrc  string
+	callCnt int
+}
+
+func (a *moneyAPI) LatestFactBySource(_ context.Context, key, source string) (ipc.Fact, error) {
+	a.gotKey, a.gotSrc = key, source
+	a.callCnt++
+	return a.fact, a.err
+}
+
+func moneyNow() time.Time { return time.Date(2026, 8, 15, 20, 0, 0, 0, time.UTC) }
+
+func moneyFact(ts time.Time, val string) ipc.Fact {
+	return ipc.Fact{Kind: "env", Key: zenmoney.KeySpentMonth, Value: val, Source: zenmoney.Source, Ts: ts}
+}
+
+func TestQueryMoneyAnswersFromTheFact(t *testing.T) {
+	api := &moneyAPI{fact: moneyFact(moneyNow(), `{"spent":[{"currency":"RUB","amount":1749.5}],"count":3}`)}
+	h := &reactiveHandler{api: api, now: moneyNow}
+	reply, ok := h.queryMoney(context.Background(), &queryTurn{
+		dec: router.Decision{Utterance: "сколько я потратил в этом месяце?"},
+	})
+	if !ok {
+		t.Fatal("the money source must claim a money question")
+	}
+	if api.gotKey != zenmoney.KeySpentMonth || api.gotSrc != zenmoney.Source {
+		t.Errorf("read %q/%q, want the month key from the poller's source", api.gotKey, api.gotSrc)
+	}
+	if !strings.Contains(reply, "1749.5") {
+		t.Errorf("reply = %q, want the exact figure", reply)
+	}
+	if !strings.Contains(reply, "в этом месяце") {
+		t.Errorf("reply = %q, want the window named", reply)
+	}
+}
+
+func TestQueryMoneyPicksTodaysKey(t *testing.T) {
+	api := &moneyAPI{fact: moneyFact(moneyNow(), `{"spent":[{"currency":"RUB","amount":250}],"count":1}`)}
+	h := &reactiveHandler{api: api, now: moneyNow}
+	if _, ok := h.queryMoney(context.Background(), &queryTurn{
+		dec: router.Decision{Utterance: "сколько я потратил сегодня?"},
+	}); !ok {
+		t.Fatal("expected the source to claim it")
+	}
+	if api.gotKey != zenmoney.KeySpentToday {
+		t.Errorf("key = %q, want today's", api.gotKey)
+	}
+}
+
+// The capability is off unless configured, and then there is no fact. She says
+// so instead of letting the recall pass answer a money question from a note.
+func TestQueryMoneySaysNotConnected(t *testing.T) {
+	h := &reactiveHandler{api: &moneyAPI{err: ipc.ErrNoFact}, now: moneyNow}
+	reply, ok := h.queryMoney(context.Background(), &queryTurn{
+		dec: router.Decision{Utterance: "сколько я потратил?"},
+	})
+	if !ok {
+		t.Fatal("expected the source to claim it")
+	}
+	if !strings.Contains(reply, "не подключено") {
+		t.Errorf("reply = %q, want an honest 'not connected'", reply)
+	}
+	// No number of any kind in that answer.
+	for _, d := range []string{"0", "1", "2", "3", "4", "5", "6", "7", "8", "9"} {
+		if strings.Contains(reply, d) {
+			t.Errorf("reply %q contains a digit — nothing was read, so there is no figure", reply)
+		}
+	}
+}
+
+// A fact older than the staleness bound is dated rather than spoken as if it
+// were current: the poller can be down, and last week's total presented as
+// today's is a lie by omission.
+func TestQueryMoneyDatesAStaleFact(t *testing.T) {
+	old := moneyNow().Add(-72 * time.Hour)
+	api := &moneyAPI{fact: moneyFact(old, `{"spent":[{"currency":"RUB","amount":100}],"count":1}`)}
+	h := &reactiveHandler{api: api, now: moneyNow}
+	reply, _ := h.queryMoney(context.Background(), &queryTurn{
+		dec: router.Decision{Utterance: "сколько я потратил?"},
+	})
+	if !strings.Contains(reply, "данные от") {
+		t.Errorf("reply = %q, want the stale fact dated", reply)
+	}
+}
+
+func TestQueryMoneyPassesOtherQuestions(t *testing.T) {
+	api := &moneyAPI{}
+	h := &reactiveHandler{api: api, now: moneyNow}
+	for _, u := range []string{"какая погода?", "я потратил весь день на это", "какие у меня задачи?"} {
+		if _, ok := h.queryMoney(context.Background(), &queryTurn{dec: router.Decision{Utterance: u}}); ok {
+			t.Errorf("the money source claimed %q", u)
+		}
+	}
+	if api.callCnt != 0 {
+		t.Error("a non-money question must not read the money facts")
+	}
+}
+
+// Money must be answered before the recall sources, or a question about
+// spending gets answered by the nearest note.
+func TestQuerySourcesOrderMoneyBeforeRecall(t *testing.T) {
+	moneyAt, notesAt := -1, -1
+	for i, src := range querySources {
+		switch src.name {
+		case "money":
+			moneyAt = i
+		case "notes":
+			notesAt = i
+		}
+	}
+	if moneyAt < 0 || notesAt < 0 {
+		t.Fatalf("sources missing: money=%d notes=%d", moneyAt, notesAt)
+	}
+	if moneyAt > notesAt {
+		t.Errorf("money source at %d, after notes at %d", moneyAt, notesAt)
+	}
+}

cmd/mavend/actions_note.go

@@ -11,6 +11,12 @@ import (
 // actionNote handles router.IntentNote: embed the note, persist it, and
 // index it for recall.
 func (h *reactiveHandler) actionNote(ctx context.Context, dec router.Decision) string {
+	// An utterance that explicitly files a task is work, not recall, and
+	// belongs in the task store (Vikunja #130). Checked before the embedding
+	// is paid for. Everything else is a note, exactly as before.
+	if reply, ok := h.captureTaskFromNote(ctx, dec); ok {
+		return reply
+	}
 	// embed the note text with the same model the classifier uses, persist
 	// via CoreAPI (source=tap:voice). Semantic recall lives in `notes`, not
 	// facts — no predicate reads it (spec's two-memory split).

cmd/mavend/actions_query.go

@@ -5,11 +5,15 @@ import (
 	"errors"
 	"fmt"
 	"log"
+	"strings"
 	"time"
 
+	"github.com/kami/maven/internal/crawl"
 	"github.com/kami/maven/internal/ipc"
 	"github.com/kami/maven/internal/memory"
+	"github.com/kami/maven/internal/morning"
 	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/rss"
 	"github.com/kami/maven/internal/weather"
 )
 
@@ -45,11 +49,43 @@ type querySource struct {
 // line here plus its method; where you put the line is the whole decision.
 var querySources = []querySource{
 	{"fact-by-key", (*reactiveHandler).queryFactByKey},
+	// Before "calendar" on purpose: both match "…на сегодня", and the plan is
+	// the more specific ask (its matcher requires a plan word), so the calendar
+	// listing would otherwise swallow it.
+	{"day-plan", (*reactiveHandler).queryDayPlan},
+	// Also before "calendar": "что я обычно делаю по средам?" names a weekday,
+	// and the habit question is the more specific one. Its matcher requires a
+	// habit marker ("обычно", "каждый", …), so a question about this coming
+	// Wednesday still reaches the calendar.
+	{"habits", (*reactiveHandler).queryHabits},
+	// Before "calendar" and before the recall sources: "что мне нужно
+	// сделать?" is a question about the task list, and the notes pass would
+	// otherwise answer it with whatever note happens to be nearest. Its
+	// matcher requires a task noun or an explicit "что … сделать", so a
+	// date-bearing question still reaches the calendar.
+	{"tasks", (*reactiveHandler).queryTasks},
+	// Before the recall sources too: "сколько я потратил?" is a question about
+	// the money facts the poller wrote, and the notes pass would otherwise
+	// answer it from whatever he once said about spending. Its matcher needs a
+	// money noun plus an actual ask, so "я потратил весь день" is untouched.
+	{"money", (*reactiveHandler).queryMoney},
+	// Before the recall sources and before general knowledge: "что нового?" is
+	// a question about the feeds she reads, and general knowledge would answer
+	// it by inventing news. Its matcher needs a feed noun plus an ask, so
+	// "у меня новая лента в инстаграме" is untouched.
+	{"feeds", (*reactiveHandler).queryFeeds},
 	{"calendar", (*reactiveHandler).queryCalendar},
 	{"weather", (*reactiveHandler).queryWeather},
 	{"embed", (*reactiveHandler).queryEmbed},
 	{"memory", (*reactiveHandler).queryMemory},
 	{"notes", (*reactiveHandler).queryNotes},
+	// LAST before the model answers from memory, and that position is the whole
+	// design (Vikunja #259): local sources first. The model, his own notes and
+	// facts, and — once internal/kiwix is wired into this chain — the offline
+	// ZIMs all get their turn before anything touches the network. This source
+	// only claims a turn where he named a URL out loud, so it never competes
+	// with a local answer.
+	{"web", (*reactiveHandler).queryWeb},
 	{"general-knowledge", (*reactiveHandler).queryGeneral},
 }
 
@@ -89,6 +125,132 @@ func (h *reactiveHandler) queryFactByKey(ctx context.Context, t *queryTurn) (str
 	return "", false
 }
 
+// queryDayPlan — "какие планы на сегодня?", "что у меня по плану?", "что
+// дальше?" (Vikunja #128). Recites the day: calendar events, pending
+// reminders, and any morning checklist still outstanding.
+//
+// Read-only by construction — the plan is assembled and rendered core-side and
+// nothing here schedules or announces. "что дальше?" asks for the rest of the
+// day, so that phrasing trims what has already passed.
+func (h *reactiveHandler) queryDayPlan(ctx context.Context, t *queryTurn) (string, bool) {
+	if !router.IsDayPlanQuery(t.dec.Utterance) {
+		return "", false
+	}
+	plan, err := h.api.DayPlan(ctx)
+	if err != nil {
+		log.Printf("voice: day plan: %v", err)
+		return "не получилось собрать план.", true
+	}
+	if !isRestOfDayQuery(t.dec.Utterance) {
+		return plan.Spoken, true
+	}
+	// Rebuild the pure plan so the rest-of-day rendering is the same code that
+	// rendered the whole day — one formatter, one persona.
+	p := morning.Plan{Date: plan.Date}
+	for _, it := range plan.Items {
+		p.Items = append(p.Items, morning.PlanEntry{
+			At:        it.At,
+			Text:      it.Text,
+			Kind:      morning.PlanKind(it.Kind),
+			Uncertain: it.Uncertain,
+		})
+	}
+	return p.After(h.now()).FormatRU(), true
+}
+
+// isRestOfDayQuery — "что дальше?" and its English form, the only plan phrasing
+// that means "from now on" rather than "the whole day".
+func isRestOfDayQuery(text string) bool {
+	s := strings.ToLower(text)
+	return strings.Contains(s, "дальше") || strings.Contains(s, "next")
+}
+
+// habitFactWindow — how many recent facts the behaviour profile is counted
+// over. Enough for a season of habits without scanning the whole store on every
+// question; the profile is recomputed on read, so the bound is the cost control.
+const habitFactWindow = 2000
+
+// queryHabits — "что я обычно делаю по вторникам?" (Vikunja #254). Counts the
+// answer out of the fact log rather than asking the model to summarise a life:
+// see internal/memory/behavior.go for why nothing here is generated.
+func (h *reactiveHandler) queryHabits(ctx context.Context, t *queryTurn) (string, bool) {
+	q, ok := router.ParseHabitQuery(t.dec.Utterance)
+	if !ok {
+		return "", false
+	}
+	facts, err := h.api.RecentFacts(ctx, habitFactWindow)
+	if err != nil {
+		log.Printf("voice: habits: recent facts: %v", err)
+		return "не получилось посмотреть записи.", true
+	}
+	obs := make([]memory.Observation, 0, len(facts))
+	for _, f := range facts {
+		obs = append(obs, memory.Observation{At: f.Ts, Key: f.Key, Kind: f.Kind})
+	}
+	profile := memory.BuildProfile(obs, h.now())
+	if q.HasWeekday {
+		return profile.FormatWeekdayRU(q.Weekday), true
+	}
+	return profile.FormatOverallRU(), true
+}
+
+// feedNoteWindow — how many recent notes are scanned for feed items, and
+// feedReadOut — how many headlines she actually reads back. She summarises the
+// top of the pile, she does not recite a river.
+const (
+	feedNoteWindow = 200
+	feedReadOut    = 3
+)
+
+// queryFeeds — "что нового в лентах?", "что нового по технологиям?"
+// (Vikunja #258).
+//
+// This is the ONLY way a feed item reaches him. The poller writes notes and
+// never speaks; asking is the trigger. If that ever changes, the thing that
+// changed is "Maven is not a nag", not a detail of this file.
+func (h *reactiveHandler) queryFeeds(ctx context.Context, t *queryTurn) (string, bool) {
+	q, ok := router.ParseFeedQuery(t.dec.Utterance)
+	if !ok {
+		return "", false
+	}
+	if !h.feedsOn {
+		// Claim the turn rather than fall through: "не читаю ленты" is true, and
+		// letting general knowledge answer "что нового?" would be an invented
+		// news bulletin.
+		return "я пока не читаю ленты — они не настроены.", true
+	}
+	notes, err := h.api.RecentNotes(ctx, feedNoteWindow)
+	if err != nil {
+		log.Printf("voice: feeds: recent notes: %v", err)
+		return "не получилось посмотреть ленты.", true
+	}
+	var picked []string
+	for _, n := range notes {
+		if !strings.HasPrefix(n.Source, rss.SourcePrefix) {
+			continue
+		}
+		if !router.CategoryMatches(n.Text, q.Category) {
+			continue
+		}
+		// The note carries title, summary and link; she reads the title.
+		title := n.Text
+		if i := strings.IndexByte(title, '\n'); i > 0 {
+			title = title[:i]
+		}
+		picked = append(picked, strings.TrimSpace(title))
+		if len(picked) == feedReadOut {
+			break
+		}
+	}
+	if len(picked) == 0 {
+		if q.Category != "" {
+			return "по этой теме в лентах пока ничего.", true
+		}
+		return "в лентах пока ничего нового.", true
+	}
+	return "вот что нового: " + strings.Join(picked, "; "), true
+}
+
 // queryCalendar — "что у меня сегодня?", "планы на завтра?"
 // h.now(), not time.Now(): the handler's clock is the injected one, so this
 // source can be tested at a fixed time like the rest.
@@ -102,12 +264,15 @@ func (h *reactiveHandler) queryCalendar(ctx context.Context, t *queryTurn) (stri
 		log.Printf("voice: calendar events: %v", err)
 		return "не получилось проверить календарь.", true
 	}
-	values := make([]string, len(events))
+	// Provenance travels with each event. A work meeting relayed off a phone
+	// notification (source ambient:notif, #126) is stored below full confidence
+	// and gets hedged; a CalDAV read is recited plainly.
+	entries := make([]router.CalendarEntry, len(events))
 	for i, e := range events {
-		values[i] = e.Value
+		entries[i] = router.CalendarEntry{Text: e.Value, Uncertain: e.Confidence < 1.0}
 	}
 	var f router.CalendarEventFormatter
-	return f.Format(values, date), true
+	return f.FormatEntries(entries, date), true
 }
 
 func (h *reactiveHandler) queryWeather(ctx context.Context, t *queryTurn) (string, bool) {
@@ -214,6 +379,57 @@ func (h *reactiveHandler) queryNotes(ctx context.Context, t *queryTurn) (string,
 	return reply, true
 }
 
+// webPageContextRunes — how much of a fetched page is handed to the phraser.
+// Less than the crawler keeps: the rest of the 4096-token window belongs to the
+// prompt, the persona block and the reply.
+const webPageContextRunes = 1500
+
+// queryWeb — "посмотри https://example.org/x — что там?" (Vikunja #259).
+//
+// It claims a turn ONLY when he named a URL, which is what keeps a fallback from
+// becoming a habit: no URL, no fetch, and the model answers from what is local.
+// What leaves the box is the URL and nothing else — no note, no fact, no history
+// travels with it.
+func (h *reactiveHandler) queryWeb(ctx context.Context, t *queryTurn) (string, bool) {
+	link, ok := router.FirstURL(t.dec.Utterance)
+	if !ok {
+		return "", false
+	}
+	if h.crawler == nil {
+		// Claim rather than fall through: he asked about a specific page, and
+		// letting the model answer from the URL's spelling alone is how a small
+		// model invents a page's contents.
+		return "я не читаю страницы — это не настроено.", true
+	}
+	ctxFetch, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+	page, err := h.crawler.Page(ctxFetch, link)
+	if err != nil {
+		if errors.Is(err, crawl.ErrRobots) {
+			return "эта страница закрыта для чтения — robots.txt не разрешает.", true
+		}
+		log.Printf("voice: web: %v", err)
+		return "не получилось прочитать страницу.", true
+	}
+	if page.Text == "" {
+		return "страница открылась, но читать там нечего.", true
+	}
+	// The page is handed to the phraser the same way a note is: as context for
+	// the question he actually asked. She answers the question, she does not
+	// recite the page.
+	snippet := page.Title + "\n" + crawl.TrimRunes(page.Text, webPageContextRunes)
+	reply, perr := h.phraser.PhraseQuery(ctx, t.dec.Utterance, []string{snippet})
+	if perr != nil {
+		log.Printf("voice: web: phrase: %v", perr)
+	}
+	if reply == "" {
+		// No phraser (or it failed): read back the top of the page rather than
+		// pretend the fetch did not happen.
+		return "вот что на странице: " + crawl.TrimRunes(page.Text, 300), true
+	}
+	return reply, true
+}
+
 // queryGeneral — general knowledge from the phraser, the last source before
 // giving up. It always claims: either the model answers or Maven says she
 // doesn't know.

cmd/mavend/actions_task.go

@@ -0,0 +1,83 @@
+package main
+
+import (
+	"context"
+	"log"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/store"
+	"github.com/kami/maven/internal/tasks"
+)
+
+// Task capture on the voice/chat path (Vikunja #130).
+//
+// Two halves, both deliberately small:
+//
+//   - captureTaskFromNote runs at the top of actionNote. An utterance that
+//     explicitly files a task ("добавь в задачи купить молоко") goes to the task
+//     store instead of the note store. Anything without an explicit marker is
+//     still a note — see router.ParseTaskCapture for why "надо бы поспать" must
+//     not become a task.
+//   - queryTasks is a query source that reads the list back.
+//
+// Nothing here speaks unprompted. Tasks are answered when asked about; no tick
+// rule reads the table.
+
+// captureTaskFromNote claims the turn when the utterance explicitly files a
+// task, returning the reply. ("", false) hands the turn back to the note path.
+func (h *reactiveHandler) captureTaskFromNote(ctx context.Context, dec router.Decision) (string, bool) {
+	cap, ok := router.ParseTaskCapture(dec.Utterance)
+	if !ok {
+		return "", false
+	}
+	resp, err := h.api.CaptureTask(ctx, ipc.CaptureTaskReq{
+		Text:   cap.Text,
+		Source: "tap:voice",
+		Status: store.TaskOpen, // he stated it himself — not a candidate
+		Weight: cap.Weight,     // 0 unless he said "срочно" / "важно"
+		Ts:     h.now(),
+	})
+	if err != nil {
+		log.Printf("voice: capture task: %v", err)
+		return "не получилось записать задачу.", true
+	}
+	if !resp.Created {
+		return "это уже в списке.", true
+	}
+	return "записала: " + cap.Text, true
+}
+
+// queryTasks — "какие у меня задачи?", "что мне нужно сделать?".
+//
+// Reads the live set and recites it in priority order (Vikunja #129). The order
+// is computed by internal/tasks from what he told her — deadlines, the urgency
+// he stated, how long a task has been sitting — never asked of the model. The
+// rendering is the package's too, so the spoken list and the /tasks page can
+// never disagree about what comes first.
+func (h *reactiveHandler) queryTasks(ctx context.Context, t *queryTurn) (string, bool) {
+	if !router.IsTaskListQuery(t.dec.Utterance) {
+		return "", false
+	}
+	live, err := h.api.ListTasks(ctx, "live")
+	if err != nil {
+		log.Printf("voice: list tasks: %v", err)
+		return "не получилось посмотреть задачи.", true
+	}
+	return tasks.FormatRU(tasks.Rank(taskItems(live), h.now())), true
+}
+
+// taskItems maps wire rows onto the ranker's input. Written here rather than in
+// internal/tasks so the ranker stays a pure package with no ipc (and therefore
+// no store, and therefore no cgo) dependency — the same posture as
+// internal/morning and internal/memory.
+func taskItems(ts []ipc.Task) []tasks.Item {
+	out := make([]tasks.Item, len(ts))
+	for i, t := range ts {
+		out[i] = tasks.Item{
+			ID: t.ID, Text: t.Text, Status: t.Status,
+			Created: t.CreatedTs, Due: t.Due, Weight: t.Weight,
+		}
+	}
+	return out
+}

cmd/mavend/actions_task_test.go

@@ -0,0 +1,227 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/router"
+)
+
+// taskAPI answers only the three task methods; every other call is
+// unimplemented, which is the assertion that capture needs nothing else — in
+// particular no embedder, so a filed task costs no model call.
+type taskAPI struct {
+	ipc.UnimplementedCoreAPI
+
+	captured []ipc.CaptureTaskReq
+	created  bool
+	capErr   error
+
+	tasks   []ipc.Task
+	listArg string
+	listErr error
+}
+
+func (a *taskAPI) CaptureTask(_ context.Context, req ipc.CaptureTaskReq) (ipc.CaptureTaskResp, error) {
+	a.captured = append(a.captured, req)
+	if a.capErr != nil {
+		return ipc.CaptureTaskResp{}, a.capErr
+	}
+	return ipc.CaptureTaskResp{ID: 1, Created: a.created}, nil
+}
+
+func (a *taskAPI) ListTasks(_ context.Context, status string) ([]ipc.Task, error) {
+	a.listArg = status
+	return a.tasks, a.listErr
+}
+
+func taskNow() time.Time { return time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC) }
+
+func taskHandler(api ipc.CoreAPI) *reactiveHandler {
+	return &reactiveHandler{api: api, now: taskNow}
+}
+
+func TestCaptureTaskFromNoteFilesTheTask(t *testing.T) {
+	api := &taskAPI{created: true}
+	h := taskHandler(api)
+	reply, ok := h.captureTaskFromNote(context.Background(), router.Decision{
+		Intent: router.IntentNote, Utterance: "добавь в задачи купить молоко",
+	})
+	if !ok {
+		t.Fatal("an explicit capture must claim the turn")
+	}
+	if len(api.captured) != 1 {
+		t.Fatalf("captured %d, want 1", len(api.captured))
+	}
+	got := api.captured[0]
+	if got.Text != "купить молоко" {
+		t.Errorf("text = %q, want the marker stripped", got.Text)
+	}
+	if got.Source != "tap:voice" {
+		t.Errorf("source = %q, want tap:voice", got.Source)
+	}
+	if got.Status != "open" {
+		t.Errorf("status = %q — work he stated is open, never a candidate", got.Status)
+	}
+	if !got.Ts.Equal(taskNow()) {
+		t.Errorf("ts = %v, want the handler clock", got.Ts)
+	}
+	if !strings.Contains(reply, "купить молоко") {
+		t.Errorf("reply = %q, want it to read the task back", reply)
+	}
+}
+
+// A note is still a note: capture only fires on an explicit marker, so
+// ordinary recall is untouched.
+func TestCaptureTaskFromNotePassesOrdinaryNotes(t *testing.T) {
+	api := &taskAPI{}
+	h := taskHandler(api)
+	for _, u := range []string{"надо бы поспать", "мне понравился этот фильм", "запиши что я пил воду"} {
+		if _, ok := h.captureTaskFromNote(context.Background(), router.Decision{Utterance: u}); ok {
+			t.Errorf("%q was captured as a task", u)
+		}
+	}
+	if len(api.captured) != 0 {
+		t.Errorf("captured %d requests, want none", len(api.captured))
+	}
+}
+
+func TestCaptureTaskFromNoteSaysAlreadyOnTheList(t *testing.T) {
+	h := taskHandler(&taskAPI{created: false})
+	reply, ok := h.captureTaskFromNote(context.Background(), router.Decision{Utterance: "добавь в задачи купить молоко"})
+	if !ok {
+		t.Fatal("expected the capture path to claim it")
+	}
+	if !strings.Contains(reply, "уже") {
+		t.Errorf("reply = %q — a deduped capture must not claim it saved something new", reply)
+	}
+}
+
+func TestCaptureTaskFromNoteReportsStoreFailure(t *testing.T) {
+	h := taskHandler(&taskAPI{capErr: errors.New("db is on fire")})
+	reply, ok := h.captureTaskFromNote(context.Background(), router.Decision{Utterance: "добавь задачу починить кран"})
+	if !ok {
+		t.Fatal("a failed capture still claims the turn — the note path must not double-write")
+	}
+	if !strings.Contains(reply, "не получилось") {
+		t.Errorf("reply = %q, want an honest failure", reply)
+	}
+}
+
+func TestQueryTasksRecitesTheLiveList(t *testing.T) {
+	api := &taskAPI{tasks: []ipc.Task{
+		{ID: 1, Text: "купить молоко", Status: "open"},
+		{ID: 2, Text: "продлить страховку", Status: "candidate"},
+	}}
+	h := taskHandler(api)
+	reply, ok := h.queryTasks(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "какие у меня задачи?"},
+	})
+	if !ok {
+		t.Fatal("the task source must claim a task-list question")
+	}
+	if api.listArg != "live" {
+		t.Errorf("ListTasks(%q), want \"live\" — a resolved task is not outstanding work", api.listArg)
+	}
+	if !strings.Contains(reply, "купить молоко") || !strings.Contains(reply, "продлить страховку") {
+		t.Errorf("reply = %q, want both tasks", reply)
+	}
+	// The candidate must be named as unconfirmed, not recited as his work.
+	openIdx := strings.Index(reply, "купить молоко")
+	candIdx := strings.Index(reply, "продлить страховку")
+	if !(openIdx < candIdx) {
+		t.Errorf("reply = %q, want confirmed work before candidates", reply)
+	}
+	if !strings.Contains(reply, "не подтвердил") {
+		t.Errorf("reply = %q, want the candidate flagged as unconfirmed", reply)
+	}
+}
+
+// The stated urgency rides through capture as a weight, so the ranker can use
+// it later (Vikunja #129). "срочно" is not part of the task text.
+func TestCaptureTaskCarriesStatedUrgency(t *testing.T) {
+	api := &taskAPI{created: true}
+	h := taskHandler(api)
+	if _, ok := h.captureTaskFromNote(context.Background(), router.Decision{
+		Utterance: "добавь в задачи срочно оплатить интернет",
+	}); !ok {
+		t.Fatal("expected a capture")
+	}
+	got := api.captured[0]
+	if got.Text != "оплатить интернет" {
+		t.Errorf("text = %q, want the urgency word out of the task", got.Text)
+	}
+	if got.Weight == 0 {
+		t.Error("weight = 0 — he said срочно and it was dropped")
+	}
+}
+
+// The recital is ordered by the ranker, not by insertion: a deadline he named
+// comes before undated work.
+func TestQueryTasksRecitesInPriorityOrder(t *testing.T) {
+	due := taskNow()
+	api := &taskAPI{tasks: []ipc.Task{
+		{ID: 1, Text: "купить молоко", Status: "open", CreatedTs: taskNow()},
+		{ID: 2, Text: "оплатить интернет", Status: "open", CreatedTs: taskNow(), Due: &due},
+	}}
+	h := taskHandler(api)
+	reply, _ := h.queryTasks(context.Background(), &queryTurn{
+		dec: router.Decision{Utterance: "какие у меня задачи?"},
+	})
+	if strings.Index(reply, "оплатить интернет") > strings.Index(reply, "купить молоко") {
+		t.Errorf("reply = %q, want the dated task first", reply)
+	}
+	if !strings.Contains(reply, "сегодня") {
+		t.Errorf("reply = %q, want the reason named", reply)
+	}
+}
+
+func TestQueryTasksEmptyList(t *testing.T) {
+	h := taskHandler(&taskAPI{})
+	reply, ok := h.queryTasks(context.Background(), &queryTurn{
+		dec: router.Decision{Utterance: "что мне нужно сделать?"},
+	})
+	if !ok {
+		t.Fatal("expected the task source to claim it")
+	}
+	if reply != "задач нет." {
+		t.Errorf("reply = %q", reply)
+	}
+}
+
+func TestQueryTasksPassesOtherQuestions(t *testing.T) {
+	api := &taskAPI{}
+	h := taskHandler(api)
+	for _, u := range []string{"как дела?", "какая погода в москве?", "что у меня сегодня?"} {
+		if _, ok := h.queryTasks(context.Background(), &queryTurn{dec: router.Decision{Utterance: u}}); ok {
+			t.Errorf("the task source claimed %q", u)
+		}
+	}
+	if api.listArg != "" {
+		t.Error("a non-task question must not read the task list")
+	}
+}
+
+// The chain must reach the task source before the recall sources, or "что мне
+// нужно сделать?" gets answered by whatever note is nearest.
+func TestQuerySourcesOrderTasksBeforeRecall(t *testing.T) {
+	var tasksAt, notesAt = -1, -1
+	for i, src := range querySources {
+		switch src.name {
+		case "tasks":
+			tasksAt = i
+		case "notes":
+			notesAt = i
+		}
+	}
+	if tasksAt < 0 || notesAt < 0 {
+		t.Fatalf("sources missing: tasks=%d notes=%d", tasksAt, notesAt)
+	}
+	if tasksAt > notesAt {
+		t.Errorf("tasks source at %d, after notes at %d", tasksAt, notesAt)
+	}
+}

cmd/mavend/capture.go

@@ -0,0 +1,263 @@
+// mavend/capture.go — core's half of the meeting recorder (Vikunja #253,
+// docs/plans/08-hearing.md).
+//
+// The split: a client that has a microphone (mavenclient, or a phone on the PWA)
+// is told to start, streams frames over ipc.MethodCaptureAppend, and is told to
+// stop. Core keeps the PCM, stores it as a WAV blob under the same media store
+// and the same retention as images, transcribes it through the ONE STT Maven has
+// (mavsttd's whisper.cpp, reused — not a second engine), and summarises the
+// transcript on the resident model in windows that fit n_ctx 4096.
+//
+// # Off unless configured, twice over
+//
+// No `media` block ⇒ nowhere to keep audio ⇒ the four capture methods do not
+// exist. No `capture` block with enabled ⇒ they still do not exist. On an
+// unconfigured box there is no wire path that starts a recording, which is the
+// only guarantee worth making about a capability like this one.
+//
+// # What this file refuses to do
+//
+//   - Nothing listens. There is no VAD hook here, no wake-word branch, no
+//     "start when you hear a meeting". The plan document's keyword-triggered
+//     recorder is refused in internal/capture's package comment for the reason
+//     that applies here too: noticing a keyword requires listening, which is
+//     the behaviour this capability must not have.
+//   - No transcript note by default. The summary is written where he will read
+//     it; the verbatim record of what other people said takes a deliberate
+//     capture.save_transcript.
+//   - The transcript is never search input beyond this box, and the audio never
+//     leaves it at all.
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/kami/maven/internal/capture"
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/llm"
+	"github.com/kami/maven/internal/phraser"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/store"
+)
+
+// captureSummaryTimeout — the budget for one Stop, which is a map-reduce over
+// the whole meeting: one model call per transcript window plus a reduce, each of
+// which is seconds on this box. Forty windows is the configured ceiling, so the
+// budget has to be minutes, not the 60s the reply path uses.
+const captureSummaryTimeout = 20 * time.Minute
+
+// llmCompleter adapts *llm.Client to capture.Completer. The pure package names
+// the two strings it needs and stays free of the llm request struct; the client
+// itself is the swap-aware one from llmClientFor, so a model swap re-points it.
+type llmCompleter struct {
+	c         *llm.Client
+	maxTokens int
+}
+
+func (l llmCompleter) Complete(ctx context.Context, system, user string) (string, error) {
+	return l.c.Complete(ctx, llm.Req{System: system, User: user, MaxTokens: l.maxTokens})
+}
+
+// captureWiring — the recorder plus what it needs to write the result down.
+type captureWiring struct {
+	rec *capture.Recorder
+	st  *store.Store
+	emb router.Embedder
+	cfg *config.CaptureConfig
+	now func() time.Time
+}
+
+// newCaptureWiring returns nil when the recorder should not exist: no media
+// store, no capture block, capture disabled, or no STT to transcribe with.
+//
+// A missing llama-server is NOT a reason to return nil. Without one the
+// recording is still made, stored and transcribed, and the summary is simply
+// absent — the honest degradation, and much better than refusing to record a
+// meeting that is happening now.
+func newCaptureWiring(keeper *mediaKeeper, st *store.Store, voiceW *voiceWiring, phr phraser.Phraser, emb router.Embedder, cfg *config.Config) *captureWiring {
+	if keeper == nil || !cfg.Capture.Records() {
+		return nil
+	}
+	tr := transcriberOf(voiceW)
+	if tr == nil {
+		// Voice off ⇒ no STT client ⇒ nothing could turn the audio into words.
+		// Storing hours of unreadable audio of other people is worse than not
+		// recording, so this is a refusal, not a degradation.
+		log.Printf("capture: enabled but voice/stt is not wired — meeting capture disabled")
+		return nil
+	}
+
+	cc := cfg.Capture
+	var sum *capture.Summarizer
+	if lp, ok := phr.(*phraser.LLMPhraser); ok {
+		client := llmClientFor(lp, captureSummaryTimeout)
+		sum = capture.NewSummarizer(
+			llmCompleter{c: client, maxTokens: 512},
+			cc.ChunkRunes, cc.MaxChunks, contextBlockFn(cfg, time.Now),
+		)
+	} else {
+		log.Printf("capture: no llama-server phraser — meetings are transcribed, not summarised")
+	}
+
+	rec, err := capture.New(keeper.store, tr, sum, capture.Config{
+		MaxDuration: cc.MaxDuration(),
+		STTWindow:   time.Duration(cc.STTWindow),
+	})
+	if err != nil {
+		log.Printf("capture: %v — meeting capture disabled", err)
+		return nil
+	}
+	log.Printf("capture: enabled, sessions capped at %s", rec.MaxDuration())
+	return &captureWiring{rec: rec, st: st, emb: emb, cfg: cc, now: time.Now}
+}
+
+// start handles ipc.MethodCaptureStart.
+func (c *captureWiring) start(_ context.Context, req ipc.CaptureStartReq) (ipc.CaptureStartResp, error) {
+	s, err := c.rec.Start(req.Label)
+	if err != nil {
+		return ipc.CaptureStartResp{}, err
+	}
+	// The label is logged; nothing that was said ever is.
+	log.Printf("capture: started %q", s.Label)
+	return ipc.CaptureStartResp{
+		Label:      s.Label,
+		Started:    s.Started,
+		MaxSeconds: int(c.rec.MaxDuration().Seconds()),
+	}, nil
+}
+
+// append handles ipc.MethodCaptureAppend. ErrExpired is reported as a successful
+// response with Expired set rather than an error: the cap firing is the designed
+// behaviour, and the client needs the flag to stop sending and call stop.
+func (c *captureWiring) append(_ context.Context, req ipc.CaptureAppendReq) (ipc.CaptureAppendResp, error) {
+	err := c.rec.Append(req.Audio)
+	st := c.rec.Status()
+	if errors.Is(err, capture.ErrExpired) {
+		log.Printf("capture: %q hit the %s cap — stopping", st.Label, c.rec.MaxDuration())
+		return ipc.CaptureAppendResp{Seconds: st.Duration.Seconds(), Expired: true}, nil
+	}
+	if err != nil {
+		return ipc.CaptureAppendResp{}, err
+	}
+	return ipc.CaptureAppendResp{Seconds: st.Duration.Seconds()}, nil
+}
+
+// stop handles ipc.MethodCaptureStop.
+//
+// The error handling here mirrors vision's, and for the same reason: the audio is
+// stored first, so a transcription or summary failure returns what exists rather
+// than nothing. A response can carry a blob id with no transcript (STT failed,
+// re-runnable), or a transcript with no summary (the model failed, the words are
+// kept) — both are degraded successes and neither is an error to the caller.
+func (c *captureWiring) stop(ctx context.Context, req ipc.CaptureStopReq) (ipc.CaptureStopResp, error) {
+	if req.Discard {
+		// "забудь, не записывай" — nothing is stored, transcribed or noted.
+		if !c.rec.Abort() {
+			return ipc.CaptureStopResp{}, capture.ErrNoSession
+		}
+		log.Printf("capture: session discarded on request")
+		return ipc.CaptureStopResp{Discarded: true}, nil
+	}
+
+	res, err := c.rec.Stop(ctx)
+	resp := ipc.CaptureStopResp{
+		BlobID:     res.BlobID,
+		Label:      res.Label,
+		Started:    res.Started,
+		Seconds:    res.Duration.Seconds(),
+		Transcript: res.Transcript,
+		Summary:    res.Summary,
+		Chunks:     res.Chunks,
+	}
+	if err != nil {
+		if res.BlobID == "" && res.Transcript == "" {
+			// Nothing survived: no session, or an empty recording. There is
+			// nothing to hand back, so this is a real error.
+			return ipc.CaptureStopResp{}, err
+		}
+		log.Printf("capture: %q partially finished: %v", res.Label, err)
+	}
+
+	if id, werr := c.writeNotes(ctx, res); werr != nil {
+		log.Printf("capture: note write for %q failed: %v", res.Label, werr)
+	} else {
+		resp.NoteID = id
+	}
+	log.Printf("capture: finished %q — %s of audio, %d summary chunk(s)",
+		res.Label, res.Duration.Round(time.Second), res.Chunks)
+	return resp, nil
+}
+
+// writeNotes stores the summary as a note, and the transcript too when
+// capture.save_transcript is set. Returns the summary note's id, or 0 when there
+// was no summary to write.
+//
+// The note source carries the blob id, which is the only link back to the audio.
+// When retention prunes the blob the note remains — words about a meeting are a
+// far lighter thing to keep than a recording of it.
+func (c *captureWiring) writeNotes(ctx context.Context, res capture.Result) (int64, error) {
+	source := "capture:meeting"
+	if res.BlobID != "" {
+		source = "capture:meeting:" + res.BlobID[:12]
+	}
+	var id int64
+	if text := res.Summary; text != "" {
+		var err error
+		id, err = c.writeNote(ctx, text, source)
+		if err != nil {
+			return 0, fmt.Errorf("summary note: %w", err)
+		}
+	}
+	if c.cfg.SaveTranscript && res.Transcript != "" {
+		if _, err := c.writeNote(ctx, res.Transcript, source+":transcript"); err != nil {
+			return id, fmt.Errorf("transcript note: %w", err)
+		}
+	}
+	return id, nil
+}
+
+func (c *captureWiring) writeNote(ctx context.Context, text, source string) (int64, error) {
+	var vec []float32
+	if c.emb != nil {
+		// EmbedPassage, not Embed: this is text being searched FOR, and the e5
+		// embedder is asymmetric. Backwards here makes the meeting unfindable by
+		// the question that should have matched it.
+		var err error
+		vec, err = router.EmbedPassage(ctx, c.emb, text)
+		if err != nil {
+			return 0, fmt.Errorf("embed: %w", err)
+		}
+	}
+	return c.st.WriteNote(ctx, c.now(), text, vec, source)
+}
+
+// status handles ipc.MethodCaptureStatus.
+func (c *captureWiring) status(_ context.Context) (ipc.CaptureStatusResp, error) {
+	st := c.rec.Status()
+	return ipc.CaptureStatusResp{
+		Running: st.Running,
+		Label:   st.Label,
+		Started: st.Started,
+		Seconds: st.Duration.Seconds(),
+		Bytes:   st.Bytes,
+	}, nil
+}
+
+// wireCapture installs the four IPC hooks, or leaves them nil so every capture
+// method reports ErrUnknownMethod. Takes the media keeper wireVision already
+// opened: one blob store, one retention loop, images and audio side by side.
+func wireCapture(srv *ipc.Server, keeper *mediaKeeper, st *store.Store, voiceW *voiceWiring, phr phraser.Phraser, cfg *config.Config) {
+	cw := newCaptureWiring(keeper, st, voiceW, phr, embedderOf(voiceW), cfg)
+	if cw == nil {
+		return
+	}
+	srv.CaptureStartFn = cw.start
+	srv.CaptureAppendFn = cw.append
+	srv.CaptureStopFn = cw.stop
+	srv.CaptureStatusFn = cw.status
+}

cmd/mavend/crawls.go

@@ -0,0 +1,184 @@
+// mavend/crawls.go — the driver for reading web pages (Vikunja #259,
+// docs/plans/14-web-crawler.md). The crawler is pure and lives in
+// internal/crawl; this is the impure half: the guarded fetcher, a ticker for the
+// scheduled watches, and the fact-backed dedup hashes.
+//
+// Two paths, one config block, both off unless configured:
+//
+//   - ON DEMAND — he names a URL out loud and she reads it. That is the
+//     `queryWeb` source in actions_query.go, LAST in the chain: after his
+//     memory, after the notes, and (once Kiwix is wired into the chain) after
+//     the local ZIMs. A local read costs nothing and leaks nothing; a fetch puts
+//     a URL in someone's log, so it goes last.
+//   - SCHEDULED — a watched page is re-read on its interval, and a page whose
+//     text changed is written as a note. It does NOT announce itself. Same rule
+//     as the feed poller: notes, never nudges.
+//
+// Only the URL goes out. Nothing here reads a note, a fact, the persona block or
+// the history, and internal/crawl has no access to the store at all.
+package main
+
+import (
+	"context"
+	"log"
+	"net/url"
+	"time"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/crawl"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/webfetch"
+)
+
+// newCrawler builds the crawler from the `crawl` block, or returns nil when
+// there is none. Every caller checks for nil, and nil means no page is ever
+// fetched.
+func newCrawler(cfg *config.Config) *crawl.Crawler {
+	if cfg.Crawl == nil {
+		return nil
+	}
+	cc := cfg.Crawl
+
+	hosts := append([]string(nil), cc.AllowHosts...)
+	// A watched page's own host is always reachable; otherwise an allowlist and
+	// a watch list would have to be kept in sync by hand.
+	for _, w := range cc.Watches {
+		if u, err := url.Parse(w.URL); err == nil && u.Hostname() != "" {
+			hosts = append(hosts, u.Hostname())
+		}
+	}
+	// An allowlist plus on-demand is a contradiction worth logging rather than
+	// silently resolving: he asked for arbitrary pages AND for a fixed list.
+	// The allowlist wins, because it is the narrower instruction.
+	if len(hosts) > 0 && cc.OnDemand && len(cc.AllowHosts) > 0 {
+		log.Printf("crawl: allow_hosts is set, so on-demand reading is limited to those hosts")
+	}
+	ua := cc.UserAgent
+	if ua == "" {
+		ua = webfetch.DefaultUserAgent
+	}
+	fetcher := webfetch.New(webfetch.Config{
+		AllowHosts: hosts,
+		DenyHosts:  cc.DenyHosts,
+		Timeout:    time.Duration(cc.Timeout),
+		MaxBytes:   cc.MaxBytes,
+		UserAgent:  ua,
+	})
+	// The user-agent handed to the crawler is the one the fetcher sends: obeying
+	// robots rules written for a different name would be a lie.
+	return crawl.New(&crawlFetcher{f: fetcher}, crawl.Config{
+		UserAgent: ua,
+		MaxRunes:  cc.MaxRunes,
+	})
+}
+
+// onDemandCrawler returns a crawler for the answer path, or nil when on-demand
+// reading is off. The scheduled watches can be on while this is off: reading a
+// fixed list of pages on a timer and reading whatever URL is in an utterance are
+// different permissions, and the config keeps them separate.
+func onDemandCrawler(cfg *config.Config) *crawl.Crawler {
+	if cfg.Crawl == nil || !cfg.Crawl.OnDemand {
+		return nil
+	}
+	return newCrawler(cfg)
+}
+
+// crawlWorker — ticker + watcher for the scheduled half.
+type crawlWorker struct {
+	watcher  *crawl.Watcher
+	interval time.Duration
+}
+
+// crawlTickInterval — how often the worker asks what is due. Per-watch cadence
+// is the watcher's business.
+const crawlTickInterval = 15 * time.Minute
+
+// newCrawlWorker wires the scheduled crawls, or nil when nothing is watched.
+func newCrawlWorker(c *crawl.Crawler, api ipc.CoreAPI, emb router.Embedder, cfg *config.Config) *crawlWorker {
+	if c == nil || cfg.Crawl == nil || len(cfg.Crawl.Watches) == 0 {
+		return nil
+	}
+	watches := make([]crawl.WatchConfig, 0, len(cfg.Crawl.Watches))
+	for _, w := range cfg.Crawl.Watches {
+		watches = append(watches, crawl.WatchConfig{
+			Name:     w.Name,
+			URL:      w.URL,
+			Interval: time.Duration(w.Interval),
+		})
+	}
+	watcher := crawl.NewWatcher(c, watches, api, &factHashes{api: api},
+		crawlEmbedder(emb), time.Duration(cfg.Crawl.Interval))
+	if watcher == nil {
+		log.Printf("crawl: configured but nothing watchable — scheduled crawls disabled")
+		return nil
+	}
+	log.Printf("crawl: watching %d page(s), checking what is due every %s", len(watches), crawlTickInterval)
+	return &crawlWorker{watcher: watcher, interval: crawlTickInterval}
+}
+
+// run checks what is due until ctx is canceled. The first round runs
+// immediately; it writes notes only, so an early round startles nobody.
+func (w *crawlWorker) run(ctx context.Context) {
+	w.watcher.CheckDue(ctx, time.Now())
+	t := time.NewTicker(w.interval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case now := <-t.C:
+			w.watcher.CheckDue(ctx, now)
+		}
+	}
+}
+
+// crawlFetcher adapts webfetch to crawl.Fetcher, which is the seam that keeps
+// net/http out of the crawler package.
+type crawlFetcher struct{ f *webfetch.Fetcher }
+
+func (a *crawlFetcher) Get(ctx context.Context, u string) (*crawl.Response, error) {
+	resp, err := a.f.Get(ctx, u)
+	if err != nil {
+		return nil, err
+	}
+	return &crawl.Response{URL: resp.URL, ContentType: resp.ContentType, Body: resp.Body}, nil
+}
+
+// factHashes stores each watch's last content hash as a config fact, so a
+// restart does not re-note an unchanged page. Same mechanism the feed reader
+// uses for its marks, and inspectable on /dash.
+type factHashes struct{ api ipc.CoreAPI }
+
+func hashKey(name string) string { return "crawl:hash:" + name }
+
+func (h *factHashes) LastHash(ctx context.Context, name string) (string, error) {
+	f, err := h.api.LatestFact(ctx, hashKey(name))
+	if err != nil {
+		// No hash yet is not an error: the watcher treats "" as "never read".
+		return "", nil
+	}
+	return f.Value, nil
+}
+
+func (h *factHashes) SetHash(ctx context.Context, name, hash string) error {
+	_, err := h.api.WriteFact(ctx, ipc.WriteFactReq{
+		Ts:         time.Now(),
+		Kind:       "config",
+		Key:        hashKey(name),
+		Value:      hash,
+		Source:     "poll:crawl",
+		Confidence: 1.0,
+	})
+	return err
+}
+
+// crawlEmbedder adapts router.Embedder for the watcher, embedding with
+// EmbedPassage (a page is text being searched FOR, and the e5 embedder is
+// asymmetric).
+func crawlEmbedder(emb router.Embedder) crawl.Embedder {
+	if emb == nil {
+		return nil
+	}
+	return passageEmbedder{emb}
+}

cmd/mavend/crawls_test.go

@@ -0,0 +1,186 @@
+package main
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/crawl"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/phraser"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/voice"
+)
+
+// The default config reads nothing. This is the whole "off unless configured"
+// contract for the crawler, asserted at the wiring level rather than trusted.
+func TestCrawlOffByDefault(t *testing.T) {
+	cfg := &config.Config{}
+	if c := newCrawler(cfg); c != nil {
+		t.Error("newCrawler with no crawl block returned a crawler")
+	}
+	if c := onDemandCrawler(cfg); c != nil {
+		t.Error("onDemandCrawler with no crawl block returned a crawler")
+	}
+	if w := newCrawlWorker(nil, nil, nil, cfg); w != nil {
+		t.Error("newCrawlWorker with no crawl block returned a worker")
+	}
+	// Watches configured but on_demand off ⇒ the answer path still reads
+	// nothing: a timer over a fixed list is not permission for arbitrary URLs.
+	withWatch := &config.Config{Crawl: &config.CrawlConfig{
+		Watches: []config.CrawlWatchConfig{{Name: "p", URL: "https://example.org/p"}},
+	}}
+	if c := onDemandCrawler(withWatch); c != nil {
+		t.Error("onDemandCrawler honoured a watch list as on-demand permission")
+	}
+	if c := newCrawler(withWatch); c == nil {
+		t.Error("newCrawler returned nil for a configured watch")
+	}
+}
+
+// The wired fetcher must refuse a private address, because the crawler on this
+// box sits one hop from the whole homelab. Same guard the webfetch tests cover;
+// this asserts the daemon actually wires it.
+func TestCrawlerRefusesPrivateAddress(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/html")
+		w.Write([]byte("<html><body>secret</body></html>"))
+	}))
+	defer srv.Close()
+
+	c := newCrawler(&config.Config{Crawl: &config.CrawlConfig{OnDemand: true}})
+	if c == nil {
+		t.Fatal("newCrawler returned nil for an on-demand config")
+	}
+	if _, err := c.Page(context.Background(), srv.URL); err == nil {
+		t.Fatalf("reading %s succeeded; a loopback address must be refused", srv.URL)
+	}
+}
+
+func TestFactHashesRoundTrip(t *testing.T) {
+	ctx := context.Background()
+	st := newTestStore(t)
+	h := &factHashes{api: ipc.NewStoreAPI(st)}
+
+	got, err := h.LastHash(ctx, "page")
+	if err != nil {
+		t.Fatalf("LastHash on a fresh store: %v", err)
+	}
+	if got != "" {
+		t.Errorf("LastHash = %q, want empty for a never-read page", got)
+	}
+	if err := h.SetHash(ctx, "page", "deadbeef"); err != nil {
+		t.Fatalf("SetHash: %v", err)
+	}
+	got, err = h.LastHash(ctx, "page")
+	if err != nil {
+		t.Fatalf("LastHash: %v", err)
+	}
+	if got != "deadbeef" {
+		t.Errorf("LastHash = %q, want deadbeef", got)
+	}
+	if key := hashKey("page"); key != "crawl:hash:page" {
+		t.Errorf("hashKey = %q", key)
+	}
+}
+
+// stubCrawlFetcher serves one fixed page to every URL, so queryWeb can be
+// exercised without a network or an allowlist.
+type stubCrawlFetcher struct{ body, ctype string }
+
+func (s *stubCrawlFetcher) Get(_ context.Context, u string) (*crawl.Response, error) {
+	ct := s.ctype
+	if ct == "" {
+		ct = "text/html"
+	}
+	if strings.HasSuffix(u, "/robots.txt") {
+		return &crawl.Response{URL: u, ContentType: "text/plain", Body: []byte("")}, nil
+	}
+	return &crawl.Response{URL: u, ContentType: ct, Body: []byte(s.body)}, nil
+}
+
+func buildWebHandler(c *crawl.Crawler) *reactiveHandler {
+	return &reactiveHandler{
+		replier: voice.NewStubReplier(),
+		phraser: phraser.NewStub(),
+		crawler: c,
+	}
+}
+
+func askWeb(h *reactiveHandler, q string) (string, bool) {
+	return h.queryWeb(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: q},
+	})
+}
+
+func TestQueryWebPassesWithoutAURL(t *testing.T) {
+	h := buildWebHandler(crawl.New(&stubCrawlFetcher{body: "<html><body>x</body></html>"}, crawl.Config{}))
+	if reply, ok := askWeb(h, "почему небо синее?"); ok {
+		t.Errorf("the web source claimed a question with no URL: %q", reply)
+	}
+}
+
+// Not configured is said out loud rather than falling through, so a small model
+// never invents a page's contents from its URL.
+func TestQueryWebSaysWhenNotConfigured(t *testing.T) {
+	h := buildWebHandler(nil)
+	reply, ok := askWeb(h, "посмотри https://example.org/page")
+	if !ok {
+		t.Fatal("the web source did not claim a question with a URL")
+	}
+	if !strings.Contains(reply, "не настроено") {
+		t.Errorf("reply = %q, want the not-configured answer", reply)
+	}
+}
+
+func TestQueryWebReadsThePage(t *testing.T) {
+	h := buildWebHandler(crawl.New(&stubCrawlFetcher{
+		body: "<html><head><title>Заголовок</title></head><body><p>текст страницы</p></body></html>",
+	}, crawl.Config{}))
+	reply, ok := askWeb(h, "посмотри https://example.org/page — что там?")
+	if !ok {
+		t.Fatal("the web source did not claim a question with a URL")
+	}
+	if !strings.Contains(reply, "текст страницы") {
+		t.Errorf("reply = %q, want the page text read back", reply)
+	}
+}
+
+func TestQueryWebRefusesNonHTML(t *testing.T) {
+	h := buildWebHandler(crawl.New(&stubCrawlFetcher{
+		body: "\x00\x01binary", ctype: "application/octet-stream",
+	}, crawl.Config{}))
+	reply, ok := askWeb(h, "почитай https://example.org/blob.bin")
+	if !ok {
+		t.Fatal("the web source did not claim a question with a URL")
+	}
+	if !strings.Contains(reply, "не получилось") {
+		t.Errorf("reply = %q, want the read-failed answer", reply)
+	}
+}
+
+// robots.txt is honoured on the answer path too, and she says so instead of
+// reporting a generic failure.
+func TestQueryWebObeysRobots(t *testing.T) {
+	h := buildWebHandler(crawl.New(&robotsDenyFetcher{}, crawl.Config{}))
+	reply, ok := askWeb(h, "посмотри https://example.org/private")
+	if !ok {
+		t.Fatal("the web source did not claim a question with a URL")
+	}
+	if !strings.Contains(reply, "robots.txt") {
+		t.Errorf("reply = %q, want the robots answer", reply)
+	}
+}
+
+type robotsDenyFetcher struct{}
+
+func (robotsDenyFetcher) Get(_ context.Context, u string) (*crawl.Response, error) {
+	if strings.HasSuffix(u, "/robots.txt") {
+		return &crawl.Response{URL: u, ContentType: "text/plain",
+			Body: []byte("User-agent: *\nDisallow: /private\n")}, nil
+	}
+	return &crawl.Response{URL: u, ContentType: "text/html", Body: []byte("<html>nope</html>")}, nil
+}

cmd/mavend/dayplan_test.go

@@ -0,0 +1,227 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/router"
+)
+
+// planAPI answers only DayPlan; every other call is unimplemented, which is
+// exactly the assertion that the plan source needs nothing else.
+type planAPI struct {
+	ipc.UnimplementedCoreAPI
+	plan  ipc.DayPlan
+	err   error
+	calls int
+}
+
+func (a *planAPI) DayPlan(context.Context) (ipc.DayPlan, error) {
+	a.calls++
+	if a.err != nil {
+		return ipc.DayPlan{}, a.err
+	}
+	return a.plan, nil
+}
+
+func planDay() time.Time { return time.Date(2026, 8, 3, 12, 0, 0, 0, time.UTC) }
+
+func samplePlan() ipc.DayPlan {
+	day := planDay()
+	mid := time.Date(2026, 8, 3, 0, 0, 0, 0, time.UTC)
+	return ipc.DayPlan{
+		Date: mid,
+		Items: []ipc.DayPlanItem{
+			{At: day.Add(-2 * time.Hour), Text: "Standup @ 10:00-10:30", Kind: "event"},
+			{At: day.Add(2 * time.Hour), Text: "Планёрка @ 14:00-14:30", Kind: "event", Uncertain: true},
+			{At: day.Add(6 * time.Hour), Text: "позвонить маме", Kind: "reminder"},
+		},
+		Spoken: "план на 03.08.2026: 10:00 — Standup @ 10:00-10:30; " +
+			"похоже, 14:00 — Планёрка @ 14:00-14:30; 18:00 — позвонить маме.",
+	}
+}
+
+func planHandler(api ipc.CoreAPI) *reactiveHandler {
+	return &reactiveHandler{api: api, now: planDay}
+}
+
+func TestQueryDayPlanRecitesTheDay(t *testing.T) {
+	api := &planAPI{plan: samplePlan()}
+	h := planHandler(api)
+	reply, ok := h.queryDayPlan(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "какие планы на сегодня?"},
+	})
+	if !ok {
+		t.Fatal("the plan source must claim a plan question")
+	}
+	if reply != api.plan.Spoken {
+		t.Errorf("reply = %q, want the core's spoken plan %q", reply, api.plan.Spoken)
+	}
+}
+
+// "что дальше?" is the rest of the day, not the whole day: what has already
+// happened is not a plan.
+func TestQueryDayPlanTrimsToRestOfDay(t *testing.T) {
+	h := planHandler(&planAPI{plan: samplePlan()})
+	reply, ok := h.queryDayPlan(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "что дальше?"},
+	})
+	if !ok {
+		t.Fatal("expected the plan source to claim it")
+	}
+	if strings.Contains(reply, "Standup") {
+		t.Errorf("a passed item must not be read back: %q", reply)
+	}
+	if !strings.Contains(reply, "Планёрка") || !strings.Contains(reply, "позвонить маме") {
+		t.Errorf("the rest of the day is missing: %q", reply)
+	}
+	// Provenance survives the trim.
+	if !strings.Contains(reply, "похоже,") {
+		t.Errorf("a relayed event must stay hedged: %q", reply)
+	}
+}
+
+// A question that is not about the plan must fall through, or the plan buries
+// the calendar listing and the weather behind it.
+func TestQueryDayPlanPassesOnEverythingElse(t *testing.T) {
+	for _, q := range []string{
+		"что у меня сегодня?",
+		"какие планы на завтра?",
+		"когда планёрка?",
+		"какая погода?",
+		"",
+	} {
+		api := &planAPI{plan: samplePlan()}
+		reply, ok := planHandler(api).queryDayPlan(context.Background(), &queryTurn{
+			dec: router.Decision{Intent: router.IntentQuery, Utterance: q},
+		})
+		if ok {
+			t.Errorf("%q was claimed by the plan source (reply %q)", q, reply)
+		}
+		if api.calls != 0 {
+			t.Errorf("%q hit the core for a plan it does not want", q)
+		}
+	}
+}
+
+func TestQueryDayPlanCoreFailure(t *testing.T) {
+	h := planHandler(&planAPI{err: errors.New("socket closed")})
+	reply, ok := h.queryDayPlan(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "план на сегодня"},
+	})
+	if !ok {
+		t.Fatal("a failed plan read must still answer, not fall through to RAG")
+	}
+	if reply != "не получилось собрать план." {
+		t.Errorf("reply = %q", reply)
+	}
+}
+
+// The day plan must sit before the calendar listing: both match "…на сегодня",
+// and the more specific matcher has to get first refusal (see #373 for what
+// happens when the order is wrong).
+func TestDayPlanSourcePrecedesCalendar(t *testing.T) {
+	plan, cal := -1, -1
+	for i, s := range querySources {
+		switch s.name {
+		case "day-plan":
+			plan = i
+		case "calendar":
+			cal = i
+		}
+	}
+	if plan < 0 || cal < 0 {
+		t.Fatalf("sources missing: day-plan=%d calendar=%d", plan, cal)
+	}
+	if plan > cal {
+		t.Errorf("day-plan at %d must come before calendar at %d", plan, cal)
+	}
+}
+
+// habitAPI answers only RecentFacts — the whole input the behaviour profile
+// needs (Vikunja #254). Nothing is asked of the LLM, so nothing else is wired.
+type habitAPI struct {
+	ipc.UnimplementedCoreAPI
+	facts []ipc.Fact
+	err   error
+	calls int
+}
+
+func (a *habitAPI) RecentFacts(_ context.Context, _ int) ([]ipc.Fact, error) {
+	a.calls++
+	return a.facts, a.err
+}
+
+// tuesdayFacts — n weekly Tuesday rows for key, ending before now.
+func tuesdayFacts(key string, hh, weeks int, now time.Time) []ipc.Fact {
+	d := now
+	for d.Weekday() != time.Tuesday {
+		d = d.AddDate(0, 0, -1)
+	}
+	var out []ipc.Fact
+	for i := 0; i < weeks; i++ {
+		day := d.AddDate(0, 0, -7*i)
+		out = append(out, ipc.Fact{
+			Ts:   time.Date(day.Year(), day.Month(), day.Day(), hh, 0, 0, 0, now.Location()),
+			Kind: "self",
+			Key:  key,
+		})
+	}
+	return out
+}
+
+func TestQueryHabitsAnswersFromCountedFacts(t *testing.T) {
+	now := planDay() // a Monday
+	api := &habitAPI{facts: tuesdayFacts("workout", 19, 4, now)}
+	h := &reactiveHandler{api: api, now: func() time.Time { return now }}
+
+	reply, ok := h.queryHabits(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "что я обычно делаю по вторникам?"},
+	})
+	if !ok {
+		t.Fatal("the habit source must claim a habit question")
+	}
+	if want := "по вторникам ты обычно тренируешься около 19:00."; reply != want {
+		t.Errorf("reply = %q, want %q", reply, want)
+	}
+}
+
+func TestQueryHabitsPassesOnEverythingElse(t *testing.T) {
+	now := planDay()
+	for _, q := range []string{"что я делаю в среду?", "что у меня сегодня?", "какие планы на сегодня?", ""} {
+		api := &habitAPI{}
+		h := &reactiveHandler{api: api, now: func() time.Time { return now }}
+		if reply, ok := h.queryHabits(context.Background(), &queryTurn{
+			dec: router.Decision{Intent: router.IntentQuery, Utterance: q},
+		}); ok {
+			t.Errorf("%q was claimed by the habit source (reply %q)", q, reply)
+		}
+		if api.calls != 0 {
+			t.Errorf("%q scanned the fact log for a profile it does not want", q)
+		}
+	}
+}
+
+// Both specific sources must precede the calendar listing, which matches any
+// utterance naming a day.
+func TestHabitSourcePrecedesCalendar(t *testing.T) {
+	habits, cal := -1, -1
+	for i, s := range querySources {
+		switch s.name {
+		case "habits":
+			habits = i
+		case "calendar":
+			cal = i
+		}
+	}
+	if habits < 0 || cal < 0 {
+		t.Fatalf("sources missing: habits=%d calendar=%d", habits, cal)
+	}
+	if habits > cal {
+		t.Errorf("habits at %d must come before calendar at %d", habits, cal)
+	}
+}

cmd/mavend/feeds.go

@@ -0,0 +1,194 @@
+// mavend/feeds.go — the driver for RSS/Atom reading (Vikunja #258,
+// docs/plans/13-rss-news-feeds.md). The reader itself is pure and lives in
+// internal/rss; this is the impure half: a ticker, the guarded fetcher, and the
+// two adapters that let a pure package talk to the store.
+//
+// Why in-core rather than its own daemon like mavmaild and mavpoll: those two
+// hold a CREDENTIAL (an IMAP password, a zenmoney token), and the reason they
+// are separate processes is that core must never see it. A feed URL is public,
+// there is no secret to isolate, and a whole extra binary and compose service
+// would buy nothing. The other half of the mavpoll precedent — off unless
+// configured — is kept: no `feeds` block, no poller, no outbound request.
+//
+// It is its own goroutine, not a step on the tick: the tick has a delivery
+// deadline behind it, and a feed read is a network round-trip that nobody is
+// waiting on.
+//
+// Nothing here dispatches. A feed that announced itself would be a nag, so the
+// only output is notes with source "rss:<feed>", which the answer path reads
+// when he asks ("что нового в лентах?" — see queryFeeds in actions_query.go).
+package main
+
+import (
+	"context"
+	"log"
+	"net/url"
+	"time"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/rss"
+	"github.com/kami/maven/internal/stt"
+	"github.com/kami/maven/internal/webfetch"
+)
+
+// feedWorker — ticker + poller.
+type feedWorker struct {
+	poller   *rss.Poller
+	interval time.Duration
+}
+
+// feedTickInterval — how often the worker asks the poller what is due. Per-feed
+// cadence is the poller's business; this is just the granularity.
+const feedTickInterval = 5 * time.Minute
+
+// newFeedWorker wires feed reading, or returns nil when it must not run:
+// no `feeds` block (the normal case), or nothing valid in it. Every caller
+// checks for nil.
+func newFeedWorker(api ipc.CoreAPI, emb router.Embedder, cfg *config.Config) *feedWorker {
+	if cfg.Feeds == nil {
+		return nil
+	}
+	fc := cfg.Feeds
+
+	feeds := make([]rss.FeedConfig, 0, len(fc.Sources))
+	hosts := append([]string(nil), fc.AllowHosts...)
+	for _, s := range fc.Sources {
+		feeds = append(feeds, rss.FeedConfig{
+			Name:     s.Name,
+			URL:      s.URL,
+			Category: s.Category,
+			Interval: time.Duration(s.Interval),
+			Include:  s.Include,
+			Exclude:  s.Exclude,
+		})
+		// Each configured feed's own host is allowed. The allowlist is then
+		// exactly "the feeds he asked for", so a redirect off to somewhere else
+		// is refused by the fetcher rather than followed.
+		if u, err := url.Parse(s.URL); err == nil && u.Hostname() != "" {
+			hosts = append(hosts, u.Hostname())
+		}
+	}
+
+	fetcher := webfetch.New(webfetch.Config{
+		AllowHosts: hosts,
+		Timeout:    time.Duration(fc.Timeout),
+		MaxBytes:   fc.MaxBytes,
+	})
+	poller := rss.NewPoller(feeds, &feedFetcher{f: fetcher}, api, &factMarks{api: api},
+		embedderFor(emb), nil, rss.Config{
+			DefaultInterval: time.Duration(fc.PollInterval),
+			MaxItems:        fc.MaxItems,
+			MaxAge:          time.Duration(fc.MaxAge),
+		})
+	if poller == nil {
+		log.Printf("feeds: configured but nothing pollable — feed reading disabled")
+		return nil
+	}
+	log.Printf("feeds: reading %d feed(s), checking what is due every %s", len(feeds), feedTickInterval)
+	return &feedWorker{poller: poller, interval: feedTickInterval}
+}
+
+// run polls what is due until ctx is canceled. The first round runs immediately
+// so a restart does not blind her for the first interval; it writes notes only,
+// so an early round cannot startle anyone.
+func (w *feedWorker) run(ctx context.Context) {
+	w.poller.PollDue(ctx, time.Now())
+	t := time.NewTicker(w.interval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case now := <-t.C:
+			w.poller.PollDue(ctx, now)
+		}
+	}
+}
+
+// embedderOf — the voice wiring's embedder, or nil when voice is not wired.
+// Feed notes are embedded with the SAME model the rest of the store uses, or not
+// at all; a second embedder would write vectors nothing can search.
+func embedderOf(w *voiceWiring) router.Embedder {
+	if w == nil {
+		return nil
+	}
+	return w.embedder
+}
+
+// transcriberOf — the STT the voice path is using, or nil when voice is off.
+// The meeting recorder reuses it rather than dialling mavsttd a second time:
+// Maven has one speech-to-text engine and adding a second would mean two
+// whisper contexts competing for the same iGPU.
+func transcriberOf(w *voiceWiring) stt.Transcriber {
+	if w == nil {
+		return nil
+	}
+	return w.transcriber
+}
+
+// feedFetcher adapts webfetch to rss.Fetcher — the pure package names the two
+// fields it needs and stays free of net/http.
+type feedFetcher struct{ f *webfetch.Fetcher }
+
+func (a *feedFetcher) Get(ctx context.Context, u string) (*rss.Body, error) {
+	resp, err := a.f.Get(ctx, u)
+	if err != nil {
+		return nil, err
+	}
+	return &rss.Body{Bytes: resp.Body}, nil
+}
+
+// factMarks stores "how far this feed was read" as a config fact, the same
+// mechanism the plan named and the same one the pattern tick uses for its own
+// bookkeeping. Durable, inspectable on /dash, and cheap.
+type factMarks struct{ api ipc.CoreAPI }
+
+func markKey(feed string) string { return "rss:latest:" + feed }
+
+func (m *factMarks) LastMark(ctx context.Context, feed string) (time.Time, error) {
+	f, err := m.api.LatestFact(ctx, markKey(feed))
+	if err != nil {
+		// No mark yet is not an error worth propagating: the poller treats a
+		// zero time as a cold start.
+		return time.Time{}, nil
+	}
+	t, err := time.Parse(time.RFC3339, f.Value)
+	if err != nil {
+		return time.Time{}, nil
+	}
+	return t, nil
+}
+
+func (m *factMarks) SetMark(ctx context.Context, feed string, at time.Time) error {
+	_, err := m.api.WriteFact(ctx, ipc.WriteFactReq{
+		Ts:         time.Now(),
+		Kind:       "config",
+		Key:        markKey(feed),
+		Value:      at.UTC().Format(time.RFC3339),
+		Source:     "poll:rss",
+		Confidence: 1.0,
+	})
+	return err
+}
+
+// embedderFor adapts router.Embedder to rss.Embedder, and returns nil when
+// there is none — a note without a vector is still a note the recent-notes path
+// can read.
+//
+// EmbedPassage, not Embed: a feed item is text being searched FOR, and the e5
+// embedder is asymmetric. Getting this backwards makes the item unfindable by
+// the question that should have matched it.
+func embedderFor(emb router.Embedder) rss.Embedder {
+	if emb == nil {
+		return nil
+	}
+	return passageEmbedder{emb}
+}
+
+type passageEmbedder struct{ e router.Embedder }
+
+func (p passageEmbedder) Embed(ctx context.Context, text string) ([]float32, error) {
+	return router.EmbedPassage(ctx, p.e, text)
+}

cmd/mavend/feeds_test.go

@@ -0,0 +1,177 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/phraser"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/rss"
+	"github.com/kami/maven/internal/voice"
+)
+
+// buildFeedHandler — a handler with the given feed notes already stored. No
+// embedder: the feed source answers from recent notes by source, which is what
+// makes it work for notes written before an embedder existed.
+func buildFeedHandler(t *testing.T, feedsOn bool, notes ...ipc.Note) *reactiveHandler {
+	t.Helper()
+	ctx := context.Background()
+	st := newTestStore(t)
+	now := time.Now()
+	for i, n := range notes {
+		ts := now.Add(time.Duration(i) * time.Minute)
+		if _, err := st.WriteNote(ctx, ts, n.Text, nil, n.Source); err != nil {
+			t.Fatalf("WriteNote: %v", err)
+		}
+	}
+	return &reactiveHandler{
+		api:      ipc.NewStoreAPI(st),
+		replier:  voice.NewStubReplier(),
+		phraser:  phraser.NewStub(),
+		now:      func() time.Time { return now },
+		feedsOn:  feedsOn,
+		embedder: nil,
+	}
+}
+
+func askFeeds(t *testing.T, h *reactiveHandler, q string) (string, bool) {
+	t.Helper()
+	return h.queryFeeds(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: q},
+	})
+}
+
+func TestQueryFeedsReadsFeedNotes(t *testing.T) {
+	h := buildFeedHandler(t, true,
+		ipc.Note{Text: "Новая уязвимость в ядре [технологии]\nпатч вышел\nhttps://example.org/a", Source: "rss:habr"},
+		ipc.Note{Text: "что-то он сам сказал", Source: "tap:voice"},
+	)
+	reply, ok := askFeeds(t, h, "что нового в лентах?")
+	if !ok {
+		t.Fatal("the feed source did not claim the question")
+	}
+	if !strings.Contains(reply, "уязвимость") {
+		t.Errorf("reply = %q, want the headline", reply)
+	}
+	if strings.Contains(reply, "он сам сказал") {
+		t.Errorf("a note he dictated leaked into the feed answer: %q", reply)
+	}
+	// She reads the headline, not the summary and not the URL.
+	if strings.Contains(reply, "https://") || strings.Contains(reply, "патч вышел") {
+		t.Errorf("reply = %q, want the title line only", reply)
+	}
+}
+
+func TestQueryFeedsByCategory(t *testing.T) {
+	h := buildFeedHandler(t, true,
+		ipc.Note{Text: "Релиз ядра [технологии]", Source: "rss:habr"},
+		ipc.Note{Text: "Выборы отложены [политика]", Source: "rss:news"},
+	)
+	reply, ok := askFeeds(t, h, "что нового по технологиям?")
+	if !ok {
+		t.Fatal("not claimed")
+	}
+	if !strings.Contains(reply, "ядра") || strings.Contains(reply, "Выборы") {
+		t.Fatalf("reply = %q, want only the технологии item", reply)
+	}
+	reply, _ = askFeeds(t, h, "что нового по спорту?")
+	if !strings.Contains(reply, "ничего") {
+		t.Fatalf("reply = %q, want an honest empty answer for an unread category", reply)
+	}
+}
+
+// "не настроены" and "ничего нового" are different truths, and neither may be
+// answered by the model inventing a bulletin.
+func TestQueryFeedsOffAndEmptyDiffer(t *testing.T) {
+	off := buildFeedHandler(t, false)
+	reply, ok := askFeeds(t, off, "что нового?")
+	if !ok || !strings.Contains(reply, "не настроены") {
+		t.Fatalf("feeds off: reply = %q, ok = %v", reply, ok)
+	}
+	on := buildFeedHandler(t, true)
+	reply, ok = askFeeds(t, on, "что нового?")
+	if !ok || !strings.Contains(reply, "ничего нового") {
+		t.Fatalf("feeds on but empty: reply = %q, ok = %v", reply, ok)
+	}
+}
+
+func TestQueryFeedsPassesOnANonFeedQuestion(t *testing.T) {
+	h := buildFeedHandler(t, true)
+	if reply, ok := askFeeds(t, h, "напомни полить цветы"); ok {
+		t.Fatalf("claimed an unrelated question with %q", reply)
+	}
+}
+
+// The mark is what stops a restart from re-noting yesterday's headlines, so the
+// fact round-trip is worth a test of its own.
+func TestFactMarksRoundTrip(t *testing.T) {
+	st := newTestStore(t)
+	m := &factMarks{api: ipc.NewStoreAPI(st)}
+	ctx := context.Background()
+
+	at, err := m.LastMark(ctx, "habr")
+	if err != nil || !at.IsZero() {
+		t.Fatalf("no mark yet: got %v, %v — want zero time and no error", at, err)
+	}
+	want := time.Date(2026, 7, 28, 10, 0, 0, 0, time.UTC)
+	if err := m.SetMark(ctx, "habr", want); err != nil {
+		t.Fatal(err)
+	}
+	got, err := m.LastMark(ctx, "habr")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !got.Equal(want) {
+		t.Fatalf("mark = %v, want %v", got, want)
+	}
+}
+
+// Off unless configured, checked at the wiring seam: no `feeds` block ⇒ no
+// worker ⇒ no outbound request is possible.
+func TestNewFeedWorkerOffByDefault(t *testing.T) {
+	st := newTestStore(t)
+	api := ipc.NewStoreAPI(st)
+	if w := newFeedWorker(api, nil, &config.Config{}); w != nil {
+		t.Fatal("a config with no feeds block wired a feed worker")
+	}
+	// An empty sources list is normalised to "off" by config.Load; the worker
+	// refuses it too, so a hand-built Config cannot switch it on by accident.
+	if w := newFeedWorker(api, nil, &config.Config{Feeds: &config.FeedsConfig{}}); w != nil {
+		t.Fatal("an empty sources list wired a feed worker")
+	}
+	cfg := &config.Config{Feeds: &config.FeedsConfig{Sources: []config.FeedSourceConfig{
+		{Name: "habr", URL: "https://example.org/rss"},
+	}}}
+	w := newFeedWorker(api, nil, cfg)
+	if w == nil {
+		t.Fatal("a configured feed did not wire a worker")
+	}
+	if got := w.poller.Feeds(); len(got) != 1 || got[0].Name != "habr" {
+		t.Fatalf("feeds = %+v", got)
+	}
+}
+
+// The fetcher the worker builds must be allowlisted to the configured feeds and
+// nothing else — the crawler's SSRF guards are only worth as much as the
+// allowlist handed to them.
+func TestFeedWorkerFetcherIsAllowlisted(t *testing.T) {
+	cfg := &config.Config{Feeds: &config.FeedsConfig{Sources: []config.FeedSourceConfig{
+		{Name: "habr", URL: "https://feeds.example.org/rss"},
+	}}}
+	w := newFeedWorker(ipc.NewStoreAPI(newTestStore(t)), nil, cfg)
+	if w == nil {
+		t.Fatal("no worker")
+	}
+	// PollFeed goes through the guarded fetcher; a feed URL pointing at the box
+	// itself must fail rather than be read.
+	_, err := w.poller.PollFeed(context.Background(), rss.FeedConfig{
+		Name: "evil", URL: "http://127.0.0.1:9100/mcp",
+	}, time.Now())
+	if err == nil {
+		t.Fatal("the poller fetched a private address")
+	}
+}

cmd/mavend/mail.go

@@ -0,0 +1,157 @@
+// mavend/mail.go — core's half of the email reader (Vikunja #246,
+// docs/plans/01-email-reader.md).
+//
+// The split: cmd/mavmaild holds the IMAP credential, connects to the mailbox
+// and converts messages to plaintext; it hands each message to core over
+// ipc.MethodIngestMail. Core runs the extraction on the resident model —
+// llama-server lives in this process, spawned by the phraser — and writes what
+// comes back through the one task intake seam.
+//
+// What this file may produce is exactly one thing: rows in `tasks` with status
+// "candidate". No fact, no reminder, no note, no nudge, no calendar event. A
+// 1.7B misreading a mail can therefore put a wrong line on a review page and
+// nothing else; it can never make Maven speak, and it can never make her
+// recite something out of an advert as true.
+//
+// Off unless configured twice over: no `email` block in mavend.json ⇒ the IPC
+// method does not exist; no llama-server phraser ⇒ same. A reader pointed at a
+// core that is not set up for mail gets ErrUnknownMethod rather than silence.
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/email"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/phraser"
+	"github.com/kami/maven/internal/store"
+)
+
+// evidenceMaxChars — how much of the subject line is kept as a candidate's
+// evidence. Enough to recognise the mail on /tasks, not enough to turn the task
+// list into a copy of his mailbox.
+const evidenceMaxChars = 160
+
+// mailIntake — extraction + capture for one message at a time.
+type mailIntake struct {
+	st      *store.Store
+	ex      *email.Extractor
+	timeout time.Duration
+	now     func() time.Time
+}
+
+// newMailIntake returns nil when mail ingestion must not be available, which is
+// the default. Both preconditions are real:
+//
+//   - no cfg.Email ⇒ not configured, and a capability is off unless configured;
+//   - no llama-server phraser ⇒ nothing to extract with. There is deliberately
+//     no keyword fallback: "the subject line became a task" is not extraction,
+//     it is a mailbox rendered as a to-do list, and it would fill the review
+//     page faster than he could clear it.
+func newMailIntake(st *store.Store, phr phraser.Phraser, cfg *config.Config) *mailIntake {
+	if cfg.Email == nil {
+		return nil
+	}
+	lp, ok := phr.(*phraser.LLMPhraser)
+	if !ok {
+		log.Printf("mail intake: configured but no llama-server phraser — mail ingestion disabled")
+		return nil
+	}
+	timeout := time.Duration(cfg.Email.Timeout)
+	if timeout <= 0 {
+		timeout = config.DefaultEmailTimeout
+	}
+	ex := email.NewExtractor(llmClientFor(lp, timeout), cfg.Email.MaxTasks, contextBlockFn(cfg, time.Now))
+	log.Printf("mail intake: enabled (max %d candidates per message, timeout %s)", cfg.Email.MaxTasks, timeout)
+	return &mailIntake{st: st, ex: ex, timeout: timeout, now: time.Now}
+}
+
+// ingest handles one ipc.MethodIngestMail call.
+//
+// Junk and empty messages are answered Skipped without touching the model — the
+// reader's header filter is what keeps the resident model off newsletters.
+//
+// Every candidate is captured with Status "candidate", Source "email:<mailbox>"
+// and the subject as Evidence. CaptureTask dedupes on normalised text among
+// live rows, so a mailbox re-read after a restart produces Created=0 rather
+// than a second copy of every task.
+func (m *mailIntake) ingest(ctx context.Context, req ipc.IngestMailReq) (ipc.IngestMailResp, error) {
+	msg := email.Message{
+		UID:     req.UID,
+		From:    req.From,
+		Subject: req.Subject,
+		Date:    req.Date,
+		Body:    req.Body,
+		Junk:    req.Junk,
+	}
+	if msg.Junk || (msg.Subject == "" && msg.Body == "") {
+		return ipc.IngestMailResp{Skipped: true}, nil
+	}
+
+	ctx, cancel := context.WithTimeout(ctx, m.timeout)
+	defer cancel()
+	cands, err := m.ex.Extract(ctx, msg)
+	if err != nil {
+		// The error from internal/email never carries mail text; keep it that way
+		// by not adding the subject here.
+		return ipc.IngestMailResp{}, fmt.Errorf("mail intake: uid %d: %w", req.UID, err)
+	}
+	if len(cands) == 0 {
+		return ipc.IngestMailResp{}, nil
+	}
+
+	source := email.SourcePrefix + req.Mailbox
+	evidence := truncateRunes(req.Subject, evidenceMaxChars)
+	now := m.now()
+	var resp ipc.IngestMailResp
+	for _, c := range cands {
+		t := store.Task{
+			CreatedTs: now,
+			Text:      c.Text,
+			Source:    source,
+			Evidence:  evidence,
+			// The one status this path may ever write. Anything Maven derived from
+			// something she read is a suggestion until he confirms it on /tasks.
+			Status: store.TaskCandidate,
+		}
+		if due, ok := email.ParseDue(c.Due); ok {
+			t.Due = &due
+		}
+		id, created, err := m.st.CaptureTask(ctx, t)
+		if err != nil {
+			return resp, fmt.Errorf("mail intake: capture: %w", err)
+		}
+		resp.TaskIDs = append(resp.TaskIDs, id)
+		if created {
+			resp.Created++
+		}
+	}
+	// Counts only: the log line names the mailbox and the UID, never the subject,
+	// the sender or the task text. Reviewing a candidate is what /tasks is for.
+	log.Printf("mail intake: %s uid %d → %d candidate(s), %d new", source, req.UID, len(cands), resp.Created)
+	return resp, nil
+}
+
+// wireMailIntake installs the IPC hook, or leaves it nil so the method reports
+// ErrUnknownMethod. Called on both startup paths (unlocked boot and passkey
+// unlock) so mail behaves the same either way.
+func wireMailIntake(srv *ipc.Server, st *store.Store, phr phraser.Phraser, cfg *config.Config) {
+	mi := newMailIntake(st, phr, cfg)
+	if mi == nil {
+		return
+	}
+	srv.IngestMailFn = mi.ingest
+}
+
+// truncateRunes cuts a string to n runes, marking the cut.
+func truncateRunes(s string, n int) string {
+	r := []rune(s)
+	if len(r) <= n {
+		return s
+	}
+	return string(r[:n]) + "…"
+}

cmd/mavend/mail_test.go

@@ -0,0 +1,182 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/email"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/llm"
+	"github.com/kami/maven/internal/store"
+)
+
+// mailLLM — a canned extraction reply.
+type mailLLM struct {
+	reply string
+	calls int
+}
+
+func (m *mailLLM) Complete(_ context.Context, _ llm.Req) (string, error) {
+	m.calls++
+	return m.reply, nil
+}
+
+func newTestIntake(t *testing.T, reply string) (*mailIntake, *store.Store, *mailLLM) {
+	t.Helper()
+	st := newTestStore(t)
+	fake := &mailLLM{reply: reply}
+	return &mailIntake{
+		st:      st,
+		ex:      email.NewExtractor(fake, 0, nil),
+		timeout: 5 * time.Second,
+		now:     func() time.Time { return time.Date(2026, 8, 1, 10, 0, 0, 0, time.UTC) },
+	}, st, fake
+}
+
+func ingestReq() ipc.IngestMailReq {
+	return ipc.IngestMailReq{
+		Mailbox: "INBOX", UID: 42,
+		From:    "billing@isp.example",
+		Subject: "Счёт за интернет",
+		Body:    "Оплатите счёт до 5 августа.",
+	}
+}
+
+// The one property that matters: a mail-derived task is a candidate, attributed
+// to the mailbox, with the subject as reviewable evidence — and nothing else is
+// written.
+func TestIngestCapturesCandidates(t *testing.T) {
+	mi, st, _ := newTestIntake(t, `[{"text":"оплатить счёт за интернет","due":"2026-08-05"}]`)
+	resp, err := mi.ingest(context.Background(), ingestReq())
+	if err != nil {
+		t.Fatalf("ingest: %v", err)
+	}
+	if resp.Created != 1 || len(resp.TaskIDs) != 1 {
+		t.Fatalf("resp = %+v, want one created task", resp)
+	}
+	tasks, err := st.ListTasks(context.Background(), "")
+	if err != nil {
+		t.Fatalf("list: %v", err)
+	}
+	if len(tasks) != 1 {
+		t.Fatalf("got %d tasks, want 1", len(tasks))
+	}
+	got := tasks[0]
+	if got.Status != store.TaskCandidate {
+		t.Errorf("status = %q, want %q — mail may only produce candidates", got.Status, store.TaskCandidate)
+	}
+	if got.Source != "email:INBOX" {
+		t.Errorf("source = %q, want email:INBOX", got.Source)
+	}
+	if got.Evidence != "Счёт за интернет" {
+		t.Errorf("evidence = %q, want the subject line", got.Evidence)
+	}
+	if got.Due == nil || got.Due.Format("2006-01-02") != "2026-08-05" {
+		t.Errorf("due = %v, want 2026-08-05", got.Due)
+	}
+	// Nothing else may have been written: no reminder, no fact.
+	rem, err := st.ListReminders(context.Background(), 10)
+	if err != nil {
+		t.Fatalf("list reminders: %v", err)
+	}
+	if len(rem) != 0 {
+		t.Errorf("mail created %d reminders; a misread mail must never be able to fire", len(rem))
+	}
+}
+
+// Re-reading a mailbox must not grow the list — CaptureTask dedupes among live
+// rows, and the intake relies on exactly that.
+func TestIngestSameMailTwiceIsIdempotent(t *testing.T) {
+	mi, st, _ := newTestIntake(t, `[{"text":"оплатить счёт","due":""}]`)
+	if _, err := mi.ingest(context.Background(), ingestReq()); err != nil {
+		t.Fatalf("first ingest: %v", err)
+	}
+	resp, err := mi.ingest(context.Background(), ingestReq())
+	if err != nil {
+		t.Fatalf("second ingest: %v", err)
+	}
+	if resp.Created != 0 || len(resp.TaskIDs) != 1 {
+		t.Errorf("resp = %+v, want the existing row and Created=0", resp)
+	}
+	tasks, _ := st.ListTasks(context.Background(), "")
+	if len(tasks) != 1 {
+		t.Errorf("got %d tasks after two reads, want 1", len(tasks))
+	}
+}
+
+func TestIngestJunkSkipsTheModel(t *testing.T) {
+	mi, st, fake := newTestIntake(t, `[{"text":"купить со скидкой","due":""}]`)
+	req := ingestReq()
+	req.Junk = true
+	resp, err := mi.ingest(context.Background(), req)
+	if err != nil {
+		t.Fatalf("ingest: %v", err)
+	}
+	if !resp.Skipped || resp.Created != 0 {
+		t.Errorf("resp = %+v, want skipped", resp)
+	}
+	if fake.calls != 0 {
+		t.Errorf("model called %d times for junk, want 0", fake.calls)
+	}
+	if tasks, _ := st.ListTasks(context.Background(), ""); len(tasks) != 0 {
+		t.Errorf("junk produced %d tasks, want 0", len(tasks))
+	}
+}
+
+func TestIngestEmptyMessageSkipped(t *testing.T) {
+	mi, _, fake := newTestIntake(t, "[]")
+	resp, err := mi.ingest(context.Background(), ipc.IngestMailReq{Mailbox: "INBOX", UID: 1})
+	if err != nil || !resp.Skipped {
+		t.Fatalf("resp = %+v, err = %v; want skipped", resp, err)
+	}
+	if fake.calls != 0 {
+		t.Errorf("model called %d times for an empty message, want 0", fake.calls)
+	}
+}
+
+func TestIngestNoTasksWritesNothing(t *testing.T) {
+	mi, st, _ := newTestIntake(t, "[]")
+	resp, err := mi.ingest(context.Background(), ingestReq())
+	if err != nil {
+		t.Fatalf("ingest: %v", err)
+	}
+	if resp.Created != 0 || len(resp.TaskIDs) != 0 || resp.Skipped {
+		t.Errorf("resp = %+v, want nothing captured and not skipped", resp)
+	}
+	if tasks, _ := st.ListTasks(context.Background(), ""); len(tasks) != 0 {
+		t.Errorf("got %d tasks, want 0", len(tasks))
+	}
+}
+
+func TestIngestTruncatesEvidence(t *testing.T) {
+	mi, st, _ := newTestIntake(t, `[{"text":"дело","due":""}]`)
+	req := ingestReq()
+	req.Subject = strings.Repeat("щ", 400)
+	if _, err := mi.ingest(context.Background(), req); err != nil {
+		t.Fatalf("ingest: %v", err)
+	}
+	tasks, _ := st.ListTasks(context.Background(), "")
+	if len(tasks) != 1 {
+		t.Fatalf("got %d tasks, want 1", len(tasks))
+	}
+	if n := len([]rune(tasks[0].Evidence)); n > evidenceMaxChars+1 {
+		t.Errorf("evidence kept %d runes, want ≤ %d", n, evidenceMaxChars)
+	}
+}
+
+// Off unless configured: no email block ⇒ no intake, so the IPC method does not
+// exist at all.
+func TestNewMailIntakeOffWithoutConfig(t *testing.T) {
+	st := newTestStore(t)
+	if mi := newMailIntake(st, nil, &config.Config{}); mi != nil {
+		t.Error("no email block must mean no mail intake")
+	}
+	// Configured but with a non-LLM phraser: still off — there is no fallback
+	// extraction, by design.
+	if mi := newMailIntake(st, nil, &config.Config{Email: &config.EmailConfig{}}); mi != nil {
+		t.Error("without a llama-server phraser there is nothing to extract with")
+	}
+}

cmd/mavend/main.go

@@ -169,6 +169,9 @@ func run(args []string) error {
 		coreAPI    ipc.CoreAPI
 		eco        *ecosystemWiring
 		factWorker *factEnrichmentWorker
+		evalWorker *memoryEvalWorker // nil ⇒ memory evaluation off (the default)
+		feedWkr    *feedWorker       // nil ⇒ no feed is read (the default)
+		crawlWkr   *crawlWorker      // nil ⇒ no page is watched (the default)
 	)
 
 	if !locked {
@@ -261,18 +264,25 @@ func run(args []string) error {
 		tickInterval := time.Duration(cfg.TickInterval)
 		repeatInterval := time.Duration(cfg.RepeatInterval)
 		autotuneInterval := time.Duration(cfg.AutotuneInterval)
-		tl = newTickLoop(st, gatherer, dispatcher, phr, rules, tickInterval, repeatInterval, autotuneInterval, cfg.Digest, routinesFromConfig(cfg.Routines), config.MorningRoutinesFromConfig(cfg.MorningRoutines))
+		tl = newTickLoop(st, gatherer, dispatcher, phr, rules, tickInterval, repeatInterval, autotuneInterval, cfg.Digest, routinesFromConfig(cfg.Routines), config.MorningRoutinesFromConfig(cfg.MorningRoutines), cfg.PatternProposals)
 		factWorker = newFactEnrichmentWorker(st, eco, time.Duration(cfg.FactEnrichmentInterval))
+		evalWorker = newMemoryEvalWorker(st, phr, cfg)
+		feedWkr = newFeedWorker(ipc.NewStoreAPI(st), embedderOf(voiceW), cfg)
+		crawlWkr = newCrawlWorker(newCrawler(cfg), ipc.NewStoreAPI(st), embedderOf(voiceW), cfg)
 
 		coreAPI = &daemonAPI{
 			CoreAPI:          ipc.NewStoreAPI(st),
 			getTrace:         tl.trace,
 			getMorningStatus: func(ctx context.Context) []ipc.MorningRoutineStatus { return tl.morningStatus(ctx, time.Now()) },
+			getDayPlan:       func(ctx context.Context) ipc.DayPlan { return tl.dayPlan(ctx, time.Now()) },
 		}
 		if voiceW != nil && voiceW.handler != nil {
 			api := coreAPI.(*daemonAPI)
 			api.chatFn = voiceW.handler.handleText
 		}
+		if voiceW != nil && voiceW.mcp != nil {
+			coreAPI.(*daemonAPI).getMCPServers = voiceW.mcp.status
+		}
 	} else {
 		// locked mode: no real store yet, so there's no meaningful CoreAPI to
 		// serve. srv.Check below is the actual guard — every CoreAPI call is
@@ -317,6 +327,25 @@ func run(args []string) error {
 
 	srv.StepUp = func(ctx context.Context) error { return passkeySess.Assert(ctx, auth.Scope{}) }
 
+	// Mail ingestion (Vikunja #246): the hook stays nil unless an email block is
+	// configured and there is a llama-server to extract with, in which case
+	// ipc.MethodIngestMail reports ErrUnknownMethod.
+	if !locked {
+		wireMailIntake(srv, st, phr, cfg)
+		wireModelSwap(srv, phr, cfg)
+		// Vision + the media blob store (Vikunja #252). Both stay dark without a
+		// media block; MethodDescribeImage answers ErrUnknownMethod then.
+		keeper := wireVision(ctx, srv, st, embedderOf(voiceW), cfg)
+		// The meeting recorder (Vikunja #253) shares that blob store and its
+		// retention loop. Off unless a capture block enables it, in which case
+		// all four capture methods answer ErrUnknownMethod.
+		wireCapture(srv, keeper, st, voiceW, phr, cfg)
+		// Voice identification (Vikunja #255). Enrolment plumbing only until a
+		// speaker-embedding model exists on disk; off entirely without a speaker
+		// block, so no wire path takes a voiceprint on a default box.
+		wireSpeaker(srv, st, cfg)
+	}
+
 	// WrapKeyFn — wraps the env key with a passkey credential public key and
 	// persists the wrapped blob. Only wired when the daemon has the key in
 	// memory (env key mode). Called by mavweb after passkey enrollment.
@@ -438,20 +467,32 @@ func run(args []string) error {
 			tickInterval := time.Duration(cfg.TickInterval)
 			repeatInterval := time.Duration(cfg.RepeatInterval)
 			autotuneInterval := time.Duration(cfg.AutotuneInterval)
-			tl = newTickLoop(st, gatherer, dispatcher, phr, rules, tickInterval, repeatInterval, autotuneInterval, cfg.Digest, routinesFromConfig(cfg.Routines), config.MorningRoutinesFromConfig(cfg.MorningRoutines))
+			tl = newTickLoop(st, gatherer, dispatcher, phr, rules, tickInterval, repeatInterval, autotuneInterval, cfg.Digest, routinesFromConfig(cfg.Routines), config.MorningRoutinesFromConfig(cfg.MorningRoutines), cfg.PatternProposals)
 			factWorker = newFactEnrichmentWorker(st, eco, time.Duration(cfg.FactEnrichmentInterval))
+			evalWorker = newMemoryEvalWorker(st, phr, cfg)
+			feedWkr = newFeedWorker(ipc.NewStoreAPI(st), embedderOf(voiceW), cfg)
+			crawlWkr = newCrawlWorker(newCrawler(cfg), ipc.NewStoreAPI(st), embedderOf(voiceW), cfg)
 
 			// Swap the CoreAPI from the locked placeholder to the real store adapter.
 			newAPI := &daemonAPI{
 				CoreAPI:          ipc.NewStoreAPI(st),
 				getTrace:         tl.trace,
 				getMorningStatus: func(ctx context.Context) []ipc.MorningRoutineStatus { return tl.morningStatus(ctx, time.Now()) },
+				getDayPlan:       func(ctx context.Context) ipc.DayPlan { return tl.dayPlan(ctx, time.Now()) },
 			}
 			if voiceW != nil && voiceW.handler != nil {
 				newAPI.chatFn = voiceW.handler.handleText
 			}
 			srv.SetAPI(newAPI)
 			srv.Check = (&auth.Gate{Enrollment: auth.NewFloorEnrollment(), Session: passkeySess}).Check
+			wireMailIntake(srv, st, phr, cfg)
+			wireModelSwap(srv, phr, cfg)
+			keeper := wireVision(ctx, srv, st, embedderOf(voiceW), cfg)
+			wireCapture(srv, keeper, st, voiceW, phr, cfg)
+			// Voice identification (Vikunja #255). Enrolment plumbing only until a
+			// speaker-embedding model exists on disk; off entirely without a speaker
+			// block, so no wire path takes a voiceprint on a default box.
+			wireSpeaker(srv, st, cfg)
 
 			// Start voice server.
 			if voiceW != nil {
@@ -476,6 +517,32 @@ func run(args []string) error {
 				factWorker.run(ctx)
 			}()
 
+			// Start background memory evaluation (nil unless configured).
+			if evalWorker != nil {
+				go func() {
+					evalWorker.run(ctx)
+				}()
+			}
+
+			// Start feed reading (nil unless configured).
+			if feedWkr != nil {
+				go func() {
+					feedWkr.run(ctx)
+				}()
+			}
+
+			// Start the watched-page crawls (nil unless configured).
+			if crawlWkr != nil {
+				go func() {
+					crawlWkr.run(ctx)
+				}()
+			}
+
+			// Keep MCP connections alive (nil unless configured).
+			if voiceW != nil && voiceW.mcp != nil {
+				go voiceW.mcp.run(ctx)
+			}
+
 			dl.unlock()
 			log.Printf("mavend: unlocked via passkey assertion")
 			return nil
@@ -514,6 +581,34 @@ func run(args []string) error {
 			defer wg.Done()
 			factWorker.run(ctx)
 		}()
+		if evalWorker != nil {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				evalWorker.run(ctx)
+			}()
+		}
+		if feedWkr != nil {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				feedWkr.run(ctx)
+			}()
+		}
+		if crawlWkr != nil {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				crawlWkr.run(ctx)
+			}()
+		}
+		if voiceW != nil && voiceW.mcp != nil {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+				voiceW.mcp.run(ctx)
+			}()
+		}
 	}
 
 	<-ctx.Done()

cmd/mavend/mcp.go

@@ -0,0 +1,154 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/mcp"
+	"github.com/kami/maven/internal/store"
+	"github.com/kami/maven/internal/webfetch"
+)
+
+// mcpRefreshInterval — how often the manager re-dials a server that is down.
+// The manager applies its own backoff on top, so this being short is cheap.
+const mcpRefreshInterval = time.Minute
+
+// mcpWiring — the MCP client, when the `mcp` block configures at least one
+// enabled server. nil ⇒ nothing was configured, nothing is connected, and an
+// allowlist row that happens to look like an MCP row refuses to run.
+//
+// It lives on the voice wiring because MCP tools ARE acts: they run through
+// tool.Executor, the enabled allowlist and the confirm turn, which only exist
+// on the voice/chat path. No voice surface ⇒ nothing that could call a tool.
+type mcpWiring struct {
+	mgr *mcp.Manager
+	st  *store.Store
+}
+
+// wireMCP builds the manager, connects, and proposes what it found. It never
+// fails the daemon: a server that is unreachable at boot is logged and retried,
+// because Maven starting is not contingent on someone else's process.
+func wireMCP(cfg *config.Config, st *store.Store) *mcpWiring {
+	servers := cfg.MCPServers()
+	if len(servers) == 0 {
+		return nil
+	}
+	limits := webfetch.Config{}
+	if cfg.MCP != nil {
+		limits.AllowHosts = cfg.MCP.AllowHosts
+		limits.DenyHosts = cfg.MCP.DenyHosts
+		limits.MaxBytes = cfg.MCP.MaxBytes
+		limits.Timeout = time.Duration(cfg.MCP.Timeout)
+	}
+	mgr, err := mcp.NewManager(mcp.WebfetchDoor(limits), servers)
+	if err != nil {
+		// Validation already ran in config.validate, so this is a programming
+		// error rather than a config one. Still not fatal: MCP off is a working
+		// Maven.
+		log.Printf("mcp: not wired: %v", err)
+		return nil
+	}
+	w := &mcpWiring{mgr: mgr, st: st}
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	mgr.Connect(ctx)
+	w.propose(ctx)
+	return w
+}
+
+// propose writes a 'proposed' allowlist row for every discovered tool. It does
+// NOT enable anything: a configured server is a place Maven may look, not a
+// capability she has. Kami enables what he wants on /tools, behind step-up,
+// which is the same gate a shell tool goes through.
+//
+// Re-running on every boot is idempotent — ProposeMCPTool never touches an
+// existing row, so a tool he disabled stays disabled and one he enabled keeps
+// the cmd he enabled it with.
+func (w *mcpWiring) propose(ctx context.Context) {
+	if w == nil {
+		return
+	}
+	now := time.Now()
+	fresh := 0
+	for _, t := range w.mgr.Tools() {
+		name := mcp.LocalName(t.Server, t.Name)
+		// No readOnlyHint ⇒ assume it mutates ⇒ the confirm turn. Being wrong
+		// in this direction only costs a question.
+		destructive := !t.ReadOnly
+		provenance := fmt.Sprintf("mcp %s/%s", t.Server, t.Name)
+		if t.Description != "" {
+			provenance += ": " + t.Description
+		}
+		ok, err := w.st.ProposeMCPTool(ctx, name, mcp.Scope(t.Server),
+			mcp.Cmd(t.Server, t.Name), destructive, provenance, now)
+		if err != nil {
+			log.Printf("mcp: propose %s: %v", name, err)
+			continue
+		}
+		if ok {
+			fresh++
+		}
+	}
+	if fresh > 0 {
+		log.Printf("mcp: %d new tool proposal(s) waiting on /tools", fresh)
+	}
+}
+
+// run re-dials downed servers and picks up tools that appeared, until ctx is
+// canceled.
+func (w *mcpWiring) run(ctx context.Context) {
+	if w == nil {
+		return
+	}
+	t := time.NewTicker(mcpRefreshInterval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			w.mgr.Refresh(ctx)
+			w.propose(ctx)
+		}
+	}
+}
+
+// status maps the manager's view onto the wire type the web surface reads.
+func (w *mcpWiring) status() []ipc.MCPServerStatus {
+	if w == nil {
+		return nil
+	}
+	in := w.mgr.Status()
+	out := make([]ipc.MCPServerStatus, 0, len(in))
+	for _, s := range in {
+		out = append(out, ipc.MCPServerStatus{
+			Name:      s.Name,
+			Transport: s.Transport,
+			Target:    s.Target,
+			Connected: s.Connected,
+			Server:    s.Server,
+			Tools:     s.Tools,
+			Err:       s.Err,
+		})
+	}
+	return out
+}
+
+func (w *mcpWiring) close() {
+	if w == nil {
+		return
+	}
+	_ = w.mgr.Close()
+}
+
+// caller is the tool.MCPCaller the executor gets, or nil when MCP is off.
+func (w *mcpWiring) caller() *mcp.Manager {
+	if w == nil {
+		return nil
+	}
+	return w.mgr
+}

cmd/mavend/mcp_test.go

@@ -0,0 +1,77 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/kami/maven/internal/config"
+)
+
+func TestWireMCPOffWhenUnconfigured(t *testing.T) {
+	st := newTestStore(t)
+	for name, cfg := range map[string]*config.Config{
+		"no block": {},
+		"nothing enabled": {MCP: &config.MCPConfig{Servers: []config.MCPServerConfig{
+			{Name: "vikunja", URL: "http://192.168.1.104:9100/mcp"},
+		}}},
+	} {
+		t.Run(name, func(t *testing.T) {
+			if w := wireMCP(cfg, st); w != nil {
+				t.Fatal("MCP must be off unless a server is configured AND enabled")
+			}
+		})
+	}
+	// nil wiring must be safe to use everywhere it is reachable.
+	var w *mcpWiring
+	w.close()
+	w.propose(context.Background())
+	if w.status() != nil || w.caller() != nil {
+		t.Fatal("a nil wiring must report nothing")
+	}
+}
+
+// An unreachable server must not stop the daemon, must be reported as down, and
+// must propose nothing.
+func TestWireMCPUnreachableServerIsNotFatal(t *testing.T) {
+	st := newTestStore(t)
+	w := wireMCP(&config.Config{MCP: &config.MCPConfig{Servers: []config.MCPServerConfig{{
+		Name: "dead", Command: "/nonexistent/mcp-server", Enabled: true,
+	}}}}, st)
+	if w == nil {
+		t.Fatal("a configured server should still wire")
+	}
+	defer w.close()
+	st2 := w.status()
+	if len(st2) != 1 || st2[0].Connected || st2[0].Err == "" {
+		t.Fatalf("status = %+v", st2)
+	}
+	tools, err := st.ListTools(context.Background(), "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(tools) != 0 {
+		t.Fatalf("a server that never answered must propose nothing, got %+v", tools)
+	}
+}
+
+// A url server whose address is private is refused by webfetch unless that
+// server sets allow_private. This is the guard the whole MCP path rides on, so
+// it is asserted here too, at the wiring level.
+func TestWireMCPPrivateURLRefusedWithoutAllowPrivate(t *testing.T) {
+	st := newTestStore(t)
+	w := wireMCP(&config.Config{MCP: &config.MCPConfig{Servers: []config.MCPServerConfig{{
+		Name: "lan", URL: "http://127.0.0.1:9100/mcp", Enabled: true,
+	}}}}, st)
+	if w == nil {
+		t.Fatal("should wire")
+	}
+	defer w.close()
+	s := w.status()[0]
+	if s.Connected {
+		t.Fatal("a loopback server must not connect without allow_private")
+	}
+	if !strings.Contains(s.Err, "private address") {
+		t.Fatalf("err = %q, want the private-address refusal", s.Err)
+	}
+}

cmd/mavend/memoryeval.go

@@ -0,0 +1,87 @@
+// mavend/memoryeval.go — the driver for background memory evaluation
+// (Vikunja #248). The evaluator itself is pure-ish and lives in
+// internal/memeval; this is the one impure part: a ticker, the store, and the
+// resident model's base URL.
+//
+// It is its own goroutine and NOT a step on the main tick, deliberately. The
+// tick runs every 60s and has a delivery deadline behind it; an evaluation is
+// a multi-second LLM round-trip on the same llama-server that answers voice
+// turns, and it happens hourly at most. Bolting it onto the tick would make
+// every hour's tick the slow one for no benefit.
+package main
+
+import (
+	"context"
+	"log"
+	"time"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/memeval"
+	"github.com/kami/maven/internal/phraser"
+	"github.com/kami/maven/internal/store"
+)
+
+// memoryEvalWorker — ticker + evaluator.
+type memoryEvalWorker struct {
+	eval     *memeval.Evaluator
+	interval time.Duration
+}
+
+// newMemoryEvalWorker wires the evaluation loop, or returns nil when it should
+// not run at all. nil is the normal case and every caller must handle it:
+//
+//   - no memory_eval config block ⇒ off (a capability is off unless configured);
+//   - no LLM phraser ⇒ nothing to evaluate with. There is no template fallback
+//     here on purpose: a "memory evaluation" assembled from string templates
+//     would be a fixed sentence pretending to be an observation.
+func newMemoryEvalWorker(st *store.Store, phr phraser.Phraser, cfg *config.Config) *memoryEvalWorker {
+	if cfg.MemoryEval == nil {
+		return nil
+	}
+	lp, ok := phr.(*phraser.LLMPhraser)
+	if !ok {
+		log.Printf("memory eval: configured but no llama-server phraser — evaluation disabled")
+		return nil
+	}
+	interval := time.Duration(cfg.MemoryEval.Interval)
+	if interval <= 0 {
+		interval = config.DefaultMemoryEvalInterval
+	}
+	// A generous per-request timeout: this is a long prompt to a Thinking model
+	// and nobody is waiting on the answer.
+	client := llmClientFor(lp, 5*time.Minute)
+	ev := memeval.NewEvaluator(st, st, client, memeval.Config{
+		MaxItems:      cfg.MemoryEval.MaxItems,
+		MinConfidence: cfg.MemoryEval.MinConfidence,
+		ContextBlock:  contextBlockFn(cfg, time.Now),
+	})
+	log.Printf("memory eval: enabled, every %s", interval)
+	return &memoryEvalWorker{eval: ev, interval: interval}
+}
+
+// run evaluates every interval until ctx is canceled.
+//
+// The first evaluation waits a full interval rather than firing at startup, the
+// opposite of the tick loop's cold-start behaviour. A tick that fires late is a
+// nudge that arrives late; an evaluation that fires late is nothing at all, and
+// the alternative is a heavy LLM call competing with startup — including with
+// the first voice turn after a restart.
+func (w *memoryEvalWorker) run(ctx context.Context) {
+	ticker := time.NewTicker(w.interval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case now := <-ticker.C:
+			obs, err := w.eval.Evaluate(ctx, now)
+			if err != nil {
+				log.Printf("memory eval: %v", err)
+				continue
+			}
+			for _, o := range obs {
+				log.Printf("memory eval: noted (%.2f, %s): %s", o.Conf, o.Action, o.Text)
+			}
+		}
+	}
+}

cmd/mavend/modelswap.go

@@ -0,0 +1,113 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"path/filepath"
+	"time"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/llm"
+	"github.com/kami/maven/internal/phraser"
+)
+
+// Swapping the resident model while the daemon runs (Vikunja #250).
+//
+// Off unless configured: with no phraser.swap_models allowlist the two IPC
+// methods are never wired, so they answer ErrUnknownMethod. When it is wired the
+// swap method is AuthStepUp (internal/auth), which means an authed human surface
+// only — there is no act, no intent and no timer that reaches it. The daemon
+// never decides to change its own brain.
+//
+// The allowlist is exact-match against paths a human wrote in mavend.json. The
+// request carries a path and llama-server is started with it as `-m`, so
+// anything looser would turn "swap the model" into "load any file on my disk".
+func wireModelSwap(srv *ipc.Server, phr phraser.Phraser, cfg *config.Config) {
+	if cfg.Phraser == nil || len(cfg.Phraser.SwapModels) == 0 {
+		return
+	}
+	lp, ok := phr.(*phraser.LLMPhraser)
+	if !ok {
+		log.Printf("model swap: phraser.swap_models is set but there is no llama-server phraser — swap disabled")
+		return
+	}
+	allowed := map[string]bool{}
+	for _, m := range cfg.Phraser.SwapModels {
+		allowed[filepath.Clean(m)] = true
+	}
+	// The configured model is always swappable back to, listed or not: the way
+	// out of a bad swap must not depend on remembering to allowlist the model
+	// you are already running.
+	allowed[filepath.Clean(cfg.Phraser.ModelPath)] = true
+
+	srv.SwapModelFn = func(ctx context.Context, req ipc.SwapModelReq) (ipc.SwapModelResp, error) {
+		path := filepath.Clean(req.ModelPath)
+		if !allowed[path] {
+			log.Printf("model swap: REFUSED %q — not in phraser.swap_models", req.ModelPath)
+			return ipc.SwapModelResp{}, fmt.Errorf("%w: %q is not in phraser.swap_models", ipc.ErrForbidden, req.ModelPath)
+		}
+		res, err := lp.Swap(ctx, phraser.SwapSpec{
+			ModelPath:  path,
+			NGpuLayers: req.NGpuLayers,
+			NCtx:       req.NCtx,
+		})
+		resp := ipc.SwapModelResp{
+			Model:      res.Model,
+			ModelPath:  res.ModelPath,
+			BaseURL:    res.BaseURL,
+			RolledBack: res.RolledBack,
+			TookMs:     res.Took.Milliseconds(),
+		}
+		if err != nil {
+			// A rolled-back swap is a failure that left a working daemon behind.
+			// Both halves matter to the caller, so the response is filled in even
+			// though the error is returned.
+			log.Printf("model swap: %v", err)
+			return resp, err
+		}
+		return resp, nil
+	}
+
+	srv.ModelStatusFn = func(ctx context.Context) (ipc.ModelStatusResp, error) {
+		path, ngl, nctx := lp.LiveModel()
+		base := lp.BaseURL()
+		resp := ipc.ModelStatusResp{
+			ModelPath:  path,
+			BaseURL:    base,
+			NGpuLayers: ngl,
+			NCtx:       nctx,
+			Swappable:  cfg.Phraser.SwapModels,
+		}
+		if base == "" {
+			resp.Model = llm.UnknownModel
+			return resp, nil
+		}
+		id, err := llm.ModelID(ctx, base)
+		if err != nil {
+			// Report the honest "I could not confirm it" rather than echoing the
+			// configured filename as if the server had said it.
+			resp.Model = llm.UnknownModel
+			return resp, nil
+		}
+		resp.Model = id
+		return resp, nil
+	}
+
+	log.Printf("model swap: enabled, %d allowlisted model(s) — step-up required", len(cfg.Phraser.SwapModels))
+}
+
+// llmClientFor builds a completion client on the phraser's llama-server and
+// keeps it pointed at the right one across a model swap.
+//
+// Without the OnSwap registration every holder of a base URL — the LLM router,
+// the replier, the mail extractor, the memory evaluator — would keep talking to
+// the port of a server that no longer exists, and the daemon would degrade to
+// the classifier permanently after the first swap. The client is re-pointed, not
+// rebuilt, so nothing that holds it has to know a swap happened.
+func llmClientFor(lp *phraser.LLMPhraser, timeout time.Duration) *llm.Client {
+	c := llm.New(lp.BaseURL(), timeout)
+	lp.OnSwap(func(base string) { c.SetBaseURL(base) })
+	return c
+}

cmd/mavend/patterns.go

@@ -1,6 +1,6 @@
 // mavend/patterns.go — the shared detect+propose step of pattern inference
 // (Vikunja #43). Event *extraction* (fact -> action/object) happens at fact-
-// write time in voice.go's detectPattern, tied to whichever channel wrote the
+// write time in detectPattern below, tied to whichever channel wrote the
 // fact. Detection — turning a run of events into a proposed routine — is
 // channel-agnostic: it only needs what's already in the events table, so it
 // runs both right after a voice fact-write (for the immediate "напоминать?"
@@ -13,6 +13,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log"
 	"time"
 
 	"github.com/kami/maven/internal/pattern"
@@ -72,3 +73,48 @@ func detectAndPropose(ctx context.Context, ds *store.Store, action, object strin
 	}
 	return r, id, nil
 }
+
+// detectPattern extracts an event from the written fact and runs the pattern
+// detector. If a stable recurring pattern is found and no proposed routine
+// exists for this action+object yet, one is created and the user is prompted
+// to confirm via the park() mechanism. Returns the suggestion phrase when a
+// new proposal was created and parked; "" otherwise.
+func (h *reactiveHandler) detectPattern(ctx context.Context, factID int64, key, value string, ts time.Time) string {
+	ev := pattern.Extract(factID, key, value, ts)
+	if ev == nil {
+		return "" // not an actionable event
+	}
+	if _, err := h.dataStore.CreateEvent(ctx, factID, ev.Action, ev.Object, ts); err != nil {
+		log.Printf("voice: create event: %v", err)
+		return ""
+	}
+	// Detect+propose (Vikunja #43) is shared with the digestion tick's
+	// proactive scan — see detectAndPropose above. Event *extraction* stays
+	// here, tied to this fact write; detection over the accumulated history does
+	// not need to happen right now for the voice path to have already done
+	// its job — it's dedupe-safe to also let the next tick find the same
+	// pattern independently.
+	r, id, err := detectAndPropose(ctx, h.dataStore, ev.Action, ev.Object, ts)
+	if err != nil {
+		log.Printf("voice: detect pattern %s/%s: %v", ev.Action, ev.Object, err)
+		return ""
+	}
+	if r == nil {
+		return "" // not enough data, too irregular, or already proposed/decided
+	}
+	log.Printf("voice: proposed routine: %s/%s every %.1f days", r.Action, r.Object, r.IntervalDays)
+
+	// Park the proposal for voice confirmation.
+	phrase := pattern.PhraseRoutine(r)
+	h.mu.Lock()
+	h.pendingRoutine = &pendingRoutineConfirm{
+		routineID: id,
+		action:    r.Action,
+		object:    r.Object,
+		interval:  r.IntervalDays,
+		phrase:    phrase,
+		expiry:    ts.Add(confirmTTL),
+	}
+	h.mu.Unlock()
+	return phrase
+}

cmd/mavend/patterns_test.go

@@ -3,9 +3,14 @@ package main
 import (
 	"context"
 	"database/sql"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/delivery"
+	"github.com/kami/maven/internal/loop"
+	"github.com/kami/maven/internal/pattern"
 	"github.com/kami/maven/internal/store"
 )
 
@@ -27,16 +32,16 @@ func seedRefillEvents(t *testing.T, st *store.Store, ctx context.Context, base t
 
 // TestTickDetectsPatternFromStoredEvents proves the tick notices a pattern on
 // its own, reading straight from the store — not as a side effect of a live
-// utterance (Vikunja #43). Three weekly events with no voice turn in sight
-// must produce exactly one proposed routine.
+// utterance (Vikunja #43). MinEvents weekly events with no voice turn in
+// sight must produce exactly one proposed routine.
 func TestTickDetectsPatternFromStoredEvents(t *testing.T) {
 	st := newTestStore(t)
 	ctx := context.Background()
 	now := refNow()
-	seedRefillEvents(t, st, ctx, now, 3)
+	seedRefillEvents(t, st, ctx, now, pattern.MinEvents)
 
 	tl := newTestTickLoop(t, st, &fakeSink{}, nil)
-	tl.detectPatterns(ctx, now)
+	tl.detectPatterns(ctx, now, loop.State{})
 
 	rows, err := st.ListProposedRoutines(ctx)
 	if err != nil {
@@ -58,11 +63,11 @@ func TestTickPatternDetectionIsIdempotent(t *testing.T) {
 	st := newTestStore(t)
 	ctx := context.Background()
 	now := refNow()
-	seedRefillEvents(t, st, ctx, now, 3)
+	seedRefillEvents(t, st, ctx, now, pattern.MinEvents)
 
 	tl := newTestTickLoop(t, st, &fakeSink{}, nil)
-	tl.detectPatterns(ctx, now)
-	tl.detectPatterns(ctx, now.Add(time.Hour))
+	tl.detectPatterns(ctx, now, loop.State{})
+	tl.detectPatterns(ctx, now.Add(time.Hour), loop.State{})
 
 	rows, err := st.ListProposedRoutines(ctx)
 	if err != nil {
@@ -81,10 +86,10 @@ func TestTickPatternDetectionRespectsDismissal(t *testing.T) {
 	st := newTestStore(t)
 	ctx := context.Background()
 	now := refNow()
-	seedRefillEvents(t, st, ctx, now, 3)
+	seedRefillEvents(t, st, ctx, now, pattern.MinEvents)
 
 	tl := newTestTickLoop(t, st, &fakeSink{}, nil)
-	tl.detectPatterns(ctx, now)
+	tl.detectPatterns(ctx, now, loop.State{})
 
 	rows, err := st.ListProposedRoutines(ctx)
 	if err != nil {
@@ -99,8 +104,8 @@ func TestTickPatternDetectionRespectsDismissal(t *testing.T) {
 
 	// More events for the same pair arrive, and the tick runs again — a
 	// dismissed pattern must not resurface.
-	seedRefillEvents(t, st, ctx, now.Add(30*24*time.Hour), 3)
-	tl.detectPatterns(ctx, now.Add(60*24*time.Hour))
+	seedRefillEvents(t, st, ctx, now.Add(30*24*time.Hour), pattern.MinEvents)
+	tl.detectPatterns(ctx, now.Add(60*24*time.Hour), loop.State{})
 
 	proposed, err := st.ListProposedRoutinesByStatus(ctx, store.RoutineProposed)
 	if err != nil {
@@ -120,3 +125,161 @@ func TestTickPatternDetectionRespectsDismissal(t *testing.T) {
 		t.Errorf("status = %s, want dismissed", all[0].Status)
 	}
 }
+
+// proposalRule — the rule name announceProposal uses for the seeded pair.
+const proposalRule = "proposal:refill cat_water"
+
+// TestTickProposalSilentByDefault — detection is always on, announcing is not.
+// With no pattern_proposals block the tick still records the proposal, and says
+// nothing about it: Maven is not autonomous, so a behaviour that speaks without
+// being asked stays off until it is configured.
+func TestTickProposalSilentByDefault(t *testing.T) {
+	st := newTestStore(t)
+	ctx := context.Background()
+	now := refNow()
+	seedRefillEvents(t, st, ctx, now, pattern.MinEvents)
+	markPresent(t, st, ctx, now)
+
+	sink := &fakeSink{}
+	tl := newTestTickLoop(t, st, sink, nil)
+	tl.tick(ctx, now)
+
+	if n := countSends(sink, proposalRule); n != 0 {
+		t.Fatalf("announced %d proposals with no config, want 0", n)
+	}
+	rows, err := st.ListProposedRoutinesByStatus(ctx, store.RoutineProposed)
+	if err != nil {
+		t.Fatalf("list proposed: %v", err)
+	}
+	if len(rows) != 1 {
+		t.Fatalf("proposed routines = %d, want 1 (silent, but recorded)", len(rows))
+	}
+}
+
+// TestTickAnnouncesProposalWhenConfigured — with notify on, the proposal goes
+// out once through the ordinary delivery path, worded by the detector itself.
+// Later ticks stay quiet because the pair is already proposed: one pattern is
+// one announcement, ever.
+func TestTickAnnouncesProposalWhenConfigured(t *testing.T) {
+	st := newTestStore(t)
+	ctx := context.Background()
+	now := refNow()
+	seedRefillEvents(t, st, ctx, now, pattern.MinEvents)
+	markPresent(t, st, ctx, now)
+
+	sink := &fakeSink{}
+	tl := newTestTickLoop(t, st, sink, nil)
+	tl.proposalCfg = &config.PatternProposalConfig{Notify: true}
+	tl.tick(ctx, now)
+
+	var got *delivery.Sendable
+	for i := range sink.sends {
+		if sink.sends[i].RuleName == proposalRule {
+			got = &sink.sends[i]
+		}
+	}
+	if got == nil {
+		t.Fatalf("proposal was not announced; sends=%+v", sink.sends)
+	}
+	if !strings.Contains(got.Body, "напоминать?") {
+		t.Errorf("body = %q, want the detector's own question", got.Body)
+	}
+	if got.Channel != delivery.ChannelVoice {
+		t.Errorf("channel = %v, want voice (sev1, present)", got.Channel)
+	}
+
+	// A month of further ticks: the pair already has a row, so there is
+	// nothing new to detect and nothing more to say.
+	sink.sends = nil
+	later := now.Add(40 * 24 * time.Hour)
+	markPresent(t, st, ctx, later)
+	tl.tick(ctx, later)
+	if n := countSends(sink, proposalRule); n != 0 {
+		t.Fatalf("re-announced an existing proposal %d times, want 0", n)
+	}
+}
+
+// TestTickProposalRespectsGate — a proposal is the least urgent thing Maven can
+// say, so it is sev1 and the restraint gate suppresses it. Away presence means
+// it is not announced at all: it is not held, not retried, it just lives on
+// /routines. The proposal row is still written — noticing is never gated.
+func TestTickProposalRespectsGate(t *testing.T) {
+	st := newTestStore(t)
+	ctx := context.Background()
+	now := refNow()
+	seedRefillEvents(t, st, ctx, now, pattern.MinEvents)
+	// no presence probes ⇒ away ⇒ care-class gate blocks.
+
+	sink := &fakeSink{}
+	tl := newTestTickLoop(t, st, sink, nil)
+	tl.proposalCfg = &config.PatternProposalConfig{Notify: true}
+	tl.tick(ctx, now)
+
+	if n := countSends(sink, proposalRule); n != 0 {
+		t.Fatalf("away: announced %d proposals, want 0", n)
+	}
+	if !tl.lastProposalAt.IsZero() {
+		t.Error("cooldown clock advanced on a suppressed announcement")
+	}
+	rows, err := st.ListProposedRoutinesByStatus(ctx, store.RoutineProposed)
+	if err != nil {
+		t.Fatalf("list proposed: %v", err)
+	}
+	if len(rows) != 1 {
+		t.Fatalf("proposed routines = %d, want 1 (detection is never gated)", len(rows))
+	}
+}
+
+// TestTickProposalCooldownSpacesAnnouncements — two patterns detected on the
+// same tick must not become two interruptions. The second one waits for the
+// cooldown, and is on /routines meanwhile.
+func TestTickProposalCooldownSpacesAnnouncements(t *testing.T) {
+	st := newTestStore(t)
+	ctx := context.Background()
+	now := refNow()
+	seedRefillEvents(t, st, ctx, now, pattern.MinEvents)
+	for i := 0; i < pattern.MinEvents; i++ {
+		ts := now.Add(time.Duration(i) * 3 * 24 * time.Hour)
+		factID, err := st.WriteFact(ctx, ts, store.KindSelf, "litter_box", "clean", "test", 1.0, sql.NullInt64{})
+		if err != nil {
+			t.Fatalf("write fact: %v", err)
+		}
+		if _, err := st.CreateEvent(ctx, factID, "clean", "litter_box", ts); err != nil {
+			t.Fatalf("create event: %v", err)
+		}
+	}
+	markPresent(t, st, ctx, now)
+
+	sink := &fakeSink{}
+	tl := newTestTickLoop(t, st, sink, nil)
+	tl.proposalCfg = &config.PatternProposalConfig{Notify: true, Cooldown: config.Duration(24 * time.Hour)}
+	tl.tick(ctx, now)
+
+	announced := 0
+	for _, s := range sink.sends {
+		if strings.HasPrefix(s.RuleName, "proposal:") {
+			announced++
+		}
+	}
+	if announced != 1 {
+		t.Fatalf("announced %d proposals on one tick, want exactly 1", announced)
+	}
+	rows, err := st.ListProposedRoutinesByStatus(ctx, store.RoutineProposed)
+	if err != nil {
+		t.Fatalf("list proposed: %v", err)
+	}
+	if len(rows) != 2 {
+		t.Fatalf("proposed routines = %d, want 2 (both recorded, one announced)", len(rows))
+	}
+
+	// Still inside the cooldown: silence, even though a proposal is pending.
+	sink.sends = nil
+	soon := now.Add(time.Hour)
+	markPresent(t, st, ctx, soon)
+	tl.tick(ctx, soon)
+	for _, s := range sink.sends {
+		if strings.HasPrefix(s.RuleName, "proposal:") {
+			t.Fatalf("announced %q inside the cooldown", s.RuleName)
+		}
+	}
+}

cmd/mavend/quiet_toggle.go

@@ -0,0 +1,144 @@
+// Quiet-mode toggle recognition — the pre-route keyword check that lets
+// "тихий режим" flip the daemon-wide quiet_hours config without going through
+// the router. Moved out of voice.go unchanged (Vikunja #321); the tests live in
+// quiet_toggle_test.go.
+package main
+
+import (
+	"context"
+	"log"
+	"strings"
+	"unicode"
+
+	"github.com/kami/maven/internal/ipc"
+)
+
+// resolveQuietToggle — pre-route keyword check. Returns (reply, true) when
+// the utterance is a quiet-on/off command; ("", false) otherwise. Called from
+// runTurn BEFORE the router so a classifier miscue can't drop it — which means
+// both the voice path and the text path (mavweb /api/chat, telegram) reach it,
+// so a false positive here is a network-reachable way to flip a daemon-wide
+// setting. See classifyQuietToggle for the matching rule.
+func (h *reactiveHandler) resolveQuietToggle(ctx context.Context, text string) (string, bool) {
+	on, off := classifyQuietToggle(text)
+	if !on && !off {
+		return "", false
+	}
+	val := "false"
+	reply := "тихий режим выключен."
+	if on {
+		val = "true"
+		reply = "тихий режим включён. буду реже напоминать."
+	}
+	if _, err := h.api.WriteFact(ctx, ipc.WriteFactReq{
+		Ts:         h.now(),
+		Kind:       "config",
+		Key:        "quiet_hours",
+		Value:      val,
+		Source:     "tap:voice",
+		Confidence: 1.0,
+	}); err != nil {
+		log.Printf("voice: write quiet_hours: %v", err)
+		return "не получилось переключить тихий режим.", true
+	}
+	return reply, true
+}
+
+// quietInflections — the inflectional endings a stem may carry and still be
+// the same word. Adjective/adverb/noun/verb endings, all ≤3 letters. This is
+// what separates "тихий"/"тихом"/"тихо" (stem "тих" + a real ending) from
+// "тихонько"/"потихоньку", which are different words: "онько" is not an
+// ending, and "потихоньку" doesn't start with the stem at all.
+var quietInflections = []string{
+	"", "а", "е", "и", "й", "о", "у", "ы", "ю", "я",
+	"ая", "ее", "ей", "ем", "ие", "ий", "им", "их", "ия", "ию", "ое", "ой", "ом", "ую", "ые", "ый", "ым", "ых", "ья",
+	"ами", "ого", "ому", "ыми", "ать", "ить", "ять",
+}
+
+// quietStem reports whether tok is the given stem carrying at most one
+// inflectional ending. Word boundaries come from tokenisation (see
+// quietTokens), not from a regexp — Go's \b is ASCII-oriented and treats every
+// Cyrillic letter as a non-word character, so `\bтих\b` would happily match
+// inside "тихонько". Comparing whole tokens sidesteps that entirely.
+func quietStem(tok, stem string) bool {
+	if !strings.HasPrefix(tok, stem) {
+		return false
+	}
+	suffix := tok[len(stem):]
+	for _, e := range quietInflections {
+		if suffix == e {
+			return true
+		}
+	}
+	return false
+}
+
+// quietTokens splits an utterance into lowercase word tokens, dropping
+// punctuation and spacing. Unicode-aware, so Cyrillic words tokenise the same
+// way ASCII ones do.
+func quietTokens(text string) []string {
+	return strings.FieldsFunc(strings.ToLower(strings.TrimSpace(text)), func(r rune) bool {
+		return !unicode.IsLetter(r) && !unicode.IsDigit(r)
+	})
+}
+
+// quietPhrase matches a pattern (a sequence of stems) against the token list.
+// Multi-word patterns match any contiguous run of tokens — "включи тихий
+// режим" carries "тихий режим". Single-word patterns match ONLY when they are
+// the whole utterance: bare "тихо" is a command, but "в комнате тихо" is a
+// remark about the room and must not flip a daemon-wide setting.
+func quietPhrase(tokens, pattern []string) bool {
+	if len(pattern) == 0 || len(tokens) < len(pattern) {
+		return false
+	}
+	if len(pattern) == 1 {
+		return len(tokens) == 1 && quietStem(tokens[0], pattern[0])
+	}
+	for i := 0; i+len(pattern) <= len(tokens); i++ {
+		hit := true
+		for j, stem := range pattern {
+			if !quietStem(tokens[i+j], stem) {
+				hit = false
+				break
+			}
+		}
+		if hit {
+			return true
+		}
+	}
+	return false
+}
+
+// quietOffPhrases / quietOnPhrases — the toggle vocabulary, as stem sequences.
+var (
+	quietOffPhrases = [][]string{
+		{"quiet", "off"}, {"quiet", "end"},
+		{"громк", "режим"}, {"шумн", "режим"},
+		{"отмен", "тих"}, {"выключ", "тих"}, {"не", "тих"},
+	}
+	quietOnPhrases = [][]string{
+		{"quiet", "on"}, {"quiet", "mode"},
+		{"тих", "режим"}, {"не", "шум"}, {"не", "беспоко"},
+		{"тих"},
+	}
+)
+
+// classifyQuietToggle reads an utterance as a quiet-mode command. OFF is
+// resolved before ON for the same reason classifyConfirm checks negatives
+// first: the OFF phrases are built out of the ON words ("выключи тихий"
+// contains "тихий"), so scanning ON first would shadow them and "выключи
+// тихий режим" would turn quiet mode on. Negation wins.
+func classifyQuietToggle(text string) (on, off bool) {
+	tokens := quietTokens(text)
+	for _, p := range quietOffPhrases {
+		if quietPhrase(tokens, p) {
+			return false, true
+		}
+	}
+	for _, p := range quietOnPhrases {
+		if quietPhrase(tokens, p) {
+			return true, false
+		}
+	}
+	return false, false
+}

cmd/mavend/speaker.go

@@ -0,0 +1,146 @@
+// mavend/speaker.go — core's half of voice identification (Vikunja #255,
+// docs/plans/10-speaker-recognition.md).
+//
+// # What is actually wired here, and what is not
+//
+// The enrolment plumbing is real: profiles are stored, listed and deleted, and
+// the wire methods exist as soon as a speaker block is configured. The
+// recognising half is NOT, and cannot be on this box, because there is no
+// speaker-embedding model on disk — no ECAPA, no x-vector, no titanet, no
+// wespeaker, nothing in /mnt/hdd1/llms but text ggufs. Until one is downloaded,
+// newSpeakerEmbedder returns nil, internal/speaker falls back to
+// speaker.Disabled, and every Identify answers ErrDisabled. The daemon logs
+// which half is off at startup rather than pretending.
+//
+// This is deliberately not papered over with a hand-rolled MFCC floor. A
+// biometric that is confidently wrong writes false claims about named people
+// into his memory, and that is worse than a capability that is honestly absent.
+//
+// # Off unless configured
+//
+// No speaker block, or one without enabled, ⇒ the three methods do not exist and
+// answer ErrUnknownMethod. On an unconfigured box there is no wire path that
+// takes a voiceprint at all.
+//
+// # The refused design step
+//
+// The plan asks for unknown speakers to be enrolled on first interaction. That
+// is refused in internal/speaker/enroll.go and there is no handler for it here:
+// no request shape in the protocol enrols whoever just spoke. Taking a biometric
+// of a guest who walked past the microphone is not something this daemon does.
+package main
+
+import (
+	"context"
+	"errors"
+	"log"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/speaker"
+	"github.com/kami/maven/internal/store"
+)
+
+// speakerWiring holds the recognizer behind the three IPC handlers.
+type speakerWiring struct {
+	rec *speaker.Recognizer
+}
+
+// newSpeakerEmbedder loads the speaker-embedding model named by the config.
+//
+// It always returns nil today. The seam exists so that wiring a real model is a
+// change to this one function and nothing else: give it a loader, and Identify
+// starts working with no change to the store, the protocol, the auth table or
+// the handlers. See the plan document for what to download.
+func newSpeakerEmbedder(cfg *config.SpeakerConfig) speaker.Embedder {
+	if cfg == nil || cfg.ModelPath == "" {
+		return nil
+	}
+	log.Printf("speaker: model_path %q is configured but no embedding backend is built yet; "+
+		"enrolment and deletion work, recognition does not (Vikunja #255)", cfg.ModelPath)
+	return nil
+}
+
+// newSpeakerWiring builds the recognizer, or nil when the capability is off.
+func newSpeakerWiring(st *store.Store, cfg *config.Config) *speakerWiring {
+	if cfg == nil || cfg.Speaker == nil || !cfg.Speaker.Enabled {
+		return nil
+	}
+	if st == nil {
+		log.Print("speaker: enabled but there is no store to keep profiles in; staying off")
+		return nil
+	}
+	rec, err := speaker.New(newSpeakerEmbedder(cfg.Speaker), st.VectorMemory(), speaker.Config{
+		Threshold:  cfg.Speaker.Threshold,
+		MinSeconds: cfg.Speaker.MinSeconds,
+	})
+	if err != nil {
+		log.Printf("speaker: %v; staying off", err)
+		return nil
+	}
+	if rec.Enabled() {
+		log.Printf("speaker: recognition on, threshold %.2f", rec.Threshold())
+	} else {
+		log.Print("speaker: enrolment on, recognition BLOCKED — no speaker-embedding model " +
+			"on this box (see docs/plans/10-speaker-recognition.md)")
+	}
+	return &speakerWiring{rec: rec}
+}
+
+func (w *speakerWiring) enroll(ctx context.Context, req ipc.EnrollSpeakerReq) (ipc.EnrollSpeakerResp, error) {
+	p, err := w.rec.Enroll(ctx, req.ID, req.Name, req.Samples)
+	if err != nil {
+		return ipc.EnrollSpeakerResp{}, speakerErr(err)
+	}
+	return ipc.EnrollSpeakerResp{Speaker: toWireSpeaker(p)}, nil
+}
+
+func (w *speakerWiring) list(ctx context.Context) (ipc.ListSpeakersResp, error) {
+	ps, err := w.rec.List(ctx)
+	if err != nil {
+		return ipc.ListSpeakersResp{}, speakerErr(err)
+	}
+	out := make([]ipc.Speaker, 0, len(ps))
+	for _, p := range ps {
+		out = append(out, toWireSpeaker(p))
+	}
+	return ipc.ListSpeakersResp{Speakers: out, Enabled: w.rec.Enabled()}, nil
+}
+
+func (w *speakerWiring) forget(ctx context.Context, req ipc.ForgetSpeakerReq) error {
+	return speakerErr(w.rec.Forget(ctx, req.ID))
+}
+
+// toWireSpeaker drops the voiceprint. A listing says who is enrolled; it does
+// not hand the biometric back out over the socket.
+func toWireSpeaker(p speaker.Profile) ipc.Speaker {
+	return ipc.Speaker{ID: p.ID, Name: p.Name, Enrolled: p.Enrolled, Samples: p.Samples}
+}
+
+// speakerErr maps the package sentinels onto the wire vocabulary so a surface
+// can tell "you asked wrong" from "core broke".
+func speakerErr(err error) error {
+	switch {
+	case err == nil:
+		return nil
+	case errors.Is(err, speaker.ErrNotFound):
+		return ipc.ErrNoFact
+	case errors.Is(err, speaker.ErrBadID),
+		errors.Is(err, speaker.ErrBadFormat),
+		errors.Is(err, speaker.ErrTooShort):
+		return errors.Join(ipc.ErrBadParams, err)
+	default:
+		return err
+	}
+}
+
+// wireSpeaker attaches the three handlers when the capability is configured.
+func wireSpeaker(srv *ipc.Server, st *store.Store, cfg *config.Config) {
+	w := newSpeakerWiring(st, cfg)
+	if w == nil {
+		return
+	}
+	srv.EnrollSpeakerFn = w.enroll
+	srv.ListSpeakersFn = w.list
+	srv.ForgetSpeakerFn = w.forget
+}

cmd/mavend/tick.go

@@ -24,6 +24,7 @@ import (
 	"github.com/kami/maven/internal/ipc"
 	"github.com/kami/maven/internal/loop"
 	"github.com/kami/maven/internal/morning"
+	"github.com/kami/maven/internal/pattern"
 	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/routine"
 	"github.com/kami/maven/internal/store"
@@ -67,6 +68,14 @@ type tickLoop struct {
 	morningRoutines []morning.Routine
 	morningLast     map[string]time.Time
 
+	// proposalCfg — announcement policy for routines the tick inferred itself.
+	// nil ⇒ detect silently, never announce (the default). lastProposalAt is
+	// the cooldown clock, in-memory on purpose: a restart is allowed to permit
+	// one more announcement, and a restart-per-day loop is a bigger problem
+	// than a duplicate proposal notice.
+	proposalCfg    *config.PatternProposalConfig
+	lastProposalAt time.Time
+
 	// digestQ — in-memory queue of eligible nudges waiting for batch flush.
 	// populated when digestCfg != nil && digestCfg.Enabled.
 	digestQ []QueuedNudge
@@ -92,6 +101,7 @@ func newTickLoop(
 	digestCfg *config.DigestConfig,
 	routines []routine.Routine,
 	morningRoutines []morning.Routine,
+	proposalCfg *config.PatternProposalConfig,
 ) *tickLoop {
 	return &tickLoop{
 		store:            st,
@@ -108,6 +118,7 @@ func newTickLoop(
 		routineLast:      make(map[string]time.Time),
 		morningRoutines:  morningRoutines,
 		morningLast:      make(map[string]time.Time),
+		proposalCfg:      proposalCfg,
 		lastPhrase:       make(map[string]delivery.PhrasedNudge),
 	}
 }
@@ -212,7 +223,7 @@ func (t *tickLoop) tick(ctx context.Context, now time.Time) {
 	// path, so a pattern already sitting in history went unnoticed until he
 	// happened to mention it again by voice. See patterns.go and
 	// detectPatterns below for how idempotence and dismissal are respected.
-	t.detectPatterns(ctx, now)
+	t.detectPatterns(ctx, now, state)
 
 	// reminders: gate-bypassing class. fired once, marked after a successful
 	// delivery.  a failed send leaves the reminder pending — the next tick
@@ -381,16 +392,19 @@ func (t *tickLoop) flushDigest(ctx context.Context, now time.Time, state loop.St
 //     resurrecting — there is nothing tick-specific to get right here beyond
 //     calling the same shared path the voice route already used.
 //
-// This only ever creates a row for the /routines page to show. It does not
-// notify, ring, or speak — Maven is "not a nag, not autonomous" (CLAUDE.md),
-// and detection is not the same act as disturbing him about it. A proposal
-// only starts producing nudges once he accepts it (fireAcceptedRoutines).
-func (t *tickLoop) detectPatterns(ctx context.Context, now time.Time) {
+// By default this only creates a row for the /routines page to show: it does
+// not notify, ring, or speak. Detection is not the same act as disturbing him
+// about it, and Maven is "not a nag, not autonomous" (CLAUDE.md). Announcing
+// is opt-in through the pattern_proposals config block — see announceProposal
+// for the restraints that apply even then. A proposal only starts producing
+// recurring nudges once he accepts it (fireAcceptedRoutines).
+func (t *tickLoop) detectPatterns(ctx context.Context, now time.Time, state loop.State) {
 	pairs, err := t.store.DistinctEventPairs(ctx)
 	if err != nil {
 		log.Printf("tick: distinct event pairs: %v", err)
 		return
 	}
+	announced := false
 	for _, p := range pairs {
 		r, _, err := detectAndPropose(ctx, t.store, p.Action, p.Object, now)
 		if err != nil {
@@ -401,9 +415,65 @@ func (t *tickLoop) detectPatterns(ctx context.Context, now time.Time) {
 			continue // no stable pattern, or already proposed/accepted/dismissed
 		}
 		log.Printf("tick: proposed routine: %s/%s every %.1f days", r.Action, r.Object, r.IntervalDays)
+		// One announcement per tick at most, whatever the scan turned up. The
+		// rest are on /routines; they are not lost, they are just not shouted.
+		if announced {
+			continue
+		}
+		announced = t.announceProposal(ctx, r, now, state)
 	}
 }
 
+// announceProposal offers a freshly inferred routine through the ordinary
+// care-delivery path, if announcing is switched on at all. Returns true when
+// something was actually sent.
+//
+// Everything here is restraint. The feature is off unless configured; when on
+// it is sev1 (the lowest severity, so quiet hours, away presence and snooze
+// all suppress it via loop.Gate exactly like a care nudge); it is spaced by
+// proposalCfg.Cooldown across every pair, not per pair; and a suppressed or
+// dropped announcement is NOT retried — the cooldown clock advances only on a
+// real send, but the proposal row already exists, so the next tick will not
+// re-detect it and nothing queues up behind it. A missed announcement means
+// he reads it on /routines instead, which is the whole point of the page.
+//
+// The body is the detector's own literal Russian phrasing (pattern.PhraseRoutine
+// — "ты заправляешь поилку раз в 7 дней — напоминать?"), not LLM-generated, so
+// an inferred routine cannot arrive worded as something Maven never observed.
+func (t *tickLoop) announceProposal(ctx context.Context, r *pattern.ProposedRoutine, now time.Time, state loop.State) bool {
+	if !t.proposalCfg.AnnounceProposals() {
+		return false
+	}
+	cooldown := time.Duration(t.proposalCfg.Cooldown)
+	if cooldown <= 0 {
+		cooldown = config.DefaultProposalCooldown
+	}
+	if !t.lastProposalAt.IsZero() && now.Sub(t.lastProposalAt) < cooldown {
+		return false
+	}
+
+	rule := loop.Rule{Name: "proposal:" + r.Action + " " + r.Object, Severity: loop.Sev1}
+	if !loop.Gate(state, rule) {
+		return false
+	}
+	body := pattern.PhraseRoutine(r)
+	pn := delivery.PhrasedNudge{
+		Candidate: loop.Candidate{Rule: rule, Severity: rule.Severity, State: state},
+		Body:      body,
+		Summary:   body,
+	}
+	sent, err := t.dispatcher.DispatchNudge(ctx, pn, now)
+	if err != nil {
+		log.Printf("tick: announce proposal %s/%s: %v", r.Action, r.Object, err)
+		return false
+	}
+	if len(sent) == 0 {
+		return false // routing dropped it — /routines still has it.
+	}
+	t.lastProposalAt = now
+	return true
+}
+
 // digestExpiry — how long a gate-suppressed care nudge stays worth
 // resurfacing. 24h: these are daily-cadence rules (water/meal/break run on
 // hour-scale cooldowns and re-derive from facts that reset every day), so a
@@ -719,6 +789,77 @@ func (t *tickLoop) morningStatus(ctx context.Context, now time.Time) []ipc.Morni
 	return out
 }
 
+// dayPlan is the read-only "what does today hold" query (Vikunja #128). It is
+// the impure half of morning.BuildPlan: it reads the calendar events, the
+// pending reminders and the checklist facts, and the pure builder orders them.
+//
+// It never dispatches. Asking for the plan is a query like any other; the only
+// unprompted delivery in maven stays with the morning nudge and the
+// dispatcher's policy.
+func (t *tickLoop) dayPlan(ctx context.Context, now time.Time) ipc.DayPlan {
+	y, m, d := now.Date()
+	dayStart := time.Date(y, m, d, 0, 0, 0, 0, now.Location())
+	dayEnd := dayStart.AddDate(0, 0, 1)
+
+	var events []morning.PlanEntry
+	facts, err := t.store.CalendarEvents(ctx, dayStart, dayEnd)
+	if err != nil {
+		log.Printf("tick: day plan: calendar events: %v", err)
+	}
+	for _, f := range facts {
+		events = append(events, morning.PlanEntry{
+			At:   f.Ts,
+			Text: f.Value,
+			Kind: morning.PlanEvent,
+			// Provenance below a calendar read (an ambient relay, #126) is
+			// hedged rather than recited as fact.
+			Uncertain: f.Confidence < 1.0,
+		})
+	}
+
+	var reminders []morning.PlanEntry
+	rems, err := t.store.ListReminders(ctx, dayPlanMaxReminders)
+	if err != nil {
+		log.Printf("tick: day plan: list reminders: %v", err)
+	}
+	for _, r := range rems {
+		if r.Status != "pending" {
+			continue
+		}
+		fire := r.NextFireTs
+		if fire.IsZero() {
+			fire = r.FireTs
+		}
+		reminders = append(reminders, morning.PlanEntry{
+			At:   fire,
+			Text: strings.TrimSpace(r.Payload),
+			Kind: morning.PlanReminder,
+		})
+	}
+
+	var checklistFacts map[string]store.Fact
+	if len(t.morningRoutines) > 0 {
+		checklistFacts = t.gatherMorningFacts(ctx)
+	}
+	plan := morning.BuildPlan(t.morningRoutines, checklistFacts, events, reminders, now)
+
+	out := ipc.DayPlan{Date: plan.Date, Spoken: plan.FormatRU()}
+	out.Items = make([]ipc.DayPlanItem, len(plan.Items))
+	for i, it := range plan.Items {
+		out.Items[i] = ipc.DayPlanItem{
+			At:        it.At,
+			Text:      it.Text,
+			Kind:      string(it.Kind),
+			Uncertain: it.Uncertain,
+		}
+	}
+	return out
+}
+
+// dayPlanMaxReminders bounds the reminder scan. The plan covers one day; a
+// pending queue longer than this is a bug elsewhere, not a plan to recite.
+const dayPlanMaxReminders = 500
+
 // tune — the feedback auto-tuner's impure step. runs on a slow cadence
 // (autotuneInterval, see run) so it doesn't write a fact every tick. for each
 // rule:
@@ -798,7 +939,9 @@ type daemonAPI struct {
 	ipc.CoreAPI
 	getTrace         func() *loop.TickTrace
 	getMorningStatus func(ctx context.Context) []ipc.MorningRoutineStatus
+	getDayPlan       func(ctx context.Context) ipc.DayPlan
 	chatFn           func(ctx context.Context, text string) string
+	getMCPServers    func() []ipc.MCPServerStatus
 }
 
 func (d *daemonAPI) Chat(ctx context.Context, text string) (string, error) {
@@ -808,6 +951,16 @@ func (d *daemonAPI) Chat(ctx context.Context, text string) (string, error) {
 	return d.chatFn(ctx, text), nil
 }
 
+// MCPServers — the configured MCP servers and their health (Vikunja #251).
+// Empty, not an error, when the mcp block is absent: "not configured" is the
+// default state and the web surface renders it as such.
+func (d *daemonAPI) MCPServers(ctx context.Context) ([]ipc.MCPServerStatus, error) {
+	if d.getMCPServers == nil {
+		return nil, nil
+	}
+	return d.getMCPServers(), nil
+}
+
 func (d *daemonAPI) TickTrace(ctx context.Context) (ipc.TickTrace, error) {
 	trace := d.getTrace()
 	if trace == nil {
@@ -823,6 +976,13 @@ func (d *daemonAPI) MorningStatus(ctx context.Context) ([]ipc.MorningRoutineStat
 	return d.getMorningStatus(ctx), nil
 }
 
+func (d *daemonAPI) DayPlan(ctx context.Context) (ipc.DayPlan, error) {
+	if d.getDayPlan == nil {
+		return ipc.DayPlan{}, errors.New("mavend: day plan not available")
+	}
+	return d.getDayPlan(ctx), nil
+}
+
 func toIPCTickTrace(t loop.TickTrace) ipc.TickTrace {
 	rules := make([]ipc.RuleTrace, len(t.RuleTraces))
 	for i, r := range t.RuleTraces {

cmd/mavend/tick_test.go

@@ -46,7 +46,7 @@ func newTestTickLoop(t *testing.T, st *store.Store, sink delivery.Sink, digestCf
 		Nudges:    st,
 		Reminders: st,
 	})
-	return newTickLoop(st, g, d, phraser.NewStub(), rules, time.Second, 5*time.Minute, 0, digestCfg, nil, nil)
+	return newTickLoop(st, g, d, phraser.NewStub(), rules, time.Second, 5*time.Minute, 0, digestCfg, nil, nil, nil)
 }
 
 func TestTickFiresRoutineWhenScheduleCrosses(t *testing.T) {
@@ -63,7 +63,7 @@ func TestTickFiresRoutineWhenScheduleCrosses(t *testing.T) {
 	sink := &fakeSink{}
 	d := delivery.NewDispatcher(delivery.Config{Voice: sink, Ntfy: sink, Telegram: sink, Nudges: st, Reminders: st})
 	rs := []routine.Routine{{Name: "morning", Cron: "0 12 * * *", Body: "полдень, время воды", Severity: 1}}
-	tl := newTickLoop(st, g, d, phraser.NewStub(), rules, time.Second, 5*time.Minute, 0, nil, rs, nil)
+	tl := newTickLoop(st, g, d, phraser.NewStub(), rules, time.Second, 5*time.Minute, 0, nil, rs, nil, nil)
 
 	// first tick: seeds, does not fire the routine.
 	tl.tick(ctx, now)

cmd/mavend/vision.go

@@ -0,0 +1,257 @@
+// mavend/vision.go — core's half of image understanding (Vikunja #252,
+// docs/plans/07-vision.md).
+//
+// The split: any surface that can receive a picture (mavweb upload, a Telegram
+// photo through mavpoll, a path he names) hands the bytes to core over
+// ipc.MethodDescribeImage. Core stores them content-addressed under
+// media.dir, prepares a downscaled JPEG, and asks a local vision server what it
+// is. The description comes back as words; nothing about the image is echoed.
+//
+// Off unless configured twice over: no `media` block ⇒ nowhere to keep the
+// bytes, so the method does not exist; no `vision` block with enabled + a local
+// endpoint ⇒ the store is wired but the describing half refuses, and the method
+// still does not exist. A surface cannot make Maven look at pictures by merely
+// sending one.
+//
+// Two things this file deliberately does not do:
+//
+//   - No cloud vision call, ever. internal/vision refuses a non-private
+//     endpoint at construction; there is no config shape here that could reach
+//     an upstream API even if someone wanted one.
+//   - No automatic memory. SaveNote is opt-in per call. Glancing at a screenshot
+//     is not the same act as remembering it, and a 1.7B-class VLM's guess about
+//     a photo is not a fact worth carrying around.
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"path/filepath"
+	"time"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/media"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/store"
+	"github.com/kami/maven/internal/vision"
+)
+
+// prunePeriod — how often stored blobs are checked against media.retention.
+// Hourly is far more often than needed for a 7-day retention and costs a
+// directory walk over a handful of sidecars; the point is that the promise is
+// kept by a loop that runs, not by an operator remembering a cron.
+const prunePeriod = time.Hour
+
+// mediaKeeper — the blob store plus the loop that enforces its retention. The
+// two are one object because a store without the loop is a directory that grows
+// forever, and shipping that would break the only interesting promise this
+// capability makes.
+type mediaKeeper struct {
+	store *media.Store
+}
+
+// openMediaStore builds the blob store from config, or returns nil when media is
+// not configured. A relative dir resolves against StateDir, the same rule the db
+// and socket paths follow.
+func openMediaStore(cfg *config.Config) *mediaKeeper {
+	dir := cfg.Media.StoreDir()
+	if dir == "" {
+		return nil
+	}
+	if !filepath.IsAbs(dir) && cfg.StateDir != "" {
+		dir = filepath.Join(cfg.StateDir, dir)
+	}
+	st, err := media.Open(dir, cfg.Media.MaxBytes, time.Duration(cfg.Media.Retention))
+	if err != nil {
+		log.Printf("media: %v — image and audio intake disabled", err)
+		return nil
+	}
+	log.Printf("media: blob store at %s, retention %s", st.Dir(), st.Retention())
+	return &mediaKeeper{store: st}
+}
+
+// runPrune deletes over-retention blobs on a loop until ctx ends. It prunes once
+// immediately, so a daemon restarted after a long downtime does not sit on a
+// month of stale recordings until the first tick.
+func (k *mediaKeeper) runPrune(ctx context.Context) {
+	prune := func() {
+		n, err := k.store.Prune()
+		if err != nil {
+			log.Printf("media: prune: %v", err)
+			return
+		}
+		if n > 0 {
+			log.Printf("media: pruned %d blob(s) older than %s", n, k.store.Retention())
+		}
+	}
+	prune()
+	t := time.NewTicker(prunePeriod)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-t.C:
+			prune()
+		}
+	}
+}
+
+// visionIntake — one image at a time: store, prepare, describe, optionally note.
+type visionIntake struct {
+	in  *vision.Intake
+	st  *store.Store
+	emb router.Embedder
+	now func() time.Time
+}
+
+// newVisionIntake returns nil when there is nothing to wire. keeper == nil means
+// no media block, which disables the method outright; a missing or disabled
+// vision block still wires the method, because storing an image and answering
+// "I can't look at it yet" is more useful than pretending the surface does not
+// exist — and it is exactly the state this box is in until a vision model is on
+// disk.
+func newVisionIntake(keeper *mediaKeeper, st *store.Store, emb router.Embedder, cfg *config.Config) *visionIntake {
+	if keeper == nil {
+		return nil
+	}
+	vc := cfg.Vision
+	maxDim := 0
+	var provider vision.Provider = vision.Disabled{}
+	if vc.LooksAtImages() {
+		p, err := vision.NewLocal(vision.Config{
+			Endpoint:  vc.Endpoint,
+			Model:     vc.Model,
+			Timeout:   time.Duration(vc.Timeout),
+			MaxTokens: vc.MaxTokens,
+			Prompt:    vc.Prompt,
+		})
+		if err != nil {
+			// A public endpoint, a hostname, a bad URL. Logged once here rather
+			// than failing every turn, and the store still works.
+			log.Printf("vision: %v — she can store images but not describe them", err)
+		} else {
+			provider = p
+			maxDim = vc.MaxDim
+			log.Printf("vision: enabled against %s", p.Endpoint())
+		}
+	} else {
+		log.Printf("vision: not configured — images are stored, not described")
+	}
+	return &visionIntake{
+		in:  vision.NewIntake(keeper.store, provider, maxDim),
+		st:  st,
+		emb: emb,
+		now: time.Now,
+	}
+}
+
+// describe handles one ipc.MethodDescribeImage call.
+//
+// A description failure is NOT an error out of this method when the bytes were
+// stored: the caller gets the id and an empty description, which is honest ("it
+// is kept, I cannot read it yet") and re-runnable. A failure to store, or bytes
+// that are not an image at all, is an error — there is nothing to come back to.
+func (v *visionIntake) describe(ctx context.Context, req ipc.DescribeImageReq) (ipc.DescribeImageResp, error) {
+	if len(req.Data) == 0 && req.ID == "" {
+		return ipc.DescribeImageResp{}, fmt.Errorf("describe image: neither data nor id")
+	}
+
+	var (
+		res vision.Result
+		err error
+	)
+	if req.ID != "" {
+		res, err = v.in.Rerun(ctx, req.ID, req.Question)
+	} else {
+		res, err = v.in.Accept(ctx, req.Data, sourceOrDefault(req.Source), req.Question)
+	}
+	if res.Blob.ID == "" {
+		// Nothing was stored: bad format, over the size cap, unwritable dir.
+		return ipc.DescribeImageResp{}, fmt.Errorf("describe image: %w", err)
+	}
+
+	resp := ipc.DescribeImageResp{
+		ID:          res.Blob.ID,
+		Description: res.Description,
+		Width:       res.Image.Width,
+		Height:      res.Image.Height,
+	}
+	if err != nil {
+		// Bytes are safe, words are not available. The log names the blob and the
+		// reason; it never names what was in the picture.
+		if errors.Is(err, vision.ErrDisabled) {
+			log.Printf("vision: stored %s, no vision model configured", res.Blob)
+		} else {
+			log.Printf("vision: stored %s, describe failed: %v", res.Blob, err)
+		}
+		return resp, nil
+	}
+
+	if req.SaveNote {
+		id, werr := v.writeNote(ctx, res)
+		if werr != nil {
+			// The description is still returned: losing the note is worse as a
+			// silent failure than as a log line next to a successful answer.
+			log.Printf("vision: note write for %s failed: %v", res.Blob, werr)
+		} else {
+			resp.NoteID = id
+		}
+	}
+	log.Printf("vision: described %s (%dx%d)", res.Blob, res.Image.Width, res.Image.Height)
+	return resp, nil
+}
+
+// writeNote stores the description as an ordinary note so it is recallable. The
+// note carries the blob id in its source, which is the only link back to the
+// bytes — the note text is words about the picture, never the picture.
+func (v *visionIntake) writeNote(ctx context.Context, res vision.Result) (int64, error) {
+	var vec []float32
+	if v.emb != nil {
+		// EmbedPassage, not Embed: a description is text being searched FOR, and
+		// the e5 embedder is asymmetric. Backwards here makes it unfindable by
+		// the question that should have matched it.
+		var err error
+		vec, err = router.EmbedPassage(ctx, v.emb, res.Description)
+		if err != nil {
+			return 0, fmt.Errorf("embed: %w", err)
+		}
+	}
+	source := "media:image:" + res.Blob.ID[:12]
+	return v.st.WriteNote(ctx, v.now(), res.Description, vec, source)
+}
+
+// sourceOrDefault labels a blob whose sender did not say where it came from.
+func sourceOrDefault(s string) string {
+	if s == "" {
+		return "unknown"
+	}
+	return s
+}
+
+// wireVision installs the IPC hook and starts the retention loop, or leaves the
+// hook nil so ipc.MethodDescribeImage reports ErrUnknownMethod. Called on both
+// startup paths (unlocked boot and passkey unlock) so vision behaves the same
+// either way.
+//
+// Returns the media keeper so the meeting recorder can share it: one blob store
+// with one retention loop holds both the images and the audio, which is the
+// whole point of internal/media being a shared package. nil ⇒ no media block,
+// and neither capability exists.
+func wireVision(ctx context.Context, srv *ipc.Server, st *store.Store, emb router.Embedder, cfg *config.Config) *mediaKeeper {
+	keeper := openMediaStore(cfg)
+	if keeper == nil {
+		return nil
+	}
+	go keeper.runPrune(ctx)
+
+	vi := newVisionIntake(keeper, st, emb, cfg)
+	if vi == nil {
+		return keeper
+	}
+	srv.DescribeImageFn = vi.describe
+	return keeper
+}

cmd/mavend/voice.go

@@ -50,13 +50,12 @@ import (
 	"strings"
 	"sync"
 	"time"
-	"unicode"
 
 	"github.com/kami/maven/internal/audio"
+	"github.com/kami/maven/internal/crawl"
 	"github.com/kami/maven/internal/dialogue"
 	"github.com/kami/maven/internal/ipc"
 	"github.com/kami/maven/internal/memory"
-	"github.com/kami/maven/internal/pattern"
 	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/store"
@@ -84,6 +83,15 @@ type reactiveHandler struct {
 	replier  voice.Replier
 	now      func() time.Time
 
+	// crawler reads a web page he names out loud (queryWeb). nil ⇒ on-demand
+	// page reading is off, which is the default: no `crawl` block, no fetch.
+	crawler *crawl.Crawler
+
+	// feedsOn — whether any RSS feed is configured (config.Feeds). It changes
+	// only what she SAYS when asked and nothing is there: "ленты не настроены"
+	// instead of "ничего нового", which are different truths.
+	feedsOn bool
+
 	weatherProvider weather.Provider
 	weatherLocation string // default location for weather queries
 
@@ -277,181 +285,6 @@ func (h *reactiveHandler) applyAction(ctx context.Context, dec router.Decision)
 	return ""
 }
 
-// detectPattern extracts an event from the written fact and runs the pattern
-// detector. If a stable recurring pattern is found and no proposed routine
-// exists for this action+object yet, one is created and the user is prompted
-// to confirm via the park() mechanism. Returns the suggestion phrase when a
-// new proposal was created and parked; "" otherwise.
-func (h *reactiveHandler) detectPattern(ctx context.Context, factID int64, key, value string, ts time.Time) string {
-	ev := pattern.Extract(factID, key, value, ts)
-	if ev == nil {
-		return "" // not an actionable event
-	}
-	if _, err := h.dataStore.CreateEvent(ctx, factID, ev.Action, ev.Object, ts); err != nil {
-		log.Printf("voice: create event: %v", err)
-		return ""
-	}
-	// Detect+propose (Vikunja #43) is shared with the digestion tick's
-	// proactive scan — see patterns.go. Event *extraction* above stays here,
-	// tied to this fact write; detection over the accumulated history does
-	// not need to happen right now for the voice path to have already done
-	// its job — it's dedupe-safe to also let the next tick find the same
-	// pattern independently.
-	r, id, err := detectAndPropose(ctx, h.dataStore, ev.Action, ev.Object, ts)
-	if err != nil {
-		log.Printf("voice: detect pattern %s/%s: %v", ev.Action, ev.Object, err)
-		return ""
-	}
-	if r == nil {
-		return "" // not enough data, too irregular, or already proposed/decided
-	}
-	log.Printf("voice: proposed routine: %s/%s every %.1f days", r.Action, r.Object, r.IntervalDays)
-
-	// Park the proposal for voice confirmation.
-	phrase := pattern.PhraseRoutine(r)
-	h.mu.Lock()
-	h.pendingRoutine = &pendingRoutineConfirm{
-		routineID: id,
-		action:    r.Action,
-		object:    r.Object,
-		interval:  r.IntervalDays,
-		phrase:    phrase,
-		expiry:    ts.Add(confirmTTL),
-	}
-	h.mu.Unlock()
-	return phrase
-}
-
-// resolveQuietToggle — pre-route keyword check. Returns (reply, true) when
-// the utterance is a quiet-on/off command; ("", false) otherwise. Called from
-// runTurn BEFORE the router so a classifier miscue can't drop it — which means
-// both the voice path and the text path (mavweb /api/chat, telegram) reach it,
-// so a false positive here is a network-reachable way to flip a daemon-wide
-// setting. See classifyQuietToggle for the matching rule.
-func (h *reactiveHandler) resolveQuietToggle(ctx context.Context, text string) (string, bool) {
-	on, off := classifyQuietToggle(text)
-	if !on && !off {
-		return "", false
-	}
-	val := "false"
-	reply := "тихий режим выключен."
-	if on {
-		val = "true"
-		reply = "тихий режим включён. буду реже напоминать."
-	}
-	if _, err := h.api.WriteFact(ctx, ipc.WriteFactReq{
-		Ts:         h.now(),
-		Kind:       "config",
-		Key:        "quiet_hours",
-		Value:      val,
-		Source:     "tap:voice",
-		Confidence: 1.0,
-	}); err != nil {
-		log.Printf("voice: write quiet_hours: %v", err)
-		return "не получилось переключить тихий режим.", true
-	}
-	return reply, true
-}
-
-// quietInflections — the inflectional endings a stem may carry and still be
-// the same word. Adjective/adverb/noun/verb endings, all ≤3 letters. This is
-// what separates "тихий"/"тихом"/"тихо" (stem "тих" + a real ending) from
-// "тихонько"/"потихоньку", which are different words: "онько" is not an
-// ending, and "потихоньку" doesn't start with the stem at all.
-var quietInflections = []string{
-	"", "а", "е", "и", "й", "о", "у", "ы", "ю", "я",
-	"ая", "ее", "ей", "ем", "ие", "ий", "им", "их", "ия", "ию", "ое", "ой", "ом", "ую", "ые", "ый", "ым", "ых", "ья",
-	"ами", "ого", "ому", "ыми", "ать", "ить", "ять",
-}
-
-// quietStem reports whether tok is the given stem carrying at most one
-// inflectional ending. Word boundaries come from tokenisation (see
-// quietTokens), not from a regexp — Go's \b is ASCII-oriented and treats every
-// Cyrillic letter as a non-word character, so `\bтих\b` would happily match
-// inside "тихонько". Comparing whole tokens sidesteps that entirely.
-func quietStem(tok, stem string) bool {
-	if !strings.HasPrefix(tok, stem) {
-		return false
-	}
-	suffix := tok[len(stem):]
-	for _, e := range quietInflections {
-		if suffix == e {
-			return true
-		}
-	}
-	return false
-}
-
-// quietTokens splits an utterance into lowercase word tokens, dropping
-// punctuation and spacing. Unicode-aware, so Cyrillic words tokenise the same
-// way ASCII ones do.
-func quietTokens(text string) []string {
-	return strings.FieldsFunc(strings.ToLower(strings.TrimSpace(text)), func(r rune) bool {
-		return !unicode.IsLetter(r) && !unicode.IsDigit(r)
-	})
-}
-
-// quietPhrase matches a pattern (a sequence of stems) against the token list.
-// Multi-word patterns match any contiguous run of tokens — "включи тихий
-// режим" carries "тихий режим". Single-word patterns match ONLY when they are
-// the whole utterance: bare "тихо" is a command, but "в комнате тихо" is a
-// remark about the room and must not flip a daemon-wide setting.
-func quietPhrase(tokens, pattern []string) bool {
-	if len(pattern) == 0 || len(tokens) < len(pattern) {
-		return false
-	}
-	if len(pattern) == 1 {
-		return len(tokens) == 1 && quietStem(tokens[0], pattern[0])
-	}
-	for i := 0; i+len(pattern) <= len(tokens); i++ {
-		hit := true
-		for j, stem := range pattern {
-			if !quietStem(tokens[i+j], stem) {
-				hit = false
-				break
-			}
-		}
-		if hit {
-			return true
-		}
-	}
-	return false
-}
-
-// quietOffPhrases / quietOnPhrases — the toggle vocabulary, as stem sequences.
-var (
-	quietOffPhrases = [][]string{
-		{"quiet", "off"}, {"quiet", "end"},
-		{"громк", "режим"}, {"шумн", "режим"},
-		{"отмен", "тих"}, {"выключ", "тих"}, {"не", "тих"},
-	}
-	quietOnPhrases = [][]string{
-		{"quiet", "on"}, {"quiet", "mode"},
-		{"тих", "режим"}, {"не", "шум"}, {"не", "беспоко"},
-		{"тих"},
-	}
-)
-
-// classifyQuietToggle reads an utterance as a quiet-mode command. OFF is
-// resolved before ON for the same reason classifyConfirm checks negatives
-// first: the OFF phrases are built out of the ON words ("выключи тихий"
-// contains "тихий"), so scanning ON first would shadow them and "выключи
-// тихий режим" would turn quiet mode on. Negation wins.
-func classifyQuietToggle(text string) (on, off bool) {
-	tokens := quietTokens(text)
-	for _, p := range quietOffPhrases {
-		if quietPhrase(tokens, p) {
-			return false, true
-		}
-	}
-	for _, p := range quietOnPhrases {
-		if quietPhrase(tokens, p) {
-			return true, false
-		}
-	}
-	return false, false
-}
-
 // replySystem answers system-observable queries using the handler's clock
 // and (in future) system interfaces. The decision's utterance is parsed
 // for keywords to determine what the user is asking about.

cmd/mavend/voicewire.go

@@ -40,6 +40,15 @@ type voiceWiring struct {
 	// mavsttd / mavttsd don't keep a stale conn into a restarting daemon.
 	sttClient *worker.Client
 	ttsClient *worker.Client
+	// transcriber — the STT in use, exposed so the meeting recorder
+	// (cmd/mavend/capture.go) can reuse it. Maven has exactly one STT and does
+	// not grow a second one for capture: this is the same whisper.cpp worker the
+	// voice path talks to.
+	transcriber stt.Transcriber
+	// mcp — the MCP client, nil unless the `mcp` block configures an enabled
+	// server (Vikunja #251). Its tools land in the same allowlist as every
+	// other act, so nothing else here has to know about it.
+	mcp *mcpWiring
 }
 
 // close releases the listener + worker conns. Safe to call on nil (when
@@ -60,6 +69,7 @@ func (w *voiceWiring) close() {
 	if w.ttsClient != nil {
 		_ = w.ttsClient.Close()
 	}
+	w.mcp.close()
 }
 
 // wireVoice builds the audio path from cfg + a CoreAPI + a router. Returns
@@ -87,6 +97,7 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 	} else {
 		transcriber = stt.NewStub()
 	}
+	w.transcriber = transcriber
 
 	// ----- tts (Stub in-process OR Remote) -----
 	var synthesizer tts.Synthesizer
@@ -131,6 +142,14 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 	// daemon restart.
 	seedTools(coreAPI, cfg.Voice.Tools)
 	exec := tool.NewExecutor(coreAPI, time.Duration(cfg.Voice.ToolTimeout))
+	// MCP servers (Vikunja #251): discovery PROPOSES tools into the same
+	// allowlist, so an MCP tool is enabled by hand on /tools like any other and
+	// runs through the same confirm turn. Off unless the `mcp` block configures
+	// an enabled server.
+	w.mcp = wireMCP(cfg, dataStore)
+	if w.mcp != nil {
+		exec = exec.WithMCP(w.mcp.caller())
+	}
 	matcher := tool.NewMatcher(coreAPI)
 
 	// ----- weather provider (Open-Meteo when configured, Stub otherwise) -----
@@ -148,7 +167,9 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 	// The replier uses the same llama-server as the phraser.
 	var llmClient *llm.Client
 	if lp, ok := phr.(*phraser.LLMPhraser); ok {
-		llmClient = llm.New(lp.BaseURL(), 60*time.Second)
+		// llmClientFor, not llm.New: this client must follow the phraser onto
+		// the new llama-server when the resident model is swapped (Vikunja #250).
+		llmClient = llmClientFor(lp, 60*time.Second)
 	}
 	// ----- router (the cascade; floor examples seed the classifier) -----
 	// The act matcher's allowlist is exactly the enabled tool names — the
@@ -201,16 +222,20 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 
 	// ----- the handler (the reactive path; closes over stt / tts / router / coreAPI / memory) -----
 	h := &reactiveHandler{
-		stt:              transcriber,
-		tts:              synthesizer,
-		router:           rtr,
-		embedder:         emb,
-		api:              coreAPI,
-		tools:            exec,
-		matcher:          matcher,
-		replier:          replier,
-		phraser:          phr,
-		now:              time.Now,
+		stt:      transcriber,
+		tts:      synthesizer,
+		router:   rtr,
+		embedder: emb,
+		api:      coreAPI,
+		tools:    exec,
+		matcher:  matcher,
+		replier:  replier,
+		phraser:  phr,
+		now:      time.Now,
+		feedsOn:  cfg.Feeds != nil,
+		// nil unless `crawl.on_demand` is on: reading a page he names is a
+		// capability, and capabilities are off unless configured.
+		crawler:          onDemandCrawler(cfg),
 		weatherProvider:  weatherProvider,
 		weatherLocation:  weatherLocation,
 		memStore:         memStore,

cmd/mavmaild/main.go

@@ -0,0 +1,332 @@
+// mavmaild — the mail reader module (Vikunja #246,
+// docs/plans/01-email-reader.md).
+//
+// Every so often it opens one IMAP mailbox read-only, fetches the messages it
+// has not read yet, and hands each one to core over ipc.MethodIngestMail. Core
+// runs the extraction on the resident model and writes what comes back as task
+// CANDIDATES he reviews on /tasks. Nothing here writes to the store, nothing
+// here can create a reminder, and nothing here speaks.
+//
+// Why a separate daemon rather than a loop inside mavend, when extraction has
+// to happen in mavend anyway: the credential. mavpoll set the precedent with the
+// zenmoney token (#125) — the module that talks to a third party holds the
+// secret, reads it from a FILE so it never appears in `ps`, in
+// docker-compose.yml or in shell history, and core never sees it. Core learns
+// that mail exists only as message text on one IPC method; it cannot connect to
+// the mailbox even if it wanted to, and a compromised core yields no mail
+// password.
+//
+// Off unless configured: without -password-file there is nothing to run, and
+// the daemon says so and exits. If core has no `email` block the very first
+// ingest comes back ErrUnknownMethod and this daemon stops polling instead of
+// hammering a socket that will keep refusing.
+//
+// Mail is personal, so the log is counts and UIDs: how many messages were
+// fetched, how many were bulk, how many candidates came back. No subject, no
+// sender, no body, ever — reviewing a candidate is what /tasks is for.
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"log"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"sort"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/kami/maven/internal/email"
+	"github.com/kami/maven/internal/ipc"
+)
+
+func main() {
+	if err := run(os.Args[1:]); err != nil {
+		fmt.Fprintln(os.Stderr, "mavmaild:", err)
+		os.Exit(1)
+	}
+}
+
+func run(args []string) error {
+	fs := flag.NewFlagSet("mavmaild", flag.ContinueOnError)
+	socket := fs.String("socket", "", "core IPC socket path (required)")
+	server := fs.String("imap", "", "IMAP server, host or host:993 (required)")
+	user := fs.String("user", "", "IMAP username (required)")
+	passFile := fs.String("password-file", "", "file holding the IMAP password (required — never passed as a flag value)")
+	mailbox := fs.String("mailbox", "INBOX", "mailbox to read, read-only")
+	interval := fs.Duration("interval", 15*time.Minute, "how often to read the mailbox")
+	lookback := fs.Duration("lookback", 72*time.Hour, "how far back to search on each poll")
+	max := fs.Int("max", 25, "most messages to fetch in one poll")
+	timeout := fs.Duration("timeout", 30*time.Second, "IMAP network timeout")
+	statePath := fs.String("state", "", "file remembering which UIDs were read (default: none — every poll re-reads the window)")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	if *socket == "" {
+		return fmt.Errorf("-socket is required")
+	}
+	if *server == "" || *user == "" || *passFile == "" {
+		return fmt.Errorf("mail reading is off unless configured: set -imap, -user and -password-file")
+	}
+
+	// The password is read from a file, never taken as a flag value: an argv
+	// secret is visible in `ps` to every user on the box and lands in the compose
+	// file and the shell history. Read once at start — a rotated password means a
+	// restart, which is cheaper than re-reading his credential every quarter hour.
+	raw, err := os.ReadFile(*passFile)
+	if err != nil {
+		return fmt.Errorf("read password file: %w", err)
+	}
+	password := strings.TrimSpace(string(raw))
+	if password == "" {
+		return fmt.Errorf("password file %s is empty", *passFile)
+	}
+
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	core, err := ipc.DialWait(*socket, 60*time.Second)
+	if err != nil {
+		return err
+	}
+	defer core.Close()
+
+	r := &reader{
+		core:     core,
+		addr:     *server,
+		user:     *user,
+		mailbox:  *mailbox,
+		lookback: *lookback,
+		max:      *max,
+		timeout:  *timeout,
+		state:    newSeenState(*statePath),
+	}
+	if err := r.state.load(); err != nil {
+		// A missing or corrupt state file must not stop mail from being read: the
+		// worst case is re-reading the window, and capture dedupes on text.
+		log.Printf("mavmaild: state: %v (starting from an empty seen-set)", err)
+	}
+
+	// The password is never logged, not even its length.
+	log.Printf("mavmaild: reading %s on %s every %s (lookback %s, max %d/poll)",
+		*mailbox, *server, *interval, *lookback, *max)
+
+	r.pollOnce(ctx, password) // don't idle a full interval on start
+	t := time.NewTicker(*interval)
+	defer t.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			log.Printf("mavmaild: bye")
+			return nil
+		case <-t.C:
+			if r.disabled {
+				// Core told us mail ingestion is not configured. Nothing will change
+				// without a core restart, and a restart restarts us too.
+				log.Printf("mavmaild: core does not accept mail — idling")
+				return nil
+			}
+			r.pollOnce(ctx, password)
+		}
+	}
+}
+
+// mailIngester — the slice of core this daemon uses. One method: hand over a
+// message. It cannot write a fact, create a reminder or read the store, and the
+// interface says so.
+type mailIngester interface {
+	IngestMail(ctx context.Context, req ipc.IngestMailReq) (ipc.IngestMailResp, error)
+}
+
+type reader struct {
+	core     mailIngester
+	addr     string
+	user     string
+	mailbox  string
+	lookback time.Duration
+	max      int
+	timeout  time.Duration
+	state    *seenState
+
+	// dial — connection seam for the tests; nil ⇒ implicit TLS.
+	dial func(addr string, timeout time.Duration) (*email.Conn, error)
+
+	// disabled — core answered ErrUnknownMethod, i.e. it has no email block.
+	disabled bool
+}
+
+// pollOnce — one read of the mailbox, then one ingest per message.
+//
+// A fetch error aborts this poll and nothing else; the next tick tries again.
+// An ingest error for one message does not skip the rest — one mail the model
+// choked on should not hide the four behind it.
+func (r *reader) pollOnce(ctx context.Context, password string) {
+	msgs, err := r.fetch(password)
+	if err != nil {
+		// The error may name a UID; it never names a subject or a sender.
+		log.Printf("mavmaild: fetch: %v", err)
+		if len(msgs) == 0 {
+			return
+		}
+	}
+	var junk, candidates, created int
+	for _, m := range msgs {
+		if ctx.Err() != nil {
+			return
+		}
+		if m.Junk {
+			junk++
+			// Marked seen without a model call: the header filter already decided,
+			// and re-classifying it every quarter hour would be pure waste.
+			r.state.mark(m.UID)
+			continue
+		}
+		resp, err := r.core.IngestMail(ctx, ipc.IngestMailReq{
+			Mailbox: r.mailbox,
+			UID:     m.UID,
+			From:    m.From,
+			Subject: m.Subject,
+			Date:    m.Date,
+			Body:    m.Body,
+		})
+		if errors.Is(err, ipc.ErrUnknownMethod) {
+			log.Printf("mavmaild: core has no email block configured — mail ingestion is off; stopping")
+			r.disabled = true
+			return
+		}
+		if err != nil {
+			// Not marked seen: an ingest that failed should be retried next poll.
+			log.Printf("mavmaild: ingest uid %d: %v", m.UID, err)
+			continue
+		}
+		r.state.mark(m.UID)
+		candidates += len(resp.TaskIDs)
+		created += resp.Created
+	}
+	if err := r.state.save(); err != nil {
+		log.Printf("mavmaild: state: %v", err)
+	}
+	log.Printf("mavmaild: %s: %d read, %d bulk, %d candidate(s), %d new", r.mailbox, len(msgs), junk, candidates, created)
+}
+
+// fetch reads the mailbox. Messages already in the seen-set are not fetched at
+// all, so a steady mailbox costs one SEARCH per poll and nothing else.
+func (r *reader) fetch(password string) ([]email.Message, error) {
+	f := email.FetchSince{
+		Addr:    r.addr,
+		User:    r.user,
+		Mailbox: r.mailbox,
+		Timeout: r.timeout,
+		Since:   time.Now().Add(-r.lookback),
+		Max:     r.max,
+		Skip:    r.state.seen,
+	}
+	return f.RunWith(password, r.dial)
+}
+
+// ---- seen state ------------------------------------------------------------
+
+// seenState — the UIDs already handed to core, persisted so a restart does not
+// re-read (and re-extract, at multi-second LLM cost) the whole lookback window.
+//
+// Correctness does not depend on it: ipc.CaptureTask dedupes on normalised text
+// among live tasks, so a re-read produces no duplicate rows. This exists to save
+// the model's time, which is why a broken state file is a log line rather than a
+// failure.
+//
+// UIDs are per-mailbox and monotonic, so the set is kept as a high-water mark
+// plus the stragglers above it. If the server ever changes UIDVALIDITY, UIDs
+// reset and the window is simply re-read once — dedupe absorbs it.
+type seenState struct {
+	path  string
+	high  uint32
+	set   map[uint32]bool
+	dirty bool
+}
+
+func newSeenState(path string) *seenState {
+	return &seenState{path: path, set: map[uint32]bool{}}
+}
+
+type seenFile struct {
+	High uint32   `json:"high"`
+	UIDs []uint32 `json:"uids,omitempty"`
+}
+
+func (s *seenState) seen(uid uint32) bool {
+	return uid <= s.high || s.set[uid]
+}
+
+func (s *seenState) mark(uid uint32) {
+	if s.seen(uid) {
+		return
+	}
+	s.set[uid] = true
+	s.dirty = true
+	// Advance the high-water mark through any contiguous run, so the explicit set
+	// stays small on a mailbox read in order.
+	for {
+		next := s.high + 1
+		if !s.set[next] {
+			break
+		}
+		delete(s.set, next)
+		s.high = next
+	}
+}
+
+func (s *seenState) load() error {
+	if s.path == "" {
+		return nil
+	}
+	b, err := os.ReadFile(s.path)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil // first run
+	}
+	if err != nil {
+		return err
+	}
+	var f seenFile
+	if err := json.Unmarshal(b, &f); err != nil {
+		return fmt.Errorf("parse %s: %w", s.path, err)
+	}
+	s.high = f.High
+	for _, u := range f.UIDs {
+		s.set[u] = true
+	}
+	return nil
+}
+
+// save writes the state atomically (temp file + rename), 0600: it is a list of
+// message ids from his mailbox, which is metadata about his mail.
+func (s *seenState) save() error {
+	if s.path == "" || !s.dirty {
+		return nil
+	}
+	uids := make([]uint32, 0, len(s.set))
+	for u := range s.set {
+		uids = append(uids, u)
+	}
+	sort.Slice(uids, func(i, j int) bool { return uids[i] < uids[j] })
+	b, err := json.Marshal(seenFile{High: s.high, UIDs: uids})
+	if err != nil {
+		return err
+	}
+	tmp := s.path + ".tmp"
+	if err := os.MkdirAll(filepath.Dir(s.path), 0o700); err != nil {
+		return err
+	}
+	if err := os.WriteFile(tmp, b, 0o600); err != nil {
+		return err
+	}
+	if err := os.Rename(tmp, s.path); err != nil {
+		return err
+	}
+	s.dirty = false
+	return nil
+}

cmd/mavmaild/main_test.go

@@ -0,0 +1,254 @@
+package main
+
+import (
+	"bufio"
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/email"
+	"github.com/kami/maven/internal/ipc"
+)
+
+// ---- a scripted IMAP server, same shape internal/email's tests use ---------
+
+type fakeIMAP struct {
+	msgs map[uint32]string
+	uids []uint32
+	cmds []string
+}
+
+func (f *fakeIMAP) serve(c net.Conn) {
+	defer c.Close()
+	fmt.Fprint(c, "* OK fake ready\r\n")
+	r := bufio.NewReader(c)
+	for {
+		line, err := r.ReadString('\n')
+		if err != nil {
+			return
+		}
+		parts := strings.SplitN(strings.TrimRight(line, "\r\n"), " ", 2)
+		if len(parts) != 2 {
+			return
+		}
+		tag, cmd := parts[0], parts[1]
+		f.cmds = append(f.cmds, cmd)
+		upper := strings.ToUpper(cmd)
+		switch {
+		case strings.HasPrefix(upper, "LOGIN"), strings.HasPrefix(upper, "EXAMINE"):
+			fmt.Fprintf(c, "%s OK\r\n", tag)
+		case strings.HasPrefix(upper, "UID SEARCH"):
+			var ids []string
+			for _, u := range f.uids {
+				ids = append(ids, strconv.FormatUint(uint64(u), 10))
+			}
+			fmt.Fprintf(c, "* SEARCH %s\r\n%s OK\r\n", strings.Join(ids, " "), tag)
+		case strings.HasPrefix(upper, "UID FETCH"):
+			uid, _ := strconv.ParseUint(strings.Fields(cmd)[2], 10, 32)
+			if raw, ok := f.msgs[uint32(uid)]; ok {
+				fmt.Fprintf(c, "* 1 FETCH (UID %d BODY[] {%d}\r\n%s)\r\n", uid, len(raw), raw)
+			}
+			fmt.Fprintf(c, "%s OK\r\n", tag)
+		case strings.HasPrefix(upper, "LOGOUT"):
+			fmt.Fprintf(c, "* BYE\r\n%s OK\r\n", tag)
+			return
+		default:
+			fmt.Fprintf(c, "%s BAD\r\n", tag)
+		}
+	}
+}
+
+func (f *fakeIMAP) dial(_ string, timeout time.Duration) (*email.Conn, error) {
+	cli, srv := net.Pipe()
+	go f.serve(srv)
+	return email.NewConn(cli, timeout)
+}
+
+// ---- a fake core -----------------------------------------------------------
+
+type fakeCore struct {
+	got  []ipc.IngestMailReq
+	resp ipc.IngestMailResp
+	err  error
+}
+
+func (c *fakeCore) IngestMail(_ context.Context, req ipc.IngestMailReq) (ipc.IngestMailResp, error) {
+	c.got = append(c.got, req)
+	if c.err != nil {
+		return ipc.IngestMailResp{}, c.err
+	}
+	return c.resp, nil
+}
+
+func mail(subject, body string, extraHeaders ...string) string {
+	h := "Subject: " + subject + "\r\nFrom: a@b.c\r\nContent-Type: text/plain; charset=utf-8\r\n"
+	for _, e := range extraHeaders {
+		h += e + "\r\n"
+	}
+	return h + "\r\n" + body + "\r\n"
+}
+
+func newTestReader(t *testing.T, f *fakeIMAP, core *fakeCore, statePath string) *reader {
+	t.Helper()
+	return &reader{
+		core: core, addr: "mail.example:993", user: "kami", mailbox: "INBOX",
+		lookback: 72 * time.Hour, max: 25, timeout: 5 * time.Second,
+		state: newSeenState(statePath),
+		dial:  f.dial,
+	}
+}
+
+func TestPollHandsMessagesToCore(t *testing.T) {
+	f := &fakeIMAP{
+		uids: []uint32{1, 2},
+		msgs: map[uint32]string{
+			1: mail("Счёт", "Оплатить до 5 августа."),
+			2: mail("Скидки", "Sale!", "List-Unsubscribe: <mailto:u@x>"),
+		},
+	}
+	core := &fakeCore{resp: ipc.IngestMailResp{TaskIDs: []int64{1}, Created: 1}}
+	r := newTestReader(t, f, core, "")
+	r.pollOnce(context.Background(), "secret")
+
+	// The newsletter is filtered before core is asked: only the real mail crosses.
+	if len(core.got) != 1 {
+		t.Fatalf("core saw %d messages, want 1 (the bulk one must not cross): %+v", len(core.got), core.got)
+	}
+	got := core.got[0]
+	if got.UID != 1 || got.Mailbox != "INBOX" || got.Subject != "Счёт" {
+		t.Errorf("ingest req = %+v", got)
+	}
+	if !strings.Contains(got.Body, "Оплатить") {
+		t.Errorf("body = %q", got.Body)
+	}
+}
+
+// A second poll must not re-send what core already saw — extraction is a
+// multi-second LLM call per message.
+func TestPollSkipsSeenUIDs(t *testing.T) {
+	f := &fakeIMAP{uids: []uint32{5}, msgs: map[uint32]string{5: mail("Счёт", "текст")}}
+	core := &fakeCore{}
+	r := newTestReader(t, f, core, "")
+	r.pollOnce(context.Background(), "secret")
+	r.pollOnce(context.Background(), "secret")
+	if len(core.got) != 1 {
+		t.Errorf("core saw %d messages over two polls, want 1", len(core.got))
+	}
+}
+
+// An ingest that failed is NOT marked seen: the next poll retries it.
+func TestPollRetriesFailedIngest(t *testing.T) {
+	f := &fakeIMAP{uids: []uint32{5}, msgs: map[uint32]string{5: mail("Счёт", "текст")}}
+	core := &fakeCore{err: fmt.Errorf("llama-server is warming up")}
+	r := newTestReader(t, f, core, "")
+	r.pollOnce(context.Background(), "secret")
+	core.err = nil
+	r.pollOnce(context.Background(), "secret")
+	if len(core.got) != 2 {
+		t.Errorf("core saw %d attempts, want 2 (a failed ingest is retried)", len(core.got))
+	}
+}
+
+// Core without an email block ⇒ stop, don't hammer the socket.
+func TestPollStopsWhenCoreRefusesMail(t *testing.T) {
+	f := &fakeIMAP{uids: []uint32{1, 2}, msgs: map[uint32]string{1: mail("a", "b"), 2: mail("c", "d")}}
+	core := &fakeCore{err: fmt.Errorf("call: %w", ipc.ErrUnknownMethod)}
+	r := newTestReader(t, f, core, "")
+	r.pollOnce(context.Background(), "secret")
+	if !r.disabled {
+		t.Error("ErrUnknownMethod must disable the reader")
+	}
+	if len(core.got) != 1 {
+		t.Errorf("core saw %d messages, want 1 — stop at the first refusal", len(core.got))
+	}
+}
+
+func TestSeenStatePersists(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "state", "seen.json")
+	f := &fakeIMAP{uids: []uint32{9}, msgs: map[uint32]string{9: mail("Счёт", "текст")}}
+	core := &fakeCore{}
+	r := newTestReader(t, f, core, path)
+	r.pollOnce(context.Background(), "secret")
+
+	fi, err := os.Stat(path)
+	if err != nil {
+		t.Fatalf("state file: %v", err)
+	}
+	// A list of message ids from his mailbox is metadata about his mail.
+	if perm := fi.Mode().Perm(); perm != 0o600 {
+		t.Errorf("state file mode = %v, want 0600", perm)
+	}
+
+	// A fresh reader with the same state file must not re-read the message.
+	core2 := &fakeCore{}
+	r2 := newTestReader(t, f, core2, path)
+	if err := r2.state.load(); err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	r2.pollOnce(context.Background(), "secret")
+	if len(core2.got) != 0 {
+		t.Errorf("after a restart core saw %d messages, want 0", len(core2.got))
+	}
+}
+
+func TestSeenStateHighWaterMark(t *testing.T) {
+	s := newSeenState("")
+	s.mark(1)
+	s.mark(3)
+	s.mark(2)
+	if s.high != 3 {
+		t.Errorf("high = %d, want 3 (contiguous run collapses)", s.high)
+	}
+	if len(s.set) != 0 {
+		t.Errorf("explicit set = %v, want empty", s.set)
+	}
+	if !s.seen(2) || s.seen(4) {
+		t.Errorf("seen(2)=%v seen(4)=%v", s.seen(2), s.seen(4))
+	}
+}
+
+func TestSeenStateCorruptFileIsNotFatal(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "seen.json")
+	if err := os.WriteFile(path, []byte("{not json"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	s := newSeenState(path)
+	if err := s.load(); err == nil {
+		t.Error("a corrupt state file should report an error the caller logs")
+	}
+	if s.seen(1) {
+		t.Error("a corrupt state file must leave an empty seen-set, not a poisoned one")
+	}
+}
+
+// Off unless configured, and the credential is never a flag value.
+func TestRunRequiresConfig(t *testing.T) {
+	if err := run([]string{}); err == nil {
+		t.Error("no -socket must be an error")
+	}
+	if err := run([]string{"-socket", "/tmp/nope.sock"}); err == nil {
+		t.Error("no mailbox configuration must be an error, not a default mailbox")
+	}
+	// There is no -password flag at all: only -password-file.
+	if err := run([]string{"-socket", "/x", "-imap", "h", "-user", "u", "-password", "p"}); err == nil ||
+		!strings.Contains(err.Error(), "flag provided but not defined") {
+		t.Errorf("a -password flag must not exist; err = %v", err)
+	}
+}
+
+func TestRunRejectsEmptyPasswordFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "pass")
+	if err := os.WriteFile(path, []byte("  \n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	err := run([]string{"-socket", "/x/y.sock", "-imap", "h", "-user", "u", "-password-file", path})
+	if err == nil || !strings.Contains(err.Error(), "empty") {
+		t.Errorf("an empty password file must be refused before dialling; err = %v", err)
+	}
+}

cmd/mavpoll/main.go

@@ -9,6 +9,12 @@
 // Two sources, each its own provenance (the loop's rules trust source):
 //   - netdata  → poll:netdata      resource alarms (disk/mem/cert/temp)
 //   - kuma     → poll:uptimekuma   service up/down (the source of truth for it)
+//   - zenmoney → poll:zenmoney     spending/income totals (Vikunja #125)
+//
+// The zenmoney source is why the token lives HERE and not in core: the poller
+// already owns every other third-party credential, it holds no store key, and
+// core never needs to know an account exists to answer a question about a fact
+// the poller wrote. It is off unless -zenmoney-token-file is given.
 //
 // Netdata needs no auth over the wg-fronted net. Kuma's /metrics needs an API
 // key (basic-auth); without -kuma the whole kuma path is skipped (netdata-only
@@ -37,6 +43,7 @@ import (
 	"time"
 
 	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/zenmoney"
 )
 
 func main() {
@@ -52,6 +59,9 @@ func run(args []string) error {
 	netdataURL := fs.String("netdata", "http://127.0.0.1:19999", "netdata base URL ('' to disable)")
 	kumaURL := fs.String("kuma", "", "uptime-kuma metrics URL, e.g. http://127.0.0.1:3001/metrics ('' to disable)")
 	kumaKey := fs.String("kuma-key", "", "uptime-kuma API key (basic-auth username)")
+	zenTokenFile := fs.String("zenmoney-token-file", "", "file holding the zenmoney API token ('' disables money tracking)")
+	zenURL := fs.String("zenmoney-url", zenmoney.DefaultBaseURL, "zenmoney API base URL (tests/self-hosted proxies)")
+	zenInterval := fs.Duration("zenmoney-interval", time.Hour, "how often to read zenmoney (money does not move every minute)")
 	wgIface := fs.String("wg", "", "wireguard interface for the presence signal, e.g. wg0 or 'all' ('' to disable)")
 	wgCmd := fs.String("wg-cmd", "wg", "wg binary (use e.g. 'sudo wg' if the poller lacks CAP_NET_ADMIN)")
 	interval := fs.Duration("interval", 60*time.Second, "poll cadence")
@@ -62,8 +72,24 @@ func run(args []string) error {
 	if *socket == "" {
 		return fmt.Errorf("-socket is required")
 	}
-	if *netdataURL == "" && *kumaURL == "" && *wgIface == "" {
-		return fmt.Errorf("nothing to poll: set -netdata, -kuma and/or -wg")
+	if *netdataURL == "" && *kumaURL == "" && *wgIface == "" && *zenTokenFile == "" {
+		return fmt.Errorf("nothing to poll: set -netdata, -kuma, -wg and/or -zenmoney-token-file")
+	}
+
+	// The token is read from a file, never taken as a flag value: an argv token
+	// is visible in `ps` to every user on the box and lands in the compose file
+	// and the shell history. Read once at start — a rotated token means a
+	// restart, which is cheaper than re-reading his credential every hour.
+	var zen *zenmoney.Client
+	if *zenTokenFile != "" {
+		raw, err := os.ReadFile(*zenTokenFile)
+		if err != nil {
+			return fmt.Errorf("read zenmoney token: %w", err)
+		}
+		zen, err = zenmoney.New(strings.TrimSpace(string(raw)), *zenURL, *timeout*3)
+		if err != nil {
+			return err
+		}
 	}
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
@@ -83,9 +109,13 @@ func run(args []string) error {
 		kumaKey:    *kumaKey,
 		wgIface:    *wgIface,
 		wgCmd:      *wgCmd,
+		zen:        zen,
+		zenEvery:   *zenInterval,
 	}
 
-	log.Printf("mavpoll: polling every %s (netdata=%q kuma=%q wg=%q)", *interval, *netdataURL, *kumaURL, *wgIface)
+	// The token is never logged, not even its length.
+	log.Printf("mavpoll: polling every %s (netdata=%q kuma=%q wg=%q zenmoney=%v every %s)",
+		*interval, *netdataURL, *kumaURL, *wgIface, zen != nil, *zenInterval)
 	p.pollOnce(ctx) // fire immediately; don't idle a full interval on start
 	t := time.NewTicker(*interval)
 	defer t.Stop()
@@ -108,6 +138,12 @@ type poller struct {
 	kumaKey    string
 	wgIface    string
 	wgCmd      string
+
+	// zen is nil unless a token file was configured — money tracking is a
+	// capability, off by default like weather and telegram.
+	zen      *zenmoney.Client
+	zenEvery time.Duration
+	zenLast  time.Time
 }
 
 // pollOnce — one sweep of both sources. A failure in one source logs and does
@@ -129,6 +165,66 @@ func (p *poller) pollOnce(ctx context.Context) {
 			log.Printf("mavpoll: wg: %v", err)
 		}
 	}
+	// Money on its own, much slower cadence: a bank feed that updates hourly
+	// polled every minute is 60 pointless reads of his financial history.
+	if p.zen != nil && now.Sub(p.zenLast) >= p.zenEvery {
+		p.zenLast = now
+		if err := p.pollZenmoney(ctx, now); err != nil {
+			log.Printf("mavpoll: zenmoney: %v", err)
+		}
+	}
+}
+
+// ---- zenmoney: spending/income totals → money facts ------------------------
+
+// pollZenmoney reads today's and this month's totals and writes them as
+// facts(kind=env, source=poll:zenmoney) (Vikunja #125).
+//
+// Two properties this function exists to hold:
+//
+//   - An empty or failed read writes NOTHING. zenmoney.Summary.Value() refuses
+//     to encode a summary built from zero transactions, so a poller that cannot
+//     reach the API leaves the last good fact in place rather than overwriting
+//     it with a zero Maven would then recite as fact.
+//   - Nothing about the money leaves the box except the diff request itself, to
+//     the service that already holds his bank sessions. The totals are written
+//     to the store and read back only when he asks; they are never search input
+//     and no tick rule fires on them.
+//
+// Both windows are read from one diff call each. Two calls an hour against an
+// API whose whole job is this is not worth caching.
+// moneyWindow — one fact key and the period it covers.
+type moneyWindow struct {
+	key      string
+	from, to time.Time
+}
+
+func (p *poller) pollZenmoney(ctx context.Context, now time.Time) error {
+	dFrom, dTo := zenmoney.DayWindow(now)
+	mFrom, mTo := zenmoney.MonthWindow(now)
+	windows := []moneyWindow{
+		{zenmoney.KeySpentToday, dFrom, dTo},
+		{zenmoney.KeySpentMonth, mFrom, mTo},
+	}
+	var firstErr error
+	for _, w := range windows {
+		sum, err := p.zen.Since(ctx, w.from, w.to)
+		if err != nil {
+			if firstErr == nil {
+				firstErr = err
+			}
+			continue
+		}
+		val, ok := sum.Value()
+		if !ok {
+			// Nothing read. Silence, not a zero.
+			continue
+		}
+		if err := p.writeIfChangedRaw(ctx, w.key, zenmoney.Source, val, now); err != nil && firstErr == nil {
+			firstErr = err
+		}
+	}
+	return firstErr
 }
 
 // ---- wireguard: latest handshake → presence signal -------------------------
@@ -301,6 +397,31 @@ func (p *poller) writeIfChanged(ctx context.Context, key, source, val string, no
 	return nil
 }
 
+// writeIfChangedRaw is writeIfChanged for values that are already JSON (the
+// money facts store an object, not a string). Kept separate rather than
+// generalising writeIfChanged, because the string-valued env facts encoding
+// their own value is the convention the rules rely on.
+//
+// The log line names the key and the source, never the figures: mavpoll's log
+// is not the place his spending ends up.
+func (p *poller) writeIfChangedRaw(ctx context.Context, key, source, jsonVal string, now time.Time) error {
+	prev, err := p.core.LatestFactBySource(ctx, key, source)
+	switch {
+	case err == nil && prev.Value == jsonVal:
+		return nil
+	case err != nil && err != ipc.ErrNoFact && !isNoFact(err):
+		return fmt.Errorf("read %s: %w", key, err)
+	}
+	if _, err := p.core.WriteFact(ctx, ipc.WriteFactReq{
+		Ts: now, Kind: "env", Key: key, Value: jsonVal,
+		Source: source, Confidence: 1.0,
+	}); err != nil {
+		return fmt.Errorf("write %s: %w", key, err)
+	}
+	log.Printf("mavpoll: %s updated (%s)", key, source)
+	return nil
+}
+
 // isNoFact — ErrNoFact rehydrated over the wire is wrapped (fmt.Errorf %w), so
 // errors.Is is the right check; keep a helper so the switch above reads clean.
 func isNoFact(err error) bool {

cmd/mavpoll/main_test.go

@@ -1,8 +1,17 @@
 package main
 
 import (
+	"context"
 	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
 	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/zenmoney"
 )
 
 func TestMaxSeverity(t *testing.T) {
@@ -62,3 +71,120 @@ func TestParseMaxHandshake(t *testing.T) {
 		}
 	}
 }
+
+// ---- zenmoney (Vikunja #125) ----------------------------------------------
+
+// factCore records the facts the poller wrote and answers "no fact yet".
+type factCore struct {
+	ipc.UnimplementedCoreAPI
+
+	written []ipc.WriteFactReq
+	prev    map[string]string
+}
+
+func (c *factCore) LatestFactBySource(_ context.Context, key, source string) (ipc.Fact, error) {
+	if v, ok := c.prev[key+"|"+source]; ok {
+		return ipc.Fact{Key: key, Source: source, Value: v}, nil
+	}
+	return ipc.Fact{}, ipc.ErrNoFact
+}
+
+func (c *factCore) WriteFact(_ context.Context, req ipc.WriteFactReq) (int64, error) {
+	c.written = append(c.written, req)
+	return int64(len(c.written)), nil
+}
+
+func zenFixtureServer(t *testing.T, body []byte, status int) *httptest.Server {
+	t.Helper()
+	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if status != http.StatusOK {
+			w.WriteHeader(status)
+			return
+		}
+		w.Write(body)
+	}))
+}
+
+func TestPollZenmoneyWritesMoneyFacts(t *testing.T) {
+	body, err := os.ReadFile("../../internal/zenmoney/testdata/diff.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv := zenFixtureServer(t, body, http.StatusOK)
+	defer srv.Close()
+	zen, err := zenmoney.New("tok", srv.URL, time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	core := &factCore{}
+	p := &poller{core: core, zen: zen}
+	now := time.Date(2026, 8, 1, 21, 0, 0, 0, time.UTC)
+	if err := p.pollZenmoney(context.Background(), now); err != nil {
+		t.Fatal(err)
+	}
+	if len(core.written) != 2 {
+		t.Fatalf("wrote %d facts, want today + month", len(core.written))
+	}
+	for _, f := range core.written {
+		if f.Kind != "env" || f.Source != zenmoney.Source {
+			t.Errorf("fact = %+v, want kind=env source=%s", f, zenmoney.Source)
+		}
+		if _, err := zenmoney.ParseFactValue(f.Value); err != nil {
+			t.Errorf("fact value %q does not decode: %v", f.Value, err)
+		}
+	}
+}
+
+// A read that returns nothing for the window writes NOTHING. Silence, not a
+// zero: an invented 0 would be recited back to him as fact.
+func TestPollZenmoneyWritesNothingWhenEmpty(t *testing.T) {
+	srv := zenFixtureServer(t, []byte(`{"serverTimestamp":1,"instrument":[],"transaction":[]}`), http.StatusOK)
+	defer srv.Close()
+	zen, _ := zenmoney.New("tok", srv.URL, time.Second)
+	core := &factCore{}
+	p := &poller{core: core, zen: zen}
+	if err := p.pollZenmoney(context.Background(), time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	if len(core.written) != 0 {
+		t.Errorf("wrote %+v, want no fact at all", core.written)
+	}
+}
+
+// An API failure must not overwrite the last good total either.
+func TestPollZenmoneyFailureWritesNothing(t *testing.T) {
+	srv := zenFixtureServer(t, nil, http.StatusUnauthorized)
+	defer srv.Close()
+	zen, _ := zenmoney.New("bad", srv.URL, time.Second)
+	core := &factCore{}
+	p := &poller{core: core, zen: zen}
+	if err := p.pollZenmoney(context.Background(), time.Now()); err == nil {
+		t.Error("want the 401 reported")
+	}
+	if len(core.written) != 0 {
+		t.Errorf("wrote %+v on a failed read", core.written)
+	}
+}
+
+// Unchanged totals do not churn the facts table.
+func TestWriteIfChangedRawSkipsUnchanged(t *testing.T) {
+	core := &factCore{prev: map[string]string{
+		zenmoney.KeySpentToday + "|" + zenmoney.Source: `{"count":1}`,
+	}}
+	p := &poller{core: core}
+	if err := p.writeIfChangedRaw(context.Background(), zenmoney.KeySpentToday, zenmoney.Source, `{"count":1}`, time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	if len(core.written) != 0 {
+		t.Errorf("wrote %+v for an unchanged value", core.written)
+	}
+}
+
+// Money tracking is off unless configured: no token file, no zenmoney client,
+// and the poller still refuses to start with nothing at all to poll.
+func TestRunRequiresSomethingToPoll(t *testing.T) {
+	err := run([]string{"-socket", "/tmp/nope.sock", "-netdata", "", "-kuma", "", "-wg", ""})
+	if err == nil || !strings.Contains(err.Error(), "nothing to poll") {
+		t.Errorf("err = %v, want a 'nothing to poll' refusal", err)
+	}
+}

cmd/mavupdate/main.go

@@ -0,0 +1,204 @@
+// Command mavupdate deploys a new build of Maven to the box she runs on, with
+// an automatic rollback when the new build does not come up (Vikunja #249).
+//
+// It is a CLI on purpose, and it is the ONLY trigger for the update path.
+//
+// The obvious design — an IPC method plus a button on the web UI behind the
+// step-up passkey gate, the way /tools works — was considered and refused. A
+// step-up gate protects against the wrong person clicking; it does not change
+// the fact that anything reachable over the network becomes, in the event of a
+// mavweb bug, a remote arbitrary-code path with a build system attached. An
+// update needs shell access on the host, which is a strictly higher bar than
+// the gate that guards the tool allowlist. That is deliberate and it is the
+// reason there is no MethodApplyUpdate anywhere in internal/ipc.
+//
+// Consequently: mavend does not import internal/update, nothing runs on a timer,
+// nothing checks a release server, and no act, intent, tool or LLM output can
+// reach any of this. She cannot update herself. She can be updated, by him.
+//
+//	mavupdate -config deploy/mavend.json list          # snapshots available to roll back to
+//	mavupdate -config deploy/mavend.json verify        # make build + make test, deploys nothing
+//	mavupdate -config deploy/mavend.json apply -yes    # the whole thing
+//	mavupdate -config deploy/mavend.json rollback [id] # restore + restart (default: newest)
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/update"
+)
+
+func main() {
+	cfgPath := flag.String("config", "deploy/mavend.json", "path to mavend.json (the update block is read from it)")
+	yes := flag.Bool("yes", false, "required by `apply` and `rollback`: yes, restart the daemon")
+	flag.Usage = usage
+	flag.Parse()
+
+	// The stdlib flag package stops parsing at the first non-flag argument, so a
+	// `-yes` written after the subcommand (which is how anyone would type it, and
+	// how the usage text shows it) lands in Args instead of the flag. Pick it out
+	// by hand rather than silently treating "apply -yes" as an unconfirmed apply.
+	var args []string
+	for _, a := range flag.Args() {
+		if a == "-yes" || a == "--yes" {
+			*yes = true
+			continue
+		}
+		args = append(args, a)
+	}
+	if len(args) == 0 {
+		usage()
+		os.Exit(2)
+	}
+
+	cfg, err := config.Load(*cfgPath)
+	if err != nil {
+		die("config: %v", err)
+	}
+	if cfg.Update == nil {
+		die("no `update` block in %s — the update capability is off unless configured.\nSee the package comment in internal/update for what it does and does not do.", *cfgPath)
+	}
+
+	logf := func(format string, a ...any) {
+		fmt.Fprintf(os.Stderr, "%s  %s\n", time.Now().Format("15:04:05"), fmt.Sprintf(format, a...))
+	}
+	u, err := update.New(*cfg.Update, update.WithLogger(logf))
+	if err != nil {
+		die("%v", err)
+	}
+
+	// Ctrl-C cancels the build or the health wait. It cannot cancel a rollback
+	// midway into leaving the box in an unknown state, because the rollback runs
+	// on its own context — see cmdApply.
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	switch args[0] {
+	case "list":
+		cmdList(u)
+	case "verify":
+		cmdVerify(ctx, u)
+	case "apply":
+		if !*yes {
+			die("apply restarts mavend and can roll her back. Re-run with -yes if that is what you want.")
+		}
+		cmdApply(ctx, u)
+	case "rollback":
+		if !*yes {
+			die("rollback restores the previous artifacts and restarts mavend. Re-run with -yes.")
+		}
+		id := ""
+		if len(args) > 1 {
+			id = args[1]
+		}
+		cmdRollback(ctx, u, id)
+	default:
+		usage()
+		os.Exit(2)
+	}
+}
+
+func cmdList(u *update.Updater) {
+	snaps, err := u.Snapshots()
+	if err != nil {
+		die("snapshots: %v", err)
+	}
+	if len(snaps) == 0 {
+		fmt.Println("no snapshots yet — the first `apply` takes one before it builds anything")
+		return
+	}
+	fmt.Printf("%-18s  %-12s  %s\n", "SNAPSHOT", "COMMIT", "FILES")
+	for _, s := range snaps {
+		commit := s.Commit
+		if len(commit) > 12 {
+			commit = commit[:12]
+		}
+		if commit == "" {
+			commit = "-"
+		}
+		fmt.Printf("%-18s  %-12s  %d\n", s.ID, commit, len(s.Files))
+	}
+	fmt.Printf("\nrollback to the newest with:  mavupdate rollback -yes\n")
+}
+
+func cmdVerify(ctx context.Context, u *update.Updater) {
+	steps, err := u.Verify(ctx)
+	report(steps)
+	if err != nil {
+		die("%v", err)
+	}
+	fmt.Println("verified: the tree builds and passes its own tests. Nothing was deployed — run `apply -yes` for that.")
+}
+
+func cmdApply(ctx context.Context, u *update.Updater) {
+	res, err := u.Apply(ctx)
+	report(res.Steps)
+	summarize(res)
+	switch {
+	case err == nil:
+		fmt.Println("\nupdate committed: she answers on the new build.")
+	case errors.Is(err, update.ErrRollbackFailed):
+		die("\n%v\n\nSHE IS PROBABLY DOWN. The previous artifacts are in the snapshot dir; copy them\nover the install dir and restart by hand.", err)
+	case errors.Is(err, update.ErrRolledBack):
+		die("\n%v\n\nShe is answering again on the previous build. Nothing was lost; fix the change and retry.", err)
+	default:
+		die("\n%v", err)
+	}
+}
+
+func cmdRollback(ctx context.Context, u *update.Updater, id string) {
+	res, err := u.Rollback(ctx, id)
+	report(res.Steps)
+	summarize(res)
+	if err != nil && !errors.Is(err, update.ErrRolledBack) {
+		die("\n%v", err)
+	}
+	fmt.Printf("\nrolled back to %s; she answers on it.\n", res.SnapshotID)
+}
+
+func report(steps []update.Step) {
+	for _, s := range steps {
+		status := "ok"
+		if s.Err != nil {
+			status = "FAILED: " + s.Err.Error()
+		}
+		fmt.Printf("  %-8s %-8s %s\n", s.Name, s.Took.Round(time.Second), status)
+		if s.Output != "" {
+			fmt.Printf("---- %s output ----\n%s\n-------------------\n", s.Name, s.Output)
+		}
+	}
+}
+
+func summarize(res update.Result) {
+	fmt.Printf("\nverified=%v snapshot=%s installed=%d restarted=%v healthy=%v rolled_back=%v rollback_healthy=%v took=%s\n",
+		res.Verified, res.SnapshotID, len(res.Installed), res.Restarted, res.Healthy, res.RolledBack, res.RollbackHealthy, res.Took.Round(time.Second))
+}
+
+func usage() {
+	fmt.Fprint(os.Stderr, `mavupdate — deploy a new build of Maven, with rollback.
+
+  mavupdate [-config path] list
+  mavupdate [-config path] verify
+  mavupdate [-config path] apply -yes
+  mavupdate [-config path] rollback [snapshot-id] -yes
+
+apply is: health-check the running daemon, snapshot the deployed artifacts,
+make build, make test, install, restart, health-check — and restore the
+snapshot if any of that fails. It never fetches code and never runs by itself.
+
+`)
+	flag.PrintDefaults()
+}
+
+func die(format string, a ...any) {
+	fmt.Fprintf(os.Stderr, format+"\n", a...)
+	os.Exit(1)
+}

cmd/mavweb/ambient.go

@@ -0,0 +1,135 @@
+package main
+
+import (
+	"crypto/subtle"
+	"encoding/json"
+	"errors"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+
+	"github.com/kami/maven/internal/calendar"
+	"github.com/kami/maven/internal/ipc"
+)
+
+// POST /api/ambient — the work calendar read (Vikunja #126).
+//
+// Maven does not hold a work credential. A corp mail or calendar session on the
+// homelab ties the box's blast radius to the employer's data, so the work
+// calendar is read as a SIGNAL instead: an Android notification-listener on the
+// owner's phone posts meeting notifications here over wg/LAN, and the ones that
+// clearly describe a meeting become calendar events at source=ambient:notif,
+// confidence below 1.0. Mail as a notification signal, not a mailbox.
+//
+// Off unless configured: no -ambient-token, no route. The token is a shared
+// secret because the poster is a phone service, not a browser — WebAuthn has no
+// answer for a background Android service. The endpoint is write-only and
+// accepts exactly one shape of write; it cannot read anything back out.
+//
+// A notification with no recognisable clock reading stores NOTHING. Maven is
+// not a guesser-of-truth, and a mailbox of noise rendered as invented meetings
+// is worse than a gap.
+
+// ambientMaxBody bounds the request. A notification is two short lines.
+const ambientMaxBody = 8 << 10
+
+type ambientResp struct {
+	Stored bool   `json:"stored"`
+	Key    string `json:"key,omitempty"`
+	Reason string `json:"reason,omitempty"`
+}
+
+// handleAmbient ingests one relayed notification. token is the configured
+// shared secret; an empty token means the capability is off and the handler is
+// never registered, so it is treated as a hard failure here too.
+func handleAmbient(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, token string) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		return
+	}
+	if token == "" {
+		http.Error(w, "ambient ingest disabled (no -ambient-token)", http.StatusServiceUnavailable)
+		return
+	}
+	if !ambientAuthorized(r, token) {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		return
+	}
+	if core == nil {
+		http.Error(w, "ambient ingest disabled (no -core)", http.StatusServiceUnavailable)
+		return
+	}
+
+	var n calendar.Notification
+	body, err := io.ReadAll(io.LimitReader(r.Body, ambientMaxBody))
+	if err != nil {
+		http.Error(w, "read failed", http.StatusBadRequest)
+		return
+	}
+	if err := json.Unmarshal(body, &n); err != nil {
+		http.Error(w, "bad json", http.StatusBadRequest)
+		return
+	}
+	if n.Posted.IsZero() {
+		writeAmbient(w, http.StatusBadRequest, ambientResp{Reason: "posted_at is required"})
+		return
+	}
+
+	ev, ok := calendar.EventFromNotification(n)
+	if !ok {
+		// Not an event. 202: the relay did its job, there is just nothing here
+		// worth remembering, and it must not retry.
+		writeAmbient(w, http.StatusAccepted, ambientResp{Reason: "no meeting time in notification"})
+		return
+	}
+
+	key := calendar.FactKey(ev)
+	val := calendar.FactValue(ev)
+
+	// Append-only discipline, same as cmd/mavcaldav: a phone reposts the same
+	// notification many times, and each repost is the same event.
+	if prev, err := core.LatestFactBySource(r.Context(), key, calendar.SourceAmbient); err == nil && prev.Value == val {
+		writeAmbient(w, http.StatusOK, ambientResp{Stored: false, Key: key, Reason: "unchanged"})
+		return
+	} else if err != nil && !errors.Is(err, ipc.ErrNoFact) {
+		log.Printf("ambient: read %s: %v", key, err)
+		http.Error(w, "read failed", http.StatusBadGateway)
+		return
+	}
+
+	// kind=env: an observation about the world, never a self-fact — a passive
+	// signal does not write truth about the owner. Confidence below 1.0 is the
+	// honest part: this is a notification about a meeting, not a reading of a
+	// calendar, and the query path hedges when it recites one.
+	if _, err := core.WriteFact(r.Context(), ipc.WriteFactReq{
+		Ts:         ev.Start,
+		Kind:       "env",
+		Key:        key,
+		Value:      val,
+		Source:     calendar.SourceAmbient,
+		Confidence: calendar.AmbientConfidence,
+	}); err != nil {
+		log.Printf("ambient: write %s: %v", key, err)
+		http.Error(w, "write failed", http.StatusBadGateway)
+		return
+	}
+	log.Printf("ambient: %s=%s (%s, pkg=%s)", key, val, calendar.SourceAmbient, n.Package)
+	writeAmbient(w, http.StatusCreated, ambientResp{Stored: true, Key: key})
+}
+
+// ambientAuthorized accepts the token as a bearer header or as an X-Maven-Token
+// header, compared in constant time.
+func ambientAuthorized(r *http.Request, token string) bool {
+	got := strings.TrimSpace(strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer"))
+	if got == "" {
+		got = strings.TrimSpace(r.Header.Get("X-Maven-Token"))
+	}
+	return subtle.ConstantTimeCompare([]byte(got), []byte(token)) == 1
+}
+
+func writeAmbient(w http.ResponseWriter, code int, resp ambientResp) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(code)
+	json.NewEncoder(w).Encode(resp)
+}

cmd/mavweb/ambient_test.go

@@ -0,0 +1,223 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/calendar"
+	"github.com/kami/maven/internal/ipc"
+)
+
+const ambientTestToken = "s3cret"
+
+// ambientCore adds provenance-scoped reads to fakeCore, which the dedupe path
+// needs.
+type ambientCore struct {
+	fakeCore
+	latest  map[string]ipc.Fact // "key|source" → fact
+	readErr error
+}
+
+func (c *ambientCore) LatestFactBySource(_ context.Context, key, source string) (ipc.Fact, error) {
+	if c.readErr != nil {
+		return ipc.Fact{}, c.readErr
+	}
+	f, ok := c.latest[key+"|"+source]
+	if !ok {
+		return ipc.Fact{}, ipc.ErrNoFact
+	}
+	return f, nil
+}
+
+func postAmbient(t *testing.T, core ipc.CoreAPI, token string, n calendar.Notification) (*httptest.ResponseRecorder, ambientResp) {
+	t.Helper()
+	body, err := json.Marshal(n)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req := httptest.NewRequest(http.MethodPost, "/api/ambient", strings.NewReader(string(body)))
+	req.Header.Set("Authorization", "Bearer "+ambientTestToken)
+	rr := httptest.NewRecorder()
+	handleAmbient(rr, req, core, token)
+	var resp ambientResp
+	json.Unmarshal(rr.Body.Bytes(), &resp)
+	return rr, resp
+}
+
+func meetingNotification() calendar.Notification {
+	return calendar.Notification{
+		Package: "com.google.android.gm",
+		Title:   "Планёрка",
+		Text:    "10:00-10:30",
+		Posted:  time.Date(2026, 8, 3, 9, 40, 0, 0, time.UTC),
+	}
+}
+
+func TestHandleAmbientStoresMeeting(t *testing.T) {
+	core := &ambientCore{}
+	rr, resp := postAmbient(t, core, ambientTestToken, meetingNotification())
+
+	if rr.Code != http.StatusCreated {
+		t.Fatalf("status = %d, want 201: %s", rr.Code, rr.Body)
+	}
+	if !resp.Stored {
+		t.Errorf("resp = %+v, want stored", resp)
+	}
+	if len(core.writeLog) != 1 {
+		t.Fatalf("expected 1 fact write, got %d", len(core.writeLog))
+	}
+	got := core.writeLog[0]
+	if got.Source != calendar.SourceAmbient {
+		t.Errorf("source = %q, want %q", got.Source, calendar.SourceAmbient)
+	}
+	if got.Confidence >= 1.0 {
+		t.Errorf("confidence = %v — a notification is not a calendar read", got.Confidence)
+	}
+	if got.Confidence != calendar.AmbientConfidence {
+		t.Errorf("confidence = %v, want %v", got.Confidence, calendar.AmbientConfidence)
+	}
+	if got.Kind != "env" {
+		t.Errorf("kind = %q — a passive signal never writes a self-fact", got.Kind)
+	}
+	if want := "calendar_event_20260803_"; !strings.HasPrefix(got.Key, want) {
+		t.Errorf("key = %q, want prefix %q", got.Key, want)
+	}
+	if got.Value != "Планёрка @ 10:00-10:30" {
+		t.Errorf("value = %q", got.Value)
+	}
+}
+
+// A phone reposts the same notification many times. Each repost is the same
+// event, and the append-only log must not fill with duplicates.
+func TestHandleAmbientDedupesReposts(t *testing.T) {
+	core := &ambientCore{}
+	postAmbient(t, core, ambientTestToken, meetingNotification())
+	if len(core.writeLog) != 1 {
+		t.Fatalf("first post did not write")
+	}
+	w := core.writeLog[0]
+	core.latest = map[string]ipc.Fact{w.Key + "|" + w.Source: {Value: w.Value}}
+
+	rr, resp := postAmbient(t, core, ambientTestToken, meetingNotification())
+	if rr.Code != http.StatusOK {
+		t.Errorf("status = %d, want 200 for an unchanged repost", rr.Code)
+	}
+	if resp.Stored {
+		t.Error("a repost must not be stored again")
+	}
+	if len(core.writeLog) != 1 {
+		t.Errorf("wrote %d facts, want 1", len(core.writeLog))
+	}
+}
+
+// The conservative half: noise stores nothing at all.
+func TestHandleAmbientIgnoresNonMeetings(t *testing.T) {
+	core := &ambientCore{}
+	rr, resp := postAmbient(t, core, ambientTestToken, calendar.Notification{
+		Package: "com.google.android.gm",
+		Title:   "3 новых письма",
+		Posted:  time.Now(),
+	})
+	if rr.Code != http.StatusAccepted {
+		t.Errorf("status = %d, want 202 (accepted, nothing to store — the relay must not retry)", rr.Code)
+	}
+	if resp.Stored {
+		t.Error("a notification with no meeting time must store nothing")
+	}
+	if len(core.writeLog) != 0 {
+		t.Fatalf("wrote %d facts for a non-meeting", len(core.writeLog))
+	}
+}
+
+func TestHandleAmbientAuth(t *testing.T) {
+	body := `{"title":"Планёрка 10:00","posted_at":"2026-08-03T09:40:00Z"}`
+
+	newReq := func(hdr, val string) *http.Request {
+		r := httptest.NewRequest(http.MethodPost, "/api/ambient", strings.NewReader(body))
+		if hdr != "" {
+			r.Header.Set(hdr, val)
+		}
+		return r
+	}
+
+	t.Run("no token rejected", func(t *testing.T) {
+		core := &ambientCore{}
+		rr := httptest.NewRecorder()
+		handleAmbient(rr, newReq("", ""), core, ambientTestToken)
+		if rr.Code != http.StatusUnauthorized {
+			t.Errorf("status = %d, want 401", rr.Code)
+		}
+		if len(core.writeLog) != 0 {
+			t.Error("an unauthorized post must not write")
+		}
+	})
+
+	t.Run("wrong token rejected", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		handleAmbient(rr, newReq("Authorization", "Bearer nope"), &ambientCore{}, ambientTestToken)
+		if rr.Code != http.StatusUnauthorized {
+			t.Errorf("status = %d, want 401", rr.Code)
+		}
+	})
+
+	t.Run("X-Maven-Token accepted", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		handleAmbient(rr, newReq("X-Maven-Token", ambientTestToken), &ambientCore{}, ambientTestToken)
+		if rr.Code != http.StatusCreated {
+			t.Errorf("status = %d, want 201: %s", rr.Code, rr.Body)
+		}
+	})
+
+	t.Run("capability off", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		handleAmbient(rr, newReq("Authorization", "Bearer "+ambientTestToken), &ambientCore{}, "")
+		if rr.Code != http.StatusServiceUnavailable {
+			t.Errorf("status = %d, want 503 when no token is configured", rr.Code)
+		}
+	})
+
+	t.Run("GET rejected", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/api/ambient", nil)
+		handleAmbient(rr, r, &ambientCore{}, ambientTestToken)
+		if rr.Code != http.StatusMethodNotAllowed {
+			t.Errorf("status = %d, want 405 — the ingest is write-only", rr.Code)
+		}
+	})
+}
+
+func TestHandleAmbientBadInput(t *testing.T) {
+	t.Run("bad json", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/ambient", strings.NewReader("{nope"))
+		req.Header.Set("X-Maven-Token", ambientTestToken)
+		rr := httptest.NewRecorder()
+		handleAmbient(rr, req, &ambientCore{}, ambientTestToken)
+		if rr.Code != http.StatusBadRequest {
+			t.Errorf("status = %d, want 400", rr.Code)
+		}
+	})
+
+	t.Run("missing posted_at", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/ambient", strings.NewReader(`{"title":"Планёрка 10:00"}`))
+		req.Header.Set("X-Maven-Token", ambientTestToken)
+		rr := httptest.NewRecorder()
+		handleAmbient(rr, req, &ambientCore{}, ambientTestToken)
+		if rr.Code != http.StatusBadRequest {
+			t.Errorf("status = %d, want 400", rr.Code)
+		}
+	})
+
+	t.Run("read error surfaces", func(t *testing.T) {
+		core := &ambientCore{readErr: fmt.Errorf("socket closed")}
+		rr, _ := postAmbient(t, core, ambientTestToken, meetingNotification())
+		if rr.Code != http.StatusBadGateway {
+			t.Errorf("status = %d, want 502", rr.Code)
+		}
+	})
+}

cmd/mavweb/handlers_test.go

@@ -67,6 +67,14 @@ type fakeCore struct {
 	// for handleChatAPI tests
 	chatText string
 	chatErr  error
+
+	// for the MCP section of /tools
+	mcpServers []ipc.MCPServerStatus
+	mcpErr     error
+}
+
+func (f *fakeCore) MCPServers(context.Context) ([]ipc.MCPServerStatus, error) {
+	return f.mcpServers, f.mcpErr
 }
 
 func (f *fakeCore) Chat(_ context.Context, text string) (string, error) {
@@ -1118,3 +1126,49 @@ func TestHandleChatAPI_FailOpenByDefault(t *testing.T) {
 		t.Errorf("core.Chat text = %q, want %q", core.chatText, "привет")
 	}
 }
+
+// The MCP section renders the configured servers, and a proposal that already
+// knows its cmd prefills the enable form so the argv is not retyped by hand.
+func TestHandleTools_GET_MCPSection(t *testing.T) {
+	core := &fakeCore{
+		proposed: []ipc.Tool{{
+			Name: "vikunja_list_tasks", Scope: "mcp:vikunja",
+			Cmd: []string{"mcp", "vikunja", "list_tasks"}, Destructive: true,
+			Utterance: "mcp vikunja/list_tasks: List tasks in a project.",
+		}},
+		mcpServers: []ipc.MCPServerStatus{
+			{Name: "vikunja", Transport: "http", Target: "http://192.168.1.104:9100/mcp", Connected: true, Server: "vikunja 0.1.0", Tools: 4},
+			{Name: "files", Transport: "stdio", Target: "mcp-server-fs /srv", Err: "start: no such file"},
+		},
+	}
+	rr := httptest.NewRecorder()
+	handleTools(rr, httptest.NewRequest(http.MethodGet, "/tools", nil), core, nil, false)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d", rr.Code)
+	}
+	body := rr.Body.String()
+	for _, want := range []string{
+		"MCP servers", "vikunja", "192.168.1.104:9100/mcp", "vikunja 0.1.0",
+		"files", "no such file",
+		`value="mcp vikunja list_tasks"`, // the enable form is prefilled
+		"checked",                        // and pre-marked destructive (no readOnlyHint)
+	} {
+		if !strings.Contains(body, want) {
+			t.Errorf("missing %q in /tools output", want)
+		}
+	}
+}
+
+// MCP off (or an older core that does not know the method) renders the section
+// empty instead of breaking the page.
+func TestHandleTools_GET_MCPUnavailable(t *testing.T) {
+	core := &fakeCore{mcpErr: ipc.ErrNotImplemented}
+	rr := httptest.NewRecorder()
+	handleTools(rr, httptest.NewRequest(http.MethodGet, "/tools", nil), core, nil, false)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", rr.Code)
+	}
+	if !strings.Contains(rr.Body.String(), "no MCP servers configured") {
+		t.Error("expected the empty-state copy")
+	}
+}

cmd/mavweb/main.go

@@ -25,6 +25,7 @@ import (
 	"github.com/kami/maven/internal/audio"
 	"github.com/kami/maven/internal/ipc"
 	"github.com/kami/maven/internal/pattern"
+	"github.com/kami/maven/internal/tasks"
 	"github.com/kami/maven/internal/voice"
 	"github.com/kami/maven/internal/webauthn"
 )
@@ -58,6 +59,9 @@ var notificationsHTML string
 //go:embed reminders.html
 var remindersHTML string
 
+//go:embed tasks.html
+var tasksHTML string
+
 //go:embed voice.html
 var voiceHTML string
 
@@ -97,6 +101,7 @@ var sidebarSections = []struct {
 		Pages: []struct{ Label, URL, Key string }{
 			{Label: "Rule Trace", URL: "/trace", Key: "trace"},
 			{Label: "Notifications", URL: "/notifications", Key: "notifications"},
+			{Label: "Tasks", URL: "/tasks", Key: "tasks"},
 			{Label: "Reminders", URL: "/reminders", Key: "reminders"},
 			{Label: "Routines", URL: "/routines", Key: "routines"},
 			{Label: "Morning", URL: "/morning", Key: "morning"},
@@ -119,6 +124,7 @@ var sidebarSections = []struct {
 		Label: "Settings",
 		Pages: []struct{ Label, URL, Key string }{
 			{Label: "Tools", URL: "/tools", Key: "tools"},
+			{Label: "Model", URL: "/models", Key: "models"},
 			{Label: "Passkey", URL: "/auth/passkey", Key: "passkey"},
 		},
 	},
@@ -170,6 +176,8 @@ func pageIcon(key string) string {
 		return `<svg class=icon width="14" height="14"><use href="/ethos-icons.svg#i-wave"/></svg>`
 	case "notifications":
 		return `<svg class=icon width="14" height="14"><use href="/ethos-icons.svg#i-bell"/></svg>`
+	case "tasks":
+		return `<svg class=icon width="14" height="14"><use href="/ethos-icons.svg#i-grid"/></svg>`
 	case "reminders":
 		return `<svg class=icon width="14" height="14"><use href="/ethos-icons.svg#i-calendar"/></svg>`
 	case "routines":
@@ -184,6 +192,8 @@ func pageIcon(key string) string {
 		return `<svg class=icon width="14" height="14"><use href="/ethos-icons.svg#i-grid"/></svg>`
 	case "tools":
 		return `<svg class=icon width="14" height="14"><use href="/ethos-icons.svg#i-settings"/></svg>`
+	case "models":
+		return `<svg class=icon width="14" height="14"><use href="/ethos-icons.svg#i-wave"/></svg>`
 	case "passkey":
 		return `<svg class=icon width="14" height="14"><use href="/ethos-icons.svg#i-lock"/></svg>`
 	default:
@@ -202,6 +212,8 @@ func pageTitle(key string) string {
 		return "Rule Trace"
 	case "notifications":
 		return "Notifications"
+	case "tasks":
+		return "Tasks"
 	case "reminders":
 		return "Reminders"
 	case "routines":
@@ -216,6 +228,8 @@ func pageTitle(key string) string {
 		return "Ecosystem"
 	case "tools":
 		return "Tools"
+	case "models":
+		return "Resident Model"
 	case "passkey":
 		return "Passkey"
 	default:
@@ -334,6 +348,10 @@ func main() {
 	nexusURL := flag.String("nexus", "", "Nexus base URL for the /ecosystem panel (empty = not configured)")
 	praxisURL := flag.String("praxis", "", "Praxis base URL for the /ecosystem panel (empty = not configured)")
 	hexisURL := flag.String("hexis", "", "Hexis base URL for the /ecosystem panel (empty = not configured)")
+	// Shared secret for POST /api/ambient, the notification-relay ingest that
+	// reads the work calendar as a signal instead of holding a work credential
+	// (see ambient.go). Empty ⇒ the route is not registered at all.
+	ambientToken := flag.String("ambient-token", "", "shared secret for POST /api/ambient notification ingest (empty = ingest disabled, route not registered)")
 	flag.Parse()
 
 	var core ipc.CoreAPI
@@ -381,6 +399,14 @@ func main() {
 	mux.HandleFunc("/api/signal", func(w http.ResponseWriter, r *http.Request) {
 		handleSignal(w, r, core)
 	})
+	// Off unless configured: no token, no route — an unconfigured ingest is not
+	// a 503 waiting to be probed, it does not exist.
+	if *ambientToken != "" {
+		mux.HandleFunc("/api/ambient", func(w http.ResponseWriter, r *http.Request) {
+			handleAmbient(w, r, core, *ambientToken)
+		})
+		log.Printf("mavweb: ambient notification ingest enabled at POST /api/ambient")
+	}
 	mux.HandleFunc("/dash", func(w http.ResponseWriter, r *http.Request) {
 		handleDash(w, r, core)
 	})
@@ -396,6 +422,11 @@ func main() {
 	mux.HandleFunc("/reminders", func(w http.ResponseWriter, r *http.Request) {
 		handleReminders(w, r, core)
 	})
+	// /tasks — capture + review. POST is not step-up gated; see handleTasks for
+	// why a task write is not in the same class as /tools or /routines.
+	mux.HandleFunc("/tasks", func(w http.ResponseWriter, r *http.Request) {
+		handleTasks(w, r, core)
+	})
 	mux.HandleFunc("/morning", func(w http.ResponseWriter, r *http.Request) {
 		handleMorning(w, r, core)
 	})
@@ -453,6 +484,12 @@ func main() {
 	mux.HandleFunc("/routines", func(w http.ResponseWriter, r *http.Request) {
 		handleRoutines(w, r, core, stepUpSession, *requireStepUp)
 	})
+	// /models — the resident-model surface (Vikunja #250). Same step-up gate as
+	// /tools, and for a comparable reason: which model is loaded decides how every
+	// utterance is routed and how every reply is worded. GET is read-only.
+	mux.HandleFunc("/models", func(w http.ResponseWriter, r *http.Request) {
+		handleModels(w, r, core, stepUpSession, *requireStepUp)
+	})
 
 	// State-changing routes on this server, and their gate (Vikunja #317):
 	//
@@ -655,7 +692,7 @@ const toolsHTML = `{{template "shellTop" "tools"}}
 {{if .Msg}}<div class="msg msg-ok">{{.Msg}}</div>{{end}}
 <section class=card>
 <h2 class=card-title>proposed <span class=badge>{{len .Proposed}}</span></h2>
-{{if .Proposed}}<p class=hint>maven drafted these from acts she couldn't run. Fill the command (argv, space-separated) and enable.</p>
+{{if .Proposed}}<p class=hint>maven drafted these from acts she couldn't run. Fill the command (argv, space-separated) and enable. A row in an <code>mcp:</code> scope came from an MCP server and already knows what it calls — check the command, then enable.</p>
 <div class=scroll><table><tr><th>name</th><th>scope</th><th>from utterance</th><th>enable as</th></tr>
 {{range .Proposed}}<tr>
 <td><code>{{.Name}}</code></td><td><span class=badge>{{.Scope}}</span></td><td>{{.Utterance}}</td>
@@ -663,8 +700,8 @@ const toolsHTML = `{{template "shellTop" "tools"}}
 <input type=hidden name=name value="{{.Name}}">
 <input type=hidden name=scope value="{{.Scope}}">
 <input type=hidden name=action value=enable>
-<input type=text name=cmd class=input-wide placeholder="systemctl restart" required>
-<label><input type=checkbox name=destructive> destructive</label>
+<input type=text name=cmd class=input-wide placeholder="systemctl restart" value="{{join .Cmd " "}}" required>
+<label><input type=checkbox name=destructive {{if .Destructive}}checked{{end}}> destructive</label>
 <button class=btn>enable</button></form>
 <form method=post action=/tools class=inline-form>
 <input type=hidden name=name value="{{.Name}}">
@@ -693,6 +730,19 @@ const toolsHTML = `{{template "shellTop" "tools"}}
   <div class=hint>enable proposed tools above, or ask maven to configure one</div>
 </div>{{end}}
 </section>
+<section class=card>
+<h2 class=card-title>MCP servers <span class=badge>{{len .MCP}}</span></h2>
+{{if .MCP}}<p class=hint>servers she connects OUT to. Their tools appear above as proposals — a configured server is a place she may look, not a capability she has. A <code>stdio</code> target is a process on this box; an <code>http</code> one on a loopback or LAN address is inside the network, so treat its tools accordingly.</p>
+<div class=scroll><table><tr><th>name</th><th>transport</th><th>target</th><th>state</th><th>tools</th></tr>
+{{range .MCP}}<tr><td><code>{{.Name}}</code></td><td><span class=badge>{{.Transport}}</span></td><td><code>{{.Target}}</code></td>
+<td>{{if .Connected}}connected{{if .Server}} — {{.Server}}{{end}}{{else}}<span class=red>down</span>{{if .Err}} — {{.Err}}{{end}}{{end}}</td>
+<td>{{.Tools}}</td></tr>{{end}}</table></div>
+{{else}}<div class=empty>
+  <svg class=icon width="20" height="20"><use href="/ethos-icons.svg#i-settings"/></svg>
+  <div>no MCP servers configured</div>
+  <div class=hint>add an <code>mcp.servers</code> block to mavend.json to let her use an external tool server</div>
+</div>{{end}}
+</section>
 {{template "shellBottom"}}`
 
 // routinesHTML — proposed routine review surface. One row per thing maven
@@ -732,6 +782,8 @@ var passkeyTmpl = template.Must(template.New("passkey").Funcs(shellFuncs()).Pars
 
 var voiceTmpl = template.Must(template.New("voice").Funcs(shellFuncs()).Parse(shellTopHTML + voiceHTML + shellBottomHTML))
 
+var tasksTmpl = template.Must(template.New("tasks").Funcs(shellFuncs()).Parse(shellTopHTML + tasksHTML + shellBottomHTML))
+
 var routinesTmpl = template.Must(template.New("routines").Funcs(shellFuncs()).Parse(shellTopHTML + routinesHTML + shellBottomHTML))
 
 var traceTmpl = template.Must(template.New("trace").Funcs(func() template.FuncMap {
@@ -802,6 +854,187 @@ func handleReminders(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	}
 }
 
+// taskRow is one line on /tasks, with every timestamp already formatted so the
+// template holds no date logic.
+type taskRow struct {
+	ID       int64
+	Text     string
+	Source   string
+	Evidence string
+	Status   string
+	Due      string
+	Created  string
+	Resolved string
+	// Why — the ranker's reason for this row's position (Vikunja #129), in
+	// Russian, empty when nothing distinguished the task. Blank is the honest
+	// rendering: he never said this one mattered more.
+	Why string
+}
+
+// handleTasks serves the task review surface (GET) and the four writes it
+// offers (POST): add, confirm, done, drop.
+//
+// Not step-up gated, unlike /tools and /routines, and the difference is the
+// point: enabling a tool defines argv Maven will execute, and accepting a
+// routine hands the tick loop a new standing reason to interrupt him. A task is
+// neither — nothing in the tick loop reads the tasks table, so the worst a
+// weaker caller can do here is write a line onto a list he reads himself. It
+// still sits behind whatever transport auth fronts mavweb, like every other
+// page.
+//
+// "confirm" is the only interesting move: it promotes a candidate Maven derived
+// from something she read into work he owns. That review step is why derived
+// tasks are captured as candidates in the first place.
+func handleTasks(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
+	if core == nil {
+		http.Error(w, "tasks disabled (no -core)", http.StatusServiceUnavailable)
+		return
+	}
+	ctx := r.Context()
+	var msg, errMsg string
+	if r.Method == http.MethodPost {
+		var err error
+		msg, err = applyTaskPost(ctx, core, r)
+		if err != nil {
+			log.Printf("tasks: %v", err)
+			errMsg = err.Error()
+		}
+	}
+
+	all, err := core.ListTasks(ctx, "")
+	if err != nil {
+		log.Printf("tasks: list: %v", err)
+		http.Error(w, "tasks error: "+err.Error(), http.StatusBadGateway)
+		return
+	}
+	// Live rows are ordered by the same ranker the spoken list uses, so the page
+	// and the voice reply can never disagree about what comes first. Resolved
+	// rows keep store order (newest first) — ranking finished work is pointless.
+	var live []tasks.Item
+	var resolved []taskRow
+	for _, t := range all {
+		switch t.Status {
+		case "candidate", "open":
+			live = append(live, tasks.Item{
+				ID: t.ID, Text: t.Text, Status: t.Status,
+				Created: t.CreatedTs, Due: t.Due, Weight: t.Weight,
+			})
+		default:
+			resolved = append(resolved, taskRow{
+				ID: t.ID, Text: t.Text, Source: t.Source, Evidence: t.Evidence,
+				Status: t.Status, Created: fmtTaskTime(&t.CreatedTs),
+				Due: fmtTaskDate(t.Due), Resolved: fmtTaskTime(t.Resolved),
+			})
+		}
+	}
+	byID := make(map[int64]ipc.Task, len(all))
+	for _, t := range all {
+		byID[t.ID] = t
+	}
+	var cands, open []taskRow
+	for _, r := range tasks.Rank(live, time.Now()) {
+		t := byID[r.ID]
+		row := taskRow{
+			ID: t.ID, Text: t.Text, Source: t.Source, Evidence: t.Evidence,
+			Status: t.Status, Created: fmtTaskTime(&t.CreatedTs),
+			Due: fmtTaskDate(t.Due), Resolved: fmtTaskTime(t.Resolved),
+			Why: r.Reason,
+		}
+		if t.Status == "candidate" {
+			// A candidate's due date is Maven's reading of a mail, so its
+			// ranking reason is not shown as if he had set a priority.
+			row.Why = ""
+			cands = append(cands, row)
+		} else {
+			open = append(open, row)
+		}
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := tasksTmpl.Execute(w, struct {
+		Msg, Err   string
+		Candidates []taskRow
+		Open       []taskRow
+		Resolved   []taskRow
+	}{msg, errMsg, cands, open, resolved}); err != nil {
+		log.Printf("tasks render: %v", err)
+	}
+}
+
+// applyTaskPost performs one write and returns the message to show. A bad
+// request returns an error, which the page renders inline rather than as a
+// bare 400 — this is a form surface, not an API.
+func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (string, error) {
+	action := r.FormValue("action")
+	if action == "add" {
+		text := strings.TrimSpace(r.FormValue("text"))
+		if text == "" {
+			return "", errors.New("empty task text")
+		}
+		req := ipc.CaptureTaskReq{Text: text, Source: "tap:web", Status: "open", Ts: time.Now()}
+		// Importance is his, stated on the form. Out-of-range values are
+		// clamped rather than rejected — a bad select is not worth a 400.
+		if v := r.FormValue("weight"); v != "" {
+			var wgt int
+			if n, _ := fmt.Sscanf(v, "%d", &wgt); n != 1 || wgt < 0 {
+				return "", fmt.Errorf("bad weight %q", v)
+			}
+			if wgt > tasks.MaxWeight {
+				wgt = tasks.MaxWeight
+			}
+			req.Weight = wgt
+		}
+		if d := r.FormValue("due"); d != "" {
+			due, err := time.ParseInLocation("2006-01-02", d, time.Local)
+			if err != nil {
+				return "", fmt.Errorf("bad due date %q", d)
+			}
+			req.Due = &due
+		}
+		resp, err := core.CaptureTask(ctx, req)
+		if err != nil {
+			return "", err
+		}
+		if !resp.Created {
+			return "already on the list", nil
+		}
+		return "added task", nil
+	}
+
+	var id int64
+	if n, _ := fmt.Sscanf(r.FormValue("id"), "%d", &id); n != 1 {
+		return "", errors.New("invalid id")
+	}
+	var status, msg string
+	switch action {
+	case "confirm":
+		status, msg = "open", "confirmed task"
+	case "done":
+		status, msg = "done", "task done"
+	case "drop":
+		status, msg = "dropped", "dropped task"
+	default:
+		return "", fmt.Errorf("unknown action %q", action)
+	}
+	if err := core.SetTaskStatus(ctx, id, status, time.Now()); err != nil {
+		return "", err
+	}
+	return msg, nil
+}
+
+func fmtTaskTime(t *time.Time) string {
+	if t == nil || t.IsZero() {
+		return "—"
+	}
+	return t.Local().Format("02 Jan 15:04")
+}
+
+func fmtTaskDate(t *time.Time) string {
+	if t == nil || t.IsZero() {
+		return "—"
+	}
+	return t.Local().Format("02 Jan")
+}
+
 // routineRow is one line on the page: what maven noticed, in her words, and
 // how long ago she noticed it.
 type routineRow struct {
@@ -947,12 +1180,32 @@ func handleMorning(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 		http.Error(w, "core read failed", http.StatusBadGateway)
 		return
 	}
+	view := morningView{Routines: status}
+	// The day plan (#128) shows on this page because it is the same question at
+	// a different scale. A plan read that fails must not take the checklist
+	// down with it — the page degrades to what it had before.
+	plan, err := core.DayPlan(ctx)
+	if err != nil {
+		log.Printf("morning: day plan: %v", err)
+		view.PlanErr = err.Error()
+	} else {
+		view.Plan = &plan
+	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := morningTmpl.Execute(w, status); err != nil {
+	if err := morningTmpl.Execute(w, view); err != nil {
 		log.Printf("morning render: %v", err)
 	}
 }
 
+// morningView — what /morning renders: today's plan on top, the checklist
+// state under it. PlanErr is set instead of Plan when the core could not build
+// a plan, so the page says so rather than showing an empty day.
+type morningView struct {
+	Plan     *ipc.DayPlan
+	PlanErr  string
+	Routines []ipc.MorningRoutineStatus
+}
+
 func handleVoice(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	if err := voiceTmpl.Execute(w, nil); err != nil {
@@ -1080,12 +1333,20 @@ func handleTools(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, sessi
 		http.Error(w, "core read failed", http.StatusBadGateway)
 		return
 	}
+	// MCP is off by default and an older core may not know the method at all,
+	// so a failure here renders an empty section rather than breaking the page.
+	servers, err := core.MCPServers(ctx)
+	if err != nil {
+		log.Printf("tools: mcp servers: %v", err)
+		servers = nil
+	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
 	if err := toolsTmpl.Execute(w, struct {
 		Msg      string
 		Proposed []ipc.Tool
 		Enabled  []ipc.Tool
-	}{msg, proposed, enabled}); err != nil {
+		MCP      []ipc.MCPServerStatus
+	}{msg, proposed, enabled, servers}); err != nil {
 		log.Printf("tools render: %v", err)
 	}
 }

cmd/mavweb/models.go

@@ -0,0 +1,145 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"html/template"
+	"log"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/webauthn"
+)
+
+// The resident-model surface (Vikunja #250).
+//
+// GET shows which model llama-server actually has loaded and which files the
+// daemon is configured to allow. POST swaps to one of them, behind the same
+// step-up gate as POST /tools: the loaded model decides how every utterance is
+// routed and how every reply is worded, so it is an owner action.
+//
+// There is nothing on this page Maven can press. The swap is an IPC method rated
+// AuthStepUp in internal/auth, unreachable from an act, an intent or a timer.
+
+// modelController — the two non-CoreAPI methods this page needs. *ipc.Client
+// satisfies it; a core without a swap allowlist answers ErrUnknownMethod, which
+// the page renders as "not configured" rather than an error.
+type modelController interface {
+	ModelStatus(ctx context.Context) (ipc.ModelStatusResp, error)
+	SwapModel(ctx context.Context, req ipc.SwapModelReq) (ipc.SwapModelResp, error)
+}
+
+var modelsTmpl = template.Must(template.New("models").Funcs(shellFuncs()).Parse(shellTopHTML + modelsHTML + shellBottomHTML))
+
+const modelsHTML = `{{template "shellTop" "models"}}
+<h1>Resident model</h1>
+<p class=hint>swapping requires step-up — <a href=/auth/passkey>assert a passkey</a> first. The old model is unloaded before the new one is loaded (one model fits the iGPU at a time), so turns during the load are refused and fall back to the classifier.</p>
+{{if .Msg}}<div class="msg msg-ok">{{.Msg}}</div>{{end}}
+{{if .Err}}<div class="msg msg-err">{{.Err}}</div>{{end}}
+{{if .Off}}
+<section class=card>
+<h2 class=card-title>swap not configured</h2>
+<p class=hint>this core has no <code>phraser.swap_models</code> allowlist, so there is nothing to swap to. Add the gguf paths you allow to <code>deploy/mavend.json</code> and restart once.</p>
+</section>
+{{else}}
+<section class=card>
+<h2 class=card-title>loaded now</h2>
+<div class=scroll><table>
+<tr><th>model</th><td><code>{{.Status.Model}}</code></td></tr>
+<tr><th>file</th><td><code>{{.Status.ModelPath}}</code></td></tr>
+<tr><th>server</th><td><code>{{.Status.BaseURL}}</code></td></tr>
+<tr><th>n_ctx</th><td>{{.Status.NCtx}}</td></tr>
+<tr><th>n_gpu_layers</th><td>{{.Status.NGpuLayers}}</td></tr>
+</table></div>
+<p class=hint>the model name is what llama-server reports for itself, not what the config says it should be.</p>
+</section>
+<section class=card>
+<h2 class=card-title>allowed models <span class=badge>{{len .Status.Swappable}}</span></h2>
+{{if .Status.Swappable}}<div class=scroll><table><tr><th>file</th><th></th></tr>
+{{range .Status.Swappable}}<tr><td><code>{{.}}</code></td>
+<td><form method=post action=/models class=inline-form>
+<input type=hidden name=model_path value="{{.}}">
+<button class=btn>load this one</button></form></td></tr>{{end}}
+</table></div>
+{{else}}<div class=empty><div>no models allowlisted</div></div>{{end}}
+</section>
+{{end}}
+{{template "shellBottom"}}`
+
+type modelsPage struct {
+	Msg    string
+	Err    string
+	Off    bool
+	Status ipc.ModelStatusResp
+}
+
+// handleModels renders the model surface (GET) and applies a swap (POST).
+//
+// A failed swap is reported as a failure with the model that is still serving
+// named, because that is the state the operator needs: the daemon rolled back
+// and is answering turns, it just is not answering them with what he asked for.
+func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
+	if core == nil {
+		http.Error(w, "models disabled (no -core)", http.StatusServiceUnavailable)
+		return
+	}
+	mc, ok := core.(modelController)
+	if !ok {
+		http.Error(w, "models unavailable: core connection does not support model swap", http.StatusServiceUnavailable)
+		return
+	}
+	ctx := r.Context()
+	page := modelsPage{}
+
+	if r.Method == http.MethodPost {
+		if !stepUpOK(session, requireStepUp) {
+			http.Error(w, "step-up required: assert a passkey first", http.StatusForbidden)
+			return
+		}
+		path := strings.TrimSpace(r.FormValue("model_path"))
+		if path == "" {
+			http.Error(w, "model_path required", http.StatusBadRequest)
+			return
+		}
+		req := ipc.SwapModelReq{ModelPath: path}
+		if v, err := strconv.Atoi(r.FormValue("n_ctx")); err == nil {
+			req.NCtx = v
+		}
+		res, err := mc.SwapModel(ctx, req)
+		switch {
+		case err == nil:
+			page.Msg = "loaded " + res.Model + " (" + strconv.FormatInt(res.TookMs, 10) + "ms)"
+			log.Printf("models: swapped to %s (%s) in %dms", res.ModelPath, res.Model, res.TookMs)
+		case errors.Is(err, ipc.ErrForbidden):
+			http.Error(w, "refused: that model is not in phraser.swap_models, or step-up was not asserted", http.StatusForbidden)
+			return
+		case errors.Is(err, ipc.ErrUnknownMethod):
+			http.Error(w, "swap not configured on this core", http.StatusServiceUnavailable)
+			return
+		case res.RolledBack:
+			page.Err = "swap failed, rolled back to " + res.Model + " — she is still answering, with the old model"
+			log.Printf("models: swap to %s failed, rolled back: %v", path, err)
+		default:
+			page.Err = "swap failed: " + err.Error()
+			log.Printf("models: swap to %s failed: %v", path, err)
+		}
+	}
+
+	st, err := mc.ModelStatus(ctx)
+	if err != nil {
+		if errors.Is(err, ipc.ErrUnknownMethod) {
+			page.Off = true
+		} else {
+			log.Printf("models: status: %v", err)
+			http.Error(w, "core read failed", http.StatusBadGateway)
+			return
+		}
+	}
+	page.Status = st
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := modelsTmpl.Execute(w, page); err != nil {
+		log.Printf("models render: %v", err)
+	}
+}

cmd/mavweb/models_test.go

@@ -0,0 +1,150 @@
+package main
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/webauthn"
+)
+
+// fakeModelCore is a core that supports the two model methods. It records what
+// the page asked for, so the tests can assert the gate rather than the HTML.
+type fakeModelCore struct {
+	ipc.UnimplementedCoreAPI
+
+	status    ipc.ModelStatusResp
+	statusErr error
+
+	swapResp ipc.SwapModelResp
+	swapErr  error
+	swapped  []ipc.SwapModelReq
+}
+
+func (f *fakeModelCore) ModelStatus(ctx context.Context) (ipc.ModelStatusResp, error) {
+	return f.status, f.statusErr
+}
+
+func (f *fakeModelCore) SwapModel(ctx context.Context, req ipc.SwapModelReq) (ipc.SwapModelResp, error) {
+	f.swapped = append(f.swapped, req)
+	return f.swapResp, f.swapErr
+}
+
+func modelsGET(t *testing.T, core ipc.CoreAPI) *httptest.ResponseRecorder {
+	t.Helper()
+	w := httptest.NewRecorder()
+	handleModels(w, httptest.NewRequest(http.MethodGet, "/models", nil), core, nil, false)
+	return w
+}
+
+func modelsPOST(t *testing.T, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool, path string) *httptest.ResponseRecorder {
+	t.Helper()
+	r := httptest.NewRequest(http.MethodPost, "/models", strings.NewReader("model_path="+path))
+	r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	w := httptest.NewRecorder()
+	handleModels(w, r, core, session, requireStepUp)
+	return w
+}
+
+func TestModels_GETShowsTheLoadedModelAndTheAllowlist(t *testing.T) {
+	core := &fakeModelCore{status: ipc.ModelStatusResp{
+		Model:     "Qwen3-1.7B-UD-Q4_K_XL",
+		ModelPath: "/opt/maven/models/llm/qwen3.gguf",
+		BaseURL:   "http://127.0.0.1:18099",
+		NCtx:      4096,
+		Swappable: []string{"/opt/maven/models/llm/qwen3.gguf", "/opt/maven/models/llm/qwen3-cpt.gguf"},
+	}}
+	w := modelsGET(t, core)
+	if w.Code != http.StatusOK {
+		t.Fatalf("GET /models = %d; want 200", w.Code)
+	}
+	body := w.Body.String()
+	for _, want := range []string{"Qwen3-1.7B-UD-Q4_K_XL", "qwen3-cpt.gguf", "4096"} {
+		if !strings.Contains(body, want) {
+			t.Errorf("page does not mention %q", want)
+		}
+	}
+	if len(core.swapped) != 0 {
+		t.Errorf("a GET swapped the model: %v", core.swapped)
+	}
+}
+
+func TestModels_POSTRequiresStepUpWhenFailingClosed(t *testing.T) {
+	// No WebAuthn configured (nil session) + -require-stepup ⇒ deny, exactly
+	// like POST /tools. Nothing reaches core.
+	core := &fakeModelCore{}
+	w := modelsPOST(t, core, nil, true, "/opt/maven/models/llm/qwen3.gguf")
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("POST /models without assertable step-up = %d; want 403", w.Code)
+	}
+	if len(core.swapped) != 0 {
+		t.Fatalf("a denied POST still called SwapModel: %v", core.swapped)
+	}
+}
+
+func TestModels_POSTSwapsAndReportsTheModelThatAnswered(t *testing.T) {
+	core := &fakeModelCore{
+		swapResp: ipc.SwapModelResp{Model: "qwen3-cpt", ModelPath: "/m/cpt.gguf", TookMs: 4200},
+		status:   ipc.ModelStatusResp{Model: "qwen3-cpt", ModelPath: "/m/cpt.gguf"},
+	}
+	w := modelsPOST(t, core, nil, false, "/m/cpt.gguf")
+	if w.Code != http.StatusOK {
+		t.Fatalf("POST /models = %d; want 200", w.Code)
+	}
+	if len(core.swapped) != 1 || core.swapped[0].ModelPath != "/m/cpt.gguf" {
+		t.Fatalf("SwapModel calls = %v; want one for /m/cpt.gguf", core.swapped)
+	}
+	if !strings.Contains(w.Body.String(), "loaded qwen3-cpt") {
+		t.Errorf("page does not report which model was loaded:\n%s", w.Body.String())
+	}
+}
+
+func TestModels_RolledBackSwapSaysSheIsStillAnswering(t *testing.T) {
+	core := &fakeModelCore{
+		swapResp: ipc.SwapModelResp{Model: "qwen3", ModelPath: "/m/old.gguf", RolledBack: true},
+		swapErr:  errBrokenModel{},
+		status:   ipc.ModelStatusResp{Model: "qwen3", ModelPath: "/m/old.gguf"},
+	}
+	w := modelsPOST(t, core, nil, false, "/m/cpt.gguf")
+	if w.Code != http.StatusOK {
+		t.Fatalf("POST /models after a rollback = %d; want 200 with the failure rendered", w.Code)
+	}
+	body := w.Body.String()
+	if !strings.Contains(body, "rolled back to qwen3") {
+		t.Errorf("page does not say it rolled back:\n%s", body)
+	}
+}
+
+func TestModels_RefusedPathIs403(t *testing.T) {
+	core := &fakeModelCore{swapErr: ipc.ErrForbidden}
+	w := modelsPOST(t, core, nil, false, "/etc/passwd")
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("POST /models with a non-allowlisted path = %d; want 403", w.Code)
+	}
+}
+
+func TestModels_UnconfiguredCoreRendersOff(t *testing.T) {
+	core := &fakeModelCore{statusErr: ipc.ErrUnknownMethod}
+	w := modelsGET(t, core)
+	if w.Code != http.StatusOK {
+		t.Fatalf("GET /models against a core without the swap = %d; want 200", w.Code)
+	}
+	if !strings.Contains(w.Body.String(), "swap not configured") {
+		t.Errorf("page does not say the capability is off:\n%s", w.Body.String())
+	}
+}
+
+func TestModels_CoreWithoutTheMethodsIs503(t *testing.T) {
+	// An in-process CoreAPI (no swap methods) must not 500 the page.
+	w := modelsGET(t, ipc.UnimplementedCoreAPI{})
+	if w.Code != http.StatusServiceUnavailable {
+		t.Fatalf("GET /models on a core without the methods = %d; want 503", w.Code)
+	}
+}
+
+type errBrokenModel struct{}
+
+func (errBrokenModel) Error() string { return "llm: server did not start" }

cmd/mavweb/morning.html

@@ -1,9 +1,27 @@
 {{template "shellTop" "morning"}}
+<h1>Today</h1>
+{{with .Plan}}
+<div class=hint>{{.Date.Format "02.01.2006"}}</div>
+{{if not .Items}}
+<div class=hint>nothing planned</div>
+{{else}}
+<div class=scroll><table class=mono>
+<tr><th>at<th>kind<th>what</tr>
+{{range .Items}}<tr>
+<td>{{.At.Format "15:04"}}</td>
+<td class=gray>{{.Kind}}</td>
+<td>{{if .Uncertain}}<span class=hint title="relayed notification, not a calendar read">похоже,</span> {{end}}{{.Text}}</td>
+</tr>{{end}}
+</table></div>
+{{end}}
+{{end}}
+{{if .PlanErr}}<div class=hint>plan unavailable: {{.PlanErr}}</div>{{end}}
+
 <h1>Morning Routines</h1>
-{{if not .}}
+{{if not .Routines}}
 <div class=hint>no morning routines configured</div>
 {{else}}
-{{range .}}
+{{range .Routines}}
 <div class="mb-4">
   <div><strong>{{.Name}}</strong>
     <span class={{if .Active}}green{{else}}gray{{end}}>{{if .Active}}active now{{else}}outside window{{end}}</span>

cmd/mavweb/tasks.html

@@ -0,0 +1,83 @@
+{{template "shellTop" "tasks"}}
+<h1>Tasks</h1>
+{{if .Msg}}<div class="msg msg-ok">{{.Msg}}</div>{{end}}
+{{if .Err}}<div class="msg msg-err">{{.Err}}</div>{{end}}
+
+<section class=card>
+<h2 class=card-title>add</h2>
+<form method=post action=/tasks class=inline-form>
+<input type=hidden name=action value=add>
+<input type=text name=text placeholder="что нужно сделать" size=44 required>
+<input type=date name=due title="due date (optional)">
+<select name=weight title="importance (optional)">
+<option value=0>normal</option>
+<option value=2>важно</option>
+<option value=3>срочно</option>
+</select>
+<button class=btn>add</button>
+</form>
+</section>
+
+{{if .Candidates}}
+<section class=card>
+<h2 class=card-title>found, not confirmed <span class=badge>{{len .Candidates}}</span></h2>
+<div class=hint>maven derived these from something she read. nothing counts as your work until you confirm it.</div>
+<div class=scroll><table>
+<tr><th>task</th><th>where from</th><th>due</th><th>captured</th><th></th><th></th></tr>
+{{range .Candidates}}<tr>
+<td class=text-max>{{.Text}}</td>
+<td class=hint>{{.Source}}{{if .Evidence}} — {{.Evidence}}{{end}}</td>
+<td>{{.Due}}</td>
+<td class=muted>{{.Created}}</td>
+<td><form method=post action=/tasks class=inline-form>
+<input type=hidden name=id value="{{.ID}}">
+<input type=hidden name=action value=confirm>
+<button class=btn>confirm</button></form></td>
+<td><form method=post action=/tasks class=inline-form>
+<input type=hidden name=id value="{{.ID}}">
+<input type=hidden name=action value=drop>
+<button class="btn btn-muted">drop</button></form></td>
+</tr>{{end}}</table></div>
+</section>
+{{end}}
+
+<section class=card>
+<h2 class=card-title>open <span class=badge>{{len .Open}}</span></h2>
+<div class=hint>most pressing first — by the deadlines and the urgency you gave, nothing guessed.</div>
+{{if .Open}}<div class=scroll><table>
+<tr><th>task</th><th>why</th><th>from</th><th>due</th><th>captured</th><th></th><th></th></tr>
+{{range .Open}}<tr>
+<td class=text-max>{{.Text}}</td>
+<td class=hint>{{.Why}}</td>
+<td class=hint>{{.Source}}</td>
+<td>{{.Due}}</td>
+<td class=muted>{{.Created}}</td>
+<td><form method=post action=/tasks class=inline-form>
+<input type=hidden name=id value="{{.ID}}">
+<input type=hidden name=action value=done>
+<button class=btn>done</button></form></td>
+<td><form method=post action=/tasks class=inline-form>
+<input type=hidden name=id value="{{.ID}}">
+<input type=hidden name=action value=drop>
+<button class="btn btn-muted">drop</button></form></td>
+</tr>{{end}}</table></div>
+{{else}}<div class=empty>
+  <svg class=icon width="20" height="20"><use href="/ethos-icons.svg#i-grid"/></svg>
+  <div>no open tasks</div>
+  <div class=hint>add one above, or tell maven "добавь в задачи …"</div>
+</div>{{end}}
+</section>
+
+{{if .Resolved}}
+<section class=card>
+<h2 class=card-title>resolved <span class=badge>{{len .Resolved}}</span></h2>
+<div class=scroll><table>
+<tr><th>task</th><th>status</th><th>when</th></tr>
+{{range .Resolved}}<tr>
+<td class=text-max>{{.Text}}</td>
+<td><span class="badge {{.Status}}">{{.Status}}</span></td>
+<td class=muted>{{.Resolved}}</td>
+</tr>{{end}}</table></div>
+</section>
+{{end}}
+{{template "shellBottom"}}

cmd/mavweb/tasks_test.go

@@ -0,0 +1,225 @@
+package main
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/tasks"
+)
+
+// fakeTaskCore serves the /tasks handler: a canned list plus a log of the
+// writes the page made.
+type fakeTaskCore struct {
+	ipc.UnimplementedCoreAPI
+
+	tasks   []ipc.Task
+	listErr error
+
+	captured   []ipc.CaptureTaskReq
+	created    bool
+	captureErr error
+
+	statusID  int64
+	statusVal string
+	statusErr error
+}
+
+func (f *fakeTaskCore) ListTasks(_ context.Context, status string) ([]ipc.Task, error) {
+	if f.listErr != nil {
+		return nil, f.listErr
+	}
+	return f.tasks, nil
+}
+
+func (f *fakeTaskCore) CaptureTask(_ context.Context, req ipc.CaptureTaskReq) (ipc.CaptureTaskResp, error) {
+	f.captured = append(f.captured, req)
+	if f.captureErr != nil {
+		return ipc.CaptureTaskResp{}, f.captureErr
+	}
+	return ipc.CaptureTaskResp{ID: 7, Created: f.created}, nil
+}
+
+func (f *fakeTaskCore) SetTaskStatus(_ context.Context, id int64, status string, _ time.Time) error {
+	f.statusID, f.statusVal = id, status
+	return f.statusErr
+}
+
+func TestHandleTasksSplitsCandidatesFromOpen(t *testing.T) {
+	now := time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC)
+	resolved := now.Add(time.Hour)
+	core := &fakeTaskCore{tasks: []ipc.Task{
+		{ID: 1, Text: "купить молоко", Source: "tap:voice", Status: "open", CreatedTs: now},
+		{ID: 2, Text: "продлить страховку", Source: "email:kami", Evidence: "полис истекает", Status: "candidate", CreatedTs: now},
+		{ID: 3, Text: "полить цветы", Source: "tap:web", Status: "done", CreatedTs: now, Resolved: &resolved},
+	}}
+	rec := httptest.NewRecorder()
+	handleTasks(rec, httptest.NewRequest(http.MethodGet, "/tasks", nil), core)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d", rec.Code)
+	}
+	body := rec.Body.String()
+	for _, want := range []string{
+		"купить молоко", "продлить страховку", "полить цветы",
+		"полис истекает",       // the evidence trail is visible for review
+		"found, not confirmed", // candidates get their own section
+	} {
+		if !strings.Contains(body, want) {
+			t.Errorf("body missing %q", want)
+		}
+	}
+	// The candidate must offer confirm, and the open task must not.
+	if !strings.Contains(body, "value=confirm") {
+		t.Error("candidate row has no confirm action")
+	}
+}
+
+func TestHandleTasksAddCaptures(t *testing.T) {
+	core := &fakeTaskCore{created: true}
+	form := url.Values{"action": {"add"}, "text": {"  позвонить в банк "}, "due": {"2026-08-05"}}
+	req := httptest.NewRequest(http.MethodPost, "/tasks", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec := httptest.NewRecorder()
+	handleTasks(rec, req, core)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d", rec.Code)
+	}
+	if len(core.captured) != 1 {
+		t.Fatalf("captured %d requests, want 1", len(core.captured))
+	}
+	got := core.captured[0]
+	if got.Text != "позвонить в банк" {
+		t.Errorf("text = %q, want trimmed", got.Text)
+	}
+	if got.Source != "tap:web" {
+		t.Errorf("source = %q, want tap:web", got.Source)
+	}
+	if got.Status != "open" {
+		t.Errorf("status = %q — a task he typed himself is open, not a candidate", got.Status)
+	}
+	if got.Due == nil || got.Due.Format("2006-01-02") != "2026-08-05" {
+		t.Errorf("due = %v", got.Due)
+	}
+	if !strings.Contains(rec.Body.String(), "added task") {
+		t.Error("no confirmation message")
+	}
+}
+
+func TestHandleTasksAddSaysAlreadyOnTheList(t *testing.T) {
+	core := &fakeTaskCore{created: false}
+	form := url.Values{"action": {"add"}, "text": {"купить молоко"}}
+	req := httptest.NewRequest(http.MethodPost, "/tasks", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec := httptest.NewRecorder()
+	handleTasks(rec, req, core)
+	if !strings.Contains(rec.Body.String(), "already on the list") {
+		t.Error("a deduped capture must not claim it saved something new")
+	}
+}
+
+func TestHandleTasksStatusActions(t *testing.T) {
+	for _, tc := range []struct{ action, want string }{
+		{"confirm", "open"},
+		{"done", "done"},
+		{"drop", "dropped"},
+	} {
+		core := &fakeTaskCore{}
+		form := url.Values{"action": {tc.action}, "id": {"42"}}
+		req := httptest.NewRequest(http.MethodPost, "/tasks", strings.NewReader(form.Encode()))
+		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+		handleTasks(httptest.NewRecorder(), req, core)
+		if core.statusID != 42 || core.statusVal != tc.want {
+			t.Errorf("%s → SetTaskStatus(%d, %q), want (42, %q)", tc.action, core.statusID, core.statusVal, tc.want)
+		}
+	}
+}
+
+func TestHandleTasksRejectsBadPost(t *testing.T) {
+	core := &fakeTaskCore{}
+	form := url.Values{"action": {"explode"}, "id": {"1"}}
+	req := httptest.NewRequest(http.MethodPost, "/tasks", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec := httptest.NewRecorder()
+	handleTasks(rec, req, core)
+	// The page still renders, with the error inline — and nothing was written.
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d", rec.Code)
+	}
+	if core.statusVal != "" || len(core.captured) != 0 {
+		t.Error("an unknown action must write nothing")
+	}
+	if !strings.Contains(rec.Body.String(), "unknown action") {
+		t.Error("error not surfaced on the page")
+	}
+}
+
+func TestHandleTasksNoCore(t *testing.T) {
+	rec := httptest.NewRecorder()
+	handleTasks(rec, httptest.NewRequest(http.MethodGet, "/tasks", nil), nil)
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Errorf("status = %d, want 503", rec.Code)
+	}
+}
+
+// The open list is ordered by the ranker, and the reason is shown so the page
+// says why a task is first instead of asking him to trust the order.
+func TestHandleTasksOrdersOpenByRank(t *testing.T) {
+	now := time.Now()
+	due := now
+	core := &fakeTaskCore{tasks: []ipc.Task{
+		{ID: 1, Text: "купить молоко", Status: "open", CreatedTs: now},
+		{ID: 2, Text: "оплатить интернет", Status: "open", CreatedTs: now, Due: &due},
+	}}
+	rec := httptest.NewRecorder()
+	handleTasks(rec, httptest.NewRequest(http.MethodGet, "/tasks", nil), core)
+	body := rec.Body.String()
+	if strings.Index(body, "оплатить интернет") > strings.Index(body, "купить молоко") {
+		t.Error("want the dated task rendered first")
+	}
+	if !strings.Contains(body, "сегодня") {
+		t.Error("want the ranker's reason shown in the why column")
+	}
+}
+
+// A candidate is ranked into place but never carries a priority reason: its due
+// date is Maven's reading of a mail, not something he stated.
+func TestHandleTasksHidesCandidateReason(t *testing.T) {
+	now := time.Now()
+	due := now
+	core := &fakeTaskCore{tasks: []ipc.Task{
+		{ID: 1, Text: "продлить страховку", Status: "candidate", CreatedTs: now, Due: &due},
+	}}
+	rec := httptest.NewRecorder()
+	handleTasks(rec, httptest.NewRequest(http.MethodGet, "/tasks", nil), core)
+	if strings.Contains(rec.Body.String(), "сегодня") {
+		t.Error("a candidate must not be shown with a priority reason")
+	}
+}
+
+func TestApplyTaskPostCarriesWeight(t *testing.T) {
+	core := &fakeTaskCore{created: true}
+	form := url.Values{"action": {"add"}, "text": {"оплатить интернет"}, "weight": {"3"}}
+	req := httptest.NewRequest(http.MethodPost, "/tasks", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	handleTasks(httptest.NewRecorder(), req, core)
+	if len(core.captured) != 1 || core.captured[0].Weight != 3 {
+		t.Fatalf("captured = %+v, want weight 3", core.captured)
+	}
+}
+
+// Out of range clamps rather than 400s; a non-number is a real client error.
+func TestApplyTaskPostClampsWeight(t *testing.T) {
+	core := &fakeTaskCore{created: true}
+	form := url.Values{"action": {"add"}, "text": {"что-то"}, "weight": {"99"}}
+	req := httptest.NewRequest(http.MethodPost, "/tasks", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	handleTasks(httptest.NewRecorder(), req, core)
+	if core.captured[0].Weight != tasks.MaxWeight {
+		t.Errorf("weight = %d, want the cap", core.captured[0].Weight)
+	}
+}

deploy/README.md

@@ -36,6 +36,67 @@ present (see `.dockerignore`).
 | `/var/lib/maven` (volume)  | encrypted db at rest                    |
 | `/dev/shm` (tmpfs)         | decrypted db working copy (RAM only)    |
 
+## Reading the outside world (off by default)
+
+`mavend.json` ships without a `feeds` block, which means no RSS/Atom feed is
+fetched and no outbound request is made. Switching it on is adding the block:
+
+```json
+"feeds": {
+  "poll_interval": "30m",
+  "max_items": 5,
+  "max_age": "24h",
+  "sources": [
+    { "name": "habr", "url": "https://habr.com/ru/rss/best/daily/",
+      "category": "технологии", "exclude": ["реклама"] }
+  ]
+}
+```
+
+What it does and does not do:
+
+- items are written as notes with source `rss:<name>`, visible on `/dash`;
+- **nothing is announced.** She reads them back when asked — "что нового в
+  лентах?", "что нового по технологиям?" — and never on arrival. There is no
+  severity or channel knob here on purpose;
+- the fetcher is allowlisted to the hosts of the configured feeds, plus any
+  `allow_hosts`. It refuses non-http(s) schemes and every private address
+  (loopback, the LAN, the `10.42.0.0/24` wg range, cloud metadata). It caps the
+  response at 2 MiB and redirects at 3, and makes at most one request per host
+  per second. See `internal/webfetch`;
+- how far each feed was read is stored as a config fact `rss:latest:<name>`, so
+  a restart does not re-note yesterday's headlines.
+
+### Reading a page (`crawl`, also off by default)
+
+There is no `crawl` block either, so no page is fetched. Two halves, separately
+switched:
+
+```json
+"crawl": {
+  "on_demand": true,
+  "interval": "6h",
+  "max_runes": 4000,
+  "watches": [
+    { "name": "changelog", "url": "https://example.org/changelog", "interval": "12h" }
+  ]
+}
+```
+
+- `on_demand` lets her read a page he names in the utterance: "посмотри
+  https://example.org/x — что там?". The page becomes context for his question,
+  and only the URL leaves the box. Without a URL nothing is fetched, so this is
+  a fallback and not a habit;
+- `watches` re-reads a fixed list on its interval and writes a note when the
+  text changed. Like the feeds, it announces nothing;
+- the answer path sits **last** in the query chain, behind his memory, his notes
+  and (once wired) the local Kiwix ZIMs. A local read costs nothing;
+- `robots.txt` is fetched first and obeyed with no override; a `Disallow` is a
+  refusal she says out loud. `Crawl-delay` is honoured;
+- same guarded fetcher as the feeds: allowlist/denylist, no private addresses,
+  size cap, redirect cap, timeout, one request per host per second;
+- dedup state is the config fact `crawl:hash:<name>`.
+
 ## Not yet verified / host-dependent
 
 This stack is correct-by-construction but has **not been build-tested here**
@@ -53,3 +114,49 @@ build on the target host, most likely in one of these:
   work fine over the core socket.
 - **netdata** — `mavpoll` reaches it via `host.docker.internal`; adjust if
   netdata runs elsewhere.
+
+## Updating her (`mavupdate`, Vikunja #249)
+
+Off unless configured, and there is deliberately no button for it. There is no
+IPC method, no web route, no timer and no act that starts an update — the trigger
+is a human running `mavupdate` on the host, which needs shell access, a strictly
+higher bar than the step-up passkey gate that guards `/tools`. She cannot update
+herself; she can be updated. Nothing here ever fetches code: the new version is
+whatever you pulled into the working tree yourself.
+
+Add an `update` block to `mavend.json` (mavend ignores it — only the CLI reads
+it), with paths as they exist **on the host**, not inside a container:
+
+```json
+"update": {
+  "source_dir": "/home/kami/apps/Maven",
+  "install_dir": "/home/kami/apps/Maven",
+  "snapshot_dir": "/var/lib/maven-snapshots",
+  "binaries": ["mavend", "mavweb", "mavsttd", "mavttsd", "mavwaked",
+               "mavenclient", "mavpoll", "mavcaldav", "mavmaild"],
+  "config_files": ["deploy/mavend.json"],
+  "restart_cmd": ["docker", "compose", "up", "-d", "--build"],
+  "health_socket": "/var/lib/docker/volumes/maven_sockets/_data/mavend.sock",
+  "health_timeout_sec": 120
+}
+```
+
+`snapshot_dir` must be outside `install_dir` (a restore must not read from what
+the install writes) and `health_socket` is required: an update that cannot check
+its own result cannot roll itself back, so the config is refused without one.
+
+Then:
+
+```sh
+mavupdate -config deploy/mavend.json verify        # make build + make test, deploys nothing
+mavupdate -config deploy/mavend.json apply -yes    # snapshot, verify, install, restart, health-check
+mavupdate -config deploy/mavend.json list          # what you can roll back to
+mavupdate -config deploy/mavend.json rollback -yes # restore the previous artifacts and restart
+```
+
+`apply` refuses to start if she is not already answering — otherwise a failed
+update and a box that was already broken are indistinguishable afterwards. On any
+failure after the install it restores the snapshot, restarts, and checks again;
+if that also fails it says so loudly and names the directory to copy back by hand.
+The database is never snapshotted or rolled back (see the package comment in
+`internal/update`); schema compatibility is `store.Migrate`'s job.

deploy/ecosystem/docker-compose.yml

@@ -8,6 +8,18 @@
 #
 # Maven's own compose joins this same network (add `ecosystem` as an external
 # network there) to reach nexus:9740 / praxis:8989 / hexis:9741 directly.
+#
+# NO RELEASE PINNING (Vikunja #354): each `build:` below points at a sibling
+# WORKING TREE, so `up --build` ships whatever is checked out there, including
+# uncommitted edits. Before bringing this up, check what you are about to
+# deploy:
+#
+#   for r in nexus praxis hexis; do git -C ../../../$r status --short; \
+#     git -C ../../../$r log -1 --oneline; done
+#
+# The host nginx that fronts these is deploy/ecosystem/nginx.conf — it binds
+# the wg and LAN addresses only, with allow/deny. Keep it that way: none of
+# these containers has auth of its own.
 name: ecosystem
 
 services:

deploy/ecosystem/nginx.conf

@@ -1,6 +1,7 @@
-# Reverse-proxy the three sibling admin UIs. Drop into your nginx sites (or the
-# nginx-panel app) and reload. Assumes the compose publishes each service on
-# 127.0.0.1:<port>. Add TLS (certbot / your existing cert block) per server.
+# Reverse-proxy Maven's own web UI plus the three sibling admin UIs. Drop into
+# your nginx sites (or the nginx-panel app) and reload. Assumes the compose
+# publishes each service on 127.0.0.1:<port>. Add TLS (certbot / your existing
+# cert block) per server.
 #
 # NOTE: hexis.<domain> previously pointed at the MCP tool — repoint that
 # elsewhere first (the app now owns hexis.*).
@@ -12,6 +13,50 @@
 # Do NOT "fix" a failed bind by reverting to `listen 80` (all interfaces) —
 # that removes the only access control these containers have.
 
+# maven.<domain> → mavweb (docker-compose.yml publishes it on 127.0.0.1:9201).
+# Same bind + ACL as the siblings, and for a stronger reason: mavweb serves
+# POST /tools, which defines argv that internal/tool EXECUTES, plus POST
+# /routines, /api/revert and /api/chat (Vikunja #317). Without
+# -webauthn-origin/-webauthn-rpid mavweb has no auth of its own, so this block
+# is the auth. If you add TLS and a basic-auth/oauth2-proxy layer, keep the
+# allow/deny anyway — belt and braces on an RCE surface.
+#
+# WebSocket upgrade matters here: /ws carries push-to-talk audio, so the
+# Upgrade/Connection headers below are required, not decoration. The map keeps
+# `Connection: upgrade` off plain requests; it sits in the http context, which
+# is where sites-available files are included — if your nginx already defines
+# $connection_upgrade, drop this block.
+map $http_upgrade $connection_upgrade {
+    default upgrade;
+    ''      close;
+}
+
+server {
+    listen 10.42.0.1:80;
+    listen 192.168.1.104:80;
+    server_name maven.kvmx.ru;
+
+    allow 10.42.0.0/24;
+    allow 192.168.1.0/24;
+    deny all;
+
+    # push-to-talk uploads raw PCM; the default 1m is enough for a short
+    # utterance but not for a long one.
+    client_max_body_size 32m;
+
+    location / {
+        proxy_pass http://127.0.0.1:9201;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $connection_upgrade;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 300s;   # an LLM turn can take minutes on the iGPU
+    }
+}
+
 server {
     listen 10.42.0.1:80;
     listen 192.168.1.104:80;

deploy/mavend.json

@@ -26,6 +26,25 @@
     "severity_ceiling": 2
   },
 
+  "pattern_proposals": {
+    "notify": false,
+    "cooldown": "24h"
+  },
+
+  "mcp": {
+    "timeout": "15s",
+    "servers": [
+      {
+        "name": "vikunja",
+        "url": "http://192.168.1.104:9100/mcp",
+        "allow_private": true,
+        "allow_tools": ["list_projects", "list_tasks", "get_task_details", "create_task"],
+        "max_tools": 6,
+        "enabled": false
+      }
+    ]
+  },
+
   "nexus":  { "url": "http://nexus:9740" },
   "praxis": { "url": "http://praxis:8989" },
   "hexis":  { "url": "http://hexis:9741" },

docker-compose.yml

@@ -101,9 +101,42 @@ services:
               "-netdata", "http://127.0.0.1:19999",
               "-kuma", "http://127.0.0.1:3001/metrics",
               "-kuma-key", "uk5_mavpoll-key"]
+              # Money tracking (Vikunja #125) is OFF: it needs a zenmoney token,
+              # which mavpoll reads from a FILE so it never appears in `ps`, in
+              # this file, or in shell history. To enable, mount the token and
+              # append: "-zenmoney-token-file", "/run/secrets/zenmoney.token"
+              # (optionally "-zenmoney-interval", "1h"). Core never sees the
+              # token — the poller writes facts(kind=env, source=poll:zenmoney)
+              # and mavend only reads those back when he asks.
     depends_on: [mavend]
     volumes:
       - sockets:/run/maven
+      # - ./deploy/zenmoney.token:/run/secrets/zenmoney.token:ro
+
+  # The mail reader (Vikunja #246) is OFF and commented out: it needs an IMAP
+  # account, and there is none on this box. mavmaild reads the password from a
+  # FILE so it never appears in `ps`, in this file, or in shell history — the
+  # same rule mavpoll follows for the zenmoney token. Core never sees the
+  # password: the reader hands core message text on one IPC method, and core
+  # writes what the model extracts as task CANDIDATES he reviews on /tasks.
+  # Nothing here can create a reminder, so a misread mail cannot fire.
+  #
+  # To enable: write the password to deploy/imap.password (0600, gitignored),
+  # add an "email": {} block to deploy/mavend.json, and uncomment this service.
+  # mavmaild:
+  #   <<: *image
+  #   command: ["mavmaild", "-socket", "/run/maven/mavend.sock",
+  #             "-imap", "imap.example.org:993",
+  #             "-user", "kami@example.org",
+  #             "-password-file", "/run/secrets/imap.password",
+  #             "-mailbox", "INBOX",
+  #             "-interval", "15m",
+  #             "-state", "/var/lib/maven/mail-seen.json"]
+  #   depends_on: [mavend]
+  #   volumes:
+  #     - sockets:/run/maven
+  #     - dbdata:/var/lib/maven
+  #     - ./deploy/imap.password:/run/secrets/imap.password:ro
 
 volumes:
   dbdata:

docs/plans/03-memory-evaluation.md

@@ -25,3 +25,46 @@
 6. Add `/eval` API method to `ipc.CoreAPI` (or reuse `Chat` with system context) so mavweb can show evaluation history
 7. Add `memory_eval` block to `deploy/mavend.json`
 8. Test with synthetic store state — verify observations match expected patterns
+
+---
+
+## Status 2026-08-01 — foundation shipped (Vikunja #248)
+
+**Shipped:** `internal/memeval` (not `internal/memory/eval.go` — `internal/store`
+imports `internal/memory` for the vector backend, so an evaluator that reads
+`store.Fact` there would close an import cycle). `Evaluator.Evaluate` reads
+`RecentFacts` / `RecentNotes` / `RecentNudges`, prompts the resident model under
+a GBNF grammar for at most three `{observation, confidence, suggested_action}`
+objects, drops anything under `min_confidence`, deduplicates against what earlier
+evaluations wrote, and records the rest as notes with source `infer:memory-eval`.
+Driver: `cmd/mavend/memoryeval.go`, its own goroutine on its own ticker. Config:
+the `memory_eval` block — **absent ⇒ the loop does not run**. Visibility: `/dash`
+already renders notes with their source, so evaluation output is visible with no
+UI change.
+
+**Deliberately not shipped — this is policy, not an unfinished edge:**
+
+- *Dispatching observations as care nudges (plan step 4).* An hourly LLM loop
+  with permission to speak is a machine for generating interruptions, and the
+  content is model-generated text about his own life. The evaluator has no
+  dispatcher reference at all, so it cannot reach a channel by accident. Wiring
+  it to `delivery.Dispatcher` is a separate decision with its own opt-in.
+- *Acting on `suggested_action`.* It is recorded inside the note text and
+  interpreted by nobody. No reminder, routine or fact is created.
+- *Writing observation embeddings.* Notes are written with a nil embedding, so
+  they stay out of the RAG recall pool. Feeding generated text back into the pool
+  it came from is how a small model starts citing its own guesses as evidence.
+
+**Deferred, wants a decision or another capability:**
+
+- *Plan step 6, the `/eval` IPC method and an evaluation-history view.* `/dash`
+  covers reading the output; a dedicated trace surface is worth building once
+  there is real output to look at, and it should probably show the prompt too.
+- *`RecentEvents`.* The plan lists it; the evaluator reads facts, notes and
+  nudges. Detected action/object events already drive pattern proposals (#43), and
+  duplicating them here would mostly re-derive that.
+- *Output quality is unmeasured.* There is no fixture for "did she notice
+  something true". The tests cover the machinery — empty store, confidence floor,
+  dedupe, own-notes exclusion, error handling — not the observations. Until
+  someone reads a week of real output on `/dash`, treat the wording and the
+  `min_confidence` default as unvalidated.

docs/plans/07-vision.md

@@ -1,27 +1,106 @@
 # Plan: Vision — Image Understanding Capability
 
-**Goal:** Maven can "see" — accept images (from mavweb upload, Telegram, or filesystem paths), run vision inference via a local or remote multimodal model, and answer questions about the image content or extract structured information.
+**Goal:** Maven can "see" — accept images (from mavweb upload, Telegram, or filesystem paths), store them, run inference via a **local** multimodal model, and answer questions about the image content or extract text from it.
 
-**Done when:**
-- Vision model backend is configurable: local multimodal LLM (e.g., LLaVA, Qwen-VL via `llama-server` mmproj) or remote API
-- `internal/vision/` package handles image preprocessing, model inference, result parsing
-- Voice/text commands like "что на картинке?" or "прочитай текст с экрана" route to the vision handler
-- Extracted information can be written as facts/notes through `ipc.CoreAPI`
-- Telegram image messages are processed through the same pipeline
+**Status (2026-08-01):** intake, storage, config seam and the provider are shipped. The
+describing half is **BLOCKED on a model download** — see "What is blocked" below.
 
-**Scope:**
-- New `internal/vision/` package — image loader (Go stdlib `image` + `golang.org/x/image`), inference client
-- New config block: `voice.vision` in `config.Config` — `{enabled, provider, model_path, mmproj_path, remote_url}`
-- Router intent extension: new `IntentVision` or reuse `IntentQuery` with a vision flag
-- Reuses `internal/llm.Client` for API-compatible backends (OpenAI-compatible vision API)
-- Reuses `internal/ipc.CoreAPI` for writing extracted data
+## What shipped
 
-**Steps:**
-1. Create `internal/vision/provider.go` — `Provider` interface with `Describe(image []byte, prompt string) (string, error)` and `ExtractText(image []byte) (string, error)`
-2. Implement `LocalProvider` — spawns `llama-server` with mmproj, sends multimodal chat completion requests
-3. Implement `RemoteProvider` — calls an OpenAI-compatible vision API endpoint, reuses `internal/llm.Client`
-4. Create `internal/vision/processor.go` — image preprocessing (resize, format conversion to JPEG/PNG, base64 encoding)
-5. Wire vision into `cmd/mavend/voice.go:reactiveHandler` — detect vision intent from router (new `IntentVision` or a `Slots.HasImage` flag)
-6. Add IPC method `MethodDescribeImage` for programmatic access (mavweb upload, telegram bot)
-7. Add vision config block to `config.Config` and wire in `cmd/mavend/main.go`
-8. Test with a local multimodal model: send an image via mavweb, verify description and text extraction
+| Piece | Where |
+|---|---|
+| Blob store (content-addressed, retention-pruned) | `internal/media/store.go` |
+| Image decode / flatten / downscale / JPEG | `internal/media/image.go` |
+| `Provider` seam + `Disabled` floor + `LocalProvider` | `internal/vision/vision.go` |
+| Store-then-describe orchestration, re-runnable | `internal/vision/intake.go` |
+| Config blocks `media` and `vision` | `internal/config/config.go` |
+| IPC method `describe_image` (`AuthRead`) | `internal/ipc/{wire,api,client,server}.go`, `internal/auth/policy.go` |
+| Daemon wiring + hourly retention prune | `cmd/mavend/vision.go` |
+
+`internal/media` is deliberately shared: hearing (#253) and speaker recognition (#255) have
+the same intake problem — a blob arrives, gets stored, gets described — and they store their
+audio in the same place under the same retention.
+
+## Design decisions worth knowing
+
+**Store before describe.** `Intake.Accept` writes the blob to disk *first*, then asks the
+model. If the model is missing or broken — which is this box's actual state — the answer is
+"it's kept, I can't read it yet" with a content-addressed id, and `Intake.Rerun(id, question)`
+describes it later. Nothing is lost to a missing model.
+
+**No `RemoteProvider`.** The original step 3 called for "an OpenAI-compatible vision API
+endpoint". Refused. The surviving hard constraint in CLAUDE.md after "never phones home" was
+deprecated is *no cloud model, inference stays on the box*, and a photo of his flat is the
+worst possible exception. `vision.NewLocal` therefore validates the endpoint at construction:
+loopback, a private IP, or `localhost`. A hostname is refused too — it could resolve anywhere,
+and resolving it would mean trusting DNS with his pictures.
+
+**Blobs are not in the database.** The sqlite store is small, encrypted and read every tick;
+a 40 MB blob has no business there. What lands in the database is the *text* the blob produced,
+as an ordinary note (`source: media:image:<id-prefix>`), and only when the caller asks for it
+(`save_note`). Glancing at a screenshot is not the same act as remembering it.
+
+**Images are never search input and never embedded.** Only the derived description
+participates in recall, and only after he can see it as a note.
+
+**Retention is enforced by a loop, not by a promise.** `media.retention` defaults to 7 days
+and `cmd/mavend` prunes hourly, starting at boot. A store that grows forever would be the real
+failure mode of this capability.
+
+**No webp.** The stdlib has no webp decoder and this repo takes no new dependencies (the box
+is offline). `media.SniffImage` recognises webp well enough to refuse it *by name*, so the log
+says "webp is not supported" instead of "not an image". Telegram sends webp for stickers; that
+is a known gap, not a mystery.
+
+**Text extraction is not a second method.** "прочитай текст с картинки" is a prompt. A VLM has
+no separate OCR mode to select, and a second interface method would only duplicate the first.
+
+## What is blocked, and on what
+
+There is **no vision-capable gguf and no mmproj file on this box**. Checked 2026-08-01:
+
+```
+/mnt/hdd1/llms/{Bonsai,LFM2.5,llama3.2,ministral,nemotron3-nano,qwen3,qwen3.5}
+```
+
+— sixteen ggufs, all text-only, no `*mmproj*` anywhere. The resident Qwen3-1.7B is text-only
+by construction, so vision needs a *second* model. The ≤1.7B ceiling in CLAUDE.md is about the
+resident router/phraser, not about a second model loaded on demand — but iGPU VRAM still is,
+so keep it small.
+
+To unblock, download one pair to `/mnt/hdd1/llms/vision/` (bind-mounted to
+`/opt/maven/models/llm`), a gguf **and** its mmproj:
+
+- `Qwen2.5-VL-3B-Instruct` (Q4_K_M + `mmproj-F16.gguf`) — the safe default; reads Russian, and
+  its OCR is the best of this size class.
+- `SmolVLM2-2.2B-Instruct` — smaller and faster, weaker at Cyrillic text in images.
+- `moondream2` — smallest, English-only in practice. Do not bother, per the sub-500M lesson.
+
+Then run a second llama-server on 8081 with `--mmproj`, point `vision.endpoint` at it, and
+walk the QA steps on Vikunja #252.
+
+## Config
+
+```json
+"media": { "dir": "media", "retention": "168h", "max_bytes": 67108864 },
+"vision": {
+  "enabled": true,
+  "endpoint": "http://127.0.0.1:8081",
+  "model": "qwen2.5-vl-3b",
+  "max_dim": 896,
+  "max_tokens": 300,
+  "timeout": "90s"
+}
+```
+
+Both absent by default. No `media` block ⇒ `describe_image` does not exist at all; a `media`
+block with no `vision` block ⇒ images are stored and honestly not described.
+
+## Still open
+
+- **Router intent.** "что на картинке?" does not route anywhere yet. Adding an intent is
+  premature while nothing can answer it; the IPC method is the surface a Telegram photo or a
+  mavweb upload calls today.
+- **Telegram photo path** in `mavpoll` (download the file, call `DescribeImage`).
+- **mavweb upload page** and a `/media` listing so stored blobs are visible and deletable from
+  the authed surface.

docs/plans/08-hearing.md

@@ -1,28 +1,121 @@
-# Plan: Hearing — Audio Stream Monitoring & Meeting Summarization
+# Plan: Hearing — Meeting Capture & Summarisation
 
-**Goal:** Maven can "hear" ambient audio from workpc — microphone input during meetings, system audio — and on demand (or on trigger) produce transcripts, summaries, or extract action items. A typical use case: "Maven, запиши встречу" starts capture, "хватит" stops it, and Maven writes a summary note.
+**Goal:** "Maven, запиши встречу" starts a recording, "хватит" stops it, and she writes a
+summary note. The audio stays on the box, is pruned by retention, and nothing is recorded that
+nobody asked for.
 
-**Done when:**
-- `internal/audio/capture.go` — remote microphone capture client (receives PCM stream from workpc over WebSocket or the existing voice TCP protocol)
-- `internal/stt/` — streaming transcription (uses existing `stt.Transcriber` interface, extended with streaming support)
-- Meeting capture triggered by voice command (IntentCapture) or configurable keyword ("maven record")
-- Raw audio is either streamed to STT in real-time or saved to a WAV file and transcribed after capture ends
-- Transcription + LLM summary is written as a note (`source:capture:meeting`) through `ipc.CoreAPI`
-- New `mavheary` module (`cmd/mavheard/`) — the workpc-side agent that captures mic/speaker audio and streams it to mavend
+**Status (2026-08-01):** the recorder, the storage, the chunked transcription, the map-reduce
+summariser, the config seam and the four IPC methods are shipped and tested. What is not
+shipped is the workpc-side microphone agent and the router intent — see "Still open".
 
-**Scope:**
-- New `cmd/mavheard/` — workpc-side agent: captures microphone (PortAudio or ALSA `arecord`), streams over WebSocket to mavend
-- `internal/audio/` extended with capture types: `MicCapture`, `SystemCapture`, `FileCapture`
-- `internal/stt/stt.go` extended with `StreamingTranscriber` interface (or reuse existing with chunked input)
-- Router: new `IntentCapture` intent for start/stop commands
-- Reuses `internal/llm.Client` for summarization
-- Reuses `internal/voice/server.go` TCP protocol for streaming audio
+## What shipped
 
-**Steps:**
-1. Create `cmd/mavheard/main.go` — workpc-side daemon: captures microphone via `arecord` pipe or PortAudio, opens WebSocket or TCP connection to mavend, streams PCM frames
-2. Create `internal/audio/capture.go` — `Capture` interface: `Start()`, `Stop()`, `AudioCh <-chan Audio`; implement `MicCapture` (reads from `mavheard` stream) and `FileCapture` (reads WAV)
-3. Extend `internal/stt/stt.go` — add `TranscribeStream(ctx, audio <-chan Audio) (string, error)` to `Transcriber` interface; `Stub` returns empty; `Remote` forwards chunks to worker socket
-4. Add `IntentCapture` to `internal/router/intent.go` — slots: `Action` ("start"/"stop"/"status"), `Duration`
-5. Wire capture handler in `cmd/mavend/voice.go:reactiveHandler` — start = spawn goroutine receiving audio, stream to STT; stop = finalize, send to LLM for summarization, write note via `WriteNote`
-6. Add capture config to `voice` block in `config.Config` — `{capture_enabled, capture_timeout}`
-7. Test with a recorded WAV file — simulate a meeting, verify transcription + summary note is created
+| Piece | Where |
+|---|---|
+| Session state machine: start / append / stop / abort / status | `internal/capture/capture.go` |
+| Map-reduce summarisation against `n_ctx` 4096 | `internal/capture/summarize.go` |
+| Audio blobs in the shared store, pruned by `media.retention` | `internal/media` (from #252) |
+| Config block `capture`, off by default | `internal/config/config.go` |
+| IPC `capture_start` / `capture_append` / `capture_stop` / `capture_status` | `internal/ipc/{wire,api,client,server}.go` |
+| Authority: the three write methods `AuthWrite`, status `AuthRead` | `internal/auth/policy.go` |
+| Daemon wiring, note write, STT reuse | `cmd/mavend/capture.go` |
+
+The audio lands in the same content-addressed blob store as images, under the same retention
+loop, because #252 and #253 have the same intake problem and solving it twice would mean two
+directories to remember to prune.
+
+## The refusals, and why
+
+**Nothing listens.** The original step 8 called for capture "triggered by voice command
+(IntentCapture) **or configurable keyword ('maven record')**". The keyword half is refused.
+Noticing a keyword requires listening to the room continuously, which is precisely the
+behaviour this capability must not have, and the refusal is in the code rather than in a
+comment: `Recorder.Append` is the only way audio enters, and it returns `ErrNoSession` unless
+someone explicitly started a session. Audio arriving at an idle core is dropped, not buffered
+"just in case".
+
+**Off unless configured, twice over.** No `media` block ⇒ nowhere to keep audio ⇒ the four
+methods do not exist. No `capture` block with `enabled: true` ⇒ they still do not exist. On an
+unconfigured box there is no wire path at all that begins a recording. That is the only
+guarantee worth making here, and it is the reason the hooks use the nil-hook ⇒
+`ErrUnknownMethod` pattern rather than an in-handler check.
+
+**A forgotten session ends itself.** `max_minutes` defaults to 120 and is checked on every
+append, not on a timer that could be missed. Past the cap `Append` returns `ErrExpired`
+permanently, so a client that ignores the error cannot grow the recording; the audio collected
+before the cap is kept and `Stop` still works.
+
+**"Забудь, не записывай" leaves nothing behind.** `capture_stop` with `discard: true` throws
+the session away without storing, transcribing or summarising anything — not a blob with a note
+saying it was abandoned. Nothing.
+
+**The transcript is not saved by default.** The summary is written where he will read it; the
+verbatim record of what other people said in a room is a heavier thing to keep and takes a
+deliberate `save_transcript: true`. The audio blob is pruned by `media.retention` either way.
+
+**No second STT.** Step 3 of the original plan extended the `Transcriber` interface with
+streaming. Not needed and not done: whisper.cpp already runs as `mavsttd`, and `internal/capture`
+takes the ordinary `stt.Transcriber` the voice path already holds (exposed as
+`voiceWiring.transcriber`). Long recordings are handed over in five-minute windows —
+`chunkAudio`, cut on sample boundaries — for the same reason whisper itself works in 30-second
+windows: an hour of PCM in one call either times out or blocks the voice path for minutes.
+Capture with voice off is refused rather than degraded, because storing hours of unreadable
+audio of other people is worse than not recording.
+
+**Not `AuthStepUp`.** Recording people is invasive enough to argue for the top rung, and it is
+still wrong: step-up needs a passkey gesture, which the voice path cannot make, so
+"запиши встречу" could never work by voice — the only way he will actually use this. `AuthWrite`
+plus the off-unless-configured gate is the honest combination.
+
+## Long audio against a 4096-token context
+
+The resident model is a Thinking variant at `n_ctx` 4096, so an hour of transcript does not fit
+in one prompt and never will. `summarize.go` does map-reduce and nothing cleverer: split the
+transcript on sentence boundaries into 3000-rune windows (about 1100 Qwen tokens of Russian,
+leaving room for the persona block, the reasoning and the answer), summarise each, then
+summarise the summaries. A transcript that fits in one window skips the reduce step.
+
+Truncation was the alternative and is rejected: a truncated meeting summary reads as complete
+and is not, and he would act on it. Past `max_chunks` (40, roughly the two-hour cap) the
+transcript *is* cut, and the summary says so in the note.
+
+Two degradations are deliberate and both are reported rather than hidden:
+
+- No llama-server ⇒ transcript, no summary. The words exist.
+- The reduce call fails ⇒ the per-chunk summaries are returned joined. Real work, not thrown
+  away over the last call.
+
+The map and reduce prompts contain no first person at all, so the persona's feminine-form rules
+have nothing to get wrong in them; the reply she actually gives him is phrased by the ordinary
+replier, which does carry the persona.
+
+## Config
+
+```json
+"media": { "dir": "media", "retention": "168h" },
+"capture": {
+  "enabled": true,
+  "max_minutes": 120,
+  "stt_window": "5m",
+  "chunk_runes": 3000,
+  "max_chunks": 40,
+  "save_transcript": false
+}
+```
+
+Both absent by default. `capture` alone does nothing without `media`.
+
+## Still open
+
+- **`cmd/mavheard`** — the workpc-side microphone agent. Deferred, not refused: the core half
+  is the part with the invariants in it, and a mic client is straightforward once there is a
+  stable wire to stream at. It should be an explicit-start process, not a resident one, for the
+  same reason the recorder has no keyword trigger. The four IPC methods are the wire it will
+  use; `mavenclient` already has the mic plumbing to borrow.
+- **Router intent.** "запиши встречу" / "хватит" does not route anywhere yet. It needs the
+  `system` intent plus slots, and it needs care: "хватит" is also how someone tells her to stop
+  talking, so the recorder's stop and the speech barge-in must not collide.
+- **A `/dash` panel** showing a running session, so a recording is visible on a surface and not
+  only in a log line.
+- **Speaker attribution** — who said what — is #255 and is blocked on a model; see
+  `docs/plans/10-speaker-recognition.md`.

docs/plans/09-behavioral-memory.md

@@ -27,3 +27,36 @@
 6. Wire voice query — `"что я обычно делаю?"` routes to `IntentQuery` → behavior profile lookup → LLM-phrased answer
 7. Add IPC read method `MethodGetBehaviorProfile` so mavweb can display it on `/dash`
 8. Test with synthetic fact history — verify weekly schedule is correctly inferred
+
+---
+
+## Status (2026-08-01) — partially shipped, deliberately narrowed
+
+Shipped on `overnight/behavior-profile`:
+
+- `internal/memory/behavior.go` — `BuildProfile` counts habits per weekday out of
+  self-facts: distinct-day counts (`MinHabitDays = 2`), a median time-of-day, and
+  `FormatWeekdayRU` / `FormatOverallRU` for the spoken answer.
+- `internal/router/habit.go` — `ParseHabitQuery`, which requires a habit marker
+  ("обычно", "каждую", "привычки", …) and parses the weekday deterministically.
+- `cmd/mavend/actions_query.go` — a `habits` query source, so "что я обычно делаю
+  по вторникам?" is answered.
+
+**Not shipped, and not to be shipped as written:**
+
+- *Step 3, LLM-generated profile stored as a fact.* The profile is COUNTED, not
+  generated. A 1.7B asked to summarise a year of habits produces fluent claims
+  about the owner's life that no row supports, and a wrong claim about him is the
+  most expensive kind of wrong maven can be. Counting is verifiable and cheap.
+- *Step 5, incremental updates on fact write.* There is no cache to keep fresh —
+  the profile is recomputed on the question, so a new fact is already in the next
+  answer. A cached profile that can disagree with its own rows is two truths.
+- *Step 4, proactive daily plan proposals via the dispatcher.* Maven is not a nag,
+  and a nudge at 08:00 every day proposing the day is the definition of one. The
+  sanctioned path from "she noticed a pattern" to "she acts on it" already exists:
+  `internal/pattern/detector.go` proposes a routine, and the owner accepts it on
+  `/routines`. It goes through him.
+
+Still open, if wanted later: `MethodGetBehaviorProfile` + a `/dash` panel (step 7).
+The counted profile needs no new IPC method to be *asked* about — the query source
+reads `RecentFacts` over the existing surface — so this is a display concern only.

docs/plans/10-speaker-recognition.md

@@ -1,27 +1,125 @@
 # Plan: Speaker Recognition
 
-**Goal:** Maven can distinguish between different speakers on the voice channel — recognize known voices (the user, family members) and tag facts/notes/transcripts with a speaker identity.
+**Goal:** Maven can tell who is speaking on the voice channel, and tag what she writes with
+who said it.
 
-**Done when:**
-- Speaker embedding extractor (e.g., ECAPA-TDNN or a simple MFCC + GMM) runs on incoming voice PCM before STT
-- Embedding is compared against enrolled speaker profiles (stored as vectors in the `memory_vectors` table alongside semantic memory)
-- Unknown speakers are enrolled on first interaction (prompt: "кто это?")
-- All voice fact/note writes are tagged with `speaker:<id>` in the value/source metadata
-- Speaker identity is available as context to the router, phraser, and replier ("ok, <name>")
+**Status (2026-08-01, Vikunja #255):** the enrolment half is shipped. The recognising half is
+**BLOCKED on a model download** — there is no speaker-embedding model on this box, and one
+was not invented to fill the gap. See "Blocked, and on what" below.
 
-**Scope:**
-- New `internal/speaker/` package — enrollment, recognition, embedding extraction
-- Reuses `internal/store.MemoryStore` for speaker vector storage (same `memory_vectors` table, different `source` prefix)
-- Reuses `internal/audio` for PCM preprocessing
-- Integration point: `cmd/mavend/voice.go:HandlePushToTalk` — speaker ID extracted before STT, passed through context
+## What shipped
 
-**Steps:**
-1. Research speaker embedding approaches — simplest floor: MFCC + cosine similarity via `github.com/mjibson/go-dsp` or a pre-trained ONNX model (SpeechBrain ECAPA)
-2. Create `internal/speaker/recognizer.go` — `Recognizer` interface: `Identify(pcm []float32) (SpeakerID, confidence)`, `Enroll(id, pcm)`
-3. Create `internal/speaker/store.go` — speaker profile CRUD via `store.MemoryStore`: `Insert("speaker:<id>", embedding, meta)`, `Search(embedding, k)`
-4. Create `internal/speaker/enroll.go` — enrollment flow: capture N seconds of audio, extract embedding, prompt for name via TTS + STT round-trip
-5. Wire into `cmd/mavend/voice.go:HandlePushToTalk` — run speaker ID on the PCM before STT; pass speaker ID through `context.Context` to `applyAction`
-6. Tag all voice-written facts/notes with speaker ID — `Source` becomes `tap:voice:speaker:<id>` or metadata field
-7. Add IPC methods `MethodEnrollSpeaker`, `MethodListSpeakers`, `MethodRemoveSpeaker`
-8. Add speaker config block to `voice` in `config.Config` — `{speaker_recognition: true, model_path}`
-9. Test with 2+ recorded voice samples — verify correct identification and rejection of unknown speakers
+| Piece | Where | State |
+|---|---|---|
+| `Recognizer` — identify, list, get, forget | `internal/speaker/recognizer.go` | done; `Identify` answers `ErrDisabled` until a model exists |
+| Enrolment — several samples, averaged, re-normalised | `internal/speaker/enroll.go` | done |
+| Profile shape, id validation, cosine similarity | `internal/speaker/speaker.go` | done |
+| Profile storage as `speaker:<id>` vectors | `internal/memory` `Catalog` + `internal/store/memory.go` | done, no schema migration |
+| Config block, off by default | `internal/config` `SpeakerConfig` | done |
+| `enroll_speaker` / `list_speakers` / `forget_speaker` | `internal/ipc` | done, absent unless configured |
+| Authority rows | `internal/auth/policy.go` | done — enrol step-up, forget write, list read |
+| Daemon wiring + honest startup log | `cmd/mavend/speaker.go` | done |
+| Embedding backend | `newSpeakerEmbedder` | **BLOCKED** — returns nil, seam only |
+| Tagging voice writes with the speaker | `cmd/mavend/voice.go` | not wired; nothing to tag with yet |
+
+## Blocked, and on what
+
+A voiceprint needs a speaker-embedding model. The box was searched: `/mnt/hdd1/llms` holds
+sixteen ggufs across seven families and every one of them is a text model. There is no ECAPA,
+no x-vector, no titanet, no wespeaker, and no `.onnx` under `/mnt/hdd1` at all. There are also
+no enrolment samples, because nothing has ever recorded any.
+
+To unblock, two things are needed and neither can be done from inside the repo:
+
+1. **A model.** SpeechBrain ECAPA-TDNN exported to ONNX (`speechbrain/spkrec-ecapa-voxceleb`,
+   192-dim) is the usual choice and runs on CPU in well under a second for a few seconds of
+   audio. Download it per the recipe in `AGENTS.md`, put it beside the other models so the
+   bind mount picks it up, and point `speaker.model_path` at it.
+2. **An implementation of one function.** `newSpeakerEmbedder` in `cmd/mavend/speaker.go` is
+   the entire seam: give it an ONNX session that turns `audio.Audio` into a `[]float32` and
+   `Identify` starts working. Nothing else changes — not the store, not the protocol, not the
+   authority table, not the handlers. `internal/onnx` already loads the e5 embedder, so the
+   runtime wiring exists to copy.
+3. **Enrolment samples**, three or more per person, recorded deliberately.
+
+### Why there is no fallback
+
+The original plan offered "a simple MFCC + GMM" as the floor. That is refused. MFCC cosine
+distance is a channel and loudness detector as much as a voice detector: it will happily match
+two different people who sit at the same distance from the same microphone, and it drifts when
+the room changes. A general classifier that is sometimes wrong is a nuisance; a **biometric**
+that is confidently wrong writes false claims about named people into his memory, and then
+those claims get recalled as fact. For this capability a bad floor is worse than none, so the
+shipped state is honest absence: `speaker.Disabled`, `ErrDisabled`, and a startup line saying
+so.
+
+## The refusals, and why
+
+- **Unknown speakers are NOT enrolled on first interaction.** The plan's fourth "done when"
+  bullet asked for exactly that, with a TTS "кто это?" prompt. It is refused in
+  `enroll.go`'s doc comment and there is no request shape in the protocol that could express
+  it. Enrolling a voice is taking a biometric of a person; doing it automatically to whoever
+  walks past the microphone does it to guests who are not party to the exchange, and a
+  synthesised question into a room is not consent from whoever happens to answer. Enrolment is
+  an explicit act: an id, a name, and samples recorded for the purpose.
+- **One sample is not enough.** Three separate utterances and nine seconds minimum. A profile
+  built from one sentence encodes that sentence as much as the person, and the threshold then
+  behaves unpredictably against everything else.
+- **An unknown voice stays unknown.** Below threshold, `Identify` returns `ErrUnknown` naming
+  the closest profile in the error text for diagnosis, never as an answer. Guessing who is in
+  the room is how false memories about people get written.
+- **Deletion is one authority rung below enrolment.** Everywhere else in `policy.go` the
+  destructive direction is gated at least as hard as the constructive one. Here that would be
+  backwards: getting rid of a biometric must never be the harder half.
+- **The voiceprint never crosses the socket.** `ListSpeakersResp` carries ids, names, dates
+  and sample counts. The vector stays in core.
+- **Off unless configured.** No `speaker` block ⇒ the three methods answer
+  `ErrUnknownMethod`. There is no wire path on a default box that takes a voiceprint.
+
+## Storage
+
+Profiles live in the existing `memory_vectors` table under the `speaker:` id prefix, as the
+plan intended, so there is no migration. What that needed was a wider interface than
+`memory.Store`: `memory.Catalog` adds `ByPrefix` and `Delete`. `Delete` is the load-bearing
+one — a voiceprint someone asked to be rid of has to actually go, and a search-only store
+cannot do that. `InMemoryStore.Insert` also became an upsert by id, matching what the
+persistent store already did, so re-enrolling replaces a profile instead of stacking a second
+one behind the first.
+
+Profiles do not collide with note or fact vectors: they are only ever read through
+`ByPrefix("speaker:")`, and a note search never returns one because the prefix is not in its
+query path.
+
+## Config
+
+```json
+"speaker": {
+  "enabled": true,
+  "model_path": "/opt/maven/models/spk/ecapa-voxceleb.onnx",
+  "lib_path": "/opt/maven/lib",
+  "threshold": 0.7,
+  "min_seconds": 2.0
+}
+```
+
+`Recognizes()` requires both `enabled` and a `model_path`, so a half-filled block reads as off
+rather than as a capability that fails every turn. With `enabled` and no model the daemon still
+attaches the three methods — profiles can be created, listed and deleted — and logs that
+recognition is blocked.
+
+## Still open
+
+- The embedding backend (above). Everything below waits on it.
+- **Tagging voice writes.** `Profile.Source("tap:voice")` already produces
+  `tap:voice:speaker:kami`, which is the shape step 6 asked for, but nothing calls it yet:
+  with no recogniser there is no id to tag with. When the model lands, the hook is in the
+  voice path before STT.
+- **Speaker as router/phraser context.** Same dependency. Note the persona constraint when it
+  arrives: Maven addresses the owner informally and speaks to him, so "ok, <name>" needs care
+  for anyone who is not him.
+- **An enrolment surface.** The three IPC methods exist; no page drives them. Enrolment is
+  step-up, so it belongs on `/dash` behind a passkey, with a per-profile forget button next to
+  each row — that button is the reason `list_speakers` exists.
+- **A speaker column on the meeting recorder** (#253). Attributing lines in a transcript is
+  the obvious pairing, and it is the place where getting attribution wrong is most damaging,
+  so it waits for a real model too.

docs/plans/13-rss-news-feeds.md

@@ -27,3 +27,28 @@
 7. Add voice query handler — `"что нового?"` queries `RecentNotes` filtered by source prefix `rss:` and phrases via `phraser.PhraseQuery`
 8. Add `feeds` block to `config.Config` and `deploy/mavend.json`
 9. Test with a live RSS feed (e.g., `https://news.ycombinator.com/rss`) — verify items appear in notes table
+
+---
+
+## Shipped 2026-08-01 (#258)
+
+`internal/webfetch` (the guarded HTTP door: scheme, allow/deny hosts, private-address
+refusal in the dialer, size cap, redirect cap, per-host rate limit), `internal/rss`
+(RSS 2.0 + Atom parser, poller with durable marks and a keyword filter),
+`cmd/mavend/feeds.go` (ticker, fetcher adapter, `rss:latest:<feed>` fact marks),
+config block `feeds`, and the `feeds` query source with `router.ParseFeedQuery`.
+
+Deviations from the plan above, both deliberate:
+
+- **Step 5 (breaking-news nudges) was not built.** A feed that dispatches is a nag,
+  and the one thing Maven is not is a nag. Items are read when asked and nowhere else.
+  If breaking news is ever wanted, it belongs behind the existing delivery policy
+  (severity, quiet hours, digest), not in the poller.
+- **Step 3 (embedder relevance) is a seam, not an implementation.** `rss.Ranker`
+  exists and is wired nil. Scoring items against an "interest profile" needs a
+  profile, and there is none yet; a threshold with nothing to compare against is a
+  random filter with a confident name. The filter that runs is the per-feed
+  include/exclude keyword list, which he can read and predict.
+
+No new dependency: stdlib `encoding/xml`, no gofeed. Stock deploy config has no
+`feeds` block, so the capability is off.

docs/plans/14-web-crawler.md

@@ -28,3 +28,41 @@
 7. Add IPC methods `MethodTriggerCrawl(name)`, `MethodListCrawls`, `MethodGetCrawlResult(name)`
 8. Add `crawls` block to `config.Config` and `deploy/mavend.json`
 9. Test with a static HTML page — verify extraction matches expected values, verify scheduling fires correctly
+
+## Shipped 2026-08-01 (#259)
+
+Built as `internal/crawl` (pure: robots, extraction, watcher) plus
+`cmd/mavend/crawls.go` (fetcher, ticker, dedup facts), on top of the guarded
+`internal/webfetch` door added with the feed reader (#258). Off unless
+configured, in two separately-switched halves: `crawl.on_demand` for a URL he
+names, `crawl.watches` for a scheduled re-read.
+
+**Limits are code, not documentation** (`internal/webfetch`, tested one test per
+limit): host allowlist/denylist, no private addresses (loopback, RFC1918 —
+hence the LAN and the `10.42.0.0/24` wg range —, link-local incl. cloud
+metadata, CGNAT, v6 ULA) enforced in the dialer's `Control` hook so DNS
+rebinding and every redirect hop are covered, response size cap, redirect cap,
+timeout, one request per host per second. `robots.txt` is fetched first, cached
+per host, and a `Disallow` is refused with no override.
+
+Deliberate deviations from the plan above:
+
+- **No CSS selectors and no LLM structured extraction** (steps 2). The output is
+  plaintext handed to the phraser as context for the question he asked. A 1.7B
+  extracting a JSON price table from 4000 runes is a worse bet than reading, and
+  `goquery` is not vendored.
+- **No `crawl` act verb and no new IPC methods** (steps 5, 7). Reading a page is
+  a query source (`queryWeb` in `actions_query.go`, last in the chain, behind
+  Kiwix once that is wired), not an action he commands. Nothing needs a new wire
+  method to work.
+- **Notes, not facts.** A page's text is not a fact about him. Only the dedup
+  hash is a fact (`crawl:hash:<name>`, kind `config`, source `poll:crawl`).
+- **Nothing is dispatched.** A changed page writes a note; it does not nudge.
+  Not a nag.
+- **No `/tools` crawl history page.** The notes and the hash facts are already
+  visible on `/dash`.
+
+**No new dependency.** The vendored tree has no `x/net/html`, no `goquery` and
+no `temoto/robotstxt`, so robots parsing and HTML-to-text are stdlib
+(`regexp`, `html`) — RE2 has no backreferences, hence the `pairsRE` builder in
+`extract.go`.

internal/auth/auth_test.go

@@ -393,3 +393,82 @@ func mustWriteFactParams(source string) []byte {
 	}
 	return b
 }
+
+// TestRequirement_SwapModel — loading a different resident model is an owner
+// action at the same rung as mutating the tool allowlist: it decides how every
+// utterance is routed and how every reply is worded. The read side is not.
+func TestRequirement_SwapModel(t *testing.T) {
+	if got := Requirement(ipc.MethodSwapModel); got != AuthStepUp {
+		t.Errorf("SwapModel authority = %v; want AuthStepUp", got)
+	}
+	if got := Requirement(ipc.MethodModelStatus); got != AuthRead {
+		t.Errorf("ModelStatus authority = %v; want AuthRead", got)
+	}
+	// A surface that cannot carry a passkey gesture cannot swap the model, no
+	// matter what it is enrolled as — this is the "never through voice" property.
+	voice := Scope{Surface: SurfaceVoice, Module: "voice", SourceScope: []string{"*"}}
+	if err := Can(ipc.MethodSwapModel, voice, nil); !errors.Is(err, ErrForbidden) {
+		t.Errorf("voice swapping the model = %v; want ErrForbidden", err)
+	}
+	// And with no step-up session asserted, the gate refuses even a capable surface.
+	noSession := &Gate{Enrollment: NewFloorEnrollment()}
+	if err := noSession.Check(context.Background(), ipc.MethodSwapModel, nil); !errors.Is(err, ipc.ErrForbidden) {
+		t.Errorf("SwapModel with no asserted step-up = %v; want ErrForbidden", err)
+	}
+}
+
+// TestRequirement_Capture — recording other people is a write, not a read: it
+// puts audio of them on disk. The read side, "что ты записываешь?", is not.
+//
+// It is deliberately NOT AuthStepUp. Step-up needs a passkey gesture, which the
+// voice path cannot make, so putting it there would mean "запиши встречу" could
+// never work by voice. The real gate on this capability is that the methods do
+// not exist at all unless the operator enabled a capture block.
+func TestRequirement_Capture(t *testing.T) {
+	for _, m := range []ipc.Method{
+		ipc.MethodCaptureStart, ipc.MethodCaptureAppend, ipc.MethodCaptureStop,
+	} {
+		if got := Requirement(m); got != AuthWrite {
+			t.Errorf("%s authority = %v; want AuthWrite", m, got)
+		}
+	}
+	if got := Requirement(ipc.MethodCaptureStatus); got != AuthRead {
+		t.Errorf("CaptureStatus authority = %v; want AuthRead", got)
+	}
+	// Voice can start one: it is the surface he will actually use to say
+	// "запиши встречу", and it carries AuthWrite.
+	voice := Scope{Surface: SurfaceVoice, Module: "voice", SourceScope: []string{"*"}}
+	if err := Can(ipc.MethodCaptureStart, voice, nil); err != nil {
+		t.Errorf("voice starting a capture = %v; want allowed", err)
+	}
+}
+
+// TestRequirement_Speaker — a voiceprint is a biometric of a named person, so
+// taking one is step-up: a deliberate act from a surface that can carry a
+// passkey gesture, never something the voice path does mid-conversation.
+//
+// Deletion is one rung lower, and that asymmetry is the point. Everywhere else
+// in the table the destructive direction is gated at least as hard as the
+// constructive one; for a biometric that would be backwards, because getting
+// rid of it must never be the harder half.
+func TestRequirement_Speaker(t *testing.T) {
+	if got := Requirement(ipc.MethodEnrollSpeaker); got != AuthStepUp {
+		t.Errorf("EnrollSpeaker authority = %v; want AuthStepUp", got)
+	}
+	if got := Requirement(ipc.MethodForgetSpeaker); got != AuthWrite {
+		t.Errorf("ForgetSpeaker authority = %v; want AuthWrite", got)
+	}
+	if got := Requirement(ipc.MethodListSpeakers); got != AuthRead {
+		t.Errorf("ListSpeakers authority = %v; want AuthRead", got)
+	}
+	// Voice cannot enrol anybody, however the utterance is phrased.
+	voice := Scope{Surface: SurfaceVoice, Module: "voice", SourceScope: []string{"*"}}
+	if err := Can(ipc.MethodEnrollSpeaker, voice, nil); err == nil {
+		t.Error("voice enrolling a speaker was allowed; want refused")
+	}
+	// But it can read the roster, which is what answering "кого ты знаешь?"
+	// needs.
+	if err := Can(ipc.MethodListSpeakers, voice, nil); err != nil {
+		t.Errorf("voice listing speakers = %v; want allowed", err)
+	}
+}

internal/auth/policy.go

@@ -53,6 +53,44 @@ func Requirement(m ipc.Method) Authority {
 		// asserted — never a module or the voice/chat path. maven can propose
 		// (MethodProposeTool, no step-up: she has no passkey) but never en/disable.
 		return AuthStepUp
+	case ipc.MethodSwapModel:
+		// Swapping the resident model changes what routes every utterance and
+		// what words every reply. It is the owner's call, from a surface that can
+		// carry a passkey gesture — the same rung as mutating the tool allowlist,
+		// and for the same reason: nothing Maven says or does may reach it.
+		// MethodModelStatus is only the read side, so it stays at AuthRead.
+		return AuthStepUp
+	case ipc.MethodCaptureStart, ipc.MethodCaptureAppend, ipc.MethodCaptureStop:
+		// Recording a meeting (Vikunja #253). AuthWrite, not AuthRead: it puts
+		// audio of other people on disk, which is a heavier thing than reading a
+		// fact, and it is not something a read-only surface should be able to
+		// begin. Append and Stop sit on the same rung as Start deliberately —
+		// a surface that may not start a recording has no business feeding or
+		// harvesting one either.
+		//
+		// Not AuthStepUp, and this is the interesting line: step-up needs a
+		// passkey gesture, which the voice path cannot make. Putting it here
+		// would mean "запиши встречу" could never work by voice, and the real
+		// gate on this capability is elsewhere and stronger — the methods do not
+		// exist at all unless the operator enabled a capture block, and no
+		// recording can begin without someone saying so.
+		return AuthWrite
+	case ipc.MethodEnrollSpeaker:
+		// Taking a voiceprint (Vikunja #255). AuthStepUp, and unlike recording a
+		// meeting there is no reason to soften it: enrolment is not a thing anyone
+		// does by voice mid-conversation. It is a deliberate sit-down with a
+		// surface that can carry a passkey gesture, and it writes a biometric of a
+		// named person. If the gesture is inconvenient, that is the correct amount
+		// of friction for this particular write.
+		return AuthStepUp
+	case ipc.MethodForgetSpeaker:
+		// Deleting a voiceprint. One rung BELOW enrolment on purpose. Everywhere
+		// else in this table the destructive direction is gated at least as hard
+		// as the constructive one, and here that would be wrong: getting rid of a
+		// biometric must never be the harder half. The worst a caller at this rung
+		// can do is make Maven stop recognising someone, which is the state the
+		// box ships in anyway.
+		return AuthWrite
 	case ipc.MethodWriteFact:
 		return AuthWrite
 	case ipc.MethodAssertStepUp:
@@ -65,7 +103,39 @@ func Requirement(m ipc.Method) Authority {
 		ipc.MethodCreateReminder,
 		ipc.MethodMarkReminder,
 		ipc.MethodRecordNudge,
-		ipc.MethodResolveNudge:
+		ipc.MethodResolveNudge,
+		// Task capture (Vikunja #130). Listed explicitly rather than left to
+		// the default so the intent is on the record: capturing a task is a
+		// module write, not an allowlist mutation and not a new standing reason
+		// for Maven to speak — nothing in the tick loop reads tasks. It stays
+		// at AuthRead, the same rung as CreateReminder, which is the closest
+		// existing analogue.
+		ipc.MethodCaptureTask,
+		ipc.MethodListTasks,
+		ipc.MethodSetTaskStatus,
+		// Mail ingestion (Vikunja #246). AuthRead because of what the method can
+		// produce: candidate tasks and nothing else. It cannot write a fact, set a
+		// reminder, or touch the tool allowlist, so a compromised mail reader can
+		// at worst put junk on a review page he clears in one click.
+		ipc.MethodIngestMail,
+		// Looking at one image (Vikunja #252). AuthRead because of what it can
+		// produce: words about a picture, and optionally a note. It cannot write
+		// a fact, set a reminder, or touch the tool allowlist. The invasive part
+		// of this capability is not the authority rung — it is that the bytes are
+		// kept on disk, which media.retention bounds, and that they never leave
+		// the box, which internal/vision enforces by refusing a non-private
+		// endpoint.
+		ipc.MethodDescribeImage,
+		// "что ты записываешь?" — the read side of the recorder. It reports a
+		// label, a start time and a byte count, begins nothing and keeps nothing.
+		ipc.MethodCaptureStatus,
+		// Who is enrolled. Returns ids, names and enrolment dates — never the
+		// voiceprints themselves, which stay in core. Listing the people Maven can
+		// recognise is exactly the read a surface needs to offer a "forget" button.
+		ipc.MethodListSpeakers,
+		// The read side of the model swap: which model is resident, which ones are
+		// allowlisted. It loads nothing and changes nothing.
+		ipc.MethodModelStatus:
 		return AuthRead
 	}
 	// Unknown method ⇒ AuthRead, but ipc.dispatch returns ErrUnknownMethod

internal/calendar/ambient.go

@@ -0,0 +1,221 @@
+package calendar
+
+import (
+	"strings"
+	"time"
+	"unicode"
+)
+
+// Ambient events — the work calendar read (Vikunja #126).
+//
+// The work calendar is not read by holding a work credential. A corp mail or
+// calendar session living on the homelab ties the box's blast radius to the
+// employer's data, which is the thing the task exists to refuse. What maven
+// reads instead is the SIGNAL: an Android notification-listener on the owner's
+// phone relays meeting notifications over wg/LAN, and maven turns the ones that
+// clearly describe a meeting into calendar events.
+//
+// That makes the provenance honest. A notification is evidence about an event,
+// not a reading of the calendar, so it is stored under SourceAmbient at
+// AmbientConfidence — never indistinguishable from a real CalDAV read, and the
+// query path hedges when it recites one.
+//
+// The parse is deliberately conservative. A notification with no recognisable
+// clock reading produces nothing at all: maven is not a guesser-of-truth, and a
+// mailbox full of noise turned into invented events is worse than a gap. Mail
+// as a notification signal, not a mailbox.
+
+// Notification — one relayed Android notification. Package is the posting app
+// (for the log and for the owner to see where a wrong event came from), Title
+// and Text are the notification's two text lines, Posted is when the phone
+// showed it. Nothing else off the notification is kept.
+type Notification struct {
+	Package string    `json:"package"`
+	Title   string    `json:"title"`
+	Text    string    `json:"text"`
+	Posted  time.Time `json:"posted_at"`
+}
+
+// EventFromNotification turns a notification into the event it describes, or
+// reports false when it does not clearly describe one.
+//
+// It needs two things: a clock reading, and a summary that is not just that
+// clock reading. Everything else is defaulted — the date is Posted's day (a
+// meeting notification is about today or it would not be firing now), and a
+// bare start time gets DefaultReminderDuration.
+func EventFromNotification(n Notification) (Event, bool) {
+	if n.Posted.IsZero() {
+		return Event{}, false
+	}
+	line := strings.TrimSpace(n.Title + " " + n.Text)
+	start, end, ok := parseTimeRange(line)
+	if !ok {
+		return Event{}, false
+	}
+	summary := notificationSummary(n)
+	if summary == "" {
+		return Event{}, false
+	}
+
+	y, m, d := n.Posted.Date()
+	loc := n.Posted.Location()
+	s := time.Date(y, m, d, start.hour, start.min, 0, 0, loc)
+	var e time.Time
+	if end != nil {
+		e = time.Date(y, m, d, end.hour, end.min, 0, 0, loc)
+		// A range that ends before it starts crossed midnight.
+		if !e.After(s) {
+			e = e.AddDate(0, 0, 1)
+		}
+	} else {
+		e = s.Add(DefaultReminderDuration)
+	}
+	return Event{Summary: summary, Start: s, End: e}, true
+}
+
+// notificationSummary picks the text that names the meeting: the title when it
+// carries words, otherwise the body. The clock reading is stripped out — it
+// already lives in the times, and FactValue renders it again.
+func notificationSummary(n Notification) string {
+	for _, cand := range []string{n.Title, n.Text} {
+		s := strings.TrimSpace(stripClock(cand))
+		s = strings.Trim(s, " \t-–—,;:@|·")
+		s = strings.Join(strings.Fields(s), " ")
+		if hasLetters(s) {
+			return s
+		}
+	}
+	return ""
+}
+
+type clock struct{ hour, min int }
+
+// parseTimeRange finds the first clock reading in s, and a second one if the
+// text spells a range. Accepted separators between hours and minutes are ":"
+// and "."; between the two ends of a range, "-", "–", "—" or "до".
+//
+// Bare hours ("в 14") are NOT accepted. Loose digits in a notification are far
+// more often a count, a date or an unread badge than a meeting time, and an
+// invented event is worse than no event.
+func parseTimeRange(s string) (start clock, end *clock, ok bool) {
+	first, _, firstEnd, ok := nextClock(s, 0)
+	if !ok {
+		return clock{}, nil, false
+	}
+	sep := strings.TrimLeft(s[firstEnd:], " \t")
+	for _, p := range []string{"-", "–", "—", "до "} {
+		if !strings.HasPrefix(sep, p) {
+			continue
+		}
+		if second, _, _, ok2 := nextClock(strings.TrimPrefix(sep, p), 0); ok2 {
+			return first, &second, true
+		}
+		break
+	}
+	return first, nil, true
+}
+
+// nextClock scans s from byte offset `from` for the first HH:MM (or HH.MM) and
+// returns it with the byte range it occupied. Digits and separators are ASCII,
+// so byte offsets are safe over Cyrillic text.
+func nextClock(s string, from int) (c clock, start, end int, ok bool) {
+	for i := from; i < len(s); i++ {
+		if !isDigit(s[i]) {
+			continue
+		}
+		j := i
+		for j < len(s) && isDigit(s[j]) {
+			j++
+		}
+		// A run longer than two digits is a year, an id or an unread count.
+		if j-i > 2 {
+			i = j
+			continue
+		}
+		if j >= len(s) || (s[j] != ':' && s[j] != '.') {
+			i = j
+			continue
+		}
+		k := j + 1
+		for k < len(s) && isDigit(s[k]) {
+			k++
+		}
+		if k-(j+1) != 2 {
+			i = j
+			continue
+		}
+		// Reject a group that is a link in a longer dotted or colon chain:
+		// "2026.08.15" would otherwise offer "08.15" as 08:15, and a deadline
+		// date invented as a meeting time is exactly the wrong kind of guess.
+		// A trailing ":ss" is fine — that is a time with seconds.
+		if i > 0 && (s[i-1] == '.' || s[i-1] == ':' || isDigit(s[i-1])) {
+			i = k
+			continue
+		}
+		if k < len(s) && s[k] == '.' && k+1 < len(s) && isDigit(s[k+1]) {
+			i = k
+			continue
+		}
+		hour, min := atoi(s[i:j]), atoi(s[j+1:k])
+		if hour > 23 || min > 59 {
+			i = k
+			continue
+		}
+		return clock{hour, min}, i, k, true
+	}
+	return clock{}, 0, 0, false
+}
+
+func isDigit(b byte) bool { return b >= '0' && b <= '9' }
+
+func atoi(s string) int {
+	n := 0
+	for i := 0; i < len(s); i++ {
+		n = n*10 + int(s[i]-'0')
+	}
+	return n
+}
+
+// stripClock removes every clock reading from a summary candidate, along with
+// the preposition or separator that introduced it.
+func stripClock(s string) string {
+	for {
+		_, start, end, ok := nextClock(s, 0)
+		if !ok {
+			return s
+		}
+		head := trimTrailingPreposition(strings.TrimRight(s[:start], "0123456789:.-–— \t"))
+		s = strings.TrimSpace(strings.TrimSpace(head) + " " + strings.TrimSpace(s[end:]))
+	}
+}
+
+// trimTrailingPreposition drops the word that introduced a clock reading, so
+// "Встреча в 14:00" becomes "Встреча" and "с 11:30 до 12:15 Созвон" does not
+// keep a dangling "с". It repeats, because a range has two of them.
+func trimTrailingPreposition(s string) string {
+	preps := []string{"в", "с", "до", "от", "at", "from", "to"}
+	for again := true; again; {
+		again = false
+		s = strings.TrimRight(s, " \t")
+		for _, p := range preps {
+			if s == p {
+				return ""
+			}
+			if strings.HasSuffix(s, " "+p) {
+				s = s[:len(s)-len(p)-1]
+				again = true
+				break
+			}
+		}
+	}
+	return s
+}
+
+func hasLetters(s string) bool {
+	for _, r := range s {
+		if unicode.IsLetter(r) {
+			return true
+		}
+	}
+	return false
+}

internal/calendar/ambient_test.go

@@ -0,0 +1,148 @@
+package calendar
+
+import (
+	"testing"
+	"time"
+)
+
+func TestEventFromNotification(t *testing.T) {
+	posted := time.Date(2026, 8, 3, 9, 40, 0, 0, time.FixedZone("+04", 4*3600))
+
+	tests := []struct {
+		name        string
+		title, text string
+		wantOK      bool
+		wantSummary string
+		wantStart   string // "15:04"
+		wantEnd     string
+	}{
+		{
+			name:        "range in the body",
+			title:       "Планёрка",
+			text:        "10:00-10:30",
+			wantOK:      true,
+			wantSummary: "Планёрка",
+			wantStart:   "10:00", wantEnd: "10:30",
+		},
+		{
+			name:        "russian preposition and single time",
+			title:       "Встреча с подрядчиком в 14:00",
+			wantOK:      true,
+			wantSummary: "Встреча с подрядчиком",
+			wantStart:   "14:00", wantEnd: "14:30",
+		},
+		{
+			name:        "en dash range",
+			title:       "Sprint review",
+			text:        "Today 16:00 – 17:00, Meet",
+			wantOK:      true,
+			wantSummary: "Sprint review",
+			wantStart:   "16:00", wantEnd: "17:00",
+		},
+		{
+			name:        "до as a range separator",
+			title:       "Созвон",
+			text:        "с 11:30 до 12:15",
+			wantOK:      true,
+			wantSummary: "Созвон",
+			wantStart:   "11:30", wantEnd: "12:15",
+		},
+		{
+			name:        "dotted clock",
+			title:       "Обед 13.00",
+			wantOK:      true,
+			wantSummary: "Обед",
+			wantStart:   "13:00", wantEnd: "13:30",
+		},
+		{
+			name:        "range crossing midnight",
+			title:       "Ночной релиз",
+			text:        "23:30-00:30",
+			wantOK:      true,
+			wantSummary: "Ночной релиз",
+			wantStart:   "23:30", wantEnd: "00:30",
+		},
+		// The conservative half: no clock reading, no event.
+		{name: "no time at all", title: "3 новых письма", wantOK: false},
+		{name: "bare hour is not a time", title: "Планёрка в 14", wantOK: false},
+		{name: "unread count", title: "Входящие", text: "12 непрочитанных", wantOK: false},
+		{name: "a date is not a clock", title: "Отчёт", text: "срок 2026.08.15", wantOK: false},
+		{name: "time but nothing named", title: "10:00-10:30", wantOK: false},
+		{name: "impossible clock", title: "Смена 99:99", wantOK: false},
+		{name: "empty", wantOK: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ev, ok := EventFromNotification(Notification{
+				Package: "com.google.android.gm",
+				Title:   tt.title,
+				Text:    tt.text,
+				Posted:  posted,
+			})
+			if ok != tt.wantOK {
+				t.Fatalf("ok = %v, want %v (event %+v)", ok, tt.wantOK, ev)
+			}
+			if !ok {
+				return
+			}
+			if ev.Summary != tt.wantSummary {
+				t.Errorf("summary = %q, want %q", ev.Summary, tt.wantSummary)
+			}
+			if got := ev.Start.Format("15:04"); got != tt.wantStart {
+				t.Errorf("start = %s, want %s", got, tt.wantStart)
+			}
+			if got := ev.End.Format("15:04"); got != tt.wantEnd {
+				t.Errorf("end = %s, want %s", got, tt.wantEnd)
+			}
+			if !ev.End.After(ev.Start) {
+				t.Errorf("end %v must be after start %v", ev.End, ev.Start)
+			}
+			// The event lands on the day the phone showed it, in the phone's
+			// location — not shifted into UTC.
+			if ev.Start.Location() != posted.Location() {
+				t.Errorf("location = %v, want %v", ev.Start.Location(), posted.Location())
+			}
+			if y, m, d := ev.Start.Date(); y != 2026 || m != time.August || d != 3 {
+				t.Errorf("date = %d-%02d-%02d, want 2026-08-03", y, m, d)
+			}
+		})
+	}
+}
+
+func TestEventFromNotificationNeedsPostedAt(t *testing.T) {
+	if _, ok := EventFromNotification(Notification{Title: "Планёрка 10:00"}); ok {
+		t.Error("a notification with no posted_at has no date to sit on")
+	}
+}
+
+// An ambient event must never be indistinguishable from a calendar read.
+func TestAmbientEventsAreStoredAtReducedConfidence(t *testing.T) {
+	ev, ok := EventFromNotification(Notification{
+		Title:  "Планёрка 10:00-10:30",
+		Posted: time.Date(2026, 8, 3, 9, 0, 0, 0, time.UTC),
+	})
+	if !ok {
+		t.Fatal("expected an event")
+	}
+	if FactKey(ev) == "" || FactValue(ev) == "" {
+		t.Fatal("ambient events must use the shared fact encoding")
+	}
+	if AmbientConfidence >= 1.0 {
+		t.Fatal("ambient confidence must be below a calendar read's")
+	}
+}
+
+func TestStripClock(t *testing.T) {
+	tests := []struct{ in, want string }{
+		{"Встреча в 14:00", "Встреча"},
+		{"Планёрка 10:00-10:30", "Планёрка"},
+		{"с 11:30 до 12:15 Созвон", "Созвон"},
+		{"Ничего", "Ничего"},
+	}
+	for _, tt := range tests {
+		if got := stripClock(tt.in); got != tt.want {
+			t.Errorf("stripClock(%q) = %q, want %q", tt.in, got, tt.want)
+		}
+	}
+}

internal/calendar/calendar.go

@@ -0,0 +1,129 @@
+// Package calendar is the one calendar data model the rest of maven shares:
+// an Event, the iCal text it is parsed from and rendered to, and the fact
+// encoding that puts it in the store.
+//
+// It exists because three separate features read or write the same events and
+// must agree on their shape: the CalDAV read side (cmd/mavcaldav, Vikunja
+// #126/#127), the write-only render target that publishes maven's own
+// reminders as a calendar (#127), and the day plan that recites them (#128).
+// Before this package the parse lived inline in cmd/mavcaldav and the fact key
+// format was a Sprintf in two places.
+//
+// The package is pure: no HTTP, no store, no clock of its own. Callers own the
+// impurity, the way internal/morning and internal/loop do.
+package calendar
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+	"time"
+)
+
+// Fact sources. A calendar event reaches the store as a
+// `facts (kind=env, key=calendar_event_..., source=<one of these>)` row, and
+// the source is the whole provenance story:
+//
+//   - SourcePersonal — maven's own Radicale, read AND rendered to. Canonical
+//     state stays in sqlite; the calendar is a render target (#127).
+//   - SourceWork — a work calendar, read-only by definition (#126). Nothing in
+//     maven ever writes to it: no code path pairs this source with a PUT.
+//   - SourceAmbient — inferred from an Android notification-listener relay
+//     rather than read from a server (#126). Confidence is below 1.0 because a
+//     notification is a signal about an event, not the event.
+const (
+	SourcePersonal = "poll:caldav"
+	SourceWork     = "poll:caldav:work"
+	SourceAmbient  = "ambient:notif"
+)
+
+// AmbientConfidence — the confidence a notification-derived event is stored
+// with. A parsed notification line is evidence, not a reading of the calendar,
+// so it must never be indistinguishable from one (#126).
+const AmbientConfidence = 0.6
+
+// Sources lists every source a calendar event may legitimately carry, for the
+// store query that reads the calendar back out. Ordered from most to least
+// trusted.
+func Sources() []string {
+	return []string{SourcePersonal, SourceWork, SourceAmbient}
+}
+
+// ReadOnlySource reports whether events from this source may never be written
+// back. The work calendar is read-only by definition — see #126: maven holding
+// a credential that can write to an employer's calendar is the thing the task
+// exists to avoid.
+func ReadOnlySource(source string) bool {
+	return source == SourceWork || source == SourceAmbient
+}
+
+// Event — one calendar entry. UID is the iCal UID when the event was parsed
+// from a server and the identity maven renders under when it publishes one;
+// Start/End are instants. All-day events are not modelled: the busy gate and
+// the day plan both need a time of day, and an all-day marker answers neither.
+type Event struct {
+	UID     string
+	Summary string
+	Start   time.Time
+	End     time.Time
+}
+
+// FactKey is the store key for an event: one key per day per summary, stable
+// across polls so re-reading an unchanged calendar rewrites nothing.
+//
+// The date prefix is load-bearing — store.CalendarEvents selects a day range
+// by key prefix, not by a timestamp column.
+func FactKey(e Event) string {
+	return fmt.Sprintf("calendar_event_%s_%s", e.Start.Format("20060102"), safeKey(e.Summary))
+}
+
+// FactValue is the human-readable rendering stored as the fact value, and the
+// string the day plan and the query path read back.
+func FactValue(e Event) string {
+	return fmt.Sprintf("%s @ %s-%s", e.Summary, e.Start.Format("15:04"), e.End.Format("15:04"))
+}
+
+// KeyPrefixForDay is the fact-key prefix covering one calendar day. The store
+// range-scans between two of these.
+func KeyPrefixForDay(day time.Time) string {
+	return fmt.Sprintf("calendar_event_%s", day.Format("20060102"))
+}
+
+// Busy reports whether any event covers the instant now — the read the loop
+// gate uses to suppress nudges during a meeting.
+func Busy(events []Event, now time.Time) bool {
+	for _, e := range events {
+		if !now.Before(e.Start) && now.Before(e.End) {
+			return true
+		}
+	}
+	return false
+}
+
+// Overlapping returns the events intersecting [from, to), sorted by start.
+func Overlapping(events []Event, from, to time.Time) []Event {
+	var out []Event
+	for _, e := range events {
+		if e.End.After(from) && e.Start.Before(to) {
+			out = append(out, e)
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Start.Before(out[j].Start) })
+	return out
+}
+
+// safeKey makes a summary safe to use inside a fact key (ASCII alphanumerics
+// and dashes). Non-Latin summaries collapse to their punctuation, which is why
+// the day prefix carries the identity and this only disambiguates within a day.
+func safeKey(s string) string {
+	var b strings.Builder
+	for _, r := range s {
+		switch {
+		case (r >= 'a' && r <= 'z') || (r >= 'A' && r <= 'Z') || (r >= '0' && r <= '9') || r == '-':
+			b.WriteRune(r)
+		case r == ' ' || r == '_':
+			b.WriteRune('-')
+		}
+	}
+	return b.String()
+}

internal/calendar/calendar_test.go

@@ -0,0 +1,202 @@
+package calendar
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestParseICalDayKeepsOnlyToday(t *testing.T) {
+	now := time.Date(2026, 7, 3, 12, 0, 0, 0, time.UTC)
+
+	body := []byte(`BEGIN:VCALENDAR
+BEGIN:VEVENT
+UID:a@example
+DTSTART:20260703T090000Z
+DTEND:20260703T100000Z
+SUMMARY:Morning standup
+END:VEVENT
+BEGIN:VEVENT
+DTSTART:20260703T140000Z
+DTEND:20260703T150000Z
+SUMMARY:Team sync
+END:VEVENT
+BEGIN:VEVENT
+DTSTART:20260702T140000Z
+DTEND:20260702T150000Z
+SUMMARY:Yesterday retro
+END:VEVENT
+BEGIN:VEVENT
+DTSTART:20260704T090000Z
+DTEND:20260704T100000Z
+SUMMARY:Tomorrow standup
+END:VEVENT
+BEGIN:VEVENT
+DTSTART;VALUE=DATE:20260704
+DTEND;VALUE=DATE:20260705
+SUMMARY:All-day event
+END:VEVENT
+END:VCALENDAR`)
+
+	events := ParseICalDay(body, now)
+	if len(events) != 2 {
+		t.Fatalf("got %d events, want 2 (today only, no all-day/past/future)", len(events))
+	}
+	if events[0].Summary != "Morning standup" || events[0].UID != "a@example" {
+		t.Errorf("events[0] = %+v", events[0])
+	}
+	if !events[0].Start.Equal(time.Date(2026, 7, 3, 9, 0, 0, 0, time.UTC)) {
+		t.Errorf("events[0].Start = %v", events[0].Start)
+	}
+	if !events[0].End.Equal(time.Date(2026, 7, 3, 10, 0, 0, 0, time.UTC)) {
+		t.Errorf("events[0].End = %v", events[0].End)
+	}
+	if events[1].Summary != "Team sync" {
+		t.Errorf("events[1].Summary = %q", events[1].Summary)
+	}
+}
+
+// Regression: "today" is the owner's day, in the owner's location. Taking the
+// day number off a local clock but building the boundaries in UTC made the
+// evening fall outside the window on any box east of Greenwich.
+func TestParseICalDayUsesOwnersDay(t *testing.T) {
+	plus4 := time.FixedZone("+04", 4*60*60)
+	// 01:00 on Aug 1 local is 21:00 on Jul 31 UTC.
+	now := time.Date(2026, 8, 1, 1, 0, 0, 0, plus4)
+	body := []byte("BEGIN:VCALENDAR\nBEGIN:VEVENT\n" +
+		"DTSTART:20260731T195406Z\nDTEND:20260731T235406Z\nSUMMARY:Current meeting\n" +
+		"END:VEVENT\nEND:VCALENDAR")
+
+	events := ParseICalDay(body, now)
+	if len(events) != 1 {
+		t.Fatalf("got %d events, want the in-progress one", len(events))
+	}
+	if !Busy(events, now.UTC()) {
+		t.Error("an event in progress right now must read as busy")
+	}
+}
+
+func TestParseVEVENT(t *testing.T) {
+	block := "DTSTART;TZID=Europe/Moscow:20260703T130000\nDTEND:20260703T140000Z\nSUMMARY:Stand up meeting"
+	e, ok := parseVEVENT(block)
+	if !ok {
+		t.Fatal("expected a parsed event")
+	}
+	if !e.Start.Equal(time.Date(2026, 7, 3, 13, 0, 0, 0, time.UTC)) {
+		t.Errorf("start = %v", e.Start)
+	}
+	if !e.End.Equal(time.Date(2026, 7, 3, 14, 0, 0, 0, time.UTC)) {
+		t.Errorf("end = %v", e.End)
+	}
+	if e.Summary != "Stand up meeting" {
+		t.Errorf("summary = %q", e.Summary)
+	}
+
+	allDay := "DTSTART;VALUE=DATE:20260703\nDTEND;VALUE=DATE:20260704\nSUMMARY:All-day"
+	if _, ok := parseVEVENT(allDay); ok {
+		t.Error("all-day event should be rejected")
+	}
+}
+
+func TestParseDT(t *testing.T) {
+	tests := []struct {
+		name   string
+		line   string
+		want   time.Time
+		wantOK bool
+	}{
+		{"UTC", "DTEND:20260703T100000Z", time.Date(2026, 7, 3, 10, 0, 0, 0, time.UTC), true},
+		{"local", "DTSTART;TZID=Europe/Moscow:20260703T130000", time.Date(2026, 7, 3, 13, 0, 0, 0, time.UTC), true},
+		{"all-day", "DTSTART;VALUE=DATE:20260703", time.Time{}, false},
+		{"garbage", "DTSTART:garbage", time.Time{}, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, ok := parseDT(tt.line)
+			if ok != tt.wantOK {
+				t.Errorf("ok = %v, want %v", ok, tt.wantOK)
+			}
+			if !got.Equal(tt.want) {
+				t.Errorf("got %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestSafeKey(t *testing.T) {
+	tests := []struct{ in, want string }{
+		{"Stand up meeting", "Stand-up-meeting"},
+		{"Hello_World", "Hello-World"},
+		{"special@#$chars!!", "specialchars"},
+		{"ALL_CAPS_123", "ALL-CAPS-123"},
+	}
+	for _, tt := range tests {
+		if got := safeKey(tt.in); got != tt.want {
+			t.Errorf("safeKey(%q) = %q, want %q", tt.in, got, tt.want)
+		}
+	}
+}
+
+func TestFactKeyAndValue(t *testing.T) {
+	e := Event{
+		Summary: "Team sync",
+		Start:   time.Date(2026, 7, 3, 14, 0, 0, 0, time.UTC),
+		End:     time.Date(2026, 7, 3, 15, 0, 0, 0, time.UTC),
+	}
+	if got, want := FactKey(e), "calendar_event_20260703_Team-sync"; got != want {
+		t.Errorf("FactKey = %q, want %q", got, want)
+	}
+	if got, want := FactValue(e), "Team sync @ 14:00-15:00"; got != want {
+		t.Errorf("FactValue = %q, want %q", got, want)
+	}
+	if got, want := KeyPrefixForDay(e.Start), "calendar_event_20260703"; got != want {
+		t.Errorf("KeyPrefixForDay = %q, want %q", got, want)
+	}
+	if !strings.HasPrefix(FactKey(e), KeyPrefixForDay(e.Start)) {
+		t.Error("FactKey must start with the day prefix the store range-scans on")
+	}
+}
+
+func TestBusyAndOverlapping(t *testing.T) {
+	base := time.Date(2026, 7, 3, 0, 0, 0, 0, time.UTC)
+	events := []Event{
+		{Summary: "late", Start: base.Add(15 * time.Hour), End: base.Add(16 * time.Hour)},
+		{Summary: "early", Start: base.Add(9 * time.Hour), End: base.Add(10 * time.Hour)},
+	}
+	if !Busy(events, base.Add(9*time.Hour+30*time.Minute)) {
+		t.Error("should be busy inside the early event")
+	}
+	if Busy(events, base.Add(12*time.Hour)) {
+		t.Error("should be free at noon")
+	}
+	// Half-open: the end instant is free.
+	if Busy(events, base.Add(10*time.Hour)) {
+		t.Error("the end instant should not count as busy")
+	}
+	got := Overlapping(events, base.Add(8*time.Hour), base.Add(11*time.Hour))
+	if len(got) != 1 || got[0].Summary != "early" {
+		t.Fatalf("Overlapping = %+v", got)
+	}
+	all := Overlapping(events, base, base.AddDate(0, 0, 1))
+	if len(all) != 2 || all[0].Summary != "early" {
+		t.Fatalf("Overlapping must sort by start: %+v", all)
+	}
+}
+
+func TestSourceTrust(t *testing.T) {
+	if ReadOnlySource(SourcePersonal) {
+		t.Error("the personal calendar is the one maven may render to")
+	}
+	if !ReadOnlySource(SourceWork) {
+		t.Error("the work calendar must be read-only")
+	}
+	if !ReadOnlySource(SourceAmbient) {
+		t.Error("an ambient notification is not a writable calendar")
+	}
+	if AmbientConfidence >= 1.0 {
+		t.Error("ambient events must be less trusted than a calendar read")
+	}
+	if len(Sources()) != 3 {
+		t.Errorf("Sources() = %v", Sources())
+	}
+}

internal/calendar/ical.go

@@ -0,0 +1,145 @@
+package calendar
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+// ParseICal scans iCal text for VEVENT components and returns the events
+// overlapping [from, to). All-day events are skipped: parseDT reports no time
+// for a VALUE=DATE value, and an event with no clock reading answers neither
+// the busy gate nor the day plan.
+func ParseICal(body []byte, from, to time.Time) []Event {
+	var events []Event
+	text := string(body)
+	for {
+		i := strings.Index(text, "BEGIN:VEVENT")
+		if i < 0 {
+			break
+		}
+		text = text[i+len("BEGIN:VEVENT"):]
+		j := strings.Index(text, "END:VEVENT")
+		if j < 0 {
+			break
+		}
+		block := text[:j]
+		text = text[j+len("END:VEVENT"):]
+
+		e, ok := parseVEVENT(block)
+		if !ok {
+			continue
+		}
+		if e.End.After(from) && e.Start.Before(to) {
+			events = append(events, e)
+		}
+	}
+	return events
+}
+
+// ParseICalDay is ParseICal over the calendar day containing now, in now's own
+// location — the window cmd/mavcaldav polls.
+//
+// The location matters. The old inline version took the day number off a local
+// clock reading but built the boundaries in UTC, so east of Greenwich the
+// window was shifted by the offset and part of the evening fell outside
+// "today": on a +04 box after 20:00 UTC the poller saw an empty calendar. The
+// owner's day is the day the day plan and the busy gate mean.
+func ParseICalDay(body []byte, now time.Time) []Event {
+	y, m, d := now.Date()
+	start := time.Date(y, m, d, 0, 0, 0, 0, now.Location())
+	return ParseICal(body, start, start.AddDate(0, 0, 1))
+}
+
+// parseVEVENT extracts UID, start, end and summary from a VEVENT block.
+// Reports false for all-day events and parse failures.
+func parseVEVENT(block string) (Event, bool) {
+	var e Event
+	for _, line := range strings.Split(block, "\n") {
+		line = strings.TrimSpace(line)
+		switch {
+		case strings.HasPrefix(line, "DTSTART"):
+			if t, ok := parseDT(line); ok {
+				e.Start = t
+			}
+		case strings.HasPrefix(line, "DTEND"):
+			if t, ok := parseDT(line); ok {
+				e.End = t
+			}
+		case strings.HasPrefix(line, "SUMMARY"):
+			e.Summary = afterColon(line)
+		case strings.HasPrefix(line, "UID"):
+			e.UID = afterColon(line)
+		}
+	}
+	if e.Start.IsZero() || e.End.IsZero() {
+		return Event{}, false
+	}
+	return e, true
+}
+
+func afterColon(line string) string {
+	if i := strings.Index(line, ":"); i >= 0 {
+		return strings.TrimSpace(line[i+1:])
+	}
+	return ""
+}
+
+// parseDT parses a DTSTART/DTEND value:
+//
+//   - UTC:      DTEND:20260703T100000Z
+//   - Local:    DTSTART;TZID=Europe/Moscow:20260703T130000
+//   - All-day:  DTSTART;VALUE=DATE:20260703  (rejected)
+//
+// A local time is read as UTC, the behaviour cmd/mavcaldav has always had: the
+// CalDAV server and the poller run in the same timezone, and the busy gate only
+// needs busy/not-busy to be right.
+func parseDT(line string) (time.Time, bool) {
+	if strings.Contains(line, "VALUE=DATE:") {
+		return time.Time{}, false
+	}
+	i := strings.LastIndex(line, ":")
+	if i < 0 {
+		return time.Time{}, false
+	}
+	val := strings.TrimSuffix(strings.TrimSpace(line[i+1:]), "Z")
+	t, err := time.Parse("20060102T150405", val)
+	if err != nil {
+		return time.Time{}, false
+	}
+	return t.UTC(), true
+}
+
+// RenderICal wraps events in a VCALENDAR body suitable for PUTting to a CalDAV
+// collection. One event per file is the CalDAV convention, so callers normally
+// pass a single event.
+//
+// This is the write half of #127 and it only ever renders: the canonical state
+// is sqlite, the calendar is a view of it. Nothing reads a rendered file back.
+func RenderICal(events []Event) string {
+	var b strings.Builder
+	b.WriteString("BEGIN:VCALENDAR\r\nVERSION:2.0\r\nPRODID:-//maven//local calendar//RU\r\n")
+	for _, e := range events {
+		b.WriteString("BEGIN:VEVENT\r\n")
+		fmt.Fprintf(&b, "UID:%s\r\n", escapeText(e.UID))
+		fmt.Fprintf(&b, "DTSTAMP:%s\r\n", e.Start.UTC().Format("20060102T150405Z"))
+		fmt.Fprintf(&b, "DTSTART:%s\r\n", e.Start.UTC().Format("20060102T150405Z"))
+		fmt.Fprintf(&b, "DTEND:%s\r\n", e.End.UTC().Format("20060102T150405Z"))
+		fmt.Fprintf(&b, "SUMMARY:%s\r\n", escapeText(e.Summary))
+		b.WriteString("END:VEVENT\r\n")
+	}
+	b.WriteString("END:VCALENDAR\r\n")
+	return b.String()
+}
+
+// escapeText applies RFC 5545 TEXT escaping and strips the line breaks that
+// would otherwise let a reminder payload inject iCal properties.
+func escapeText(s string) string {
+	s = strings.ReplaceAll(s, "\\", "\\\\")
+	s = strings.ReplaceAll(s, ";", "\\;")
+	s = strings.ReplaceAll(s, ",", "\\,")
+	s = strings.ReplaceAll(s, "\r\n", "\\n")
+	s = strings.ReplaceAll(s, "\n", "\\n")
+	s = strings.ReplaceAll(s, "\r", "\\n")
+	return s
+}

internal/calendar/ical_render_test.go

@@ -0,0 +1,69 @@
+package calendar
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestRenderICalRoundTrips(t *testing.T) {
+	e := ReminderEvent(7, time.Date(2026, 8, 1, 18, 30, 0, 0, time.UTC), "позвонить маме", 0)
+	if e.UID != "maven-reminder-7" {
+		t.Errorf("UID = %q", e.UID)
+	}
+	if got := e.End.Sub(e.Start); got != DefaultReminderDuration {
+		t.Errorf("duration = %v, want %v", got, DefaultReminderDuration)
+	}
+	if got, want := ReminderPath(7), "maven-reminder-7.ics"; got != want {
+		t.Errorf("ReminderPath = %q, want %q", got, want)
+	}
+
+	body := RenderICal([]Event{e})
+	if !strings.HasPrefix(body, "BEGIN:VCALENDAR\r\n") || !strings.HasSuffix(body, "END:VCALENDAR\r\n") {
+		t.Fatalf("not a VCALENDAR body:\n%s", body)
+	}
+
+	back := ParseICal([]byte(body), e.Start.Add(-time.Hour), e.Start.Add(time.Hour))
+	if len(back) != 1 {
+		t.Fatalf("got %d events back, want 1:\n%s", len(back), body)
+	}
+	if back[0].UID != e.UID || back[0].Summary != e.Summary {
+		t.Errorf("round trip lost identity: %+v", back[0])
+	}
+	if !back[0].Start.Equal(e.Start) || !back[0].End.Equal(e.End) {
+		t.Errorf("round trip lost times: %+v", back[0])
+	}
+}
+
+func TestRenderICalIsDeterministic(t *testing.T) {
+	e := ReminderEvent(1, time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC), "выпить воды", 0)
+	if RenderICal([]Event{e}) != RenderICal([]Event{e}) {
+		t.Error("the same reminder must render byte-identically, or every poll re-PUTs it")
+	}
+}
+
+// A reminder payload is owner-supplied text. It must not be able to close the
+// VEVENT and inject properties of its own.
+func TestRenderICalEscapesInjection(t *testing.T) {
+	e := ReminderEvent(2, time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC),
+		"обед\r\nEND:VEVENT\r\nBEGIN:VEVENT\r\nSUMMARY:injected", 0)
+	body := RenderICal([]Event{e})
+	// Count line-initial occurrences: the escaped text still contains the
+	// characters "BEGIN:VEVENT", it just can no longer start a line.
+	if n := strings.Count(body, "\r\nBEGIN:VEVENT\r\n"); n != 1 {
+		t.Fatalf("payload injected a second VEVENT (%d):\n%s", n, body)
+	}
+	if n := strings.Count(body, "\r\nEND:VEVENT\r\n"); n != 1 {
+		t.Fatalf("payload closed the VEVENT early (%d):\n%s", n, body)
+	}
+	if !strings.Contains(body, `SUMMARY:обед\nEND:VEVENT`) {
+		t.Errorf("newlines should be escaped, not dropped:\n%s", body)
+	}
+}
+
+func TestReminderEventEmptyPayload(t *testing.T) {
+	e := ReminderEvent(3, time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC), "   ", 0)
+	if e.Summary != "напоминание" {
+		t.Errorf("Summary = %q, want the neutral RU fallback", e.Summary)
+	}
+}

internal/calendar/reminder.go

@@ -0,0 +1,45 @@
+package calendar
+
+import (
+	"fmt"
+	"strings"
+	"time"
+)
+
+// ReminderUIDPrefix namespaces every event maven publishes. Two reasons it is a
+// fixed prefix and not a random UUID: the render is idempotent (the same
+// reminder always lands on the same UID, so re-rendering overwrites instead of
+// duplicating), and everything maven owns in the target collection is
+// identifiable at a glance — she never touches a file she did not create.
+const ReminderUIDPrefix = "maven-reminder-"
+
+// DefaultReminderDuration — how long a rendered reminder occupies. A reminder
+// is an instant, a calendar entry is a span, so one has to be invented; 30
+// minutes reads as a block in a calendar app without swallowing the afternoon.
+const DefaultReminderDuration = 30 * time.Minute
+
+// ReminderEvent maps a reminder to the event that represents it. id and fire
+// come from the store; payload is the RU text as the owner said it, rendered
+// verbatim as the summary — the calendar is a view of sqlite, not a place to
+// rephrase.
+func ReminderEvent(id int64, fire time.Time, payload string, dur time.Duration) Event {
+	if dur <= 0 {
+		dur = DefaultReminderDuration
+	}
+	summary := strings.TrimSpace(payload)
+	if summary == "" {
+		summary = "напоминание"
+	}
+	return Event{
+		UID:     fmt.Sprintf("%s%d", ReminderUIDPrefix, id),
+		Summary: summary,
+		Start:   fire,
+		End:     fire.Add(dur),
+	}
+}
+
+// ReminderPath is the collection-relative filename for a rendered reminder.
+// One event per resource, per the CalDAV convention.
+func ReminderPath(id int64) string {
+	return fmt.Sprintf("%s%d.ics", ReminderUIDPrefix, id)
+}

internal/capture/capture.go

@@ -0,0 +1,404 @@
+// Package capture is Maven's meeting recorder (Vikunja #253,
+// docs/plans/08-hearing.md).
+//
+// One session at a time, with an explicit start and an explicit stop:
+//
+//	Start("встреча")  → audio frames appended → Stop() → transcript → summary
+//
+// # Nothing here listens
+//
+// This is the most invasive capability in the backlog and the design is
+// constrained accordingly. The constraints are the code, not a preamble:
+//
+//   - There is no ambient path. `Session.Append` is the only way audio enters,
+//     and it only accepts frames while a session someone started is running.
+//     A keyword-triggered recorder ("maven record" heard in the room) was in the
+//     plan document and is refused: it requires listening in order to notice the
+//     keyword, which is the exact behaviour this capability must not have.
+//   - A session that is not stopped stops itself. MaxDuration is a hard cap
+//     checked on every Append, not a suggestion; a forgotten recording is a
+//     recording that ends, not one that runs until the disk is full.
+//   - Audio is stored under internal/media, which means retention prunes it and
+//     it never leaves the box. Both the audio blob and the transcript stay
+//     local; only the summary is written where he will read it.
+//   - The transcript is never search input for anything outside this box. It is
+//     text about a conversation with other people in it.
+//
+// # Long audio against a 4096-token context
+//
+// The resident model is a Thinking variant at n_ctx 4096, so an hour of meeting
+// transcript does not fit in one prompt and never will. summarize.go does the
+// obvious map-reduce: split the transcript on sentence boundaries into windows
+// that fit, summarise each, then summarise the summaries. That is handled
+// explicitly rather than by truncation, because a truncated meeting summary is
+// worse than none — it looks complete and is not.
+//
+// # Transcription
+//
+// There is exactly one STT in Maven and this package does not add a second: it
+// takes an stt.Transcriber, which in deploy is the whisper.cpp worker behind
+// cmd/mavsttd. Long audio is transcribed in windows too (see chunkAudio), for
+// the same reason whisper itself works in 30s windows — handing a worker an hour
+// of PCM in one call is a request that either times out or blocks everything
+// else for minutes.
+package capture
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/kami/maven/internal/audio"
+	"github.com/kami/maven/internal/media"
+	"github.com/kami/maven/internal/stt"
+)
+
+// DefaultMaxDuration — how long one capture may run before it stops itself.
+// Two hours covers a long meeting and bounds the damage of a forgotten session:
+// at 16 kHz mono that is about 230 MB of PCM, which is over media's default
+// per-blob cap, so a session at the limit is stored truncated rather than
+// refused. That trade is deliberate — a partial recording of a meeting he asked
+// for beats an error after two hours.
+const DefaultMaxDuration = 2 * time.Hour
+
+// DefaultSTTWindow — how much audio goes to the transcriber in one call. Five
+// minutes of 16 kHz mono is under 10 MB, transcribes in well under whisper's
+// own timeout on this box, and keeps the worker responsive to the voice path
+// between windows.
+const DefaultSTTWindow = 5 * time.Minute
+
+// Errors callers distinguish.
+var (
+	// ErrDisabled — capture is not configured. A capability is off unless
+	// configured, and a recorder most of all.
+	ErrDisabled = errors.New("capture: not configured")
+	// ErrBusy — a session is already running. One at a time: two concurrent
+	// recordings would make "хватит" ambiguous.
+	ErrBusy = errors.New("capture: a session is already running")
+	// ErrNoSession — stop or append with nothing running.
+	ErrNoSession = errors.New("capture: nothing is being recorded")
+	// ErrBadFormat — a frame is not the canonical 16 kHz mono PCM shape.
+	ErrBadFormat = errors.New("capture: audio format not supported")
+	// ErrEmptyCapture — the session ended with no audio in it.
+	ErrEmptyCapture = errors.New("capture: nothing was recorded")
+	// ErrExpired — the session hit MaxDuration and was closed. Returned from
+	// Append so the caller stops sending; the audio collected so far is kept.
+	ErrExpired = errors.New("capture: session reached its time limit")
+)
+
+// Session — one recording in progress. Not created directly; Recorder.Start
+// makes it. Guarded by a mutex because frames arrive from a network goroutine
+// while a status call may read from another.
+type Session struct {
+	Label   string
+	Started time.Time
+
+	mu      sync.Mutex
+	pcm     []byte
+	format  audio.Format
+	expired bool
+}
+
+// Duration is how much audio has been collected, from the bytes rather than the
+// wall clock: a stream that dropped frames should report the audio that exists,
+// not the time that passed.
+func (s *Session) Duration() time.Duration {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.duration()
+}
+
+func (s *Session) duration() time.Duration {
+	a := audio.Audio{Format: s.format, Bytes: s.pcm}
+	return time.Duration(a.Duration() * float64(time.Second))
+}
+
+// Bytes is how much PCM has been collected. For a status line.
+func (s *Session) Bytes() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return len(s.pcm)
+}
+
+// Status — what a "что записываешь?" answer needs, and what /dash shows. It is
+// the read side of a running session and is safe to ask for at any time.
+type Status struct {
+	Running  bool          `json:"running"`
+	Label    string        `json:"label,omitempty"`
+	Started  time.Time     `json:"started,omitempty"`
+	Duration time.Duration `json:"duration,omitempty"`
+	Bytes    int           `json:"bytes,omitempty"`
+}
+
+// Recorder owns the single session slot, the blob store and the two models a
+// finished capture needs. Build it with New; a zero Recorder is not usable.
+type Recorder struct {
+	blobs       *media.Store
+	tr          stt.Transcriber
+	sum         *Summarizer
+	maxDuration time.Duration
+	sttWindow   time.Duration
+	now         func() time.Time
+
+	mu      sync.Mutex
+	current *Session
+}
+
+// Config — the recorder's knobs, built from config.CaptureConfig by the daemon.
+type Config struct {
+	// MaxDuration — hard cap on one session. 0 ⇒ DefaultMaxDuration.
+	MaxDuration time.Duration
+	// STTWindow — audio per transcription call. 0 ⇒ DefaultSTTWindow.
+	STTWindow time.Duration
+}
+
+// New builds a Recorder. blobs and tr are required — a recorder with nowhere to
+// put the audio, or nothing to transcribe it with, is not a recorder. sum may be
+// nil: the transcript is still produced and stored, and the summary is simply
+// absent, which is the honest degradation when there is no llama-server.
+func New(blobs *media.Store, tr stt.Transcriber, sum *Summarizer, cfg Config) (*Recorder, error) {
+	if blobs == nil {
+		return nil, errors.New("capture: no blob store")
+	}
+	if tr == nil {
+		return nil, errors.New("capture: no transcriber")
+	}
+	maxDur := cfg.MaxDuration
+	if maxDur <= 0 {
+		maxDur = DefaultMaxDuration
+	}
+	window := cfg.STTWindow
+	if window <= 0 {
+		window = DefaultSTTWindow
+	}
+	return &Recorder{
+		blobs:       blobs,
+		tr:          tr,
+		sum:         sum,
+		maxDuration: maxDur,
+		sttWindow:   window,
+		now:         time.Now,
+	}, nil
+}
+
+// MaxDuration is the configured hard cap. For the reply that tells him how long
+// she will keep going if he forgets to say "хватит".
+func (r *Recorder) MaxDuration() time.Duration { return r.maxDuration }
+
+// Start opens a session. label is what the meeting is called ("встреча с
+// подрядчиком"); it ends up in the summary note so the note is findable.
+// ErrBusy if one is already running — the caller says so rather than silently
+// discarding the first recording.
+func (r *Recorder) Start(label string) (*Session, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.current != nil {
+		return nil, fmt.Errorf("%w: %q since %s", ErrBusy, r.current.Label,
+			r.current.Started.Format(time.Kitchen))
+	}
+	s := &Session{
+		Label:   strings.TrimSpace(label),
+		Started: r.now().UTC(),
+		format:  audio.PCM16kMono,
+	}
+	r.current = s
+	return s, nil
+}
+
+// Append adds one frame to the running session. ErrNoSession when nothing is
+// running, which is the guard that makes an ambient path impossible: a stream
+// arriving at a Recorder nobody started is refused frame by frame.
+//
+// ErrExpired once the session is at MaxDuration. The audio collected so far is
+// kept and Stop still works — the cap ends the recording, it does not throw it
+// away.
+func (r *Recorder) Append(a audio.Audio) error {
+	if !a.Format.IsValid() {
+		return fmt.Errorf("%w: %+v", ErrBadFormat, a.Format)
+	}
+	r.mu.Lock()
+	s := r.current
+	r.mu.Unlock()
+	if s == nil {
+		return ErrNoSession
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.expired {
+		return ErrExpired
+	}
+	s.pcm = append(s.pcm, a.Bytes...)
+	if s.duration() >= r.maxDuration {
+		s.expired = true
+		return ErrExpired
+	}
+	return nil
+}
+
+// Status reports the running session, or Running=false.
+func (r *Recorder) Status() Status {
+	r.mu.Lock()
+	s := r.current
+	r.mu.Unlock()
+	if s == nil {
+		return Status{}
+	}
+	return Status{
+		Running:  true,
+		Label:    s.Label,
+		Started:  s.Started,
+		Duration: s.Duration(),
+		Bytes:    s.Bytes(),
+	}
+}
+
+// Result — a finished capture.
+type Result struct {
+	// BlobID — the stored audio, content-addressed. Empty only if storing failed.
+	BlobID string
+	// Label / Started / Duration — what was recorded and when.
+	Label    string
+	Started  time.Time
+	Duration time.Duration
+	// Transcript — the full text, joined across STT windows.
+	Transcript string
+	// Summary — the map-reduced summary, or empty when no summarizer was wired
+	// or the model failed. Empty summary with a non-empty transcript is a
+	// degraded success, not a failure: the words are there.
+	Summary string
+	// Chunks — how many windows the transcript was summarised in. 1 means it fit
+	// in one prompt. Reported so a suspiciously vague summary can be explained.
+	Chunks int
+}
+
+// Stop ends the session and produces the result: store the audio, transcribe it
+// in windows, summarise it in windows. The session slot is freed before any of
+// the slow work starts, so a stuck model cannot block the next recording.
+//
+// The order matters and is the same as vision's: the audio is stored FIRST. If
+// transcription or summarisation fails, the recording is still on disk and can
+// be run again; a meeting that happened once must not be lost to a model error.
+func (r *Recorder) Stop(ctx context.Context) (Result, error) {
+	r.mu.Lock()
+	s := r.current
+	r.current = nil
+	r.mu.Unlock()
+	if s == nil {
+		return Result{}, ErrNoSession
+	}
+
+	s.mu.Lock()
+	pcm := s.pcm
+	format := s.format
+	s.mu.Unlock()
+
+	res := Result{Label: s.Label, Started: s.Started}
+	if len(pcm) == 0 {
+		return res, ErrEmptyCapture
+	}
+	full := audio.Audio{Format: format, Bytes: pcm}
+	res.Duration = time.Duration(full.Duration() * float64(time.Second))
+
+	// Stored as WAV, not headerless PCM: a blob on disk that `aplay` and whisper
+	// can both open without being told the format is worth 44 bytes.
+	wav, err := audio.WAVFromPCM(format, pcm)
+	if err != nil {
+		return res, fmt.Errorf("capture: wav: %w", err)
+	}
+	blob, err := r.blobs.Put(media.KindAudio, "audio/wav", "capture:meeting", wav)
+	if err != nil {
+		// Over the per-blob cap is the expected case for a very long meeting.
+		// Report it and keep going: a transcript without the audio still beats
+		// nothing, and the words are what he will read.
+		return res, fmt.Errorf("capture: store audio: %w", err)
+	}
+	res.BlobID = blob.ID
+
+	text, err := r.transcribe(ctx, full)
+	if err != nil {
+		return res, fmt.Errorf("capture: transcribe: %w", err)
+	}
+	res.Transcript = text
+	if strings.TrimSpace(text) == "" {
+		return res, ErrEmptyCapture
+	}
+
+	if r.sum == nil {
+		return res, nil
+	}
+	summary, chunks, err := r.sum.Summarize(ctx, s.Label, text)
+	res.Chunks = chunks
+	if err != nil {
+		// Degraded success: the transcript is real and stored, only the summary
+		// is missing. The caller writes the transcript note and says so.
+		return res, fmt.Errorf("capture: summarize: %w", err)
+	}
+	res.Summary = summary
+	return res, nil
+}
+
+// Abort throws the running session away without transcribing or storing it.
+// This is what "забудь, не записывай" must map to: a recording someone changed
+// their mind about leaves nothing behind, not a blob with a note saying it was
+// abandoned. Returns whether anything was running.
+func (r *Recorder) Abort() bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.current == nil {
+		return false
+	}
+	r.current = nil
+	return true
+}
+
+// transcribe runs the transcriber over the audio in windows and joins the text.
+// A window that fails is fatal: a summary of a meeting with a silent hole in the
+// middle is a summary that misleads.
+func (r *Recorder) transcribe(ctx context.Context, a audio.Audio) (string, error) {
+	windows := chunkAudio(a, r.sttWindow)
+	parts := make([]string, 0, len(windows))
+	for i, w := range windows {
+		text, _, err := r.tr.Transcribe(ctx, w)
+		if err != nil {
+			return "", fmt.Errorf("window %d/%d: %w", i+1, len(windows), err)
+		}
+		if t := strings.TrimSpace(text); t != "" {
+			parts = append(parts, t)
+		}
+	}
+	return strings.Join(parts, " "), nil
+}
+
+// chunkAudio splits audio into windows of at most window duration, cut on
+// sample boundaries. A window shorter than one sample is impossible; audio
+// shorter than one window comes back as a single element, so the caller never
+// special-cases the short case.
+func chunkAudio(a audio.Audio, window time.Duration) []audio.Audio {
+	bytesPerSample := a.Format.SampleBits / 8 * a.Format.Channels
+	if bytesPerSample <= 0 || a.Format.SampleRate <= 0 || window <= 0 {
+		return []audio.Audio{a}
+	}
+	per := int(window.Seconds()) * a.Format.SampleRate * bytesPerSample
+	if per <= 0 || len(a.Bytes) <= per {
+		return []audio.Audio{a}
+	}
+	var out []audio.Audio
+	for off := 0; off < len(a.Bytes); off += per {
+		end := off + per
+		if end > len(a.Bytes) {
+			end = len(a.Bytes)
+		}
+		// Never cut mid-sample: a split inside an int16 shifts every following
+		// sample by a byte and turns the tail of the window into noise.
+		end -= (end - off) % bytesPerSample
+		if end <= off {
+			break
+		}
+		out = append(out, audio.Audio{Format: a.Format, Bytes: a.Bytes[off:end]})
+	}
+	return out
+}

internal/capture/capture_test.go

@@ -0,0 +1,363 @@
+package capture
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/audio"
+	"github.com/kami/maven/internal/media"
+)
+
+// fakeTranscriber returns a fixed phrase per call so a windowed transcription is
+// visible in the joined output.
+type fakeTranscriber struct {
+	calls  int
+	err    error
+	phrase string
+}
+
+func (f *fakeTranscriber) Transcribe(_ context.Context, a audio.Audio) (string, float64, error) {
+	f.calls++
+	if f.err != nil {
+		return "", 0, f.err
+	}
+	p := f.phrase
+	if p == "" {
+		p = "окно"
+	}
+	return fmt.Sprintf("%s%d", p, f.calls), 1.0, nil
+}
+
+// fakeCompleter records prompts and replies from a script.
+type fakeCompleter struct {
+	replies []string
+	systems []string
+	users   []string
+	err     error
+}
+
+func (f *fakeCompleter) Complete(_ context.Context, system, user string) (string, error) {
+	f.systems = append(f.systems, system)
+	f.users = append(f.users, user)
+	if f.err != nil {
+		return "", f.err
+	}
+	if len(f.replies) == 0 {
+		return "итог", nil
+	}
+	r := f.replies[0]
+	f.replies = f.replies[1:]
+	return r, nil
+}
+
+// frame builds n seconds of silence in the canonical format.
+func frame(seconds float64) audio.Audio {
+	n := int(seconds*16000) * 2
+	return audio.Audio{Format: audio.PCM16kMono, Bytes: make([]byte, n)}
+}
+
+func testRecorder(t *testing.T, tr *fakeTranscriber, sum *Summarizer, cfg Config) (*Recorder, *media.Store) {
+	t.Helper()
+	blobs, err := media.Open(t.TempDir(), 0, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r, err := New(blobs, tr, sum, cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return r, blobs
+}
+
+func TestNewRequiresStoreAndTranscriber(t *testing.T) {
+	blobs, err := media.Open(t.TempDir(), 0, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := New(nil, &fakeTranscriber{}, nil, Config{}); err == nil {
+		t.Error("recorder built with no blob store")
+	}
+	if _, err := New(blobs, nil, nil, Config{}); err == nil {
+		t.Error("recorder built with no transcriber")
+	}
+}
+
+// The invariant that matters most: audio arriving at a recorder nobody started
+// is refused. There is no ambient path in.
+func TestAppendWithoutStartIsRefused(t *testing.T) {
+	r, _ := testRecorder(t, &fakeTranscriber{}, nil, Config{})
+	if err := r.Append(frame(1)); !errors.Is(err, ErrNoSession) {
+		t.Fatalf("got %v, want ErrNoSession", err)
+	}
+	if r.Status().Running {
+		t.Error("a refused frame started a session")
+	}
+}
+
+func TestStopWithoutStartIsRefused(t *testing.T) {
+	r, _ := testRecorder(t, &fakeTranscriber{}, nil, Config{})
+	if _, err := r.Stop(context.Background()); !errors.Is(err, ErrNoSession) {
+		t.Fatalf("got %v, want ErrNoSession", err)
+	}
+}
+
+func TestOneSessionAtATime(t *testing.T) {
+	r, _ := testRecorder(t, &fakeTranscriber{}, nil, Config{})
+	if _, err := r.Start("встреча"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := r.Start("вторая"); !errors.Is(err, ErrBusy) {
+		t.Fatalf("got %v, want ErrBusy", err)
+	}
+	if _, err := r.Stop(context.Background()); !errors.Is(err, ErrEmptyCapture) {
+		t.Fatalf("empty stop: %v", err)
+	}
+	// The slot is free again after a stop, even a failed one.
+	if _, err := r.Start("третья"); err != nil {
+		t.Errorf("slot not released: %v", err)
+	}
+}
+
+func TestRoundTripStoresAudioTranscriptAndSummary(t *testing.T) {
+	tr := &fakeTranscriber{phrase: "совещание"}
+	sum := NewSummarizer(&fakeCompleter{replies: []string{"— решили купить насос"}}, 0, 0, nil)
+	r, blobs := testRecorder(t, tr, sum, Config{})
+
+	if _, err := r.Start("встреча с подрядчиком"); err != nil {
+		t.Fatal(err)
+	}
+	for i := 0; i < 3; i++ {
+		if err := r.Append(frame(2)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	res, err := r.Stop(context.Background())
+	if err != nil {
+		t.Fatalf("stop: %v", err)
+	}
+	if res.BlobID == "" {
+		t.Error("no audio blob stored")
+	}
+	blob, data, err := blobs.Read(res.BlobID)
+	if err != nil {
+		t.Fatalf("blob unreadable: %v", err)
+	}
+	if blob.Kind != media.KindAudio || blob.Source != "capture:meeting" {
+		t.Errorf("blob metadata = %+v", blob)
+	}
+	if string(data[:4]) != "RIFF" {
+		t.Error("audio was not stored as a playable WAV")
+	}
+	if res.Transcript == "" {
+		t.Error("no transcript")
+	}
+	if !strings.Contains(res.Summary, "насос") {
+		t.Errorf("summary = %q", res.Summary)
+	}
+	if !strings.Contains(res.Summary, "встреча с подрядчиком") {
+		t.Errorf("label missing from summary: %q", res.Summary)
+	}
+	if res.Duration != 6*time.Second {
+		t.Errorf("duration = %v, want 6s", res.Duration)
+	}
+}
+
+// A forgotten session stops itself, and the audio collected before the cap is
+// kept rather than thrown away.
+func TestMaxDurationEndsTheSessionAndKeepsAudio(t *testing.T) {
+	tr := &fakeTranscriber{}
+	r, _ := testRecorder(t, tr, nil, Config{MaxDuration: 4 * time.Second})
+	if _, err := r.Start("длинная"); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.Append(frame(3)); err != nil {
+		t.Fatalf("first frame: %v", err)
+	}
+	if err := r.Append(frame(3)); !errors.Is(err, ErrExpired) {
+		t.Fatalf("got %v, want ErrExpired", err)
+	}
+	// Further frames keep being refused, so a client that ignores the error
+	// cannot grow the recording past the cap.
+	if err := r.Append(frame(3)); !errors.Is(err, ErrExpired) {
+		t.Fatalf("post-expiry frame: %v", err)
+	}
+	res, err := r.Stop(context.Background())
+	if err != nil {
+		t.Fatalf("stop after expiry: %v", err)
+	}
+	if res.Duration != 6*time.Second {
+		t.Errorf("duration = %v, want the 6s collected before the cap", res.Duration)
+	}
+}
+
+func TestAppendRejectsWrongFormat(t *testing.T) {
+	r, _ := testRecorder(t, &fakeTranscriber{}, nil, Config{})
+	if _, err := r.Start("x"); err != nil {
+		t.Fatal(err)
+	}
+	bad := audio.Audio{Format: audio.Format{SampleRate: 44100, Channels: 2, SampleBits: 16, Encoding: "pcm_s16le"}, Bytes: make([]byte, 100)}
+	if err := r.Append(bad); !errors.Is(err, ErrBadFormat) {
+		t.Fatalf("got %v, want ErrBadFormat", err)
+	}
+}
+
+// "забудь, не записывай" must leave nothing behind — no blob, no transcript.
+func TestAbortLeavesNothing(t *testing.T) {
+	tr := &fakeTranscriber{}
+	r, blobs := testRecorder(t, tr, nil, Config{})
+	if _, err := r.Start("зря начали"); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.Append(frame(5)); err != nil {
+		t.Fatal(err)
+	}
+	if !r.Abort() {
+		t.Fatal("Abort reported nothing running")
+	}
+	if r.Status().Running {
+		t.Error("session survived Abort")
+	}
+	list, err := blobs.List(media.KindAudio)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(list) != 0 {
+		t.Errorf("Abort stored %d blob(s)", len(list))
+	}
+	if tr.calls != 0 {
+		t.Errorf("Abort transcribed anyway (%d calls)", tr.calls)
+	}
+	if r.Abort() {
+		t.Error("second Abort reported a session")
+	}
+}
+
+func TestStatusReportsTheRunningSession(t *testing.T) {
+	r, _ := testRecorder(t, &fakeTranscriber{}, nil, Config{})
+	if got := r.Status(); got.Running {
+		t.Error("idle recorder reports running")
+	}
+	if _, err := r.Start("планёрка"); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.Append(frame(10)); err != nil {
+		t.Fatal(err)
+	}
+	st := r.Status()
+	if !st.Running || st.Label != "планёрка" {
+		t.Fatalf("status = %+v", st)
+	}
+	if st.Duration != 10*time.Second {
+		t.Errorf("duration = %v", st.Duration)
+	}
+	if st.Bytes != 10*16000*2 {
+		t.Errorf("bytes = %d", st.Bytes)
+	}
+}
+
+// Long audio goes to the transcriber in windows: handing a whisper worker an
+// hour of PCM in one call blocks the voice path for minutes.
+func TestLongAudioIsTranscribedInWindows(t *testing.T) {
+	tr := &fakeTranscriber{}
+	r, _ := testRecorder(t, tr, nil, Config{STTWindow: 2 * time.Second})
+	if _, err := r.Start("длинная"); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.Append(frame(9)); err != nil {
+		t.Fatal(err)
+	}
+	res, err := r.Stop(context.Background())
+	if err != nil {
+		t.Fatalf("stop: %v", err)
+	}
+	if tr.calls != 5 { // 2+2+2+2+1
+		t.Errorf("transcriber called %d times, want 5", tr.calls)
+	}
+	if !strings.Contains(res.Transcript, "окно5") {
+		t.Errorf("last window missing from transcript: %q", res.Transcript)
+	}
+}
+
+// A hole in the middle of a meeting summary would mislead, so a failed window is
+// fatal — but the audio is already stored and re-runnable.
+func TestTranscriptionFailureKeepsTheAudio(t *testing.T) {
+	tr := &fakeTranscriber{err: errors.New("whisper is down")}
+	r, blobs := testRecorder(t, tr, nil, Config{})
+	if _, err := r.Start("встреча"); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.Append(frame(2)); err != nil {
+		t.Fatal(err)
+	}
+	res, err := r.Stop(context.Background())
+	if err == nil {
+		t.Fatal("transcription failure was not reported")
+	}
+	if res.BlobID == "" {
+		t.Fatal("no blob id to retry with")
+	}
+	if _, _, err := blobs.Read(res.BlobID); err != nil {
+		t.Errorf("audio was not kept: %v", err)
+	}
+}
+
+// No llama-server ⇒ transcript only. That is the honest degradation, not an
+// error.
+func TestNoSummarizerStillProducesATranscript(t *testing.T) {
+	r, _ := testRecorder(t, &fakeTranscriber{}, nil, Config{})
+	if _, err := r.Start("встреча"); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.Append(frame(1)); err != nil {
+		t.Fatal(err)
+	}
+	res, err := r.Stop(context.Background())
+	if err != nil {
+		t.Fatalf("stop: %v", err)
+	}
+	if res.Transcript == "" {
+		t.Error("no transcript")
+	}
+	if res.Summary != "" {
+		t.Errorf("summary appeared from nowhere: %q", res.Summary)
+	}
+}
+
+// A summariser failure is a degraded success: the words exist and are returned.
+func TestSummaryFailureStillReturnsTheTranscript(t *testing.T) {
+	sum := NewSummarizer(&fakeCompleter{err: errors.New("llama is down")}, 0, 0, nil)
+	r, _ := testRecorder(t, &fakeTranscriber{}, sum, Config{})
+	if _, err := r.Start("встреча"); err != nil {
+		t.Fatal(err)
+	}
+	if err := r.Append(frame(1)); err != nil {
+		t.Fatal(err)
+	}
+	res, err := r.Stop(context.Background())
+	if err == nil {
+		t.Fatal("summary failure was not reported")
+	}
+	if res.Transcript == "" {
+		t.Error("transcript lost to a summary failure")
+	}
+}
+
+func TestChunkAudioNeverCutsMidSample(t *testing.T) {
+	a := audio.Audio{Format: audio.PCM16kMono, Bytes: make([]byte, 16000*2*5+1)}
+	for _, w := range chunkAudio(a, 2*time.Second) {
+		if len(w.Bytes)%2 != 0 {
+			t.Fatalf("window of %d bytes cuts an int16 in half", len(w.Bytes))
+		}
+	}
+}
+
+func TestChunkAudioShortInputIsOneWindow(t *testing.T) {
+	a := frame(1)
+	if got := chunkAudio(a, time.Minute); len(got) != 1 {
+		t.Errorf("got %d windows, want 1", len(got))
+	}
+}

internal/capture/summarize.go

@@ -0,0 +1,261 @@
+package capture
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"unicode"
+)
+
+// DefaultChunkRunes — how much transcript goes into one summarisation prompt.
+//
+// The resident model runs at n_ctx 4096 and is a Thinking variant, so reasoning
+// tokens need room too. Russian runs roughly 2.5–3 characters per token on a
+// Qwen tokenizer, so 3000 runes is about 1100 tokens of transcript, leaving the
+// prompt, the persona block, the reasoning and the answer comfortable space.
+// This is the same reasoning internal/crawl used to land on 4000 runes, tightened
+// because a meeting transcript is denser in named entities than a web page and
+// the reduce step has to fit several summaries at once.
+const DefaultChunkRunes = 3000
+
+// DefaultMaxChunks — how many windows one meeting may be summarised in. Forty
+// chunks at 3000 runes is roughly a two-hour meeting, which is MaxDuration; past
+// that the transcript is truncated and the summary says so, because forty-one
+// sequential model calls on this box is half an hour of work nobody is waiting
+// through.
+const DefaultMaxChunks = 40
+
+// ErrNoSummary — the model returned nothing usable for every chunk.
+var ErrNoSummary = errors.New("capture: model produced no summary")
+
+// Completer is the one thing the summarizer needs from a model: text in, text
+// out. It is an interface rather than an *llm.Client so this package stays pure
+// and testable, and so the daemon can pass whatever it already has.
+type Completer interface {
+	Complete(ctx context.Context, system, user string) (string, error)
+}
+
+// Summarizer turns a transcript into something worth reading. It is map-reduce
+// and nothing cleverer: summarise each window, then summarise the summaries.
+//
+// Truncation was the alternative and is rejected. A truncated meeting summary
+// reads as complete and is not, which is worse than no summary at all — he would
+// act on it.
+type Summarizer struct {
+	llm        Completer
+	chunkRunes int
+	maxChunks  int
+	// context is the persona/context block the daemon prepends to every prompt,
+	// or empty. Passed in rather than built here so this package does not import
+	// internal/persona and the feminine self-reference rules stay in one place.
+	context func() string
+}
+
+// NewSummarizer wires a summarizer. llm nil ⇒ nil Summarizer, which Recorder
+// treats as "transcript only", the honest degradation with no llama-server.
+// chunkRunes ≤ 0 ⇒ DefaultChunkRunes; maxChunks ≤ 0 ⇒ DefaultMaxChunks.
+func NewSummarizer(llm Completer, chunkRunes, maxChunks int, contextBlock func() string) *Summarizer {
+	if llm == nil {
+		return nil
+	}
+	if chunkRunes <= 0 {
+		chunkRunes = DefaultChunkRunes
+	}
+	if maxChunks <= 0 {
+		maxChunks = DefaultMaxChunks
+	}
+	if contextBlock == nil {
+		contextBlock = func() string { return "" }
+	}
+	return &Summarizer{llm: llm, chunkRunes: chunkRunes, maxChunks: maxChunks, context: contextBlock}
+}
+
+// chunkPrompt — the map step. Deliberately plain: this is not Maven speaking to
+// him, it is a model condensing text, so there is no first person in it at all
+// and therefore nothing for the persona's gender rules to get wrong. The reply
+// she gives him afterwards is phrased by the ordinary replier, which does carry
+// the persona.
+const chunkPrompt = `Ты обрабатываешь фрагмент расшифровки разговора.
+Сожми его до 2-4 пунктов: о чём говорили, какие решения приняли, какие задачи назвали.
+Без вступлений и выводов. Только по тексту — не придумывай того, чего в нём нет.
+Если во фрагменте нет ничего содержательного, ответь одним словом: пусто.`
+
+// reducePrompt — the reduce step. Same rules, over the chunk summaries.
+const reducePrompt = `Ниже — конспекты фрагментов одной встречи, по порядку.
+Собери из них один короткий итог: о чём была встреча, какие решения приняли, что кому делать.
+Не повторяйся, не придумывай, не добавляй вступлений.`
+
+// emptyMarker — what the map step answers for a chunk with nothing in it. Such
+// chunks are dropped before the reduce step rather than padding it with noise.
+const emptyMarker = "пусто"
+
+// Summarize returns the summary and the number of chunks the transcript was
+// split into. One chunk means it fit in a single prompt and the reduce step was
+// skipped, which is the common case for a short meeting and saves a model call.
+func (s *Summarizer) Summarize(ctx context.Context, label, transcript string) (string, int, error) {
+	if s == nil {
+		return "", 0, ErrDisabled
+	}
+	chunks := ChunkText(transcript, s.chunkRunes)
+	if len(chunks) == 0 {
+		return "", 0, ErrEmptyCapture
+	}
+	truncated := false
+	if len(chunks) > s.maxChunks {
+		chunks = chunks[:s.maxChunks]
+		truncated = true
+	}
+
+	system := s.context() + chunkPrompt
+	parts := make([]string, 0, len(chunks))
+	for i, c := range chunks {
+		out, err := s.llm.Complete(ctx, system, c)
+		if err != nil {
+			return "", len(chunks), fmt.Errorf("chunk %d/%d: %w", i+1, len(chunks), err)
+		}
+		out = strings.TrimSpace(out)
+		if out == "" || strings.EqualFold(out, emptyMarker) {
+			continue
+		}
+		parts = append(parts, out)
+	}
+	if len(parts) == 0 {
+		return "", len(chunks), ErrNoSummary
+	}
+
+	summary := parts[0]
+	if len(parts) > 1 {
+		joined := strings.Join(parts, "\n\n")
+		reduced, err := s.llm.Complete(ctx, s.context()+reducePrompt, joined)
+		if err != nil {
+			// The per-chunk summaries are real work; hand them over rather than
+			// losing them to a failure in the last step.
+			return joined, len(chunks), fmt.Errorf("reduce: %w", err)
+		}
+		if r := strings.TrimSpace(reduced); r != "" {
+			summary = r
+		} else {
+			summary = joined
+		}
+	}
+	if label != "" {
+		summary = label + "\n\n" + summary
+	}
+	if truncated {
+		// Said in the note, not swallowed: a summary that silently covers the
+		// first hour of a three-hour meeting is the failure mode this guards.
+		summary += fmt.Sprintf("\n\n(расшифровка обрезана: обработано %d фрагментов из большего числа)", s.maxChunks)
+	}
+	return summary, len(chunks), nil
+}
+
+// ChunkText splits text into windows of at most maxRunes runes, cutting on
+// sentence boundaries where it can and on a word boundary otherwise. Exported
+// because it is the part worth testing on its own and the part a future
+// transcript viewer will want.
+//
+// A sentence longer than maxRunes (a transcript with no punctuation at all,
+// which whisper does produce) is cut on whitespace rather than dropped or run
+// past the limit.
+func ChunkText(text string, maxRunes int) []string {
+	text = strings.TrimSpace(text)
+	if text == "" {
+		return nil
+	}
+	if maxRunes <= 0 {
+		maxRunes = DefaultChunkRunes
+	}
+	if len([]rune(text)) <= maxRunes {
+		return []string{text}
+	}
+
+	var out []string
+	var cur []rune
+	flush := func() {
+		if s := strings.TrimSpace(string(cur)); s != "" {
+			out = append(out, s)
+		}
+		cur = cur[:0]
+	}
+	for _, sent := range splitSentences(text) {
+		sr := []rune(sent)
+		if len(sr) > maxRunes {
+			// Oversized sentence: emit what is buffered, then cut this one on
+			// word boundaries.
+			flush()
+			for _, piece := range splitWords(sr, maxRunes) {
+				out = append(out, piece)
+			}
+			continue
+		}
+		if len(cur)+len(sr) > maxRunes {
+			flush()
+		}
+		cur = append(cur, sr...)
+	}
+	flush()
+	return out
+}
+
+// splitSentences cuts on sentence-ending punctuation followed by a space,
+// keeping the punctuation with the sentence it ends. Good enough for a
+// transcript: whisper emits periods and question marks, and being wrong about an
+// abbreviation costs a slightly uneven chunk, nothing more.
+func splitSentences(text string) []string {
+	runes := []rune(text)
+	var out []string
+	start := 0
+	for i := 0; i < len(runes); i++ {
+		if runes[i] != '.' && runes[i] != '!' && runes[i] != '?' && runes[i] != '\n' {
+			continue
+		}
+		// Consume a run of punctuation ("?!", "...") so it stays together.
+		j := i
+		for j+1 < len(runes) && isSentenceEnd(runes[j+1]) {
+			j++
+		}
+		if j+1 < len(runes) && !unicode.IsSpace(runes[j+1]) {
+			i = j
+			continue
+		}
+		end := j + 1
+		for end < len(runes) && unicode.IsSpace(runes[end]) {
+			end++
+		}
+		out = append(out, string(runes[start:end]))
+		start = end
+		i = end - 1
+	}
+	if start < len(runes) {
+		out = append(out, string(runes[start:]))
+	}
+	return out
+}
+
+func isSentenceEnd(r rune) bool {
+	return r == '.' || r == '!' || r == '?'
+}
+
+// splitWords cuts an oversized run on whitespace, falling back to a hard cut
+// when a single "word" is itself longer than the limit.
+func splitWords(runes []rune, maxRunes int) []string {
+	var out []string
+	for len(runes) > maxRunes {
+		cut := maxRunes
+		for cut > 0 && !unicode.IsSpace(runes[cut]) {
+			cut--
+		}
+		if cut == 0 {
+			cut = maxRunes
+		}
+		if s := strings.TrimSpace(string(runes[:cut])); s != "" {
+			out = append(out, s)
+		}
+		runes = runes[cut:]
+	}
+	if s := strings.TrimSpace(string(runes)); s != "" {
+		out = append(out, s)
+	}
+	return out
+}

internal/capture/summarize_test.go

@@ -0,0 +1,244 @@
+package capture
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+)
+
+func TestNilSummarizerWithoutAModel(t *testing.T) {
+	if s := NewSummarizer(nil, 0, 0, nil); s != nil {
+		t.Fatal("a summarizer with no model is not nil")
+	}
+	var s *Summarizer
+	if _, _, err := s.Summarize(context.Background(), "x", "текст"); !errors.Is(err, ErrDisabled) {
+		t.Fatalf("got %v, want ErrDisabled", err)
+	}
+}
+
+// The common case: a short meeting fits in one prompt, so there is exactly one
+// model call and no reduce step.
+func TestShortTranscriptSkipsTheReduceStep(t *testing.T) {
+	f := &fakeCompleter{replies: []string{"— договорились о смете"}}
+	s := NewSummarizer(f, 0, 0, nil)
+	out, chunks, err := s.Summarize(context.Background(), "смета", "Обсудили смету. Решили подписать.")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if chunks != 1 {
+		t.Errorf("chunks = %d, want 1", chunks)
+	}
+	if len(f.users) != 1 {
+		t.Fatalf("%d model calls, want 1", len(f.users))
+	}
+	if !strings.Contains(out, "смете") || !strings.HasPrefix(out, "смета") {
+		t.Errorf("summary = %q", out)
+	}
+}
+
+func TestLongTranscriptIsMappedThenReduced(t *testing.T) {
+	f := &roleCompleter{mapReply: "часть", reduceReply: "общий итог"}
+	s := NewSummarizer(f, 40, 0, nil)
+	long := strings.Repeat("Говорили про насос и трубы. ", 12)
+	out, chunks, err := s.Summarize(context.Background(), "", long)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if chunks < 2 {
+		t.Fatalf("chunks = %d, want the transcript split", chunks)
+	}
+	// One map call per chunk, then exactly one reduce.
+	if f.maps != chunks {
+		t.Errorf("%d map calls for %d chunks", f.maps, chunks)
+	}
+	if f.reduces != 1 {
+		t.Errorf("%d reduce calls, want 1", f.reduces)
+	}
+	if out != "общий итог" {
+		t.Errorf("summary = %q, want the reduced text", out)
+	}
+}
+
+// Losing every per-chunk summary because the last call failed would throw away
+// most of the work.
+func TestReduceFailureReturnsTheJoinedParts(t *testing.T) {
+	f := &roleCompleter{mapReply: "часть", reduceFails: true}
+	s := NewSummarizer(f, 40, 0, nil)
+	long := strings.Repeat("Говорили про насос и трубы. ", 12)
+	out, _, err := s.Summarize(context.Background(), "", long)
+	if err == nil {
+		t.Fatal("reduce failure was not reported")
+	}
+	if !strings.Contains(out, "часть1") || !strings.Contains(out, "часть2") {
+		t.Errorf("per-chunk work was lost: %q", out)
+	}
+}
+
+func TestChunkFailureIsReported(t *testing.T) {
+	f := &fakeCompleter{err: errors.New("llama is down")}
+	s := NewSummarizer(f, 0, 0, nil)
+	if _, _, err := s.Summarize(context.Background(), "", "текст"); err == nil {
+		t.Fatal("chunk failure was not reported")
+	}
+}
+
+// "пусто" chunks are noise; they must not pad the reduce prompt, and a
+// transcript that is entirely empty chunks is an honest ErrNoSummary rather than
+// an invented summary.
+func TestEmptyChunksAreDropped(t *testing.T) {
+	f := &roleCompleter{mapReply: "пусто", literalMap: true, reduceReply: "не должно вызываться"}
+	s := NewSummarizer(f, 40, 0, nil)
+	long := strings.Repeat("Тишина в комнате. ", 12)
+	if _, _, err := s.Summarize(context.Background(), "", long); !errors.Is(err, ErrNoSummary) {
+		t.Fatalf("got %v, want ErrNoSummary", err)
+	}
+}
+
+func TestEmptyTranscriptIsRefused(t *testing.T) {
+	s := NewSummarizer(&fakeCompleter{}, 0, 0, nil)
+	if _, _, err := s.Summarize(context.Background(), "", "   \n "); !errors.Is(err, ErrEmptyCapture) {
+		t.Fatalf("got %v, want ErrEmptyCapture", err)
+	}
+}
+
+// A summary that silently covers the first fraction of a long meeting is the
+// failure mode; it has to say so.
+func TestTruncationIsStatedInTheSummary(t *testing.T) {
+	f := &fakeCompleter{replies: []string{"a", "b", "итог"}}
+	s := NewSummarizer(f, 30, 2, nil)
+	long := strings.Repeat("Говорили про насос и про трубы. ", 20)
+	out, chunks, err := s.Summarize(context.Background(), "", long)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if chunks != 2 {
+		t.Errorf("chunks = %d, want the cap of 2", chunks)
+	}
+	if !strings.Contains(out, "обрезана") {
+		t.Errorf("truncation not stated: %q", out)
+	}
+}
+
+// The persona block belongs to the daemon, not this package, and must reach the
+// model when it is supplied.
+func TestContextBlockIsPrependedToEveryPrompt(t *testing.T) {
+	f := &fakeCompleter{replies: []string{"итог"}}
+	s := NewSummarizer(f, 0, 0, func() string { return "ПЕРСОНА\n\n" })
+	if _, _, err := s.Summarize(context.Background(), "", "Обсудили смету."); err != nil {
+		t.Fatal(err)
+	}
+	for i, sys := range f.systems {
+		if !strings.HasPrefix(sys, "ПЕРСОНА") {
+			t.Errorf("call %d lost the context block: %q", i, sys)
+		}
+	}
+}
+
+// The map/reduce prompts must contain no first person at all: the persona's
+// feminine forms live in the replier, and a first-person instruction here is a
+// place for the model to write "я рад".
+func TestPromptsHaveNoFirstPerson(t *testing.T) {
+	for name, p := range map[string]string{"chunk": chunkPrompt, "reduce": reducePrompt} {
+		for _, bad := range []string{" я ", "рад", "поняла", "мне ", "вы ", "ваш"} {
+			if strings.Contains(strings.ToLower(" "+p+" "), bad) {
+				t.Errorf("%s prompt contains %q", name, bad)
+			}
+		}
+	}
+}
+
+func TestChunkTextSplitsOnSentenceBoundaries(t *testing.T) {
+	text := "Раз два три. Четыре пять шесть. Семь восемь девять."
+	got := ChunkText(text, 20)
+	if len(got) != 3 {
+		t.Fatalf("got %d chunks: %q", len(got), got)
+	}
+	for _, c := range got {
+		if !strings.HasSuffix(c, ".") {
+			t.Errorf("chunk does not end on a sentence: %q", c)
+		}
+	}
+}
+
+func TestChunkTextPacksSentencesUpToTheLimit(t *testing.T) {
+	text := "Раз. Два. Три. Четыре."
+	got := ChunkText(text, 12)
+	if len(got) < 2 {
+		t.Fatalf("nothing was split: %q", got)
+	}
+	for _, c := range got {
+		if n := len([]rune(c)); n > 12 {
+			t.Errorf("chunk of %d runes exceeds the limit: %q", n, c)
+		}
+	}
+}
+
+// whisper does emit long unpunctuated runs; those must be cut on whitespace, not
+// dropped and not run past the context limit.
+func TestChunkTextCutsUnpunctuatedRuns(t *testing.T) {
+	text := strings.TrimSpace(strings.Repeat("слово ", 50))
+	got := ChunkText(text, 30)
+	if len(got) < 2 {
+		t.Fatalf("unpunctuated run was not split: %d chunks", len(got))
+	}
+	total := 0
+	for _, c := range got {
+		if n := len([]rune(c)); n > 30 {
+			t.Errorf("chunk of %d runes exceeds the limit", n)
+		}
+		total += strings.Count(c, "слово")
+	}
+	if total != 50 {
+		t.Errorf("%d of 50 words survived chunking", total)
+	}
+}
+
+// A single token longer than the window must still come out, hard-cut.
+func TestChunkTextHandlesOneOversizedWord(t *testing.T) {
+	text := strings.Repeat("я", 70)
+	got := ChunkText(text, 20)
+	if len(got) != 4 {
+		t.Fatalf("got %d chunks, want 4", len(got))
+	}
+	if joined := strings.Join(got, ""); len([]rune(joined)) != 70 {
+		t.Errorf("%d runes survived, want 70", len([]rune(joined)))
+	}
+}
+
+func TestChunkTextShortInputAndEmpty(t *testing.T) {
+	if got := ChunkText("коротко", 100); len(got) != 1 || got[0] != "коротко" {
+		t.Errorf("got %q", got)
+	}
+	if got := ChunkText("   ", 100); got != nil {
+		t.Errorf("blank text produced %q", got)
+	}
+}
+
+// roleCompleter answers by which prompt it was handed, so a test does not have
+// to predict how many chunks the text splits into. Map replies are numbered
+// ("часть1", "часть2", …) unless literalMap is set.
+type roleCompleter struct {
+	mapReply    string
+	literalMap  bool
+	reduceReply string
+	reduceFails bool
+	maps        int
+	reduces     int
+}
+
+func (f *roleCompleter) Complete(_ context.Context, system, _ string) (string, error) {
+	if strings.Contains(system, "конспекты фрагментов") {
+		f.reduces++
+		if f.reduceFails {
+			return "", errors.New("llama fell over")
+		}
+		return f.reduceReply, nil
+	}
+	f.maps++
+	if f.literalMap {
+		return f.mapReply, nil
+	}
+	return fmt.Sprintf("%s%d", f.mapReply, f.maps), nil
+}

internal/config/config.go

@@ -18,11 +18,14 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"strings"
 	"time"
 
 	"github.com/kami/maven/internal/delivery/ntfysink"
 	"github.com/kami/maven/internal/delivery/telegramsink"
+	"github.com/kami/maven/internal/mcp"
 	"github.com/kami/maven/internal/morning"
+	"github.com/kami/maven/internal/update"
 	"github.com/robfig/cron/v3"
 )
 
@@ -108,6 +111,16 @@ type Config struct {
 	// calls its /v1/chat/completions endpoint to phrase nudges and reminders.
 	Phraser *PhraserConfig `json:"phraser,omitempty"`
 
+	// Update — how THIS box deploys a new build of Maven (Vikunja #249). nil ⇒
+	// the update capability does not exist, which is the state to leave it in
+	// unless the operator has read internal/update's package comment.
+	//
+	// mavend never reads this block: the daemon does not import internal/update
+	// and cannot update itself. It lives here because cmd/mavupdate — a CLI the
+	// owner runs on the host, the only trigger there is — reads the same config
+	// file to find the socket it health-checks.
+	Update *update.Config `json:"update,omitempty"`
+
 	// Voice — the client↔core surface + the stt/tts modules the daemon
 	// wires. nil ⇒ the daemon doesn't wire voice: the TCP listener stays
 	// down, the dispatcher's Voice slot stays nil (the routing table's
@@ -140,6 +153,31 @@ type Config struct {
 	// item. See internal/morning for the evaluation engine. Empty ⇒ disabled.
 	MorningRoutines []MorningRoutineConfig `json:"morning_routines,omitempty"`
 
+	// PatternProposals — whether a routine the digestion tick inferred on its
+	// own may be announced, and how often. nil / absent ⇒ silent detection
+	// only: proposals are written for /routines and never announced. See
+	// PatternProposalConfig.
+	PatternProposals *PatternProposalConfig `json:"pattern_proposals,omitempty"`
+
+	// MemoryEval — background memory evaluation (internal/memeval). nil /
+	// absent ⇒ no evaluation loop at all. See MemoryEvalConfig.
+	MemoryEval *MemoryEvalConfig `json:"memory_eval,omitempty"`
+
+	// Email — mail ingestion (Vikunja #246). nil / absent ⇒ core refuses
+	// ipc.MethodIngestMail outright, so a mail reader cannot make Maven read a
+	// mailbox by merely existing. See EmailConfig; the IMAP host and credential
+	// live in the reader (cmd/mavmaild), never here.
+	Email *EmailConfig `json:"email,omitempty"`
+
+	// Feeds — RSS/Atom feed reading (Vikunja #258). nil / absent ⇒ no feed is
+	// ever fetched: reading the outside world is off unless configured, like
+	// the weather and telegram. See FeedsConfig.
+	Feeds *FeedsConfig `json:"feeds,omitempty"`
+
+	// Crawl — reading a web page (Vikunja #259). nil / absent ⇒ Maven never
+	// fetches a page: not on request, not on a schedule. See CrawlConfig.
+	Crawl *CrawlConfig `json:"crawl,omitempty"`
+
 	// Praxis — the ecosystem attention-state service. When configured, maven
 	// calls the Praxis HTTP tools API for attention listing and item lifecycle.
 	// Maven never touches Praxis's database directly (ecosystem invariant: no
@@ -155,6 +193,142 @@ type Config struct {
 	// discovers and executes capabilities through Hexis for ecosystem actions.
 	// nil ⇒ no capability-aware routing.
 	Hexis *HexisConfig `json:"hexis,omitempty"`
+
+	// Vision — image understanding (Vikunja #252). nil / absent ⇒ she cannot
+	// look at pictures at all: the intake refuses, and no vision server is
+	// contacted. See VisionConfig.
+	Vision *VisionConfig `json:"vision,omitempty"`
+
+	// Media — where images and captured audio are kept on disk, and for how
+	// long. nil / absent ⇒ no blob store is wired, which is what disables both
+	// vision intake and meeting capture regardless of their own blocks: nothing
+	// in this repo holds a recording only in memory. See MediaConfig.
+	Media *MediaConfig `json:"media,omitempty"`
+
+	// Capture — meeting recording and summarisation (Vikunja #253). nil /
+	// absent ⇒ the recorder does not exist: the start/stop methods are not
+	// served at all, so nothing on this box can begin a recording. This is the
+	// most invasive capability Maven has and it is the one most firmly off by
+	// default. See CaptureConfig.
+	Capture *CaptureConfig `json:"capture,omitempty"`
+
+	// Speaker — voice identification (Vikunja #255). nil / absent ⇒ no
+	// voiceprint is ever computed and nobody can be enrolled. Enabling it needs
+	// a speaker-embedding model, which is not on this box. See SpeakerConfig.
+	Speaker *SpeakerConfig `json:"speaker,omitempty"`
+
+	// MCP — Model Context Protocol servers Maven connects OUT to (Vikunja
+	// #251). nil / absent / no enabled server ⇒ no connection is made and no
+	// tool is discovered, like every other capability that reaches outside the
+	// box. She is a client here, never a server: nothing exposes her own
+	// capabilities to an outside caller. See MCPConfig.
+	MCP *MCPConfig `json:"mcp,omitempty"`
+}
+
+// MCPConfig — the MCP client block. Servers are dark until one has
+// `"enabled": true`, and a discovered tool is only ever PROPOSED: Kami enables
+// it on /tools, on the authed surface, exactly as he would a shell tool. The
+// voice path can never grant a capability to itself.
+type MCPConfig struct {
+	// Servers — the configured servers. Each needs exactly one of command
+	// (a subprocess on this box) or url (a streamable-HTTP endpoint).
+	Servers []MCPServerConfig `json:"servers,omitempty"`
+
+	// Timeout — per-call budget for every server that does not set its own.
+	// 0 ⇒ mcp.DefaultTimeout (15s). A tool slower than this is not usable in a
+	// spoken turn.
+	Timeout Duration `json:"timeout,omitempty"`
+
+	// AllowHosts / DenyHosts — the host lists for the shared webfetch door that
+	// url servers go through. Deny wins. Private addresses are refused
+	// unconditionally unless the individual server sets allow_private.
+	AllowHosts []string `json:"allow_hosts,omitempty"`
+	DenyHosts  []string `json:"deny_hosts,omitempty"`
+
+	// MaxBytes — cap on one JSON-RPC response. 0 ⇒ webfetch.DefaultMaxBytes.
+	MaxBytes int64 `json:"max_bytes,omitempty"`
+}
+
+// MCPServerConfig — one MCP server.
+type MCPServerConfig struct {
+	// Name — the local handle. It prefixes every tool this server contributes
+	// ("vikunja" + "list_tasks" ⇒ the allowlist row "vikunja_list_tasks") and
+	// becomes the store scope "mcp:<name>", so its provenance is readable on
+	// /tools without opening the config.
+	Name string `json:"name"`
+
+	// Command / Args / Env / Dir — a stdio server: a child process of mavend,
+	// on this box, under this user. argv, never a shell string.
+	Command string   `json:"command,omitempty"`
+	Args    []string `json:"args,omitempty"`
+	Env     []string `json:"env,omitempty"`
+	Dir     string   `json:"dir,omitempty"`
+
+	// URL — a streamable-HTTP endpoint. It is fetched through
+	// internal/webfetch, so the SSRF guard, the redirect cap, the size cap and
+	// the one-request-per-host-per-second limit all apply.
+	URL string `json:"url,omitempty"`
+
+	// AllowPrivate — let THIS server be a loopback or LAN address. The Vikunja
+	// server on homesrv is "http://localhost:9100/mcp", which is refused
+	// without this flag. Understand what it means before setting it: a local
+	// server is a DIFFERENT trust level from a public one. It is inside the
+	// network, it usually needs no credential, and it can change things that
+	// matter — so an argument the router got wrong lands somewhere real. Set it
+	// only for a server you run yourself, and prefer allow_tools with it.
+	AllowPrivate bool `json:"allow_private,omitempty"`
+
+	// AllowTools — when set, the ONLY remote tool names taken from this server.
+	// This is the knob that keeps the catalogue deliberate: the resident model
+	// is a 1.7B with a 4096-token context, and a tool name it half-remembers is
+	// a wrong act, so fewer and better-chosen beats complete.
+	AllowTools []string `json:"allow_tools,omitempty"`
+
+	// MaxTools — cap on this server's contribution. 0 ⇒ mcp.DefaultMaxTools (12).
+	MaxTools int `json:"max_tools,omitempty"`
+
+	// Timeout — per-call budget for this server. 0 ⇒ MCPConfig.Timeout.
+	Timeout Duration `json:"timeout,omitempty"`
+
+	// Enabled — false (the default) keeps a configured server described but
+	// dark, so a block can be written and reviewed before it is switched on.
+	Enabled bool `json:"enabled,omitempty"`
+}
+
+// MCPServers maps the config blocks onto the mcp package's own type. It lives
+// here so config validation and daemon wiring cannot drift on the mapping.
+// Returns nil when nothing is configured or nothing is enabled.
+func (c *Config) MCPServers() []mcp.ServerConfig {
+	if c.MCP == nil {
+		return nil
+	}
+	out := make([]mcp.ServerConfig, 0, len(c.MCP.Servers))
+	for _, s := range c.MCP.Servers {
+		if !s.Enabled {
+			continue
+		}
+		timeout := time.Duration(s.Timeout)
+		if timeout <= 0 {
+			timeout = time.Duration(c.MCP.Timeout)
+		}
+		out = append(out, mcp.ServerConfig{
+			Name:         s.Name,
+			Command:      s.Command,
+			Args:         s.Args,
+			Env:          s.Env,
+			Dir:          s.Dir,
+			URL:          s.URL,
+			AllowPrivate: s.AllowPrivate,
+			AllowTools:   s.AllowTools,
+			MaxTools:     s.MaxTools,
+			Timeout:      timeout,
+			Enabled:      true,
+		})
+	}
+	if len(out) == 0 {
+		return nil
+	}
+	return out
 }
 
 // PraxisConfig — maven's connection to the Praxis attention service.
@@ -324,6 +498,171 @@ type VoiceConfig struct {
 	ToolTimeout Duration `json:"tool_timeout,omitempty"`
 }
 
+// MediaConfig — the on-disk blob store for images and captured audio
+// (internal/media). It is shared by all three senses: vision intake, meeting
+// capture, and speaker enrolment samples all write here.
+//
+// Absent ⇒ off, and off means Maven cannot accept an image or start a recording
+// at all. That default is deliberate: a capability that keeps photos and audio of
+// people on disk should require someone to have typed a path.
+type MediaConfig struct {
+	// Dir — the blob store root, created 0700. Relative paths resolve against
+	// StateDir. Required; an empty dir means the store is not wired.
+	Dir string `json:"dir,omitempty"`
+
+	// Retention — how long a blob is kept before the tick prunes it. 0 ⇒
+	// media.DefaultRetention (7 days). This is the knob that stops recordings
+	// of people accumulating; raising it past a few weeks should need a reason.
+	Retention Duration `json:"retention,omitempty"`
+
+	// MaxBytes — per-blob cap. 0 ⇒ media.DefaultMaxBytes (64 MiB).
+	MaxBytes int64 `json:"max_bytes,omitempty"`
+}
+
+// StoreDir reports the configured blob directory, or "" when media is not
+// wired. Safe on a nil receiver.
+func (m *MediaConfig) StoreDir() string {
+	if m == nil {
+		return ""
+	}
+	return strings.TrimSpace(m.Dir)
+}
+
+// VisionConfig — the vision provider (internal/vision, docs/plans/07-vision.md).
+//
+// Absent, or enabled=false, ⇒ the daemon wires vision.Disabled and every attempt
+// to look at an image answers that vision is not set up. There is no cloud
+// option in this block on purpose: Endpoint must be a loopback or private
+// address and internal/vision refuses anything else at startup, because
+// inference stays on the box and a photo of his flat is the last thing to make
+// an exception for.
+type VisionConfig struct {
+	// Enabled — may she look at images. Default false.
+	Enabled bool `json:"enabled,omitempty"`
+
+	// Endpoint — base URL of a llama-server running a vision model with its
+	// mmproj, e.g. "http://127.0.0.1:8081". Loopback / private only.
+	Endpoint string `json:"endpoint,omitempty"`
+
+	// Model — model name sent in the request. llama-server ignores it.
+	Model string `json:"model,omitempty"`
+
+	// MaxDim — longest edge the image is scaled to before inference. 0 ⇒
+	// media.DefaultMaxDim (896).
+	MaxDim int `json:"max_dim,omitempty"`
+
+	// MaxTokens — cap on the description. 0 ⇒ vision.DefaultMaxTokens (300).
+	MaxTokens int `json:"max_tokens,omitempty"`
+
+	// Timeout — per-description budget. 0 ⇒ vision.DefaultTimeout (90s). A small
+	// VLM on an iGPU is slow; a tight timeout here just means no answer ever.
+	Timeout Duration `json:"timeout,omitempty"`
+
+	// Prompt — the default question when he only sent a picture. Empty ⇒
+	// vision.DefaultPrompt (Russian, "опиши что на изображении").
+	Prompt string `json:"prompt,omitempty"`
+}
+
+// LooksAtImages reports whether vision is configured well enough to try. Safe on
+// a nil receiver, and false without an endpoint — enabled with nothing to talk
+// to is a misconfiguration, not a capability.
+func (v *VisionConfig) LooksAtImages() bool {
+	return v != nil && v.Enabled && strings.TrimSpace(v.Endpoint) != ""
+}
+
+// CaptureConfig — the meeting recorder (internal/capture,
+// docs/plans/08-hearing.md).
+//
+// Absent, or enabled=false, ⇒ the recorder is not wired and the capture methods
+// return "unknown method", so no client can start a recording however it asks.
+// A media block is required too: audio is never held only in memory.
+//
+// There is deliberately no "auto", no keyword trigger and no duration default
+// long enough to be forgotten about. Recording other people is an explicit act
+// with a start, a stop, and a cap.
+type CaptureConfig struct {
+	// Enabled — may she record a meeting when asked. Default false.
+	Enabled bool `json:"enabled,omitempty"`
+
+	// MaxMinutes — hard cap on one session; it stops itself there. 0 ⇒
+	// capture.DefaultMaxDuration (120 minutes).
+	MaxMinutes int `json:"max_minutes,omitempty"`
+
+	// STTWindow — audio handed to whisper per call. 0 ⇒
+	// capture.DefaultSTTWindow (5m). Larger windows transcribe slightly better
+	// and block the STT worker for longer.
+	STTWindow Duration `json:"stt_window,omitempty"`
+
+	// ChunkRunes — transcript runes per summarisation prompt. 0 ⇒
+	// capture.DefaultChunkRunes (3000), sized for the resident model's n_ctx of
+	// 4096. Raise this only if the resident model's context grows.
+	ChunkRunes int `json:"chunk_runes,omitempty"`
+
+	// MaxChunks — how many windows one meeting may be summarised in before the
+	// transcript is truncated and the summary says so. 0 ⇒
+	// capture.DefaultMaxChunks (40).
+	MaxChunks int `json:"max_chunks,omitempty"`
+
+	// SaveTranscript — write the full transcript as a note alongside the
+	// summary. Default false: a verbatim record of what other people said in a
+	// room is a heavier thing to keep than a four-line summary, so it takes a
+	// deliberate yes. The audio blob is pruned by media.retention either way.
+	SaveTranscript bool `json:"save_transcript,omitempty"`
+}
+
+// Records reports whether the recorder should be wired. Safe on a nil receiver.
+func (c *CaptureConfig) Records() bool {
+	return c != nil && c.Enabled
+}
+
+// MaxDuration is the configured session cap as a duration, or 0 for the
+// package default. Safe on a nil receiver.
+func (c *CaptureConfig) MaxDuration() time.Duration {
+	if c == nil || c.MaxMinutes <= 0 {
+		return 0
+	}
+	return time.Duration(c.MaxMinutes) * time.Minute
+}
+
+// SpeakerConfig — voice identification (internal/speaker,
+// docs/plans/10-speaker-recognition.md).
+//
+// Absent, or enabled=false, ⇒ no voiceprint is computed for any turn, the
+// enrolment methods do not exist, and nobody can be enrolled. A voiceprint is
+// biometric data about a person, so this one is off until someone typed a model
+// path on purpose.
+//
+// It cannot currently be turned on: there is no speaker-embedding model on this
+// box. See the plan document for what to download.
+type SpeakerConfig struct {
+	// Enabled — may she work out who is speaking. Default false.
+	Enabled bool `json:"enabled,omitempty"`
+
+	// ModelPath — an ECAPA-TDNN (or equivalent) speaker-embedding ONNX model.
+	// Required; without it the recognizer runs disabled and says so once.
+	ModelPath string `json:"model_path,omitempty"`
+
+	// LibPath — onnxruntime shared library, as for the text embedder. Empty ⇒
+	// the same default the embedder block uses.
+	LibPath string `json:"lib_path,omitempty"`
+
+	// Threshold — cosine similarity a match must beat. 0 ⇒
+	// speaker.DefaultThreshold (0.7). Lower it and she starts calling guests by
+	// his name, which is the expensive direction of this error.
+	Threshold float64 `json:"threshold,omitempty"`
+
+	// MinSeconds — least speech an identification will look at. 0 ⇒
+	// speaker.DefaultMinSeconds (2s).
+	MinSeconds float64 `json:"min_seconds,omitempty"`
+}
+
+// Recognizes reports whether voice identification should be wired. Safe on a
+// nil receiver, and false without a model path — enabled with nothing to embed
+// with is a misconfiguration, not a capability.
+func (s *SpeakerConfig) Recognizes() bool {
+	return s != nil && s.Enabled && strings.TrimSpace(s.ModelPath) != ""
+}
+
 // WeatherConfig configures the weather provider for voice queries.
 type WeatherConfig struct {
 	Provider        string `json:"provider,omitempty"`         // "open-meteo" or "" → stub
@@ -352,6 +691,185 @@ type DigestConfig struct {
 	SeverityCeiling int      `json:"severity_ceiling,omitempty"` // max sev batched
 }
 
+// PatternProposalConfig — announcement policy for routines the digestion tick
+// inferred by itself (Vikunja #247, #43).
+//
+// Detection is always on and always silent by default: the tick writes a
+// proposed_routines row and the /routines page shows it. Notify is what turns
+// "she noticed" into "she said something", and it is OFF unless configured —
+// Maven is not a nag and not autonomous, so a behaviour that speaks without
+// being asked has to be switched on deliberately, like weather and telegram.
+//
+// When Notify is on, the announcement is still heavily restrained:
+//   - at most one proposal per tick, however many were detected;
+//   - at most one per Cooldown across all pairs (not per pair), so a batch of
+//     freshly-detected patterns cannot turn into a queue of interruptions;
+//   - through the ordinary care-class gate (quiet hours / away / snooze), at
+//     sev1 — the lowest severity there is. A proposal is the least urgent
+//     thing Maven can say.
+//
+// A pair is only ever announced once, because it is only ever proposed once:
+// proposed_routines is UNIQUE(action, object) and the row survives dismissal.
+type PatternProposalConfig struct {
+	// Notify — announce newly inferred routines. Default false.
+	Notify bool `json:"notify,omitempty"`
+
+	// Cooldown — minimum spacing between two proposal announcements. 0 ⇒
+	// DefaultProposalCooldown (24h).
+	Cooldown Duration `json:"cooldown,omitempty"`
+}
+
+// AnnounceProposals reports whether inferred routines may be announced. Safe
+// on a nil receiver — an absent config block means silent detection.
+func (p *PatternProposalConfig) AnnounceProposals() bool {
+	return p != nil && p.Notify
+}
+
+// FeedsConfig — the RSS/Atom reader (Vikunja #258, docs/plans/13-rss-news-feeds.md).
+//
+// Absent ⇒ off, and off means no outbound request at all. Present with an empty
+// `sources` list is also off — a poller with nothing to poll is not wired.
+//
+// What a feed may NOT do here: speak. Items are written as notes with source
+// "rss:<name>" and read back when he asks; nothing is dispatched, nudged or
+// announced on arrival. That is the "not a nag" constraint, and it is why there
+// is no severity or channel field in this block to reach for.
+type FeedsConfig struct {
+	// Sources — the feeds to read. Empty ⇒ the reader stays down.
+	Sources []FeedSourceConfig `json:"sources,omitempty"`
+
+	// PollInterval — default per-feed cadence. 0 ⇒ rss.DefaultPollInterval (30m).
+	PollInterval Duration `json:"poll_interval,omitempty"`
+
+	// MaxItems — most items kept from one feed in one poll. 0 ⇒
+	// rss.DefaultMaxItems (5). This is the "не завали мне /dash" knob.
+	MaxItems int `json:"max_items,omitempty"`
+
+	// MaxAge — on a first poll (no saved mark), how far back to take items.
+	// 0 ⇒ rss.DefaultMaxAge (24h), so switching a feed on imports today, not
+	// the archive.
+	MaxAge Duration `json:"max_age,omitempty"`
+
+	// AllowHosts — when set, the reader may only connect to these hosts (and
+	// their subdomains). The feed URLs' own hosts are added automatically, so
+	// this is only needed to be stricter than that.
+	AllowHosts []string `json:"allow_hosts,omitempty"`
+
+	// Timeout — per-request budget. 0 ⇒ webfetch.DefaultTimeout.
+	Timeout Duration `json:"timeout,omitempty"`
+
+	// MaxBytes — response size cap. 0 ⇒ webfetch.DefaultMaxBytes (2 MiB).
+	MaxBytes int64 `json:"max_bytes,omitempty"`
+}
+
+// FeedSourceConfig — one feed.
+type FeedSourceConfig struct {
+	Name     string   `json:"name"`               // note source is "rss:<name>"
+	URL      string   `json:"url"`                // http(s) only
+	Category string   `json:"category,omitempty"` // "технологии" — what "что нового по X?" matches
+	Interval Duration `json:"interval,omitempty"` // 0 ⇒ FeedsConfig.PollInterval
+	Include  []string `json:"include,omitempty"`  // keep only items containing one of these
+	Exclude  []string `json:"exclude,omitempty"`  // drop items containing any of these
+}
+
+// CrawlConfig — the web crawler (Vikunja #259, docs/plans/14-web-crawler.md).
+//
+// Absent ⇒ off, and off means no page is ever fetched. Present with neither
+// `on_demand` nor a `watches` entry is also off: there would be nothing to do.
+//
+// The crawler is the LAST place an answer is looked for, behind the model, his
+// own memory and the local Kiwix ZIMs. That ordering lives in the query-source
+// chain (cmd/mavend/actions_query.go), not here, but it is the reason this block
+// is small: it is a fallback, not a search engine.
+//
+// Only the URL leaves the box. His notes, facts, persona block and history are
+// never part of a request — the crawler package cannot even read the store.
+type CrawlConfig struct {
+	// OnDemand — may he ask her to read a page he names out loud
+	// ("посмотри https://… — что там пишут?"). false ⇒ the on-demand answer
+	// source stays off and only the watches below run.
+	OnDemand bool `json:"on_demand,omitempty"`
+
+	// Watches — pages re-read on a schedule. A page whose text changed is
+	// written as a note (source "crawl:<name>"); nothing is announced.
+	Watches []CrawlWatchConfig `json:"watches,omitempty"`
+
+	// Interval — default watch cadence. 0 ⇒ crawl.DefaultWatchInterval (6h).
+	Interval Duration `json:"interval,omitempty"`
+
+	// AllowHosts — when set, the ONLY hosts the crawler may reach (subdomains
+	// included). Watched pages' own hosts are added automatically. Setting this
+	// is how "she may read the arch wiki and nothing else" is expressed.
+	AllowHosts []string `json:"allow_hosts,omitempty"`
+
+	// DenyHosts — never reachable, checked first. Private addresses do not need
+	// to be listed: they are refused unconditionally (see internal/webfetch).
+	DenyHosts []string `json:"deny_hosts,omitempty"`
+
+	// UserAgent — sent on every request AND matched against robots.txt groups.
+	// Empty ⇒ webfetch.DefaultUserAgent.
+	UserAgent string `json:"user_agent,omitempty"`
+
+	// Timeout — per-request budget. 0 ⇒ webfetch.DefaultTimeout.
+	Timeout Duration `json:"timeout,omitempty"`
+
+	// MaxBytes — response size cap. 0 ⇒ webfetch.DefaultMaxBytes (2 MiB).
+	MaxBytes int64 `json:"max_bytes,omitempty"`
+
+	// MaxRunes — how much extracted text is kept. 0 ⇒ crawl.DefaultMaxRunes
+	// (4000), which is what fits a 4096-token context alongside a prompt.
+	MaxRunes int `json:"max_runes,omitempty"`
+}
+
+// CrawlWatchConfig — one page kept an eye on.
+type CrawlWatchConfig struct {
+	Name     string   `json:"name"` // note source is "crawl:<name>"
+	URL      string   `json:"url"`
+	Interval Duration `json:"interval,omitempty"` // 0 ⇒ CrawlConfig.Interval
+}
+
+// MemoryEvalConfig — the background memory-evaluation loop (Vikunja #248).
+// Absent ⇒ off, like every other capability that costs something the owner did
+// not ask for. Each evaluation is a full LLM round-trip on the one resident
+// model, which is the same model answering him; running it hourly by default
+// would put a multi-second stall in front of an occasional voice turn for a
+// feature he may not want.
+//
+// The loop only ever writes notes (source infer:memory-eval, visible on
+// /dash). It cannot speak — see internal/memeval.
+type MemoryEvalConfig struct {
+	// Interval — how often to evaluate. 0 ⇒ DefaultMemoryEvalInterval.
+	Interval Duration `json:"interval,omitempty"`
+
+	// MaxItems — recent facts / notes / nudges fed into one evaluation.
+	// 0 ⇒ memeval.DefaultMaxItems.
+	MaxItems int `json:"max_items,omitempty"`
+
+	// MinConfidence — observations the model scores below this are dropped.
+	// 0 ⇒ memeval.DefaultMinConfidence.
+	MinConfidence float64 `json:"min_confidence,omitempty"`
+}
+
+// EmailConfig — core's half of the email reader: how many task candidates one
+// message may produce, and how long the extraction call may take.
+//
+// There is deliberately nothing about a mailbox here. Core does not connect to
+// IMAP, does not know an account exists, and holds no mail credential — the
+// reader daemon does, the same split mavpoll uses for the zenmoney token. This
+// block only says "extraction is allowed, with these bounds".
+type EmailConfig struct {
+	// MaxTasks — candidates per message. 0 ⇒ email.MaxCandidates (3).
+	MaxTasks int `json:"max_tasks,omitempty"`
+
+	// Timeout — per-message extraction budget. 0 ⇒ DefaultEmailTimeout. This is
+	// a Thinking model reading a mail; nobody is waiting on the answer, but a
+	// hung llama-server must not pin the reader's connection forever.
+	Timeout Duration `json:"timeout,omitempty"`
+}
+
+// DefaultEmailTimeout — extraction budget per message.
+const DefaultEmailTimeout = 2 * time.Minute
+
 // PhraserConfig — the LLM-backed phraser seam. The daemon spawns llama-server
 // as a managed subprocess and sends chat-completion requests to phrase nudge
 // and reminder messages. nil ⇒ the template-based Stub is used instead.
@@ -375,6 +893,21 @@ type PhraserConfig struct {
 	// persona and invented units). Chat, query and reminder phrasing always go
 	// through the model regardless. See phraser.Config.LLMNudges.
 	LLMNudges bool `json:"llm_nudges,omitempty"`
+
+	// SwapModels — the gguf files the running daemon is allowed to swap to
+	// without a restart (Vikunja #250). Empty (the default) means the swap
+	// capability does not exist: ipc.MethodSwapModel answers ErrUnknownMethod,
+	// exactly like an unconfigured weather or telegram block.
+	//
+	// It is an allowlist and not a directory on purpose. The request carries a
+	// path, and llama-server is started with it as `-m`; anything short of an
+	// exact match against a list a human wrote in this file would make "swap the
+	// model" mean "load a file of your choosing off my disk". ModelPath is
+	// always swappable back to whether or not it is listed.
+	//
+	// Paths must be absolute — the daemon's working directory is not the
+	// operator's, and a relative path here would resolve somewhere surprising.
+	SwapModels []string `json:"swap_models,omitempty"`
 }
 
 // EmbedderConfig — paths for the ONNX multilingual embedder. The daemon
@@ -448,6 +981,15 @@ const (
 	DefaultLLMRouter = true
 
 	DefaultFactEnrichmentInterval = 30 * time.Second
+
+	// DefaultProposalCooldown — one inferred-routine announcement per day at
+	// most. A proposal is never urgent; if two patterns surface in the same
+	// hour, the second one waits, and the /routines page has it either way.
+	DefaultProposalCooldown = 24 * time.Hour
+
+	// DefaultMemoryEvalInterval — the plan's cadence (1h) for the memory
+	// evaluation loop, applied only when the block is present at all.
+	DefaultMemoryEvalInterval = time.Hour
 )
 
 // Load reads the JSON config at path and applies defaults. A missing file is
@@ -520,6 +1062,42 @@ func (c *Config) applyDefaults() {
 		c.Digest.SeverityCeiling = 2
 	}
 
+	// Absent block stays nil (⇒ silent detection). Present-but-partial gets the
+	// cooldown default, so `{"notify": true}` is enough to switch it on.
+	if c.PatternProposals != nil && c.PatternProposals.Cooldown <= 0 {
+		c.PatternProposals.Cooldown = Duration(DefaultProposalCooldown)
+	}
+
+	// Same rule: absent stays nil (⇒ no evaluation loop), present gets defaults
+	// so `{}` is a valid "on with the plan's cadence".
+	if c.MemoryEval != nil && c.MemoryEval.Interval <= 0 {
+		c.MemoryEval.Interval = Duration(DefaultMemoryEvalInterval)
+	}
+
+	// Same rule again: absent stays nil (⇒ mail ingestion refused), present gets
+	// the timeout default so `{}` is a valid "on with the defaults".
+	if c.Email != nil && c.Email.Timeout <= 0 {
+		c.Email.Timeout = Duration(DefaultEmailTimeout)
+	}
+
+	// A feeds block with no sources is the same as no block: nothing to poll,
+	// nothing wired. Normalising it to nil keeps that "off" in one place.
+	if c.Feeds != nil && len(c.Feeds.Sources) == 0 {
+		c.Feeds = nil
+	}
+
+	// Same rule for MCP: a block with no server, or none enabled, is the same
+	// as no block at all. Normalising it to nil keeps "off" in one place.
+	if c.MCP != nil && len(c.MCPServers()) == 0 {
+		c.MCP = nil
+	}
+
+	// Same rule for the crawler: a block that neither answers on demand nor
+	// watches anything has nothing to do, so it is normalised to "off".
+	if c.Crawl != nil && !c.Crawl.OnDemand && len(c.Crawl.Watches) == 0 {
+		c.Crawl = nil
+	}
+
 	if c.Voice != nil {
 		if c.Voice.RouterThreshold <= 0 {
 			c.Voice.RouterThreshold = DefaultRouterThreshold
@@ -577,6 +1155,22 @@ func (c *Config) validate() error {
 		if c.Phraser.ModelPath == "" {
 			return errors.New("phraser.model_path is required")
 		}
+		// A relative entry in the swap allowlist would resolve against the
+		// daemon's working directory, so the path a human reads in this file
+		// would not be the path llama-server is handed. Fail at startup.
+		for _, m := range c.Phraser.SwapModels {
+			if !filepath.IsAbs(m) {
+				return fmt.Errorf("phraser.swap_models: %q must be an absolute path", m)
+			}
+		}
+	}
+	// The update block is validated here even though mavend never acts on it: a
+	// half-written update config that is only noticed by cmd/mavupdate is noticed
+	// at the worst possible moment, halfway through deploying a new build.
+	if c.Update != nil {
+		if err := c.Update.Validate(); err != nil {
+			return err
+		}
 	}
 	if c.Voice != nil && c.Voice.Enabled {
 		if c.Voice.Bind == "" {
@@ -602,6 +1196,12 @@ func (c *Config) validate() error {
 			return fmt.Errorf("routine %q: bad cron %q: %w", r.Name, r.Cron, err)
 		}
 	}
+	// An MCP block with a typo (no name, both command and url, a bare hostname
+	// as the url) fails here, at startup, rather than at the first turn that
+	// needed the tool.
+	if err := mcp.Validate(c.MCPServers()); err != nil {
+		return err
+	}
 	if len(c.MorningRoutines) > 0 {
 		if err := morning.Validate(morningRoutinesFromConfig(c.MorningRoutines)); err != nil {
 			return err

internal/config/config_test.go

@@ -243,3 +243,126 @@ func TestDurationRoundTrip(t *testing.T) {
 		t.Errorf("round-trip = %v, want %v", d2, d)
 	}
 }
+
+// Both new opt-in capabilities follow the same rule: absent block ⇒ nil ⇒ the
+// behaviour does not exist. Presence is the enable act, so a bare `{}` block is
+// valid and gets the defaults filled in.
+func TestOptInBlocksAbsentStayNil(t *testing.T) {
+	c, err := Load(writeConfig(t, `{}`))
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if c.PatternProposals != nil {
+		t.Errorf("pattern_proposals absent but got %+v", c.PatternProposals)
+	}
+	if c.PatternProposals.AnnounceProposals() {
+		t.Error("AnnounceProposals() true with no config block")
+	}
+	if c.MemoryEval != nil {
+		t.Errorf("memory_eval absent but got %+v", c.MemoryEval)
+	}
+}
+
+func TestOptInBlocksGetDefaultsWhenPresent(t *testing.T) {
+	c, err := Load(writeConfig(t, `{"pattern_proposals":{"notify":true},"memory_eval":{}}`))
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if !c.PatternProposals.AnnounceProposals() {
+		t.Error("notify:true did not enable announcements")
+	}
+	if time.Duration(c.PatternProposals.Cooldown) != DefaultProposalCooldown {
+		t.Errorf("proposal cooldown = %v, want %v", c.PatternProposals.Cooldown, DefaultProposalCooldown)
+	}
+	if time.Duration(c.MemoryEval.Interval) != DefaultMemoryEvalInterval {
+		t.Errorf("memory eval interval = %v, want %v", c.MemoryEval.Interval, DefaultMemoryEvalInterval)
+	}
+}
+
+// Notify is off even when the block exists — the block is where you tune it,
+// notify:true is the act that lets her speak.
+func TestPatternProposalNotifyDefaultsOff(t *testing.T) {
+	c, err := Load(writeConfig(t, `{"pattern_proposals":{"cooldown":"6h"}}`))
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if c.PatternProposals.AnnounceProposals() {
+		t.Error("notify defaulted to on")
+	}
+	if time.Duration(c.PatternProposals.Cooldown) != 6*time.Hour {
+		t.Errorf("cooldown = %v, want 6h", c.PatternProposals.Cooldown)
+	}
+}
+
+// TestSwapModelsAbsentMeansOff — the swap capability does not exist unless the
+// operator lists the models he allows (Vikunja #250).
+func TestSwapModelsAbsentMeansOff(t *testing.T) {
+	c, err := Load(writeConfig(t, `{"phraser": {"model_path": "/m/qwen.gguf"}}`))
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if len(c.Phraser.SwapModels) != 0 {
+		t.Errorf("swap_models = %v; want empty when unconfigured", c.Phraser.SwapModels)
+	}
+}
+
+func TestSwapModelsParsedAndMustBeAbsolute(t *testing.T) {
+	c, err := Load(writeConfig(t, `{"phraser": {
+		"model_path": "/m/qwen.gguf",
+		"swap_models": ["/m/qwen.gguf", "/m/qwen-cpt.gguf"]
+	}}`))
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if len(c.Phraser.SwapModels) != 2 {
+		t.Fatalf("swap_models = %v; want 2 entries", c.Phraser.SwapModels)
+	}
+	// A relative entry would resolve against the daemon's cwd, not the operator's.
+	if _, err := Load(writeConfig(t, `{"phraser": {
+		"model_path": "/m/qwen.gguf",
+		"swap_models": ["models/llm/qwen.gguf"]
+	}}`)); err == nil {
+		t.Error("Load accepted a relative swap_models entry; want a startup failure")
+	}
+}
+
+// TestUpdateBlockAbsentMeansOff — mavend never updates itself; the block only
+// exists so cmd/mavupdate can find the deployment it is asked to update
+// (Vikunja #249). Absent is the normal state.
+func TestUpdateBlockAbsentMeansOff(t *testing.T) {
+	c, err := Load(writeConfig(t, `{}`))
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if c.Update != nil {
+		t.Errorf("update = %+v; want nil when unconfigured", c.Update)
+	}
+}
+
+func TestUpdateBlockValidatedAtStartup(t *testing.T) {
+	good := `{"update": {
+		"source_dir": "/srv/maven",
+		"install_dir": "/srv/maven",
+		"snapshot_dir": "/var/lib/maven/snapshots",
+		"binaries": ["mavend", "mavweb"],
+		"restart_cmd": ["docker", "compose", "up", "-d", "--build", "mavend"],
+		"health_socket": "/run/maven/mavend.sock"
+	}}`
+	c, err := Load(writeConfig(t, good))
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if c.Update == nil || len(c.Update.Binaries) != 2 {
+		t.Fatalf("update block = %+v; want it parsed", c.Update)
+	}
+	// A block with no health check cannot detect its own failure, so it cannot
+	// roll back — refused at load, not halfway through a deploy.
+	noHealth := `{"update": {
+		"source_dir": "/srv/maven", "install_dir": "/srv/maven",
+		"snapshot_dir": "/var/lib/maven/snapshots",
+		"binaries": ["mavend"], "restart_cmd": ["true"]
+	}}`
+	if _, err := Load(writeConfig(t, noHealth)); err == nil {
+		t.Error("Load accepted an update block with no health_socket")
+	}
+}

internal/config/mcp_test.go

@@ -0,0 +1,82 @@
+package config
+
+import (
+	"testing"
+	"time"
+)
+
+func TestMCPAbsentIsOff(t *testing.T) {
+	c, err := Load(writeConfig(t, `{}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.MCP != nil {
+		t.Error("no mcp block ⇒ nil")
+	}
+	if got := c.MCPServers(); got != nil {
+		t.Errorf("MCPServers() = %+v, want nil", got)
+	}
+}
+
+// A described-but-not-enabled server must not be wired. This is how a block can
+// sit in the config file, reviewed, before it is switched on.
+func TestMCPDisabledServerIsOff(t *testing.T) {
+	c, err := Load(writeConfig(t, `{"mcp":{"servers":[
+		{"name":"vikunja","url":"http://localhost:9100/mcp","allow_private":true}]}}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if c.MCP != nil {
+		t.Errorf("a block with nothing enabled must normalise to nil, got %+v", c.MCP)
+	}
+	if got := c.MCPServers(); len(got) != 0 {
+		t.Errorf("MCPServers() = %+v", got)
+	}
+}
+
+func TestMCPEnabledServerMapping(t *testing.T) {
+	c, err := Load(writeConfig(t, `{"mcp":{
+		"timeout":"5s",
+		"servers":[
+			{"name":"vikunja","url":"http://localhost:9100/mcp","allow_private":true,
+			 "allow_tools":["list_tasks"],"max_tools":3,"enabled":true},
+			{"name":"files","command":"mcp-server-fs","args":["/srv"],"timeout":"1s","enabled":true},
+			{"name":"off","command":"nope"}
+		]}}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := c.MCPServers()
+	if len(got) != 2 {
+		t.Fatalf("servers = %+v", got)
+	}
+	if got[0].Name != "vikunja" || !got[0].AllowPrivate || got[0].MaxTools != 3 ||
+		len(got[0].AllowTools) != 1 || got[0].Timeout != 5*time.Second {
+		t.Errorf("vikunja mapped wrong: %+v", got[0])
+	}
+	if got[1].Command != "mcp-server-fs" || len(got[1].Args) != 1 || got[1].Timeout != time.Second {
+		t.Errorf("files mapped wrong: %+v", got[1])
+	}
+	// allow_private is per server and must not leak to the other one.
+	if got[1].AllowPrivate {
+		t.Error("allow_private leaked between servers")
+	}
+}
+
+func TestMCPBadServerFailsAtStartup(t *testing.T) {
+	cases := map[string]string{
+		"no name":     `{"mcp":{"servers":[{"command":"x","enabled":true}]}}`,
+		"both":        `{"mcp":{"servers":[{"name":"a","command":"x","url":"http://a.test","enabled":true}]}}`,
+		"neither":     `{"mcp":{"servers":[{"name":"a","enabled":true}]}}`,
+		"bad scheme":  `{"mcp":{"servers":[{"name":"a","url":"unix:///run/x.sock","enabled":true}]}}`,
+		"duplicate":   `{"mcp":{"servers":[{"name":"a","command":"x","enabled":true},{"name":"a","command":"y","enabled":true}]}}`,
+		"spacey name": `{"mcp":{"servers":[{"name":"a b","command":"x","enabled":true}]}}`,
+	}
+	for name, body := range cases {
+		t.Run(name, func(t *testing.T) {
+			if _, err := Load(writeConfig(t, body)); err == nil {
+				t.Fatal("want a startup error")
+			}
+		})
+	}
+}

internal/config/senses_test.go

@@ -0,0 +1,223 @@
+package config
+
+import (
+	"encoding/json"
+	"testing"
+	"time"
+)
+
+// Absent blocks must read as off on a nil receiver: the daemon calls these
+// helpers before it knows whether the operator configured anything.
+func TestSensesOffByDefault(t *testing.T) {
+	var cfg Config
+	if cfg.Media.StoreDir() != "" {
+		t.Error("media store dir is set with no media block")
+	}
+	if cfg.Vision.LooksAtImages() {
+		t.Error("vision is on with no vision block")
+	}
+	if cfg.Capture.Records() {
+		t.Error("the recorder is on with no capture block")
+	}
+	if cfg.Capture.MaxDuration() != 0 {
+		t.Error("a nil capture block invented a duration")
+	}
+	if cfg.Speaker.Recognizes() {
+		t.Error("speaker recognition is on with no speaker block")
+	}
+}
+
+// The recorder is the capability that most needs its default to be off, so it
+// gets its own test rather than a line in the one above.
+func TestCaptureIsOffUntilExplicitlyEnabled(t *testing.T) {
+	cases := []struct {
+		name string
+		c    *CaptureConfig
+		want bool
+	}{
+		{"absent", nil, false},
+		{"present but not enabled", &CaptureConfig{MaxMinutes: 60}, false},
+		{"enabled", &CaptureConfig{Enabled: true}, true},
+	}
+	for _, c := range cases {
+		if got := c.c.Records(); got != c.want {
+			t.Errorf("%s: Records() = %v, want %v", c.name, got, c.want)
+		}
+	}
+}
+
+func TestCaptureBlockParsesFromJSON(t *testing.T) {
+	raw := `{"capture":{"enabled":true,"max_minutes":45,"stt_window":"2m",
+	  "chunk_runes":2000,"max_chunks":10,"save_transcript":true}}`
+	var cfg Config
+	if err := json.Unmarshal([]byte(raw), &cfg); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if !cfg.Capture.Records() {
+		t.Fatal("capture did not parse as enabled")
+	}
+	if cfg.Capture.MaxDuration() != 45*time.Minute {
+		t.Errorf("max duration = %v", cfg.Capture.MaxDuration())
+	}
+	if time.Duration(cfg.Capture.STTWindow) != 2*time.Minute {
+		t.Errorf("stt window = %v", time.Duration(cfg.Capture.STTWindow))
+	}
+	if cfg.Capture.ChunkRunes != 2000 || cfg.Capture.MaxChunks != 10 {
+		t.Errorf("summariser limits = %+v", cfg.Capture)
+	}
+	if !cfg.Capture.SaveTranscript {
+		t.Error("save_transcript did not parse")
+	}
+}
+
+// Keeping the verbatim record of what other people said is the heavier act, so
+// it is separately opt-in from recording at all.
+func TestTranscriptIsNotSavedByDefault(t *testing.T) {
+	var cfg Config
+	if err := json.Unmarshal([]byte(`{"capture":{"enabled":true}}`), &cfg); err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Capture.SaveTranscript {
+		t.Error("transcripts are saved without anyone asking")
+	}
+	if cfg.Capture.MaxDuration() != 0 {
+		t.Error("max_minutes defaulted in config instead of in the package")
+	}
+}
+
+// enabled with nothing to talk to is a misconfiguration, not a capability.
+func TestVisionNeedsBothEnabledAndEndpoint(t *testing.T) {
+	cases := []struct {
+		name string
+		v    *VisionConfig
+		want bool
+	}{
+		{"absent", nil, false},
+		{"endpoint but not enabled", &VisionConfig{Endpoint: "http://127.0.0.1:8081"}, false},
+		{"enabled but no endpoint", &VisionConfig{Enabled: true}, false},
+		{"enabled, blank endpoint", &VisionConfig{Enabled: true, Endpoint: "   "}, false},
+		{"both", &VisionConfig{Enabled: true, Endpoint: "http://127.0.0.1:8081"}, true},
+	}
+	for _, c := range cases {
+		if got := c.v.LooksAtImages(); got != c.want {
+			t.Errorf("%s: LooksAtImages() = %v, want %v", c.name, got, c.want)
+		}
+	}
+}
+
+func TestSensesBlocksParseFromJSON(t *testing.T) {
+	raw := `{
+	  "db_path": "/tmp/x.db",
+	  "socket_path": "/tmp/x.sock",
+	  "media": {"dir": "media", "retention": "48h", "max_bytes": 1048576},
+	  "vision": {
+	    "enabled": true,
+	    "endpoint": "http://127.0.0.1:8081",
+	    "model": "qwen2.5-vl",
+	    "max_dim": 640,
+	    "max_tokens": 200,
+	    "timeout": "45s",
+	    "prompt": "Что тут?"
+	  }
+	}`
+	var cfg Config
+	if err := json.Unmarshal([]byte(raw), &cfg); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if cfg.Media.StoreDir() != "media" {
+		t.Errorf("media dir = %q", cfg.Media.StoreDir())
+	}
+	if time.Duration(cfg.Media.Retention) != 48*time.Hour {
+		t.Errorf("retention = %v", time.Duration(cfg.Media.Retention))
+	}
+	if cfg.Media.MaxBytes != 1<<20 {
+		t.Errorf("max_bytes = %d", cfg.Media.MaxBytes)
+	}
+	if !cfg.Vision.LooksAtImages() {
+		t.Fatal("vision did not parse as enabled")
+	}
+	if cfg.Vision.MaxDim != 640 || cfg.Vision.MaxTokens != 200 {
+		t.Errorf("vision limits = %+v", cfg.Vision)
+	}
+	if time.Duration(cfg.Vision.Timeout) != 45*time.Second {
+		t.Errorf("vision timeout = %v", time.Duration(cfg.Vision.Timeout))
+	}
+	if cfg.Vision.Prompt != "Что тут?" {
+		t.Errorf("prompt = %q", cfg.Vision.Prompt)
+	}
+}
+
+// A media dir set with no vision block is a valid state, and the useful one on a
+// box with no vision model: images can be kept, they just cannot be described.
+func TestMediaWithoutVisionIsValid(t *testing.T) {
+	var cfg Config
+	if err := json.Unmarshal([]byte(`{"media":{"dir":"/srv/media"}}`), &cfg); err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Media.StoreDir() != "/srv/media" {
+		t.Errorf("dir = %q", cfg.Media.StoreDir())
+	}
+	if cfg.Vision.LooksAtImages() {
+		t.Error("vision came on by itself")
+	}
+}
+
+// A voiceprint is a biometric of a named person. Nothing about it turns on by
+// itself: no speaker block means no recognition, and no enrolment either.
+func TestSpeakerIsOffUntilExplicitlyEnabled(t *testing.T) {
+	var cfg Config
+	if err := json.Unmarshal([]byte(`{}`), &cfg); err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Speaker.Recognizes() {
+		t.Error("speaker recognition came on with no config at all")
+	}
+	var empty Config
+	if err := json.Unmarshal([]byte(`{"speaker":{}}`), &empty); err != nil {
+		t.Fatal(err)
+	}
+	if empty.Speaker.Recognizes() {
+		t.Error("an empty speaker block enabled recognition")
+	}
+}
+
+// Enabled alone is not enough: recognition needs a model, and on this box there
+// is none. Recognizes() must stay false so the daemon reports the honest state
+// instead of claiming a capability it cannot perform.
+func TestSpeakerNeedsBothEnabledAndAModel(t *testing.T) {
+	var cfg Config
+	if err := json.Unmarshal([]byte(`{"speaker":{"enabled":true}}`), &cfg); err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Speaker.Recognizes() {
+		t.Error("enabled with no model_path claimed to recognise")
+	}
+	var only Config
+	if err := json.Unmarshal([]byte(`{"speaker":{"model_path":"/opt/x.onnx"}}`), &only); err != nil {
+		t.Fatal(err)
+	}
+	if only.Speaker.Recognizes() {
+		t.Error("a model_path alone enabled recognition")
+	}
+}
+
+func TestSpeakerBlockParsesFromJSON(t *testing.T) {
+	const raw = `{"speaker":{"enabled":true,"model_path":"/opt/maven/models/spk/ecapa.onnx",` +
+		`"lib_path":"/opt/maven/lib","threshold":0.62,"min_seconds":1.5}}`
+	var cfg Config
+	if err := json.Unmarshal([]byte(raw), &cfg); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if !cfg.Speaker.Recognizes() {
+		t.Fatal("speaker did not parse as enabled")
+	}
+	if cfg.Speaker.ModelPath != "/opt/maven/models/spk/ecapa.onnx" {
+		t.Errorf("model_path = %q", cfg.Speaker.ModelPath)
+	}
+	if cfg.Speaker.LibPath != "/opt/maven/lib" {
+		t.Errorf("lib_path = %q", cfg.Speaker.LibPath)
+	}
+	if cfg.Speaker.Threshold != 0.62 || cfg.Speaker.MinSeconds != 1.5 {
+		t.Errorf("thresholds = %+v", cfg.Speaker)
+	}
+}

internal/crawl/crawl.go

@@ -0,0 +1,174 @@
+// Package crawl reads a web page: fetch, robots check, HTML to text.
+//
+// It is the LAST place Maven looks for an answer, and that ordering is the whole
+// design. "Never phones home" is deprecated, but what replaced it puts local
+// sources first: the resident model, then his own memory, then the Kiwix ZIMs on
+// the box (internal/kiwix), and only then the network. A local read costs
+// nothing and leaks nothing; a fetch costs a round-trip and puts a URL in
+// someone's access log. So this package exists to be the fallback, not the
+// front door — see the querySources chain in cmd/mavend/actions_query.go for
+// where it actually sits.
+//
+// What never leaves the box: his notes, his facts, the persona block, the
+// conversation history. Only the URL is requested and, for the on-demand path,
+// only because he said it out loud. Nothing here reads the store.
+//
+// The limits are not in this package — they are in internal/webfetch, which is
+// the only way anything here touches a socket: http(s) only, host allow/deny,
+// private-address refusal, size cap, redirect cap, per-host rate limit. What
+// this package adds is politeness (robots.txt) and dedup.
+package crawl
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"net/url"
+	"strings"
+	"time"
+)
+
+// Errors callers distinguish.
+var (
+	ErrRobots  = errors.New("crawl: robots.txt disallows this path")
+	ErrNotHTML = errors.New("crawl: response is not html or text")
+)
+
+// Fetcher is the guarded HTTP door (internal/webfetch adapted by the daemon). An
+// interface so this package constructs no http.Client of its own and can be
+// tested without a network.
+type Fetcher interface {
+	Get(ctx context.Context, url string) (*Response, error)
+}
+
+// Response is the minimum a crawl needs from a fetch.
+type Response struct {
+	URL         string
+	ContentType string
+	Body        []byte
+}
+
+// Config — crawler knobs.
+type Config struct {
+	// UserAgent is the name matched against robots.txt groups. It must be the
+	// same string the fetcher sends, or Maven would be claiming one identity
+	// and obeying the rules for another.
+	UserAgent string
+	// MaxRunes caps extracted text. 0 ⇒ DefaultMaxRunes.
+	MaxRunes int
+	// RobotsTTL — how long a parsed robots.txt is trusted. 0 ⇒ 1h.
+	RobotsTTL time.Duration
+	// Now is injectable for tests. nil ⇒ time.Now.
+	Now func() time.Time
+}
+
+// Crawler fetches and extracts pages. Safe for concurrent use.
+type Crawler struct {
+	fetch  Fetcher
+	cfg    Config
+	robots *robotsCache
+}
+
+// New builds a crawler. Returns nil when there is no fetcher, which is how the
+// daemon expresses "crawling is off unless configured".
+func New(fetch Fetcher, cfg Config) *Crawler {
+	if fetch == nil {
+		return nil
+	}
+	if cfg.UserAgent == "" {
+		cfg.UserAgent = "Maven"
+	}
+	if cfg.MaxRunes <= 0 {
+		cfg.MaxRunes = DefaultMaxRunes
+	}
+	if cfg.RobotsTTL <= 0 {
+		cfg.RobotsTTL = time.Hour
+	}
+	if cfg.Now == nil {
+		cfg.Now = time.Now
+	}
+	return &Crawler{fetch: fetch, cfg: cfg, robots: newRobotsCache(cfg.RobotsTTL)}
+}
+
+// Page fetches rawURL and returns its text. It checks robots.txt first and
+// refuses a disallowed path with ErrRobots — there is no override.
+func (c *Crawler) Page(ctx context.Context, rawURL string) (Page, error) {
+	u, err := url.Parse(strings.TrimSpace(rawURL))
+	if err != nil {
+		return Page{}, fmt.Errorf("crawl: bad url %q: %w", rawURL, err)
+	}
+	ok, err := c.allowed(ctx, u)
+	if err != nil {
+		return Page{}, err
+	}
+	if !ok {
+		return Page{}, fmt.Errorf("%w: %s", ErrRobots, u.Path)
+	}
+	resp, err := c.fetch.Get(ctx, u.String())
+	if err != nil {
+		return Page{}, err
+	}
+	// A PDF or an image is bytes Maven cannot read; saying so beats storing
+	// binary garbage as a "note".
+	ct := strings.ToLower(resp.ContentType)
+	if ct != "" && !strings.Contains(ct, "html") && !strings.Contains(ct, "text/") &&
+		!strings.Contains(ct, "xml") && !strings.Contains(ct, "json") {
+		return Page{}, fmt.Errorf("%w: %s", ErrNotHTML, resp.ContentType)
+	}
+	return Extract(resp.URL, resp.Body, c.cfg.MaxRunes), nil
+}
+
+// allowed consults robots.txt for u's host, reading it at most once per TTL.
+//
+// A robots.txt that cannot be fetched (404, a timeout, a blocked host) means
+// allow, per the standard. The one thing that is NOT fail-open is an explicit
+// Disallow.
+func (c *Crawler) allowed(ctx context.Context, u *url.URL) (bool, error) {
+	host := u.Host
+	now := c.cfg.Now()
+	rules, ok := c.robots.get(host, now)
+	if !ok {
+		robotsURL := u.Scheme + "://" + host + "/robots.txt"
+		resp, err := c.fetch.Get(ctx, robotsURL)
+		switch {
+		case err != nil:
+			// Note what is NOT swallowed: a refusal from the guarded fetcher.
+			// If webfetch says this host is denied or private, the page fetch
+			// would fail the same way, and reporting the real reason beats
+			// reporting a robots verdict we never got.
+			if isFatalFetchError(err) {
+				return false, err
+			}
+			rules = Rules{}
+		default:
+			rules = ParseRobots(string(resp.Body), c.cfg.UserAgent)
+		}
+		c.robots.put(host, rules, now)
+	}
+	path := u.EscapedPath()
+	if u.RawQuery != "" {
+		path += "?" + u.RawQuery
+	}
+	return rules.Allowed(path), nil
+}
+
+// isFatalFetchError — a fetch failure that means "this host is off limits"
+// rather than "there is no robots.txt here". The sentinel set is webfetch's, but
+// this package must not import it (the interface exists precisely so it does
+// not), so the check is on the message. Ugly and honest: the alternative is a
+// dependency inversion for two strings.
+func isFatalFetchError(err error) bool {
+	s := err.Error()
+	return strings.Contains(s, "not allowed") || strings.Contains(s, "private address") ||
+		strings.Contains(s, "only http and https")
+}
+
+// Hash is the dedup key for a crawl result: the sha256 of the extracted text,
+// hex, first 16 chars. Text and not raw HTML, because a page whose only change
+// is a rotating ad slot or a CSRF token has not changed.
+func Hash(text string) string {
+	sum := sha256.Sum256([]byte(strings.TrimSpace(text)))
+	return hex.EncodeToString(sum[:])[:16]
+}

internal/crawl/crawl_test.go

@@ -0,0 +1,155 @@
+package crawl
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+)
+
+// fakeFetcher serves canned pages by URL and counts requests, so a test can
+// assert that robots.txt was read once and that a refusal never reached the page.
+type fakeFetcher struct {
+	pages map[string]Response
+	err   error
+	calls []string
+}
+
+func (f *fakeFetcher) Get(_ context.Context, u string) (*Response, error) {
+	f.calls = append(f.calls, u)
+	if f.err != nil {
+		return nil, f.err
+	}
+	r, ok := f.pages[u]
+	if !ok {
+		return nil, errors.New("http 404")
+	}
+	if r.URL == "" {
+		r.URL = u
+	}
+	if r.ContentType == "" {
+		r.ContentType = "text/html; charset=utf-8"
+	}
+	return &r, nil
+}
+
+const htmlPage = `<html><head><title>Почему небо синее</title>
+<style>body{color:red}</style><script>track()</script></head>
+<body><nav>меню</nav><h1>Небо</h1>
+<p>Свет рассеивается на молекулах воздуха.</p>
+<p>Короткие волны рассеиваются сильнее.</p>
+<footer>© 2026</footer></body></html>`
+
+func newTestCrawler(f *fakeFetcher) *Crawler {
+	return New(f, Config{UserAgent: "Maven/1.0", Now: func() time.Time { return time.Unix(0, 0) }})
+}
+
+func TestPageExtractsText(t *testing.T) {
+	f := &fakeFetcher{pages: map[string]Response{
+		"https://example.org/sky": {Body: []byte(htmlPage)},
+	}}
+	page, err := newTestCrawler(f).Page(context.Background(), "https://example.org/sky")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if page.Title != "Почему небо синее" {
+		t.Errorf("title = %q", page.Title)
+	}
+	if !strings.Contains(page.Text, "Свет рассеивается") {
+		t.Errorf("body text missing: %q", page.Text)
+	}
+	for _, junk := range []string{"track()", "color:red", "меню", "© 2026"} {
+		if strings.Contains(page.Text, junk) {
+			t.Errorf("%q survived extraction: %q", junk, page.Text)
+		}
+	}
+}
+
+func TestRobotsIsCheckedAndObeyed(t *testing.T) {
+	f := &fakeFetcher{pages: map[string]Response{
+		"https://example.org/robots.txt": {Body: []byte("User-agent: *\nDisallow: /secret\n"), ContentType: "text/plain"},
+		"https://example.org/secret/x":   {Body: []byte(htmlPage)},
+		"https://example.org/open":       {Body: []byte(htmlPage)},
+	}}
+	c := newTestCrawler(f)
+	if _, err := c.Page(context.Background(), "https://example.org/secret/x"); !errors.Is(err, ErrRobots) {
+		t.Fatalf("error = %v, want ErrRobots", err)
+	}
+	for _, u := range f.calls {
+		if strings.Contains(u, "/secret") {
+			t.Fatal("the disallowed page was fetched anyway")
+		}
+	}
+	if _, err := c.Page(context.Background(), "https://example.org/open"); err != nil {
+		t.Fatalf("allowed page: %v", err)
+	}
+	// robots.txt was read once for the host, not once per page.
+	robotsReads := 0
+	for _, u := range f.calls {
+		if strings.HasSuffix(u, "/robots.txt") {
+			robotsReads++
+		}
+	}
+	if robotsReads != 1 {
+		t.Fatalf("robots.txt read %d times, want 1", robotsReads)
+	}
+}
+
+// No robots.txt means allow — that is the standard, and the alternative makes
+// most of the web unreadable.
+func TestMissingRobotsAllows(t *testing.T) {
+	f := &fakeFetcher{pages: map[string]Response{
+		"https://example.org/page": {Body: []byte(htmlPage)},
+	}}
+	if _, err := newTestCrawler(f).Page(context.Background(), "https://example.org/page"); err != nil {
+		t.Fatalf("err = %v, want the page", err)
+	}
+}
+
+// A refusal from the guarded fetcher must surface as itself, not be laundered
+// into "no robots.txt, go ahead".
+func TestFetcherRefusalIsNotSwallowed(t *testing.T) {
+	f := &fakeFetcher{err: errors.New("webfetch: refusing to connect to a private address: 127.0.0.1")}
+	_, err := newTestCrawler(f).Page(context.Background(), "http://127.0.0.1:9100/mcp")
+	if err == nil || !strings.Contains(err.Error(), "private address") {
+		t.Fatalf("error = %v, want the fetcher's refusal", err)
+	}
+}
+
+func TestNonTextIsRefused(t *testing.T) {
+	f := &fakeFetcher{pages: map[string]Response{
+		"https://example.org/f.pdf": {Body: []byte("%PDF-1.7"), ContentType: "application/pdf"},
+	}}
+	if _, err := newTestCrawler(f).Page(context.Background(), "https://example.org/f.pdf"); !errors.Is(err, ErrNotHTML) {
+		t.Fatalf("error = %v, want ErrNotHTML", err)
+	}
+}
+
+func TestMaxRunesCapsText(t *testing.T) {
+	long := "<html><body><p>" + strings.Repeat("привет ", 2000) + "</p></body></html>"
+	f := &fakeFetcher{pages: map[string]Response{"https://example.org/l": {Body: []byte(long)}}}
+	c := New(f, Config{MaxRunes: 50})
+	page, err := c.Page(context.Background(), "https://example.org/l")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n := len([]rune(page.Text)); n > 51 {
+		t.Fatalf("text = %d runes, want the 50-rune cap", n)
+	}
+}
+
+func TestNewWithoutFetcherIsNil(t *testing.T) {
+	if New(nil, Config{}) != nil {
+		t.Fatal("a crawler with no fetcher must be nil — crawling is off unless configured")
+	}
+}
+
+func TestHashIgnoresNothingButText(t *testing.T) {
+	if Hash("a") == Hash("b") {
+		t.Fatal("different text hashed the same")
+	}
+	if Hash(" same \n") != Hash("same") {
+		t.Fatal("surrounding whitespace changed the hash")
+	}
+}

internal/crawl/extract.go

@@ -0,0 +1,106 @@
+package crawl
+
+import (
+	"html"
+	"regexp"
+	"strings"
+)
+
+// HTML → text, with a regexp and no tokenizer.
+//
+// golang.org/x/net/html is not vendored and the network is not assumed, so this
+// is stdlib. That is less of a compromise than it sounds: the unit of context
+// here is a few hundred words for a 4096-token model to read, exactly like the
+// Kiwix snippet, so what matters is dropping script/style/nav noise and keeping
+// paragraph boundaries. A DOM would buy correctness on malformed markup that is
+// then thrown away by truncation anyway.
+//
+// What this deliberately does NOT do: run JavaScript, follow links, or extract
+// structured fields with CSS selectors or an LLM prompt. The plan's step 2 asked
+// for the last of those; see docs/plans/14-web-crawler.md for why it was left
+// out for now.
+
+var (
+	// RE2 has no backreferences, so each tag pair is spelled out rather than
+	// captured and matched against itself.
+	dropRE  = regexp.MustCompile(pairsRE("script", "style", "noscript", "svg", "head", "nav", "footer", "form"))
+	titleRE = regexp.MustCompile(`(?is)<title\b[^>]*>(.*?)</title>`)
+	h1RE    = regexp.MustCompile(`(?is)<h1\b[^>]*>(.*?)</h1>`)
+	// Block-level tags become newlines so paragraphs survive as paragraphs.
+	blockRE   = regexp.MustCompile(`(?is)</?(p|div|br|li|tr|h[1-6]|section|article|blockquote|pre)\b[^>]*>`)
+	tagRE     = regexp.MustCompile(`(?s)<[^>]*>`)
+	commentRE = regexp.MustCompile(`(?s)<!--.*?-->`)
+	spaceRE   = regexp.MustCompile(`[ \t\f\v]+`)
+	blankRE   = regexp.MustCompile(`\n{2,}`)
+)
+
+// pairsRE builds `(?is)<tag …>…</tag>|…` for the given tags.
+func pairsRE(tags ...string) string {
+	parts := make([]string, 0, len(tags))
+	for _, t := range tags {
+		parts = append(parts, `<`+t+`\b[^>]*>.*?</`+t+`>`)
+	}
+	return `(?is)` + strings.Join(parts, "|")
+}
+
+// Page is an extracted page.
+type Page struct {
+	URL   string
+	Title string
+	Text  string // plain text, paragraphs separated by single newlines
+}
+
+// Extract turns a fetched HTML document into a Page. maxRunes caps the text (0 ⇒
+// DefaultMaxRunes); the cap is on runes, not bytes, because a Russian page cut
+// at a byte boundary ends in half a letter.
+func Extract(url string, body []byte, maxRunes int) Page {
+	if maxRunes <= 0 {
+		maxRunes = DefaultMaxRunes
+	}
+	s := string(body)
+	s = commentRE.ReplaceAllString(s, " ")
+
+	title := firstGroup(titleRE, s)
+	if title == "" {
+		title = firstGroup(h1RE, s)
+	}
+
+	s = dropRE.ReplaceAllString(s, "\n")
+	s = blockRE.ReplaceAllString(s, "\n")
+	s = tagRE.ReplaceAllString(s, " ")
+	s = html.UnescapeString(s)
+	s = spaceRE.ReplaceAllString(s, " ")
+
+	var lines []string
+	for _, l := range strings.Split(s, "\n") {
+		if l = strings.TrimSpace(l); l != "" {
+			lines = append(lines, l)
+		}
+	}
+	text := blankRE.ReplaceAllString(strings.Join(lines, "\n"), "\n")
+
+	return Page{URL: url, Title: title, Text: TrimRunes(text, maxRunes)}
+}
+
+// DefaultMaxRunes — how much of a page is kept. ~4000 runes is a long answer's
+// worth of context and still leaves room in a 4096-token window for the prompt
+// and the reply.
+const DefaultMaxRunes = 4000
+
+func firstGroup(re *regexp.Regexp, s string) string {
+	m := re.FindStringSubmatch(s)
+	if len(m) < 2 {
+		return ""
+	}
+	t := tagRE.ReplaceAllString(m[1], " ")
+	return strings.TrimSpace(strings.Join(strings.Fields(html.UnescapeString(t)), " "))
+}
+
+// TrimRunes cuts s to at most max runes, on a rune boundary.
+func TrimRunes(s string, max int) string {
+	r := []rune(s)
+	if len(r) <= max {
+		return s
+	}
+	return strings.TrimSpace(string(r[:max])) + "…"
+}

internal/crawl/robots.go

@@ -0,0 +1,211 @@
+package crawl
+
+import (
+	"regexp"
+	"strings"
+	"sync"
+	"time"
+)
+
+// robots.txt, parsed the small way: no wildcards beyond the two the standard
+// actually defines (`*` inside a path and `$` at the end), no sitemaps, no
+// crawl-delay-per-agent gymnastics. A personal assistant reading a handful of
+// pages does not need a spec-complete implementation; it needs to not be rude,
+// and to be auditable in one sitting.
+//
+// Two rules worth stating because they are choices, not accidents:
+//
+//   - a missing or unreadable robots.txt means ALLOW. That is what the standard
+//     says (404 ⇒ unrestricted), and the alternative would make a site that
+//     simply has no robots.txt unreadable;
+//   - an explicit Disallow means REFUSE, and Maven does not offer an override.
+//     There is no "but he asked me to" flag: the page is not read.
+
+// Rules is a parsed robots.txt for one user-agent.
+type Rules struct {
+	allow    []string
+	disallow []string
+	// Delay is Crawl-delay in seconds when the group named one, 0 otherwise.
+	// The fetcher's own per-host rate limit is the floor; this can only make
+	// Maven slower, never faster.
+	Delay time.Duration
+}
+
+// ParseRobots reads robots.txt and returns the rules that apply to agent.
+//
+// Group selection follows the standard: the most specific matching group wins,
+// which here means an exact user-agent match beats `*`. Lines that are neither
+// are ignored rather than guessed at.
+func ParseRobots(body string, agent string) Rules {
+	agent = strings.ToLower(agent)
+
+	type group struct {
+		agents   []string
+		allow    []string
+		disallow []string
+		delay    time.Duration
+	}
+	var groups []group
+	var cur *group
+	// startNew tracks whether the next User-agent line opens a new group or
+	// joins the current one: consecutive User-agent lines share their rules.
+	startNew := true
+
+	for _, raw := range strings.Split(body, "\n") {
+		line := raw
+		if i := strings.IndexByte(line, '#'); i >= 0 {
+			line = line[:i]
+		}
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		key, val, ok := strings.Cut(line, ":")
+		if !ok {
+			continue
+		}
+		key = strings.ToLower(strings.TrimSpace(key))
+		val = strings.TrimSpace(val)
+
+		switch key {
+		case "user-agent":
+			if startNew || cur == nil {
+				groups = append(groups, group{})
+				cur = &groups[len(groups)-1]
+				startNew = false
+			}
+			cur.agents = append(cur.agents, strings.ToLower(val))
+		case "disallow":
+			if cur == nil {
+				continue
+			}
+			startNew = true
+			// "Disallow:" with an empty value allows everything, and is not a
+			// path rule at all.
+			if val != "" {
+				cur.disallow = append(cur.disallow, val)
+			}
+		case "allow":
+			if cur == nil {
+				continue
+			}
+			startNew = true
+			if val != "" {
+				cur.allow = append(cur.allow, val)
+			}
+		case "crawl-delay":
+			if cur == nil {
+				continue
+			}
+			startNew = true
+			if d, err := time.ParseDuration(val + "s"); err == nil && d > 0 {
+				cur.delay = d
+			}
+		}
+	}
+
+	var star, exact *group
+	for i := range groups {
+		for _, a := range groups[i].agents {
+			if a == "*" && star == nil {
+				star = &groups[i]
+			}
+			// A robots.txt names "maven", we send "Maven/1.0 (…)": match on
+			// prefix, which is how every crawler reads this field.
+			if a != "*" && a != "" && strings.HasPrefix(agent, a) {
+				exact = &groups[i]
+			}
+		}
+	}
+	g := exact
+	if g == nil {
+		g = star
+	}
+	if g == nil {
+		return Rules{}
+	}
+	return Rules{allow: g.allow, disallow: g.disallow, Delay: g.delay}
+}
+
+// Allowed reports whether path may be fetched. Longest matching rule wins, and
+// Allow beats Disallow at equal length — the standard's tie-break, and the one
+// that makes "Disallow: /" plus "Allow: /public" mean what it looks like.
+func (r Rules) Allowed(path string) bool {
+	if path == "" {
+		path = "/"
+	}
+	best, allowed := -1, true
+	for _, p := range r.disallow {
+		if n, ok := matchPath(p, path); ok && n > best {
+			best, allowed = n, false
+		}
+	}
+	for _, p := range r.allow {
+		if n, ok := matchPath(p, path); ok && n >= best {
+			best, allowed = n, true
+		}
+	}
+	return allowed
+}
+
+// matchPath applies a robots path pattern and returns the pattern's length as
+// the specificity score. `*` matches any run of characters, `$` anchors the end.
+// A pattern is a PREFIX match otherwise, which is what "Disallow: /admin" means.
+func matchPath(pattern, path string) (int, bool) {
+	score := len(pattern)
+	re, err := robotsRegexp(pattern)
+	if err != nil {
+		return 0, false
+	}
+	return score, re.MatchString(path)
+}
+
+// robotsRegexp turns a robots path pattern into an anchored-at-the-start
+// regexp. Everything but `*` and a trailing `$` is a literal, so the pattern is
+// quoted first and the two metacharacters are put back afterwards.
+func robotsRegexp(pattern string) (*regexp.Regexp, error) {
+	end := ""
+	if strings.HasSuffix(pattern, "$") {
+		pattern = strings.TrimSuffix(pattern, "$")
+		end = "$"
+	}
+	parts := strings.Split(pattern, "*")
+	for i, p := range parts {
+		parts[i] = regexp.QuoteMeta(p)
+	}
+	return regexp.Compile("^" + strings.Join(parts, ".*") + end)
+}
+
+// robotsCache holds parsed rules per host so a crawl of ten pages on one site
+// reads robots.txt once. TTL because a site may change its mind, and a daemon
+// that runs for weeks would otherwise never notice.
+type robotsCache struct {
+	ttl time.Duration
+	mu  sync.Mutex
+	m   map[string]robotsEntry
+}
+
+type robotsEntry struct {
+	rules Rules
+	at    time.Time
+}
+
+func newRobotsCache(ttl time.Duration) *robotsCache {
+	return &robotsCache{ttl: ttl, m: map[string]robotsEntry{}}
+}
+
+func (c *robotsCache) get(host string, now time.Time) (Rules, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	e, ok := c.m[host]
+	if !ok || now.Sub(e.at) > c.ttl {
+		return Rules{}, false
+	}
+	return e.rules, true
+}
+
+func (c *robotsCache) put(host string, r Rules, now time.Time) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.m[host] = robotsEntry{rules: r, at: now}
+}

internal/crawl/robots_test.go

@@ -0,0 +1,84 @@
+package crawl
+
+import (
+	"testing"
+	"time"
+)
+
+const robotsBody = `# a comment
+User-agent: *
+Disallow: /private
+Disallow: /tmp/
+Crawl-delay: 5
+
+User-agent: Maven
+Disallow: /
+Allow: /public
+`
+
+func TestParseRobotsPicksTheMostSpecificGroup(t *testing.T) {
+	// The Maven group applies to us even though we send a longer UA string.
+	r := ParseRobots(robotsBody, "Maven/1.0 (self-hosted personal assistant)")
+	if r.Allowed("/anything") {
+		t.Error("Disallow: / in our own group was ignored")
+	}
+	if !r.Allowed("/public/page") {
+		t.Error("Allow: /public must beat the shorter Disallow: /")
+	}
+
+	// A different agent falls into the * group.
+	star := ParseRobots(robotsBody, "SomeoneElse/2")
+	if !star.Allowed("/anything") {
+		t.Error("the * group disallows nothing but /private and /tmp/")
+	}
+	if star.Allowed("/private/x") || star.Allowed("/tmp/") {
+		t.Error("the * group's disallows were not applied")
+	}
+	if star.Delay != 5*time.Second {
+		t.Errorf("crawl-delay = %v, want 5s", star.Delay)
+	}
+}
+
+func TestParseRobotsEmptyMeansAllowAll(t *testing.T) {
+	for _, body := range []string{"", "# nothing here\n", "User-agent: *\nDisallow:\n"} {
+		if !ParseRobots(body, "Maven").Allowed("/whatever") {
+			t.Errorf("body %q must allow everything", body)
+		}
+	}
+}
+
+func TestRobotsWildcards(t *testing.T) {
+	r := ParseRobots("User-agent: *\nDisallow: /*.pdf$\nDisallow: /a/*/secret\n", "Maven")
+	if r.Allowed("/docs/manual.pdf") {
+		t.Error("*.pdf$ did not match")
+	}
+	if !r.Allowed("/docs/manual.pdf.html") {
+		t.Error("$ must anchor at the end")
+	}
+	if r.Allowed("/a/b/secret") {
+		t.Error("/a/*/secret did not match")
+	}
+	if !r.Allowed("/a/b/public") {
+		t.Error("unrelated path was refused")
+	}
+}
+
+// Consecutive User-agent lines share one group, which is common in the wild.
+func TestRobotsSharedGroup(t *testing.T) {
+	r := ParseRobots("User-agent: Googlebot\nUser-agent: Maven\nDisallow: /x\n", "Maven/1.0")
+	if r.Allowed("/x/y") {
+		t.Fatal("a shared group's rules were not applied to the second agent")
+	}
+}
+
+func TestRobotsCacheTTL(t *testing.T) {
+	c := newRobotsCache(time.Minute)
+	now := time.Now()
+	c.put("example.com", ParseRobots("User-agent: *\nDisallow: /\n", "Maven"), now)
+	if _, ok := c.get("example.com", now.Add(30*time.Second)); !ok {
+		t.Error("a fresh entry must be served from cache")
+	}
+	if _, ok := c.get("example.com", now.Add(2*time.Minute)); ok {
+		t.Error("an expired entry must be re-read")
+	}
+}

internal/crawl/watch.go

@@ -0,0 +1,177 @@
+package crawl
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"strings"
+	"time"
+)
+
+// Scheduled crawls: a page is re-read on an interval, and when its TEXT changed
+// the new text is written as a note. Nothing is dispatched — same rule as the
+// feed poller (Vikunja #258). A page that announced its own change would be a
+// nag, and "the docs page changed" is not worth interrupting anyone for.
+//
+// Dedup is by content hash, so a page that re-renders identically writes nothing
+// and a rotating ad slot does not count as news.
+
+// WatchConfig — one page to keep an eye on.
+type WatchConfig struct {
+	Name     string        // note source is "crawl:<Name>"
+	URL      string        // http(s), guarded by the fetcher
+	Interval time.Duration // 0 ⇒ Watcher's default
+}
+
+// Notes is core's note-writing half (same shape as ipc.CoreAPI's method).
+type Notes interface {
+	WriteNote(ctx context.Context, ts time.Time, text string, embedding []float32, source string) (int64, error)
+}
+
+// Hashes remembers the last text hash per watch, durably, so a restart does not
+// re-note an unchanged page. The daemon backs this with config facts
+// ("crawl:hash:<name>").
+type Hashes interface {
+	LastHash(ctx context.Context, name string) (string, error)
+	SetHash(ctx context.Context, name, hash string) error
+}
+
+// Embedder embeds a note on its way into the store. nil ⇒ no vector.
+type Embedder interface {
+	Embed(ctx context.Context, text string) ([]float32, error)
+}
+
+// DefaultWatchInterval — pages change slowly, and every check is a request in
+// someone's log.
+const DefaultWatchInterval = 6 * time.Hour
+
+// Watcher re-reads watched pages on their interval.
+type Watcher struct {
+	c        *Crawler
+	watches  []WatchConfig
+	notes    Notes
+	hashes   Hashes
+	embed    Embedder
+	interval time.Duration
+	nextDue  map[string]time.Time
+}
+
+// NewWatcher wires the scheduled half, or returns nil when there is nothing to
+// watch. Callers check for nil: no watches, no goroutine, no request.
+func NewWatcher(c *Crawler, watches []WatchConfig, notes Notes, hashes Hashes, embed Embedder, defaultInterval time.Duration) *Watcher {
+	if c == nil || notes == nil {
+		return nil
+	}
+	var valid []WatchConfig
+	for _, w := range watches {
+		if strings.TrimSpace(w.Name) == "" || strings.TrimSpace(w.URL) == "" {
+			log.Printf("crawl: skipping a watch with no name or no url")
+			continue
+		}
+		valid = append(valid, w)
+	}
+	if len(valid) == 0 {
+		return nil
+	}
+	if defaultInterval <= 0 {
+		defaultInterval = DefaultWatchInterval
+	}
+	return &Watcher{
+		c: c, watches: valid, notes: notes, hashes: hashes, embed: embed,
+		interval: defaultInterval, nextDue: map[string]time.Time{},
+	}
+}
+
+// Watches returns the configured watches.
+func (w *Watcher) Watches() []WatchConfig { return w.watches }
+
+// CheckDue re-reads every watch whose interval elapsed and returns how many
+// notes were written. Errors are logged per watch, never returned: one dead page
+// must not stop the others.
+func (w *Watcher) CheckDue(ctx context.Context, now time.Time) int {
+	written := 0
+	for _, watch := range w.watches {
+		if due, ok := w.nextDue[watch.Name]; ok && now.Before(due) {
+			continue
+		}
+		interval := watch.Interval
+		if interval <= 0 {
+			interval = w.interval
+		}
+		w.nextDue[watch.Name] = now.Add(interval)
+		changed, err := w.Check(ctx, watch, now)
+		if err != nil {
+			log.Printf("crawl: watch %s: %v", watch.Name, err)
+			continue
+		}
+		if changed {
+			log.Printf("crawl: watch %s: page changed, noted", watch.Name)
+			written++
+		}
+	}
+	return written
+}
+
+// Check re-reads one watch now and reports whether it wrote a note.
+func (w *Watcher) Check(ctx context.Context, watch WatchConfig, now time.Time) (bool, error) {
+	page, err := w.c.Page(ctx, watch.URL)
+	if err != nil {
+		return false, err
+	}
+	// Title included: a page whose headline changed has changed.
+	h := Hash(page.Title + "\n" + page.Text)
+	if w.hashes != nil {
+		prev, err := w.hashes.LastHash(ctx, watch.Name)
+		if err != nil {
+			log.Printf("crawl: watch %s: read hash: %v", watch.Name, err)
+		}
+		if prev == h {
+			return false, nil
+		}
+	}
+	text := NoteText(watch, page)
+	var vec []float32
+	if w.embed != nil {
+		v, err := w.embed.Embed(ctx, text)
+		if err != nil {
+			log.Printf("crawl: watch %s: embed: %v", watch.Name, err)
+		} else {
+			vec = v
+		}
+	}
+	if _, err := w.notes.WriteNote(ctx, now, text, vec, SourceFor(watch.Name)); err != nil {
+		return false, fmt.Errorf("write note: %w", err)
+	}
+	if w.hashes != nil {
+		if err := w.hashes.SetHash(ctx, watch.Name, h); err != nil {
+			log.Printf("crawl: watch %s: save hash: %v", watch.Name, err)
+		}
+	}
+	return true, nil
+}
+
+// SourceFor is the note source for a watch, and SourcePrefix is what the answer
+// path matches to recognise one.
+func SourceFor(name string) string { return SourcePrefix + name }
+
+// SourcePrefix — provenance for anything read off the network on a schedule.
+const SourcePrefix = "crawl:"
+
+// noteRunes — how much of a watched page goes into a note. Shorter than what the
+// on-demand path reads: a note is a record of a change, not an archive.
+const noteRunes = 800
+
+// NoteText renders a watched page as a note body.
+func NoteText(watch WatchConfig, page Page) string {
+	var b strings.Builder
+	if page.Title != "" {
+		b.WriteString(page.Title)
+	} else {
+		b.WriteString(watch.Name)
+	}
+	b.WriteString("\n")
+	b.WriteString(TrimRunes(page.Text, noteRunes))
+	b.WriteString("\n")
+	b.WriteString(watch.URL)
+	return b.String()
+}

internal/crawl/watch_test.go

@@ -0,0 +1,117 @@
+package crawl
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+)
+
+type note struct {
+	text   string
+	source string
+}
+
+type fakeNotes struct{ notes []note }
+
+func (n *fakeNotes) WriteNote(_ context.Context, _ time.Time, text string, _ []float32, source string) (int64, error) {
+	n.notes = append(n.notes, note{text, source})
+	return int64(len(n.notes)), nil
+}
+
+type fakeHashes struct{ m map[string]string }
+
+func newHashes() *fakeHashes { return &fakeHashes{m: map[string]string{}} }
+func (f *fakeHashes) LastHash(_ context.Context, name string) (string, error) {
+	return f.m[name], nil
+}
+func (f *fakeHashes) SetHash(_ context.Context, name, h string) error { f.m[name] = h; return nil }
+
+var t0 = time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC)
+
+func TestWatchNotesAChangedPage(t *testing.T) {
+	f := &fakeFetcher{pages: map[string]Response{
+		"https://example.org/docs": {Body: []byte(htmlPage)},
+	}}
+	notes := &fakeNotes{}
+	hashes := newHashes()
+	w := NewWatcher(newTestCrawler(f), []WatchConfig{{Name: "docs", URL: "https://example.org/docs"}},
+		notes, hashes, nil, time.Hour)
+	if w == nil {
+		t.Fatal("NewWatcher returned nil for a configured watch")
+	}
+	if n := w.CheckDue(context.Background(), t0); n != 1 {
+		t.Fatalf("first check wrote %d notes, want 1", n)
+	}
+	if notes.notes[0].source != "crawl:docs" {
+		t.Errorf("source = %q, want crawl:docs", notes.notes[0].source)
+	}
+	if !strings.Contains(notes.notes[0].text, "https://example.org/docs") {
+		t.Errorf("note does not carry the url: %q", notes.notes[0].text)
+	}
+
+	// Unchanged page, interval elapsed: nothing written.
+	if n := w.CheckDue(context.Background(), t0.Add(2*time.Hour)); n != 0 {
+		t.Fatalf("an unchanged page wrote %d notes", n)
+	}
+
+	// Changed page: one note.
+	f.pages["https://example.org/docs"] = Response{Body: []byte(strings.Replace(htmlPage, "синее", "серое", 1))}
+	if n := w.CheckDue(context.Background(), t0.Add(4*time.Hour)); n != 1 {
+		t.Fatalf("a changed page wrote %d notes, want 1", n)
+	}
+}
+
+func TestWatchIntervalIsRespected(t *testing.T) {
+	f := &fakeFetcher{pages: map[string]Response{"https://example.org/d": {Body: []byte(htmlPage)}}}
+	w := NewWatcher(newTestCrawler(f), []WatchConfig{{Name: "d", URL: "https://example.org/d", Interval: time.Hour}},
+		&fakeNotes{}, newHashes(), nil, 0)
+	w.CheckDue(context.Background(), t0)
+	before := len(f.calls)
+	w.CheckDue(context.Background(), t0.Add(time.Minute))
+	if len(f.calls) != before {
+		t.Fatal("the page was re-read inside its interval")
+	}
+}
+
+// The hash is durable so a restart does not re-note an unchanged page.
+func TestWatchHashSurvivesRestart(t *testing.T) {
+	f := &fakeFetcher{pages: map[string]Response{"https://example.org/d": {Body: []byte(htmlPage)}}}
+	hashes := newHashes()
+	watches := []WatchConfig{{Name: "d", URL: "https://example.org/d"}}
+	NewWatcher(newTestCrawler(f), watches, &fakeNotes{}, hashes, nil, time.Hour).CheckDue(context.Background(), t0)
+
+	notes2 := &fakeNotes{}
+	NewWatcher(newTestCrawler(f), watches, notes2, hashes, nil, time.Hour).CheckDue(context.Background(), t0.Add(time.Hour))
+	if len(notes2.notes) != 0 {
+		t.Fatalf("a fresh watcher re-noted an unchanged page: %q", notes2.notes[0].text)
+	}
+}
+
+func TestWatchDeadPageDoesNotStopTheOthers(t *testing.T) {
+	f := &fakeFetcher{pages: map[string]Response{"https://example.org/live": {Body: []byte(htmlPage)}}}
+	notes := &fakeNotes{}
+	w := NewWatcher(newTestCrawler(f), []WatchConfig{
+		{Name: "dead", URL: "https://example.org/gone"},
+		{Name: "live", URL: "https://example.org/live"},
+	}, notes, newHashes(), nil, time.Hour)
+	if n := w.CheckDue(context.Background(), t0); n != 1 {
+		t.Fatalf("wrote %d notes, want 1 (the live page)", n)
+	}
+	if notes.notes[0].source != "crawl:live" {
+		t.Fatalf("source = %q", notes.notes[0].source)
+	}
+}
+
+func TestNoWatchesMeansNoWatcher(t *testing.T) {
+	c := newTestCrawler(&fakeFetcher{})
+	if NewWatcher(c, nil, &fakeNotes{}, nil, nil, 0) != nil {
+		t.Fatal("no watches must mean no watcher")
+	}
+	if NewWatcher(nil, []WatchConfig{{Name: "a", URL: "u"}}, &fakeNotes{}, nil, nil, 0) != nil {
+		t.Fatal("no crawler must mean no watcher")
+	}
+	if NewWatcher(c, []WatchConfig{{Name: "", URL: ""}}, &fakeNotes{}, nil, nil, 0) != nil {
+		t.Fatal("a watch with no name or url is not a configuration")
+	}
+}

internal/email/extract.go

@@ -0,0 +1,226 @@
+package email
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/kami/maven/internal/llm"
+	"github.com/kami/maven/internal/persona"
+)
+
+// Extraction — turning one mail into task CANDIDATES, and nothing else.
+//
+// The output of this file can only ever become rows in `tasks` with status
+// "candidate" (store.TaskCandidate), written through the one intake seam
+// (ipc.CaptureTaskReq, Vikunja #130). That bound is the whole design:
+//
+//   - No reminder. A reminder FIRES; it speaks to him unprompted. A 1.7B that
+//     misreads "встреча была в четверг" as a future appointment would then wake
+//     him up about it. A candidate that is wrong is a line on a review page he
+//     dismisses in one click, which is the correct cost of a model being wrong
+//     about someone's mail.
+//   - No fact. A fact is a claim Maven will later recite as true. Nothing read
+//     out of a marketing mail deserves that standing.
+//   - No calendar event, no note, no action. Extraction writes candidates or
+//     writes nothing.
+//
+// The due date the model may return is stored on the candidate (tasks.due_ts),
+// which no scheduler reads — it is there so the review page can sort by it.
+//
+// Privacy: the mail text goes to the resident model on this box and nowhere
+// else. It is never search input (CLAUDE.md: "his notes and facts are never
+// search input" — mail is the same class), and Evidence keeps only the subject
+// line, so the review page shows him where a candidate came from without the
+// store growing a copy of his mailbox.
+
+// MaxCandidates — at most this many candidates per message, enforced by the
+// grammar. A mail with four tasks in it is a mail he has to read himself; a
+// model allowed ten will produce ten.
+const MaxCandidates = 3
+
+// SourcePrefix — provenance for everything this package captures. The mailbox
+// name is appended: "email:INBOX". Same vocabulary as tap:voice / poll:netdata.
+const SourcePrefix = "email:"
+
+// Candidate — one piece of work the model thinks the mail is asking for.
+type Candidate struct {
+	Text string `json:"text"`
+	// Due — "YYYY-MM-DD" or empty. A date the model read out of the text, not a
+	// date it computed: relative wording ("до пятницы") is left in Text, because
+	// a small model resolving "пятница" against today's date gets it wrong often
+	// enough that a stored wrong date is worse than no date.
+	Due string `json:"due"`
+}
+
+// Completer — the llama-server seam, same shape memeval and the router use, so
+// the one resident model serves this caller too.
+type Completer interface {
+	Complete(ctx context.Context, r llm.Req) (string, error)
+}
+
+// Extractor reads a message and returns candidates. It holds no store and no
+// writer on purpose: this type cannot persist anything, so "extraction never
+// acts" is a property of the code, not of a review.
+type Extractor struct {
+	llm Completer
+	// MaxCandidates — 0 ⇒ MaxCandidates.
+	max int
+	// ContextBlock — the shared persona block, optional. Extraction output is
+	// not spoken, so the persona matters less here than in the phraser; it is
+	// wired anyway so a candidate reads in her voice on the review page.
+	contextBlock func() string
+}
+
+func NewExtractor(c Completer, max int, contextBlock func() string) *Extractor {
+	if max <= 0 || max > MaxCandidates {
+		max = MaxCandidates
+	}
+	return &Extractor{llm: c, max: max, contextBlock: contextBlock}
+}
+
+// extractGrammar — GBNF pinning the answer to a bounded array of fixed-shape
+// candidates. Same reasoning as memeval's evalGrammar and the router's
+// routeGrammar: the shape and the length bound are what keep a small model from
+// drifting into prose or spending the token budget repeating one field.
+//
+// The empty array is reachable, deliberately: most mail contains no task, and a
+// model with no way to say "nothing" invents something.
+const extractGrammar = `
+root  ::= "[" ws (item ("," ws item){0,2})? ws "]"
+item  ::= "{" ws "\"text\"" ws ":" ws text "," ws "\"due\"" ws ":" ws due ws "}"
+text  ::= "\"" ([^"\\] | "\\" .){1,120} "\""
+due   ::= "\"\"" | "\"" [0-9]{4} "-" [0-9]{2} "-" [0-9]{2} "\""
+ws    ::= [ \t\n]*
+`
+
+// extractSystem — the extraction prompt.
+//
+// Written around the two failure modes a small model has on this task: it
+// summarises when asked to extract (turning a mail into "письмо от Антона"),
+// and it invents an obligation from any polite closing sentence. Hence the
+// insistence on a verb phrase, and the explicit permission to return [].
+const extractSystem = `Ты читаешь одно письмо из его почты и достаёшь из него дела, которые письмо от него требует.
+
+Правила:
+- Отвечай ТОЛЬКО массивом JSON. Каждый элемент: {"text": "...", "due": "ГГГГ-ММ-ДД" или ""}.
+- text — короткая формулировка дела по-русски, с глаголом: "оплатить счёт за интернет", "отправить акт". Не пересказывай письмо и не описывай его.
+- Дело — это то, что должен сделать ОН. Рассылка, реклама, уведомление, отчёт, письмо «просто к сведению» — дел не содержат.
+- Если письмо ничего от него не требует, верни пустой массив []. Это нормальный ответ, так бывает чаще всего.
+- Ничего не придумывай. Если срока в письме нет — "".
+- due заполняй только когда в письме стоит конкретная дата. Слова вроде «до пятницы» оставь в text, дату не вычисляй.
+- Максимум три дела. Лучше одно точное, чем три общих.`
+
+// Extract returns the candidates in one message.
+//
+// Junk is refused without an LLM call — cheapest possible defence, and the
+// reason the header filter exists. An empty message (no subject, no body) is
+// likewise not worth a round trip.
+//
+// A parse failure is an error the caller logs and moves past. It is never
+// silently turned into zero candidates, because "the model went off the rails"
+// and "the mail contains no task" want different reactions from a human reading
+// the log.
+func (e *Extractor) Extract(ctx context.Context, msg Message) ([]Candidate, error) {
+	if msg.Junk {
+		return nil, nil
+	}
+	user := renderForModel(msg)
+	if user == "" {
+		return nil, nil
+	}
+	raw, err := e.llm.Complete(ctx, llm.Req{
+		System:        persona.Prepend(e.contextBlock, extractSystem),
+		User:          user,
+		Grammar:       extractGrammar,
+		MaxTokens:     512,
+		RepeatPenalty: 1.1,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("email: extract: %w", err)
+	}
+	items, err := parseCandidates(raw)
+	if err != nil {
+		// The raw reply is NOT in the error: it is a transformation of his mail,
+		// and this error reaches the daemon log.
+		return nil, fmt.Errorf("email: extract: unparsable reply (%d bytes)", len(raw))
+	}
+	out := make([]Candidate, 0, len(items))
+	seen := map[string]bool{}
+	for _, it := range items {
+		it.Text = strings.TrimSpace(it.Text)
+		if it.Text == "" {
+			continue
+		}
+		key := strings.ToLower(strings.Join(strings.Fields(it.Text), " "))
+		if seen[key] {
+			continue // the model repeating itself is not two tasks
+		}
+		seen[key] = true
+		if _, ok := ParseDue(it.Due); !ok {
+			it.Due = "" // a date the grammar allowed but the calendar does not
+		}
+		out = append(out, it)
+		if len(out) >= e.max {
+			break
+		}
+	}
+	return out, nil
+}
+
+// renderForModel is the user turn: subject, sender and body, labelled. Only
+// these three fields — no headers, no recipient list, no message-id, nothing
+// that would let the model start reasoning about routing metadata.
+func renderForModel(msg Message) string {
+	var b strings.Builder
+	if msg.From != "" {
+		fmt.Fprintf(&b, "От: %s\n", msg.From)
+	}
+	if msg.Subject != "" {
+		fmt.Fprintf(&b, "Тема: %s\n", msg.Subject)
+	}
+	if msg.Body != "" {
+		fmt.Fprintf(&b, "\n%s\n", msg.Body)
+	}
+	if msg.Subject == "" && msg.Body == "" {
+		return ""
+	}
+	return b.String()
+}
+
+// parseCandidates decodes the grammar-constrained reply, tolerating the
+// wrappers a Thinking model sometimes leaves around it (a fenced block, or
+// leading reasoning before the array).
+func parseCandidates(raw string) ([]Candidate, error) {
+	s := strings.TrimSpace(raw)
+	if i := strings.Index(s, "["); i > 0 {
+		s = s[i:]
+	}
+	if j := strings.LastIndex(s, "]"); j >= 0 {
+		s = s[:j+1]
+	}
+	var out []Candidate
+	if err := json.Unmarshal([]byte(s), &out); err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ParseDue turns the model's "YYYY-MM-DD" into a time in UTC. Exported because
+// the daemon-side intake stores it on the candidate.
+//
+// The zero-value/empty case returns ok=false rather than an error: no date is
+// the common answer, not a failure.
+func ParseDue(s string) (time.Time, bool) {
+	s = strings.TrimSpace(s)
+	if s == "" {
+		return time.Time{}, false
+	}
+	t, err := time.Parse("2006-01-02", s)
+	if err != nil {
+		return time.Time{}, false
+	}
+	return t, true
+}

internal/email/extract_test.go

@@ -0,0 +1,143 @@
+package email
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/kami/maven/internal/llm"
+)
+
+// fakeLLM returns a canned reply and records the request, so a test can assert
+// on the grammar and on what of the mail was sent.
+type fakeLLM struct {
+	reply string
+	err   error
+	got   llm.Req
+	calls int
+}
+
+func (f *fakeLLM) Complete(_ context.Context, r llm.Req) (string, error) {
+	f.calls++
+	f.got = r
+	return f.reply, f.err
+}
+
+func msgFor(subject, body string) Message {
+	return Message{UID: 1, From: "anton@example.org", Subject: subject, Body: body}
+}
+
+func TestExtractCandidates(t *testing.T) {
+	f := &fakeLLM{reply: `[{"text":"отправить акт","due":""},{"text":"оплатить счёт","due":"2026-08-05"}]`}
+	e := NewExtractor(f, 0, nil)
+	got, err := e.Extract(context.Background(), msgFor("Акт и счёт", "Надо отправить акт и оплатить счёт до 5 августа."))
+	if err != nil {
+		t.Fatalf("extract: %v", err)
+	}
+	if len(got) != 2 {
+		t.Fatalf("got %d candidates, want 2: %+v", len(got), got)
+	}
+	if got[0].Text != "отправить акт" || got[1].Due != "2026-08-05" {
+		t.Errorf("candidates = %+v", got)
+	}
+	if f.got.Grammar == "" {
+		t.Error("extraction must be grammar-constrained")
+	}
+	// The subject and body go to the model; nothing else about the message does.
+	if !strings.Contains(f.got.User, "Акт и счёт") || !strings.Contains(f.got.User, "оплатить счёт") {
+		t.Errorf("user turn = %q", f.got.User)
+	}
+}
+
+func TestExtractEmptyArrayIsNotAnError(t *testing.T) {
+	f := &fakeLLM{reply: "[]"}
+	got, err := NewExtractor(f, 0, nil).Extract(context.Background(), msgFor("FYI", "Просто к сведению."))
+	if err != nil || len(got) != 0 {
+		t.Fatalf("got (%v, %v), want (empty, nil) — no task is the normal answer", got, err)
+	}
+}
+
+// Junk must never reach the model: the header filter exists so the resident
+// model is not spent on newsletters.
+func TestExtractSkipsJunkWithoutCallingModel(t *testing.T) {
+	f := &fakeLLM{reply: `[{"text":"купить всё со скидкой","due":""}]`}
+	msg := msgFor("Скидки", "Sale!")
+	msg.Junk = true
+	got, err := NewExtractor(f, 0, nil).Extract(context.Background(), msg)
+	if err != nil || got != nil {
+		t.Fatalf("got (%v, %v), want (nil, nil)", got, err)
+	}
+	if f.calls != 0 {
+		t.Errorf("model called %d times for junk, want 0", f.calls)
+	}
+}
+
+func TestExtractEmptyMessageIsNotSent(t *testing.T) {
+	f := &fakeLLM{reply: "[]"}
+	if _, err := NewExtractor(f, 0, nil).Extract(context.Background(), Message{UID: 3}); err != nil {
+		t.Fatalf("extract: %v", err)
+	}
+	if f.calls != 0 {
+		t.Errorf("model called %d times for an empty message, want 0", f.calls)
+	}
+}
+
+func TestExtractCaps(t *testing.T) {
+	f := &fakeLLM{reply: `[{"text":"a","due":""},{"text":"b","due":""},{"text":"c","due":""}]`}
+	got, err := NewExtractor(f, 2, nil).Extract(context.Background(), msgFor("s", "b"))
+	if err != nil {
+		t.Fatalf("extract: %v", err)
+	}
+	if len(got) != 2 {
+		t.Errorf("got %d, want the configured cap of 2", len(got))
+	}
+}
+
+func TestExtractDropsRepeatsAndBadDates(t *testing.T) {
+	f := &fakeLLM{reply: `[{"text":"Отправить акт","due":"2026-02-31"},{"text":"отправить  акт","due":""},{"text":"  ","due":""}]`}
+	got, err := NewExtractor(f, 0, nil).Extract(context.Background(), msgFor("s", "b"))
+	if err != nil {
+		t.Fatalf("extract: %v", err)
+	}
+	if len(got) != 1 {
+		t.Fatalf("got %d candidates, want 1 (repeat and blank dropped): %+v", len(got), got)
+	}
+	if got[0].Due != "" {
+		t.Errorf("due = %q, want empty — 2026-02-31 is not a date", got[0].Due)
+	}
+}
+
+// A Thinking model sometimes wraps the array; and when it emits something
+// unparsable the caller must hear about it rather than see "no tasks".
+func TestParseCandidatesTolerance(t *testing.T) {
+	got, err := parseCandidates("думаю... [{\"text\":\"x\",\"due\":\"\"}] всё")
+	if err != nil || len(got) != 1 || got[0].Text != "x" {
+		t.Fatalf("got (%+v, %v)", got, err)
+	}
+	if _, err := parseCandidates("нет никакого JSON"); err == nil {
+		t.Error("unparsable output must be an error")
+	}
+}
+
+func TestExtractParseErrorHidesMailText(t *testing.T) {
+	f := &fakeLLM{reply: "он просил отправить акт, вот такой ответ"}
+	_, err := NewExtractor(f, 0, nil).Extract(context.Background(), msgFor("Акт", "секретный текст"))
+	if err == nil {
+		t.Fatal("want an error")
+	}
+	if strings.Contains(err.Error(), "акт") || strings.Contains(err.Error(), "секретный") {
+		t.Errorf("error text leaks mail content: %v", err)
+	}
+}
+
+func TestParseDue(t *testing.T) {
+	if _, ok := ParseDue(""); ok {
+		t.Error("empty due must be (zero, false)")
+	}
+	if got, ok := ParseDue("2026-08-05"); !ok || got.Year() != 2026 || got.Month() != 8 || got.Day() != 5 {
+		t.Errorf("ParseDue = (%v, %v)", got, ok)
+	}
+	if _, ok := ParseDue("05.08.2026"); ok {
+		t.Error("a non-ISO date must not parse")
+	}
+}

internal/email/fetch.go

@@ -0,0 +1,98 @@
+package email
+
+import (
+	"fmt"
+	"time"
+)
+
+// FetchSince is the whole read path in one call: connect, log in, examine the
+// mailbox read-only, list what arrived since a date, fetch and parse the ones
+// the caller has not seen, log out.
+//
+// It is a function rather than a long-lived object because a mail poller should
+// not hold an authenticated session (and therefore his credential in a live TLS
+// state) between polls. Connect, read, drop.
+//
+// skip decides which UIDs are already known — the poller's seen-set. max bounds
+// one poll: a mailbox that received 400 messages overnight must not turn into
+// 400 LLM calls, and the newest max are the ones a task could still be hiding
+// in. Junk messages are returned too, flagged, so the caller can mark them seen
+// without a second protocol round.
+type FetchSince struct {
+	Addr    string // host or host:993
+	User    string
+	Mailbox string // e.g. "INBOX"
+	Timeout time.Duration
+	Since   time.Time
+	Max     int
+	Skip    func(uid uint32) bool
+}
+
+// Run performs one read. password is passed here, not stored in the struct, so
+// the configuration of a mailbox and the secret for it are never the same value
+// sitting in the same place.
+func (f FetchSince) Run(password string) ([]Message, error) {
+	return f.RunWith(password, nil)
+}
+
+// RunWith is Run with an explicit connection function, which is how the reader
+// daemon and the tests substitute an in-process server. nil ⇒ Dial, i.e.
+// implicit TLS with certificate verification; there is no configuration path
+// that reaches this, so no deployment can end up talking cleartext IMAP.
+func (f FetchSince) RunWith(password string, dial func(addr string, timeout time.Duration) (*Conn, error)) ([]Message, error) {
+	if f.Addr == "" || f.User == "" || f.Mailbox == "" {
+		return nil, fmt.Errorf("email: mailbox not configured (addr/user/mailbox)")
+	}
+	if dial == nil {
+		dial = Dial
+	}
+	c, err := dial(f.Addr, f.Timeout)
+	if err != nil {
+		return nil, err
+	}
+	defer c.Close()
+	if err := c.Login(f.User, password); err != nil {
+		return nil, err
+	}
+	defer c.Logout()
+	if err := c.Select(f.Mailbox); err != nil {
+		return nil, err
+	}
+	uids, err := c.SearchSince(f.Since)
+	if err != nil {
+		return nil, err
+	}
+
+	// Newest UIDs first — IMAP hands them back ascending, and when Max clips the
+	// list the recent mail is what matters.
+	wanted := make([]uint32, 0, len(uids))
+	for i := len(uids) - 1; i >= 0; i-- {
+		if f.Skip != nil && f.Skip(uids[i]) {
+			continue
+		}
+		wanted = append(wanted, uids[i])
+		if f.Max > 0 && len(wanted) >= f.Max {
+			break
+		}
+	}
+
+	out := make([]Message, 0, len(wanted))
+	for _, uid := range wanted {
+		raw, err := c.Fetch(uid)
+		if err != nil {
+			// One unreadable message does not abandon the poll; the rest of the
+			// mailbox is still worth reading. The error names the UID, not the
+			// message.
+			return out, fmt.Errorf("email: fetch uid %d: %w", uid, err)
+		}
+		if len(raw) == 0 {
+			continue // vanished between SEARCH and FETCH
+		}
+		msg, err := ParseMessage(uid, raw)
+		if err != nil {
+			continue // unparsable headers — nothing to review, skip silently
+		}
+		out = append(out, msg)
+	}
+	return out, nil
+}

internal/email/fetch_test.go

@@ -0,0 +1,49 @@
+package email
+
+import (
+	"net"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestFetchSinceRun(t *testing.T) {
+	mk := func(subject string) string {
+		return "Subject: " + subject + "\r\nContent-Type: text/plain; charset=utf-8\r\n\r\nbody\r\n"
+	}
+	f := &fakeIMAP{
+		uids: []uint32{1, 2, 3},
+		msgs: map[uint32]string{1: mk("one"), 2: mk("two"), 3: mk("three")},
+	}
+	fs := FetchSince{
+		Addr: "mail.example:993", User: "kami", Mailbox: "INBOX",
+		Timeout: 5 * time.Second,
+		Since:   time.Date(2026, 7, 30, 0, 0, 0, 0, time.UTC),
+		Max:     2,
+		Skip:    func(uid uint32) bool { return uid == 3 },
+	}
+	msgs, err := fs.RunWith("secret", func(addr string, timeout time.Duration) (*Conn, error) {
+		cli, srv := net.Pipe()
+		go f.serve(t, srv)
+		return NewConn(cli, timeout)
+	})
+	if err != nil {
+		t.Fatalf("run: %v", err)
+	}
+	// Newest first, the already-seen UID skipped, Max respected.
+	if len(msgs) != 2 {
+		t.Fatalf("got %d messages, want 2: %+v", len(msgs), msgs)
+	}
+	if msgs[0].Subject != "two" || msgs[1].Subject != "one" {
+		t.Errorf("subjects = %q,%q, want two,one (newest first)", msgs[0].Subject, msgs[1].Subject)
+	}
+	if strings.Contains(strings.Join(f.cmds, " "), "UID FETCH 3") {
+		t.Error("a skipped UID must not be fetched again")
+	}
+}
+
+func TestFetchSinceRequiresConfig(t *testing.T) {
+	if _, err := (FetchSince{}).Run("secret"); err == nil {
+		t.Fatal("an unconfigured mailbox must not be read")
+	}
+}

internal/email/imap.go

@@ -0,0 +1,280 @@
+package email
+
+import (
+	"bufio"
+	"crypto/tls"
+	"fmt"
+	"io"
+	"net"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// A minimal IMAP4rev1 client — LOGIN, SELECT, UID SEARCH, UID FETCH with
+// BODY.PEEK, LOGOUT, and nothing else.
+//
+// Why hand-rolled instead of go-imap: the whole surface Maven needs is five
+// commands, and this is the one code path that holds his mailbox credential and
+// reads his private mail. A ~200-line client with no dependencies is auditable
+// in one sitting; a general-purpose IMAP library is a much larger amount of
+// code doing much more than we asked, in the most sensitive place in the tree.
+// If IDLE, CONDSTORE or server-side threading ever become worth having, that
+// trade should be re-made deliberately.
+//
+// BODY.PEEK[] rather than BODY[] is load-bearing: Maven reads his mail and must
+// leave no trace of having done so. Reading a message here does not mark it
+// \Seen, so the unread state in his own mail client stays his.
+
+// DefaultIMAPPort — implicit-TLS IMAP. There is no cleartext and no STARTTLS
+// path in this client: an option to send his password over a plain socket is an
+// option to get it wrong once.
+const DefaultIMAPPort = "993"
+
+// Conn — one authenticated IMAP connection. Not safe for concurrent use; the
+// poller drives one connection at a time.
+type Conn struct {
+	rwc     io.ReadWriteCloser
+	r       *bufio.Reader
+	tag     int
+	timeout time.Duration
+}
+
+// Dial opens an implicit-TLS connection and reads the server greeting.
+func Dial(addr string, timeout time.Duration) (*Conn, error) {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		host, addr = addr, net.JoinHostPort(addr, DefaultIMAPPort)
+	}
+	d := &net.Dialer{Timeout: timeout}
+	// ServerName is set from the host we asked for: certificate verification is
+	// the only thing standing between his password and a MITM on the way out.
+	c, err := tls.DialWithDialer(d, "tcp", addr, &tls.Config{ServerName: host, MinVersion: tls.VersionTLS12})
+	if err != nil {
+		return nil, fmt.Errorf("email: dial %s: %w", addr, err)
+	}
+	return NewConn(c, timeout)
+}
+
+// NewConn wraps an already-open stream (the tests speak IMAP over a pipe) and
+// consumes the greeting.
+func NewConn(rwc io.ReadWriteCloser, timeout time.Duration) (*Conn, error) {
+	c := &Conn{rwc: rwc, r: bufio.NewReaderSize(rwc, 64<<10), timeout: timeout}
+	line, err := c.readLine()
+	if err != nil {
+		return nil, fmt.Errorf("email: greeting: %w", err)
+	}
+	if !strings.HasPrefix(line, "* OK") && !strings.HasPrefix(line, "* PREAUTH") {
+		c.rwc.Close()
+		return nil, fmt.Errorf("email: server refused connection: %s", line)
+	}
+	return c, nil
+}
+
+func (c *Conn) Close() error { return c.rwc.Close() }
+
+// Login authenticates with LOGIN. The password is passed as an argument and
+// never stored on the Conn: nothing in this package keeps a credential alive
+// past the command that uses it, so no struct dump or panic trace can carry it.
+func (c *Conn) Login(user, pass string) error {
+	// The command line itself is never logged (see exec) — a LOGIN line IS the
+	// credential.
+	if _, err := c.exec(fmt.Sprintf("LOGIN %s %s", quote(user), quote(pass))); err != nil {
+		return fmt.Errorf("email: login: %w", err)
+	}
+	return nil
+}
+
+// Select opens a mailbox read-only. EXAMINE, not SELECT: read-only at the
+// protocol level means no command in this session can change a flag, expunge a
+// message, or move anything, even by mistake.
+func (c *Conn) Select(mailbox string) error {
+	if _, err := c.exec(fmt.Sprintf("EXAMINE %s", quote(mailbox))); err != nil {
+		return fmt.Errorf("email: examine %s: %w", mailbox, err)
+	}
+	return nil
+}
+
+// SearchSince returns the UIDs of messages received on or after since. An
+// unlimited search is not offered: the first poll against a years-old mailbox
+// would otherwise fetch everything and hand a decade of mail to the model.
+//
+// The IMAP SINCE key has date granularity (and compares the server's internal
+// date), so the result can include messages slightly older than since. The
+// caller dedupes by UID anyway, so a wider window costs one extra fetch.
+func (c *Conn) SearchSince(since time.Time) ([]uint32, error) {
+	cmd := fmt.Sprintf("UID SEARCH SINCE %s", since.Format("2-Jan-2006"))
+	lines, err := c.exec(cmd)
+	if err != nil {
+		return nil, fmt.Errorf("email: search: %w", err)
+	}
+	var uids []uint32
+	for _, l := range lines {
+		rest, ok := untagged(l, "SEARCH")
+		if !ok {
+			continue
+		}
+		for _, f := range strings.Fields(rest) {
+			n, err := strconv.ParseUint(f, 10, 32)
+			if err == nil {
+				uids = append(uids, uint32(n))
+			}
+		}
+	}
+	return uids, nil
+}
+
+var literalSize = regexp.MustCompile(`\{(\d+)\}$`)
+
+// Fetch returns the raw RFC 5322 bytes of one message, by UID.
+//
+// Returns (nil, nil) when the UID no longer exists — a message he deleted
+// between SEARCH and FETCH is normal, not an error.
+func (c *Conn) Fetch(uid uint32) ([]byte, error) {
+	tag := c.nextTag()
+	if err := c.send(fmt.Sprintf("%s UID FETCH %d (BODY.PEEK[])", tag, uid)); err != nil {
+		return nil, err
+	}
+	var raw []byte
+	for {
+		line, err := c.readLine()
+		if err != nil {
+			return nil, fmt.Errorf("email: fetch %d: %w", uid, err)
+		}
+		if done, err := c.tagged(tag, line); done {
+			if err != nil {
+				return nil, fmt.Errorf("email: fetch %d: %w", uid, err)
+			}
+			return raw, nil
+		}
+		m := literalSize.FindStringSubmatch(strings.TrimSpace(line))
+		if m == nil {
+			continue
+		}
+		n, err := strconv.Atoi(m[1])
+		if err != nil {
+			continue
+		}
+		buf := make([]byte, n)
+		if _, err := io.ReadFull(c.r, buf); err != nil {
+			return nil, fmt.Errorf("email: fetch %d: literal: %w", uid, err)
+		}
+		if raw == nil {
+			raw = buf
+		}
+	}
+}
+
+// Logout ends the session politely. A failure is not worth reporting — the
+// connection is being closed either way.
+func (c *Conn) Logout() {
+	_, _ = c.exec("LOGOUT")
+}
+
+// ---- protocol plumbing -----------------------------------------------------
+
+func (c *Conn) nextTag() string {
+	c.tag++
+	return fmt.Sprintf("a%03d", c.tag)
+}
+
+// exec sends one command and returns the untagged response lines.
+//
+// Neither the command nor the response is ever logged here. LOGIN goes through
+// this function, and a debug line "sent: a001 LOGIN ..." is how a credential
+// ends up in a log file forever.
+func (c *Conn) exec(cmd string) ([]string, error) {
+	tag := c.nextTag()
+	if err := c.send(tag + " " + cmd); err != nil {
+		return nil, err
+	}
+	var lines []string
+	for {
+		line, err := c.readLine()
+		if err != nil {
+			return nil, err
+		}
+		if done, err := c.tagged(tag, line); done {
+			return lines, err
+		}
+		lines = append(lines, line)
+		// A response line may carry a literal (e.g. a header FETCH). Nothing we
+		// send asks for one outside Fetch, but skip it if it appears so the
+		// stream stays aligned.
+		if m := literalSize.FindStringSubmatch(strings.TrimSpace(line)); m != nil {
+			if n, err := strconv.Atoi(m[1]); err == nil {
+				if _, err := io.CopyN(io.Discard, c.r, int64(n)); err != nil {
+					return nil, err
+				}
+			}
+		}
+	}
+}
+
+// tagged reports whether line completes the command with this tag, and turns a
+// NO/BAD completion into an error. The error text is the server's, which never
+// echoes a password.
+func (c *Conn) tagged(tag, line string) (bool, error) {
+	if !strings.HasPrefix(line, tag+" ") {
+		return false, nil
+	}
+	rest := strings.TrimSpace(line[len(tag):])
+	switch {
+	case strings.HasPrefix(rest, "OK"):
+		return true, nil
+	case strings.HasPrefix(rest, "NO"), strings.HasPrefix(rest, "BAD"):
+		return true, fmt.Errorf("server said: %s", rest)
+	default:
+		return true, fmt.Errorf("unexpected completion: %s", rest)
+	}
+}
+
+func (c *Conn) send(line string) error {
+	c.setDeadline()
+	if _, err := io.WriteString(c.rwc, line+"\r\n"); err != nil {
+		return fmt.Errorf("email: write: %w", err)
+	}
+	return nil
+}
+
+func (c *Conn) readLine() (string, error) {
+	c.setDeadline()
+	line, err := c.r.ReadString('\n')
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimRight(line, "\r\n"), nil
+}
+
+// setDeadline applies the per-connection timeout when the transport supports
+// one. A hung IMAP server must not park the poller forever.
+func (c *Conn) setDeadline() {
+	if c.timeout <= 0 {
+		return
+	}
+	if d, ok := c.rwc.(interface{ SetDeadline(time.Time) error }); ok {
+		_ = d.SetDeadline(time.Now().Add(c.timeout))
+	}
+}
+
+// untagged splits "* SEARCH 1 2 3" into its payload when the key matches.
+func untagged(line, key string) (string, bool) {
+	if !strings.HasPrefix(line, "* ") {
+		return "", false
+	}
+	rest := strings.TrimSpace(line[2:])
+	if !strings.HasPrefix(rest, key) {
+		return "", false
+	}
+	return strings.TrimSpace(rest[len(key):]), true
+}
+
+// quote renders an IMAP quoted string. Passwords routinely contain characters
+// that would otherwise end the argument early, and CR/LF are stripped rather
+// than escaped because there is no legal way to send them — a credential file
+// with a stray newline must not become a second command.
+func quote(s string) string {
+	s = strings.NewReplacer("\r", "", "\n", "").Replace(s)
+	return `"` + strings.NewReplacer(`\`, `\\`, `"`, `\"`).Replace(s) + `"`
+}

internal/email/imap_test.go

@@ -0,0 +1,162 @@
+package email
+
+import (
+	"bufio"
+	"fmt"
+	"net"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+)
+
+// fakeIMAP is a scripted server: enough of IMAP to exercise the client, and
+// nothing more. It records the commands it received so a test can assert on the
+// protocol (BODY.PEEK rather than BODY, EXAMINE rather than SELECT).
+type fakeIMAP struct {
+	msgs   map[uint32]string
+	uids   []uint32
+	cmds   []string
+	failOn string // substring of a command to answer NO
+}
+
+func (f *fakeIMAP) serve(t *testing.T, c net.Conn) {
+	t.Helper()
+	defer c.Close()
+	fmt.Fprint(c, "* OK fake IMAP ready\r\n")
+	r := bufio.NewReader(c)
+	for {
+		line, err := r.ReadString('\n')
+		if err != nil {
+			return
+		}
+		line = strings.TrimRight(line, "\r\n")
+		parts := strings.SplitN(line, " ", 2)
+		if len(parts) != 2 {
+			return
+		}
+		tag, cmd := parts[0], parts[1]
+		f.cmds = append(f.cmds, cmd)
+		if f.failOn != "" && strings.Contains(cmd, f.failOn) {
+			fmt.Fprintf(c, "%s NO computer says no\r\n", tag)
+			continue
+		}
+		upper := strings.ToUpper(cmd)
+		switch {
+		case strings.HasPrefix(upper, "LOGIN"), strings.HasPrefix(upper, "EXAMINE"):
+			fmt.Fprintf(c, "%s OK done\r\n", tag)
+		case strings.HasPrefix(upper, "UID SEARCH"):
+			var ids []string
+			for _, u := range f.uids {
+				ids = append(ids, strconv.FormatUint(uint64(u), 10))
+			}
+			fmt.Fprintf(c, "* SEARCH %s\r\n", strings.Join(ids, " "))
+			fmt.Fprintf(c, "%s OK search done\r\n", tag)
+		case strings.HasPrefix(upper, "UID FETCH"):
+			uid64, _ := strconv.ParseUint(strings.Fields(cmd)[2], 10, 32)
+			raw, ok := f.msgs[uint32(uid64)]
+			if ok {
+				fmt.Fprintf(c, "* 1 FETCH (UID %d BODY[] {%d}\r\n", uid64, len(raw))
+				fmt.Fprint(c, raw)
+				fmt.Fprint(c, ")\r\n")
+			}
+			fmt.Fprintf(c, "%s OK fetch done\r\n", tag)
+		case strings.HasPrefix(upper, "LOGOUT"):
+			fmt.Fprint(c, "* BYE\r\n")
+			fmt.Fprintf(c, "%s OK bye\r\n", tag)
+			return
+		default:
+			fmt.Fprintf(c, "%s BAD unknown\r\n", tag)
+		}
+	}
+}
+
+// dialFake wires a client Conn to an in-process server over net.Pipe.
+func dialFake(t *testing.T, f *fakeIMAP) *Conn {
+	t.Helper()
+	cli, srv := net.Pipe()
+	go f.serve(t, srv)
+	c, err := NewConn(cli, 5*time.Second)
+	if err != nil {
+		t.Fatalf("greeting: %v", err)
+	}
+	t.Cleanup(func() { c.Close() })
+	return c
+}
+
+func TestIMAPRoundTrip(t *testing.T) {
+	body := "Subject: hello\r\nContent-Type: text/plain; charset=utf-8\r\n\r\nCall the bank.\r\n"
+	f := &fakeIMAP{uids: []uint32{4, 9}, msgs: map[uint32]string{4: body, 9: body}}
+	c := dialFake(t, f)
+
+	if err := c.Login("kami", `pa"ss\word`); err != nil {
+		t.Fatalf("login: %v", err)
+	}
+	if err := c.Select("INBOX"); err != nil {
+		t.Fatalf("select: %v", err)
+	}
+	uids, err := c.SearchSince(time.Date(2026, 8, 1, 0, 0, 0, 0, time.UTC))
+	if err != nil {
+		t.Fatalf("search: %v", err)
+	}
+	if len(uids) != 2 || uids[0] != 4 || uids[1] != 9 {
+		t.Fatalf("uids = %v, want [4 9]", uids)
+	}
+	raw, err := c.Fetch(9)
+	if err != nil {
+		t.Fatalf("fetch: %v", err)
+	}
+	if string(raw) != body {
+		t.Errorf("fetched %q, want the literal verbatim", raw)
+	}
+	c.Logout()
+
+	joined := strings.Join(f.cmds, "\n")
+	// Read-only at the protocol level, and peeking — Maven must leave no trace
+	// of having read his mail.
+	if !strings.Contains(joined, "EXAMINE") || strings.Contains(joined, "SELECT ") {
+		t.Errorf("want EXAMINE (read-only), got:\n%s", joined)
+	}
+	if !strings.Contains(joined, "BODY.PEEK[]") {
+		t.Errorf("want BODY.PEEK, got:\n%s", joined)
+	}
+	// The password must have been quoted and escaped, not truncated at the quote.
+	if !strings.Contains(joined, `"pa\"ss\\word"`) {
+		t.Errorf("password not quoted correctly:\n%s", joined)
+	}
+	// SINCE must carry the IMAP date form.
+	if !strings.Contains(joined, "SINCE 1-Aug-2026") {
+		t.Errorf("want a SINCE date, got:\n%s", joined)
+	}
+}
+
+func TestIMAPServerNoIsAnError(t *testing.T) {
+	f := &fakeIMAP{failOn: "LOGIN"}
+	c := dialFake(t, f)
+	err := c.Login("kami", "wrong")
+	if err == nil {
+		t.Fatal("a NO completion must be an error")
+	}
+	// The error is the server's text; it must not echo the credential.
+	if strings.Contains(err.Error(), "wrong") {
+		t.Errorf("error leaks the password: %v", err)
+	}
+}
+
+func TestIMAPFetchMissingUID(t *testing.T) {
+	f := &fakeIMAP{uids: []uint32{1}, msgs: map[uint32]string{}}
+	c := dialFake(t, f)
+	raw, err := c.Fetch(1)
+	if err != nil {
+		t.Fatalf("fetch: %v", err)
+	}
+	if raw != nil {
+		t.Errorf("a vanished UID should give nil, got %q", raw)
+	}
+}
+
+func TestQuoteStripsNewlines(t *testing.T) {
+	if got := quote("pass\r\nA1 LOGOUT"); strings.ContainsAny(got, "\r\n") {
+		t.Errorf("quote kept a line break: %q", got)
+	}
+}

internal/email/junk.go

@@ -0,0 +1,80 @@
+package email
+
+import (
+	"net/mail"
+	"strings"
+)
+
+// The junk filter — the cheapest and most important half of reading mail.
+//
+// A mailbox is mostly machine-generated: newsletters, receipts nobody acts on,
+// social notifications, marketing. Sending all of it to a 1.7B and asking "is
+// there a task here" produces confident nonsense at a rate proportional to the
+// volume, so junk is decided by HEADERS, before any model sees the message.
+//
+// The rules are all bulk-mail markers that senders set on themselves, never
+// guesses about content:
+//
+//   - List-Unsubscribe / List-Id — by definition a mailing list. If he can
+//     unsubscribe from it, it is not asking him to do anything.
+//   - Precedence: bulk|junk|list — the sender declaring itself bulk.
+//   - Auto-Submitted other than "no" (RFC 3834) — generated by a machine.
+//   - X-Spam-Flag: YES, X-Spam-Status: Yes — the spam filter upstream already
+//     decided; we do not second-guess it in the other direction.
+//   - X-GM-LABELS / X-Gmail-Labels containing a Gmail category — Gmail's own
+//     Promotions/Social/Forums/Spam classification, when the server sends it.
+//
+// Deliberately NOT here: sender allow/deny lists and subject keyword matching.
+// Both are configuration that ages badly and both would be a place for his
+// contacts to end up in a config file. If a real correspondent's mail is being
+// dropped, the fix is a rule about a header, not a list of names.
+//
+// A junk verdict never deletes anything and never touches a flag on the server.
+// It means "do not spend the model on this", nothing more.
+
+// junkHeaders — headers whose mere presence marks bulk mail.
+var junkPresence = []string{"List-Unsubscribe", "List-Id", "List-Post"}
+
+// gmailCategories — Gmail's category labels, lowercased as they appear in
+// X-GM-LABELS. "important" and "inbox" are labels too, and are NOT categories.
+// Matching is by these exact tokens (substring is fine — they are namespaced
+// and cannot appear in a hand-made label by accident), so a user label named
+// "Social Club" is not mistaken for Gmail's Social category.
+var gmailCategories = []string{
+	"category_promotions", "category_social", "category_forums", "category_updates",
+	`\spam`, `\junk`,
+}
+
+// classifyJunk returns whether the message is bulk/automated and why. The
+// reason is a short header name, safe to log — it names the marker, never the
+// sender or the subject.
+func classifyJunk(h mail.Header) (bool, string) {
+	for _, name := range junkPresence {
+		if strings.TrimSpace(h.Get(name)) != "" {
+			return true, strings.ToLower(name)
+		}
+	}
+	switch strings.ToLower(strings.TrimSpace(h.Get("Precedence"))) {
+	case "bulk", "junk", "list":
+		return true, "precedence"
+	}
+	if v := strings.ToLower(strings.TrimSpace(h.Get("Auto-Submitted"))); v != "" && v != "no" {
+		return true, "auto-submitted"
+	}
+	if strings.EqualFold(strings.TrimSpace(h.Get("X-Spam-Flag")), "yes") {
+		return true, "x-spam-flag"
+	}
+	if v := strings.ToLower(strings.TrimSpace(h.Get("X-Spam-Status"))); strings.HasPrefix(v, "yes") {
+		return true, "x-spam-status"
+	}
+	labels := strings.ToLower(h.Get("X-GM-LABELS") + " " + h.Get("X-Gmail-Labels"))
+	for _, c := range gmailCategories {
+		if c == "" {
+			continue
+		}
+		if strings.Contains(labels, c) {
+			return true, "gmail-category"
+		}
+	}
+	return false, ""
+}

internal/email/junk_test.go

@@ -0,0 +1,59 @@
+package email
+
+import (
+	"net/mail"
+	"strings"
+	"testing"
+)
+
+func headers(t *testing.T, raw string) mail.Header {
+	t.Helper()
+	m, err := mail.ReadMessage(strings.NewReader(strings.ReplaceAll(raw, "\n", "\r\n") + "\r\n\r\nbody\r\n"))
+	if err != nil {
+		t.Fatalf("read headers: %v", err)
+	}
+	return m.Header
+}
+
+func TestClassifyJunk(t *testing.T) {
+	cases := []struct {
+		name   string
+		raw    string
+		junk   bool
+		reason string
+	}{
+		{"personal", "From: a@b.c\nSubject: привет", false, ""},
+		{"list-unsubscribe", "From: a@b.c\nList-Unsubscribe: <mailto:u@b.c>", true, "list-unsubscribe"},
+		{"list-id", "From: a@b.c\nList-Id: <golang-nuts.example>", true, "list-id"},
+		{"precedence bulk", "From: a@b.c\nPrecedence: bulk", true, "precedence"},
+		{"auto-submitted", "From: a@b.c\nAuto-Submitted: auto-generated", true, "auto-submitted"},
+		{"auto-submitted no", "From: a@b.c\nAuto-Submitted: no", false, ""},
+		{"spam flag", "From: a@b.c\nX-Spam-Flag: YES", true, "x-spam-flag"},
+		{"spam status", "From: a@b.c\nX-Spam-Status: Yes, score=9.1", true, "x-spam-status"},
+		{"spam status no", "From: a@b.c\nX-Spam-Status: No, score=0.1", false, ""},
+		{"gmail promo", "From: a@b.c\nX-Gmail-Labels: Inbox,CATEGORY_PROMOTIONS", true, "gmail-category"},
+		{"user label", "From: a@b.c\nX-Gmail-Labels: Social Club,Important", false, ""},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			junk, reason := classifyJunk(headers(t, c.raw))
+			if junk != c.junk || reason != c.reason {
+				t.Errorf("classifyJunk = (%v, %q), want (%v, %q)", junk, reason, c.junk, c.reason)
+			}
+		})
+	}
+}
+
+func TestNewsletterFixtureIsJunk(t *testing.T) {
+	msg, err := ParseMessage(9, fixture(t, "newsletter.eml"))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if !msg.Junk {
+		t.Fatal("a newsletter with List-Unsubscribe + Precedence: bulk must be junk")
+	}
+	// The reason is what gets logged, so it must never carry mail content.
+	if strings.Contains(msg.JunkReason, "@") || strings.Contains(msg.JunkReason, "Скидки") {
+		t.Errorf("junk reason leaks content: %q", msg.JunkReason)
+	}
+}

internal/email/message.go

@@ -0,0 +1,258 @@
+// Package email is the reading half of the email reader (Vikunja #246,
+// docs/plans/01-email-reader.md): a small IMAP client, a MIME-to-plaintext
+// converter, and the junk filter that decides a message is not worth reading at
+// all. Extraction lives in extract.go and writes nothing itself.
+//
+// Two constraints shape everything here, both from CLAUDE.md:
+//
+//   - Mail is personal. Nothing in this package logs a body, a subject, or an
+//     address; callers get the text and decide. Mail text is never search input
+//     — no function here reaches the network except the IMAP connection itself.
+//   - Off unless configured. There is no default host, no default account, and
+//     no fallback that would make a mailbox get read because a field was empty.
+//
+// The IMAP subset is deliberately tiny (LOGIN, SELECT, UID SEARCH, UID FETCH
+// with BODY.PEEK, LOGOUT). No IDLE: a poll every few minutes is what a task
+// candidate needs, and IDLE would mean holding a connection and a credential
+// open forever for latency nobody is waiting on.
+package email
+
+import (
+	"encoding/base64"
+	"fmt"
+	"io"
+	"mime"
+	"mime/multipart"
+	"mime/quotedprintable"
+	"net/mail"
+	"regexp"
+	"strings"
+)
+
+// MaxBodyBytes — how much of one message body is kept. A task hides in the
+// first screenful; the rest is signature, quoted history and legal boilerplate,
+// and it would only spend the resident model's 4096-token context.
+const MaxBodyBytes = 4000
+
+// Message — one mail, reduced to the fields extraction and review need.
+//
+// Raw is deliberately absent: once a message is parsed the original bytes are
+// dropped, so no caller can accidentally log or forward the whole mail.
+type Message struct {
+	UID     uint32
+	From    string
+	Subject string
+	Date    string // as sent, unparsed — display only
+	Body    string // plaintext, decoded, HTML-stripped, truncated
+	// Junk is set by the junk filter (see junk.go). A junk message is carried
+	// rather than dropped so the poller can count it and still mark it seen.
+	Junk       bool
+	JunkReason string
+}
+
+// ParseMessage turns one RFC 5322 message into a Message.
+//
+// It never fails on a body it cannot understand: an unparsable or
+// unsupported-charset body yields an empty Body and the headers still come
+// through, because a subject line alone is often the whole task ("Счёт за
+// интернет"). Only a message whose headers cannot be read at all is an error.
+func ParseMessage(uid uint32, raw []byte) (Message, error) {
+	m, err := mail.ReadMessage(strings.NewReader(string(raw)))
+	if err != nil {
+		return Message{}, fmt.Errorf("email: parse message: %w", err)
+	}
+	msg := Message{
+		UID:     uid,
+		From:    decodeHeader(m.Header.Get("From")),
+		Subject: decodeHeader(m.Header.Get("Subject")),
+		Date:    m.Header.Get("Date"),
+	}
+	msg.Junk, msg.JunkReason = classifyJunk(m.Header)
+	body, err := plaintextBody(m.Header.Get("Content-Type"), m.Header.Get("Content-Transfer-Encoding"), m.Body)
+	if err == nil {
+		msg.Body = truncate(collapse(body), MaxBodyBytes)
+	}
+	return msg, nil
+}
+
+// plaintextBody walks the MIME tree and returns the best plaintext it can.
+//
+// Preference order inside a multipart: text/plain first, text/html stripped
+// only when there is no plain part. multipart/mixed attachments are skipped
+// wholesale — an attachment is a file, not a sentence, and reading one would
+// mean parsing arbitrary formats from the network.
+func plaintextBody(contentType, encoding string, body io.Reader) (string, error) {
+	mediaType, params, err := mime.ParseMediaType(contentType)
+	if contentType == "" || err != nil {
+		// No Content-Type at all is legal and means text/plain; a broken one is
+		// treated the same rather than dropping the message.
+		mediaType, params = "text/plain", nil
+	}
+	switch {
+	case strings.HasPrefix(mediaType, "multipart/"):
+		boundary := params["boundary"]
+		if boundary == "" {
+			return "", fmt.Errorf("email: multipart without boundary")
+		}
+		return multipartText(multipart.NewReader(body, boundary))
+	case mediaType == "text/html":
+		raw, err := decodeBody(body, encoding, params["charset"])
+		if err != nil {
+			return "", err
+		}
+		return stripHTML(raw), nil
+	case mediaType == "text/plain":
+		return decodeBody(body, encoding, params["charset"])
+	default:
+		// A single-part non-text message (a bare PDF, say). No body, headers only.
+		return "", nil
+	}
+}
+
+// multipartText reads one multipart level, recursing into nested multiparts.
+// Returns the plain part if any part yielded one, else the stripped HTML.
+func multipartText(mr *multipart.Reader) (string, error) {
+	var plain, html string
+	for {
+		part, err := mr.NextPart()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			// A truncated multipart still gives up whatever came before it.
+			break
+		}
+		if part.FileName() != "" {
+			part.Close()
+			continue // attachment
+		}
+		ct := part.Header.Get("Content-Type")
+		mediaType, _, _ := mime.ParseMediaType(ct)
+		text, err := plaintextBody(ct, part.Header.Get("Content-Transfer-Encoding"), part)
+		part.Close()
+		if err != nil || strings.TrimSpace(text) == "" {
+			continue
+		}
+		if mediaType == "text/html" && !strings.HasPrefix(mediaType, "multipart/") {
+			if html == "" {
+				html = text
+			}
+			continue
+		}
+		if plain == "" {
+			plain = text
+		}
+	}
+	if strings.TrimSpace(plain) != "" {
+		return plain, nil
+	}
+	return html, nil
+}
+
+// decodeBody applies the transfer encoding, then the charset.
+//
+// Charset support is UTF-8 (and ASCII, its subset) only, on purpose: x/text's
+// encoding tables are not vendored here, and guessing at windows-1251 bytes
+// would feed the model mojibake it would happily extract a task from. An
+// unsupported charset returns an error, which ParseMessage turns into an empty
+// body — subject-only, which is honest.
+func decodeBody(r io.Reader, encoding, charset string) (string, error) {
+	switch strings.ToLower(strings.TrimSpace(encoding)) {
+	case "quoted-printable":
+		r = quotedprintable.NewReader(r)
+	case "base64":
+		r = newBase64Reader(r)
+	}
+	b, err := io.ReadAll(io.LimitReader(r, 1<<20))
+	if err != nil && len(b) == 0 {
+		return "", fmt.Errorf("email: read body: %w", err)
+	}
+	switch cs := strings.ToLower(strings.TrimSpace(charset)); cs {
+	case "", "utf-8", "utf8", "us-ascii", "ascii":
+		return string(b), nil
+	default:
+		return "", fmt.Errorf("email: unsupported charset %q", cs)
+	}
+}
+
+// decodeHeader decodes RFC 2047 encoded words ("=?utf-8?B?...?="), which is how
+// every Russian subject line arrives. Undecodable headers come back as-is
+// rather than empty: a mangled subject is still a hint, and it is only ever
+// shown to him as evidence.
+func decodeHeader(v string) string {
+	dec := new(mime.WordDecoder)
+	out, err := dec.DecodeHeader(v)
+	if err != nil {
+		return collapse(v)
+	}
+	return collapse(out)
+}
+
+var (
+	scriptStyle = regexp.MustCompile(`(?is)<(script|style)\b[^>]*>.*?</\s*(script|style)\s*>`)
+	htmlBreak   = regexp.MustCompile(`(?i)<\s*(br\s*/?|/p|/div|/tr|/li|/h[1-6])\s*>`)
+	htmlTag     = regexp.MustCompile(`(?s)<[^>]*>`)
+	htmlComment = regexp.MustCompile(`(?s)<!--.*?-->`)
+)
+
+// stripHTML reduces an HTML part to text. A regex stripper, not a parser:
+// x/net/html is not vendored, and the consumer is a model reading prose — a
+// stray angle bracket costs nothing, whereas a new dependency for the privacy-
+// sensitive path costs review.
+func stripHTML(s string) string {
+	s = scriptStyle.ReplaceAllString(s, " ")
+	s = htmlComment.ReplaceAllString(s, " ")
+	s = htmlBreak.ReplaceAllString(s, "\n")
+	s = htmlTag.ReplaceAllString(s, " ")
+	return unescapeEntities(s)
+}
+
+var entities = strings.NewReplacer(
+	"&nbsp;", " ", "&amp;", "&", "&lt;", "<", "&gt;", ">",
+	"&quot;", `"`, "&#39;", "'", "&apos;", "'", "&mdash;", "—", "&ndash;", "–",
+)
+
+func unescapeEntities(s string) string { return entities.Replace(s) }
+
+// collapse squeezes runs of whitespace, keeping single newlines. Mail bodies
+// arrive with hard-wrapped lines and blocks of blank space; the model does not
+// need them and they are pure context budget.
+func collapse(s string) string {
+	lines := strings.Split(strings.ReplaceAll(s, "\r\n", "\n"), "\n")
+	var out []string
+	blank := 0
+	for _, l := range lines {
+		l = strings.TrimSpace(strings.Join(strings.Fields(l), " "))
+		if l == "" {
+			blank++
+			if blank > 1 {
+				continue
+			}
+			out = append(out, "")
+			continue
+		}
+		blank = 0
+		out = append(out, l)
+	}
+	return strings.TrimSpace(strings.Join(out, "\n"))
+}
+
+// truncate cuts to n bytes on a rune boundary.
+func truncate(s string, n int) string {
+	if len(s) <= n {
+		return s
+	}
+	cut := s[:n]
+	for len(cut) > 0 && !isRuneStart(cut[len(cut)-1]) {
+		cut = cut[:len(cut)-1]
+	}
+	return strings.TrimSpace(cut) + "…"
+}
+
+func isRuneStart(b byte) bool { return b&0xC0 != 0x80 }
+
+// newBase64Reader — base64.NewDecoder already skips the CRLFs mail bodies wrap
+// with, so this is only a named seam for decodeBody to read cleanly.
+func newBase64Reader(r io.Reader) io.Reader {
+	return base64.NewDecoder(base64.StdEncoding, r)
+}

internal/email/message_test.go

@@ -0,0 +1,111 @@
+package email
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func fixture(t *testing.T, name string) []byte {
+	t.Helper()
+	b, err := os.ReadFile(filepath.Join("testdata", name))
+	if err != nil {
+		t.Fatalf("read fixture %s: %v", name, err)
+	}
+	return b
+}
+
+func TestParsePlainRussian(t *testing.T) {
+	msg, err := ParseMessage(7, fixture(t, "plain_ru.eml"))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if msg.UID != 7 {
+		t.Errorf("uid = %d, want 7", msg.UID)
+	}
+	if want := "Нужно закрыть задачу"; msg.Subject != want {
+		t.Errorf("subject = %q, want %q", msg.Subject, want)
+	}
+	if !strings.Contains(msg.From, "Антон") {
+		t.Errorf("from = %q, want the decoded display name", msg.From)
+	}
+	if !strings.Contains(msg.Body, "Надо отправить акт до пятницы.") {
+		t.Errorf("body = %q, want the quoted-printable text decoded", msg.Body)
+	}
+	if msg.Junk {
+		t.Errorf("a personal mail must not be junk (%s)", msg.JunkReason)
+	}
+}
+
+func TestParseHTMLOnlyIsStripped(t *testing.T) {
+	msg, err := ParseMessage(1, fixture(t, "html_only.eml"))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if strings.Contains(msg.Body, "<") || strings.Contains(msg.Body, "color:red") || strings.Contains(msg.Body, "x()") {
+		t.Errorf("body still has markup/script/style: %q", msg.Body)
+	}
+	for _, want := range []string{"Счёт за интернет: 700", "Оплатить до 5 августа."} {
+		if !strings.Contains(msg.Body, want) {
+			t.Errorf("body = %q, want it to contain %q", msg.Body, want)
+		}
+	}
+	// &nbsp; must have become a real space, not vanished into the number.
+	if strings.Contains(msg.Body, "&nbsp;") {
+		t.Errorf("entity left unescaped: %q", msg.Body)
+	}
+}
+
+func TestParsePrefersPlainAndSkipsAttachments(t *testing.T) {
+	msg, err := ParseMessage(2, fixture(t, "mixed_attachment.eml"))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if got := strings.TrimSpace(msg.Body); got != "Sign the contract before Monday." {
+		t.Errorf("body = %q, want the text/plain alternative only", got)
+	}
+	if strings.Contains(msg.Body, "PDF") {
+		t.Errorf("attachment bytes leaked into the body: %q", msg.Body)
+	}
+}
+
+// An unsupported charset must degrade to headers-only rather than to mojibake
+// the model would then extract a task from.
+func TestParseUnsupportedCharsetKeepsHeaders(t *testing.T) {
+	msg, err := ParseMessage(3, fixture(t, "cp1251.eml"))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if msg.Subject != "Legacy" {
+		t.Errorf("subject = %q, want Legacy", msg.Subject)
+	}
+	if msg.Body != "" {
+		t.Errorf("body = %q, want empty for an undecodable charset", msg.Body)
+	}
+}
+
+func TestParseTruncatesLongBody(t *testing.T) {
+	var b strings.Builder
+	b.WriteString("Subject: long\r\nContent-Type: text/plain; charset=utf-8\r\n\r\n")
+	for i := 0; i < 2000; i++ {
+		b.WriteString("длинная строка ")
+	}
+	msg, err := ParseMessage(4, []byte(b.String()))
+	if err != nil {
+		t.Fatalf("parse: %v", err)
+	}
+	if len(msg.Body) > MaxBodyBytes+8 {
+		t.Errorf("body kept %d bytes, want ≤ %d", len(msg.Body), MaxBodyBytes)
+	}
+	if !strings.HasSuffix(msg.Body, "…") {
+		t.Errorf("truncated body should be marked: %q", msg.Body[len(msg.Body)-20:])
+	}
+}
+
+func TestCollapseSqueezesBlankLines(t *testing.T) {
+	got := collapse("  a  b \r\n\r\n\r\n\r\n  c  \r\n")
+	if got != "a b\n\nc" {
+		t.Errorf("collapse = %q, want %q", got, "a b\n\nc")
+	}
+}

internal/email/testdata/cp1251.eml

@@ -0,0 +1,7 @@
+From: legacy@example.org
+To: kami@example.org
+Subject: Legacy
+Date: Fri, 01 Aug 2026 05:00:00 +0400
+Content-Type: text/plain; charset="windows-1251"
+
+Ï

internal/email/testdata/html_only.eml

@@ -0,0 +1,13 @@
+From: billing@isp.example
+To: kami@example.org
+Subject: =?utf-8?B?0KHRh9GR0YIg0LfQsCDQuNC90YLQtdGA0L3QtdGC?=
+Date: Fri, 01 Aug 2026 08:00:00 +0400
+MIME-Version: 1.0
+Content-Type: multipart/alternative; boundary="B1"
+
+--B1
+Content-Type: text/html; charset="utf-8"
+Content-Transfer-Encoding: base64
+
+PGh0bWw+PGhlYWQ+PHN0eWxlPnB7Y29sb3I6cmVkfTwvc3R5bGU+PC9oZWFkPjxib2R5PjxwPtCh0YfRkdGCINC30LAg0LjQvdGC0LXRgNC90LXRgjogNzAwJm5ic3A74oK9PC9wPjxwPtCe0L/Qu9Cw0YLQuNGC0Ywg0LTQviA1INCw0LLQs9GD0YHRgtCwLjwvcD48c2NyaXB0PngoKTwvc2NyaXB0PjwvYm9keT48L2h0bWw+
+--B1--

internal/email/testdata/mixed_attachment.eml

@@ -0,0 +1,26 @@
+From: hr@work.example
+To: kami@example.org
+Subject: Contract
+Date: Fri, 01 Aug 2026 07:00:00 +0400
+MIME-Version: 1.0
+Content-Type: multipart/mixed; boundary="M1"
+
+--M1
+Content-Type: multipart/alternative; boundary="A1"
+
+--A1
+Content-Type: text/plain; charset="utf-8"
+
+Sign the contract before Monday.
+--A1
+Content-Type: text/html; charset="utf-8"
+
+<p>Sign the contract before Monday.</p>
+--A1--
+--M1
+Content-Type: application/pdf; name="contract.pdf"
+Content-Disposition: attachment; filename="contract.pdf"
+Content-Transfer-Encoding: base64
+
+JVBERi0xLjQgbm90IHJlYWxseSBhIHBkZg==
+--M1--