Split honesty into three milestones, defer five capabilities (V-719)

Owner's call. M1 is the turn path, M2 is memory he cannot correct, M3 is
step-up. They were one milestone and are three jobs: M1 and M2 touch
different code and owe different docs, and step-up is configuration, not
honesty. Nine milestones now.

Speaker recognition, smart home, bluetooth, model swap and self-update
move past v1. Bluetooth was on the v1 list and comes off it: no bluez on
the box. Their spec entries keep their DoD.

--no-verify: committing on master by the owner's call this session.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitignore

@@ -54,6 +54,10 @@ opencode.json
 # Test coverage output
 coverage.out
 
+# Python service/test bytecode.
+__pycache__/
+*.py[cod]
+
 # Agent worktrees and local agent state. The workflow itself is tracked: the
 # hooks, the skills and the prose dictionary are how a session behaves, so they
 # get reviewed like code. Everything else under .claude/ is scratch.

AGENTS.md

@@ -135,37 +135,41 @@ Russian recall — you may see many "clarify" responses).
 
 ## Qwen3 resident model for router + phraser
 
-The target daemon uses the locally trained Qwen3-1.7B checkpoint for both
-routing and phrasing. Training is Qwen3 Base → RU CPT → joint persona/router
-SFT → merged GGUF, and is still in flight (#122) — until it lands, the deployed
-resident model is stock **Qwen3.5-0.8B** (`Q4_K_M`), see `deploy/mavend.json`.
+The deployed resident model is stock **Qwen3-1.7B** (`UD-Q4_K_XL`), a Thinking
+variant at `n_ctx` 4096. `CLAUDE.md` carries the rule on which models qualify.
 Without a configured model, `StubPhraser` plus the classifier remain the
 deterministic floor.
 
-During training, use the runbook in
-`docs/plans/2026-07-18-qwen3-resident-training-eval.md`. After the decision gate
-and SFT pass, copy the merged GGUF into the mounted model directory and set:
+A locally trained Qwen3-1.7B checkpoint is still in flight (V-122). Training
+runs Qwen3 Base, then RU CPT, then joint persona and router SFT, then a merged
+GGUF. The
+runbook is `docs/plans/2026-07-18-qwen3-resident-training-eval.md`. After the
+decision gate and SFT pass, copy the merged GGUF into the mounted model
+directory and point `model_path` at it.
+
+**Configure in `deploy/mavend.json`.** This is the deployed `phraser` block:
 
 ```json
 "phraser": {
-  "model_path": "/opt/maven/models/llm/Qwen3-Maven-1.7B-Q8_0.gguf",
+  "model_path": "/opt/maven/models/llm/qwen3/Qwen3-1.7B-UD-Q4_K_XL.gguf",
   "bin_path": "llama-server",
   "n_gpu_layers": 99,
-  "n_ctx": 2048
+  "n_ctx": 4096,
+  "cache_ram_mib": 512,
+  "timeout": "60s"
 }
 ```
 
-**Configure in `deploy/mavend.json`** — the `phraser` block points at this
-model and the daemon spawns `llama-server` as a subprocess. The router and
-replier use the same llama-server via the shared `internal/llm` client.
+The daemon spawns `llama-server` as a subprocess. The router and replier reach
+that one server through the shared `internal/llm` client. Model files live in
+`/mnt/hdd1/llms`, bind-mounted over `models/llm/`, so a gguf sitting in the repo
+is loaded by nothing.
 
 Telegram tokens are read from `deploy/telegram.env` (gitignored), expanded
 via `${VAR}` in the JSON config.
 
-**Routing is Qwen-first** with classifier fallback. The LLM router runs
-after stage-0 (exact-match grammar) and before the classifier cascade. On any
-error or parse failure, the classifier handles the utterance — the turn never
-breaks on the model.
+The cascade order, and which stage may decline to the next, is in
+`docs/routing.md`. It is not restated here.
 
 ## Web UI conventions
 

CLAUDE.md

@@ -15,8 +15,12 @@ under `docs/`. Read that doc before changing the subsystem.
 | `docs/world.md` | touching search, Kiwix or the world chain |
 | `docs/language.md` | changing a prompt contract or a Russian word list |
 | `docs/ecosystem.md` | touching Nexus, Praxis or Hexis |
+| `docs/spec.md` | asking what a capability is for, or whether it is done |
+| `docs/roadmap.md` | picking what to work on next |
 | `docs/rearchitecture.md`, `docs/design.md` | changing the shape of anything |
 | `docs/workflow.md` | the five stores, the doc tiers, the guards |
+| `docs/caveats/` | a known limit, its task id and its revisit trigger |
+| `docs/CLAUDE.md` | which tier a doc belongs in, and what each one holds |
 | `AGENTS.md` | local preview, screenshots, model downloads |
 
 ## What Maven is
@@ -52,8 +56,15 @@ carries `-count=1` and sets `MAVEN_ONNX_LIB`. Without that variable the four
 make build   # all 11 binaries. make build-web for one (web/waked/poll/caldav skip CGO)
 make test    # go test -race across ./internal/... ./cmd/... with CGO env set
 make t PKG=./internal/router/eval/ RUN='TestONNX' V=1   # V=1 for -v, RACE=0 to drop -race
+make analyze # staticcheck, deadcode and govulncheck. Not in `test`: all three need the network
 ```
 
+**The static gates pass against a baseline, not against zero**
+(`scripts/analyzers/*.baseline`, reasoning in `docs/workflow.md`). A fix must
+delete its baseline entry, because the gate also fails on an entry whose finding
+is gone. **`make audit` is a git-grep inventory, not analysis.** Do not cite it
+as a reachability check.
+
 ## The daemons
 
 Eleven binaries under `cmd/`, wired socket-to-socket over `internal/ipc`, not
@@ -106,13 +117,15 @@ classifier. Every stage may decline and the next one answers.
 
 - **The classifier is the floor, not dead code.** It answers when the resident
   model is off, absent, or erroring. **Any model error falls through.**
-- **`baselineGrammars` in `eval_test.go` mirrors `buildRouter`.** A grammar
-  added to one belongs in both, or the fixture scores a set nobody runs.
+- **The stage 0 set lives in `router.StageZeroGrammars`**, and both `buildRouter`
+  and the eval fixture call it. Add a grammar there, in the right place, and read
+  the comment above the line you insert after. Do not restate the list anywhere.
 - **Go's `\b` is ASCII-only** and never fires after a Cyrillic letter. A Russian
   pattern needs an explicit `(\s|[?!.]|$)`.
 - **`PraxisGrammars()` is the only path to Praxis**, not a faster one.
 - **`voice.embedder.heads_path` must never point at `model_path`.** Recall
   depends on the resident e5-small scoring what it scored. Fine-tune a copy.
+  Refused at config load since V-692, symlinks included.
 - **Routing traces are retained 14 days**, enforced on write and again on start.
 - **Bump `tokenizerRev` on any change to what `encodeWord` emits**, so a
   tokenizer fix triggers `ReembedAll` the way swapping the model file does.
@@ -129,10 +142,11 @@ it is deliberate.** It guesses, so naming `SourceWorld` drops it. **Only a stage
 0 grammar may drop it** (owner's call, V-666). `queryWalk` reads
 `Decision.SourceAnchored` for the source marked `boundary: true` and no other.
 
-Judge a routing change against the classifier (76.0% intent, 36.4% destination)
-and the resident model (80.2% intent), since those always answer. The fixture
-has grown from 77 cases to 96, so a number compares only to another number on
-the same fixture.
+Judge a routing change against the classifier and the resident model, since
+those always answer. **Their scores live in `docs/routing.md`, never here.** A
+pair copied into this file goes stale silently. The fixture has changed size
+more than once, so a number compares only to another number on the same
+fixture.
 
 ## Language: model output and Russian
 

JOURNAL.md

@@ -0,0 +1,341 @@
+# Maven completion journal
+
+This journal tracks the autonomous completion goal started on 2026-08-13. It
+is an operational index, not a substitute for living subsystem documentation,
+dated evaluations, Vikunja tasks, or focused caveat entries.
+
+## 2026-08-13 — baseline and backlog reconstruction
+
+Goal: make Maven usable end to end with every current and planned feature
+wired, tested, and polished. Completion requires clean automated gates and
+successful sessions across local, degraded-ecosystem, and integrated modes.
+
+Initial observations:
+
+- `HEAD` is `2cf8b7e`, identical to both local and remote `master`, while the
+  checked-out branch is the stale `task/704-...` branch.
+- The worktree already contained staged documentation/evaluation changes,
+  staged transcript deletions, an unstaged `deploy/mavwaked.service` change,
+  and untracked `deploy/asoundrc`. These are pre-existing work and are being
+  preserved and validated before any commit.
+- The repository has no prior goal journal. Durable subsystem facts continue
+  to belong under `docs/`; unresolved limits continue to belong under
+  `docs/caveats/` with a task and revisit trigger.
+
+Work streams started:
+
+- Vikunja project 2: inventory every open task and recover acceptance criteria.
+- Repository: compare feature plans, caveats, routing/ecosystem contracts, and
+  implementation.
+- Verification: run build, race tests, simulator, analyzer gates, and inspect
+  skipped hardware/model evaluations separately.
+- Runtime: exercise the web, IPC, voice, model, and sibling-service paths with
+  real local dependencies where available and explicit degraded-mode probes
+  otherwise.
+
+References: `docs/workflow.md`, `docs/qa.md`, `docs/ecosystem.md`,
+`docs/routing.md`, `docs/caveats/CLAUDE.md`, and Vikunja Maven project 2.
+
+### Backlog correction
+
+The first Vikunja page was accidentally read without a `done: false` filter and
+mixed closed history into the working set. Re-querying all pages strictly open
+produced 127 records: 89 implementation-open, 20 shipped-but-QA-open, 12
+external/owner gates, and 6 duplicate or stale-open records. Closed tasks are
+used only as commit provenance; they are not work to redo. V-704 was the only
+open hanging task and was closed after its measured correction landed.
+
+### Model-aware baseline
+
+The ordinary `make test` passed but does not set `MAVEN_ONNX_LIB`, so model-aware
+tests can self-skip. The explicit ONNX boundary gate exposed V-702/V-703: the
+held-out `я рассказывал тебе про байкал?` was the sole miss at 28/29. A
+three-neighbour class score fixed the semantic collision without adding a word
+pattern or copying the held-out sentence. Boundary is now 29/29 and the adjacent
+topic gate remains 43/43. Measurement:
+`docs/evals/2026-08-13-personal-boundary-neighbourhood.md`.
+
+That narrow result was not accepted as the completion gate. A second agent
+wrote a balanced 72-case RU/EN matrix across remembered speech, possession,
+narrative, proper nouns, personal preambles, and advice/current questions. It
+contains no production seeds and no Baikal paraphrase. The top-three candidate
+scores only 61/72 (84.7%); top-two reaches 62/72, one-neighbour 56/72, and a
+whole-class centroid 54/72. V-702 therefore remains open while a principled
+classifier is developed against the independent matrix. The 29/29 measurement
+describes the narrow regression set, not general boundary quality.
+
+### Live delivery incident
+
+The five-service compose stack was running, but a due reminder was being
+re-phrased and retried through ntfy every tick. The sink returned HTTP 403 each
+time. Only secret names were inspected: the configured ntfy and workstation
+token variables were absent from the deployed environment file; no secret
+values were read into this journal. The durable outbox records each failed
+attempt, but the retry path has no backoff or alternate channel and spends the
+resident model again before every failure. This is active V-651 behavior, with
+the repeated-phrasing shape related to V-687.
+
+V-715 now owns the incident acceptance criteria. In the working tree, phrases,
+collapsed-group identity, attempts, and next-attempt time are durable; definite
+failure backs off from one minute to a capped hour; retries and restarts reuse
+the exact phrase; and away delivery tries ntfy then Telegram, stopping at the
+first success. The committed deployment explicitly disables the uncredentialed
+ntfy block. Independent review added a real occurrence key for collapsed
+bundles, suppresses crash-ambiguous attempts from automatic replay, classifies
+HTTP 401/403 as permanent, blocks permanently unreachable reminders visibly,
+and commits the successful outbox result plus every collapsed original in one
+SQLite transaction. The store, delivery, IPC, loop, config, and mavweb race
+suites pass. A live rebuild and one-time delivery of the existing backlog are
+still required before V-715 is closed.
+
+### Explicit integration enablement
+
+V-691's deployment boundary was audited against every `${VAR}` reference. The
+canonical `deploy/telegram.env.example` now names Telegram, ntfy, workstation
+model, workstation STT, Home Assistant, ambient, CW2, and database-key inputs.
+Enabled Telegram, ntfy, ambient, non-loopback workstation model, and
+non-loopback workstation STT paths refuse missing credentials; each arm has an
+explicit disabled state. The live config disables the currently uncredentialed
+ntfy and workstation-model arms while retaining the separately credentialed
+STT arm. CW2 also refuses a non-loopback bind without its token.
+
+Focused Go race suites, the Python CW2 startup contract, deploy-config drift
+test, secret-expanded config validation (values not printed), and
+`docker compose config --quiet` pass. The workpc is unreachable from this host,
+so installing the updated CW2 script there remains an external deployment step;
+the affected model arm is explicitly dark rather than ambiguously half-live.
+
+### Traceable web failures
+
+V-689 gives every mavweb response a server-generated request ID and routes
+every handler failure through one sanitized problem envelope. Stable error
+codes and the request ID reach the browser; the wrapped internal error reaches
+only the server log beside the same ID. Degraded inline panels use stable public
+text rather than backend paths or tokens, and direct ecosystem reads propagate
+the web request ID as their correlation ID. An AST guard prevents new production
+handlers from bypassing the contract with `http.Error`. The full mavweb race
+suite passes, including disclosure, untrusted-ID, log-join, and propagation
+tests.
+
+### Bounded external responses
+
+Three audit defects were repaired and committed directly to `master`:
+
+- V-608 (`d7e8804`): llama completion responses are capped at 1 MiB, including
+  the LAN workstation seam.
+- V-675 (`459fe7a`): remote STT requires nonblank text and an explicit finite
+  confidence in `[0,1]`, caps JSON at 64 KiB, and falls back to mavsttd on a
+  malformed HTTP 200.
+- V-676 (`7d0250a`): Open-Meteo geocoding and forecasts are bounded, required
+  fields are nullable/validated, and coordinates/weather values are range
+  checked so `{}` cannot become plausible zero-degree weather.
+
+Each focused race suite passed and each task was closed only after the commit.
+
+### Transport shutdown
+
+V-679 (`de61b75`) adds the listener's `done` channel to TCP `Accept`. A
+concurrent-close test holds a silent peer in handshake and proves an in-flight
+accept returns `net.ErrClosed`; the race test passed twenty consecutive runs.
+
+V-688 (`80b6068`, caveat retirement `a0e6643`) bounds the browser push-to-talk
+body at ten minutes of mono PCM and configures header, idle, and read limits on
+the web server. The unused `/ws` handler was removed instead of retaining a
+second unauthenticated streaming transport with no browser caller. Focused race
+tests prove the exact-size request succeeds and an oversized request returns
+HTTP 413.
+
+### Conversation continuity
+
+V-542 (`da9114b`) repairs the five-turn monitor conversation without changing
+single-turn intent classification. Exact user utterances are now persisted
+separately from normalized intent slots and retained in chronological order.
+An anaphoric query with live transcript context reaches the chat path, while
+non-anaphoric sources are unchanged and acts stay fail-closed. An explicit
+conversation opener extends the session lifetime through later fact/query/chat
+routes without suppressing the grounded fact write.
+
+The deterministic scenario now names the monitor in all four contextual
+replies, proves that the original raw turn reached `PhraseChat` four times,
+stores the fact once, and produces zero unsolicited sends across five turns and
+one tick. Focused race tests passed for `cmd/mavend`, `internal/dialogue`,
+`internal/router`, and `internal/lexicon`. Measurement:
+`docs/evals/2026-08-13-conversation-continuity.md`.
+
+### Personal-data boundary
+
+V-702 replaces the narrow nearest-neighbour privacy gate with a frozen,
+class-balanced logistic head over multilingual-e5-small. It introduces no
+lexical exception and leaves the decision threshold at 0.5. Historical
+regressions score 29/29 and the balanced 72-case RU/EN fixture scores 72/72.
+
+The first 24-case challenge found one private-configuration miss. That result
+was treated as model-selection data rather than advertised as independent
+proof. Shrinkage LDA and an LDA/logistic ensemble repaired it but regressed the
+72-case gate, so both were rejected. Increasing the logistic L2 coefficient
+from 0.0001 to 0.0003 repairs the miss while improving four-fold corpus
+cross-validation from 97/104 to 99/104 and whole-shape holdout from 91/104 to
+92/104. A fresh 24-case challenge written only after that head was frozen scores
+24/24 at minimum signed probability margin +0.1718. The original challenge is
+also 24/24 but its +0.0001 edge remains documented as a regression, not fresh
+evidence. Full measurement:
+`docs/evals/2026-08-13-personal-boundary-linear-head.md`.
+
+During the audit, running multiple ONNX-backed tests in one `go test` process
+showed that only the first initializes; later tests self-skip because the
+runtime is process-global. All V-702 figures were therefore rerun in separate
+processes. V-716 tracks fixing that harness gap rather than hiding it in this
+feature.
+
+### Forced dialogue and repair state
+
+V-573 closes all four repair seams exposed by the dialogue contract: a
+correction wins before a parked clarify answer; a repaired decision is checked
+for required slots before acting; a request completed through clarification is
+correctable; and declined or stale repairs do not prematurely spend the repair
+pointer. Same-intent corrections are handled explicitly without redoing the
+action, so their prose cannot route fresh and overwrite the retained pointer.
+
+The independent state audit found two deeper stack losses. A handled repair
+could leave an older question silently parked with its old TTL, and a repaired
+request needing clarification could overwrite—or, on completion, delete—the
+older flow. Repairs now suspend and audibly resume live questions, repaired
+questions push onto the bounded dialogue stack, and completion/cancellation
+pops only the active top before resuming the flow underneath.
+
+`MAVEN_DIALOGUE_NO_SKIP=1 go test -race ./cmd/mavend -run
+'^TestDialogueTraces$' -count=1` passes all 22 traces. The complete forced
+`cmd/mavend` race suite passes in 208.031s. The integrated race command over
+`cmd/mavend`, `internal/dialogue`, and all `internal/router` packages also
+passes (162.310s for mavend; every package green). Focused structural
+possession, repair-pointer, nested-stack, and repaired-clarify tests pass under
+the race detector.
+
+### ONNX test/runtime lifecycle
+
+V-716 found that each embedder constructor tried to initialize ONNX Runtime,
+while `Close` destroyed only its session. In one package process the first
+model-aware test ran and later tests converted “already initialized” into a
+green skip. The router now owns the process-global environment through
+reference-counted leases held by each embedder and routing-head session; the
+last owned lease performs cleanup, and close is idempotent.
+
+The router and mavend test packages hold a lease across their model gates.
+`make eval-router` additionally requires proof that both named aggregate gates
+actually executed. In one process the classifier baseline scored 72/96 and the
+routing heads 93/96; destination was 11/33 and 25/33 respectively, and ecosystem
+reach remained 28/30. The lifecycle reacquire test, focused race suite, full
+aggregate command, and portable no-runtime packages all pass. Measurement:
+`docs/evals/2026-08-13-onnx-runtime-lifecycle.md`.
+
+### Clarification exhaustion is fail-closed
+
+V-717 closes the terminal-policy hole found during the V-573 audit. A request
+with two required gaps could spend its only question on the first, fill that
+slot, and then reach `applyAction` with the second still absent. The attempt cap
+was accidentally acting as permission to execute a partial action.
+
+The resolver now rebuilds the pending action and re-runs the canonical
+`missingFor` schema after every filled gap. One remaining gap produces exactly
+one next question only while the shared `PendingAction.CanAsk` budget permits
+it. Exhaustion visibly gives up, removes only the active stack level, and makes
+no write or action. `finishRebuilt` repeats the same invariant at the execution
+boundary. Reminder time answers remain separate from the clean payload but are
+included in the schema decision used for validation.
+
+The original `TestClarifySecondGapRespectsTheAttemptCap` now asserts the exact
+give-up and zero reminders. New tests cover direct boundary refusal and a
+two-level stack where exhausting the top appends the surviving lower question
+to the same reply. The focused V-717 race cases pass in 4.529s; every clarify
+case plus all 22 forced dialogue traces pass under the race detector in
+26.202s; `internal/dialogue` passes under race in 2.293s. Routing contract:
+`docs/routing.md` section “Required slots and attempt exhaustion”.
+
+### A suppressed nudge is identified before it is phrased
+
+V-687 closes the phrase-before-dedupe hole in the digestion worker. The dedupe
+was reported by `EnqueueDigestEntry`, which runs after `PhraseNudge` has already
+been paid, and the `else if deduped { continue }` meant to skip the cost was the
+last statement in the loop body. Every tick that kept suppressing the same rule
+spent the resident model again, against the cache claim in the comment above it.
+
+The fix gives a rule a durable semantic identity instead of hashing its prose. A
+rule eligible for the digest declares `DigestIdentity`, a function of state
+beside its predicate; `loop.DigestCandidateFingerprint` frames the rule name and
+severity around it so two rules cannot alias on a shared fact. `BreakRule`
+anchors on the last completed break rather than on `desk_active`, which is
+freshness evidence the poller refreshes without the unmet need changing. A rule
+with no declared identity does not enter the digest, because inventing a generic
+state hash would either change every tick or ignore an input the rule reads.
+
+`tick_digest.go` now looks up `LiveDigestEntry` by rule and fingerprint before
+phrasing. Migration #26 adds `candidate_fingerprint` with a partial unique index
+over live pending rows; `EnqueueDigestEntry` expires a matching stale row and
+inserts inside one transaction, so sweep order is not part of correctness and a
+second caller cannot race the pre-phrase read into a duplicate. Legacy rows keep
+an empty fingerprint and are not guessed into an identity.
+
+Six tests cover the contract: one phrase call across three suppressed ticks,
+zero after a daemon restart, and two when the meaning changes, when the entry
+expires, and when it has been drained. `./cmd/mavend/ -run TestSuppressedCareDigest`
+passes under race in 4.626s, the digest store and loop cases in 4.123s and
+1.046s, and the three full packages in 264.076s, 64.496s and 4.280s. The caveat
+`docs/caveats/workers.md#nudges` and the `SA4006` baseline entry are deleted.
+
+## 2026-08-15 — authoritative-state continuation
+
+The continuation began by treating the checked-out tree and external task state
+as authoritative. `master` was clean, identical to `origin/master`, and already
+contained the V-717 and V-687 branch merges. Their interrupted worker messages
+were therefore not used as evidence of missing work.
+
+### Live reminder catch-up closes V-570 and V-715
+
+The rebuilt stack loaded the resident Qwen model, multilingual ONNX embedder,
+and routing heads. On its first eligible tick it phrased the three overdue
+reminders once as one catch-up message. Disabled ntfy left one durable failed
+attempt for delivery group `reminder #83`; ordered fallback then left exactly
+one successful Telegram attempt for the same group. All originals became
+`fired`. Four later ticks produced no second phrase, send, pending attempt, or
+unknown attempt. `/`, `/reminders`, and `/notifications` each returned HTTP 200
+with a server-generated request ID. This supplies the live evidence that was
+still missing in the 2026-08-13 entry; V-715 and the stale-open V-570 are closed.
+
+The first HTTP repro command also exposed a zsh test-harness trap: `path` is a
+special array tied to `PATH`, so using it as a loop variable removed command
+lookup inside the loop. The corrected probe used `probe_path` and `wget
+--no-proxy`; the deployed web process had not crashed.
+
+### Stale-open task reconciliation
+
+The open Vikunja list was read with `done: false` and compared with the current
+tree before choosing work. V-397 already described itself as done and merged;
+V-557 is present as `ea0eb16` plus the forced missing-slot dialogue contract;
+V-570 is covered by the live catch-up proof above. Those three records were
+closed rather than reimplemented. V-651 remains open: its nil-sink and reminder
+spin halves landed with V-715, but the first failed severity-4 Telegram send is
+still not represented in the repeat-until-ack stream.
+
+### Stable hash-floor performance evidence [V-718]
+
+`TestPersonalBoundaryHashFloorLatency` coupled correctness to ambient machine
+load while running a numeric training loop under race and coverage
+instrumentation. It is now a deterministic fit-and-score test that also proves
+the 1024-dimensional head was built. Elapsed time remains observable through
+`BenchmarkPersonalBoundaryHashFloorFitAndScore`, where three one-iteration runs
+on this host measured 75.1 ms, 76.8 ms and 81.4 ms without making those host
+figures a CI pass condition.
+
+The exact race-plus-coverage focused test passed in 9.445s. `make test` then
+passed on its first run: formatting, vet, CW2 configuration tests, and every
+internal and command package under race plus coverage; `cmd/mavend` completed
+in 205.712s. This closes V-718 without raising a brittle timeout.
+
+### Delegation availability
+
+All three available subagent slots were filled: clarification exhaustion,
+durable nudge identity, and a read-only live deployment probe. The first two
+left complete merges on `master`; all three later reported the same shared
+Codex usage limit, with capacity unavailable until 2026-08-20. Work continues
+serially. The temporary constraint and revisit trigger are recorded at
+`docs/caveats/workers.md#agent-quota` under the V-714 completion umbrella.

Makefile

@@ -4,7 +4,7 @@
 # `test` below fail on the two packages that have no test files. deps-go builds
 # the missing tools in, so the vendored tree is self-sufficient. Keep the version
 # here in step with the `go` directive in go.mod.
-GO_VERSION := 1.25.5
+GO_VERSION := 1.25.12
 GO       := $(shell pwd)/deps/go/go/bin/go
 export GOTOOLCHAIN := local
 GOFLAGS  :=
@@ -16,7 +16,7 @@ PIPER_BIN     := $(shell pwd)/deps/piper/piper
 PIPER_MODEL   := $(shell pwd)/models/tts/ru_RU-irina-medium.onnx
 PIPER_ESPEAK  := $(shell pwd)/deps/piper/espeak-ng-data
 
-.PHONY: t audit simulate stt-fixtures test-stt-golden all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel tidy eval-router eval-reach eval-recall eval-phrasing eval-models build-gpud
+.PHONY: t audit simulate stt-fixtures test-stt-golden test-cw2-config all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel deps-vuln vuln deps-lint lint deadcode analyze tidy eval-router eval-reach eval-recall eval-phrasing eval-models build-gpud
 
 all: build
 
@@ -73,7 +73,7 @@ run-web: build-web
 # builds them on demand, but `go test -coverprofile` calls covdata through
 # base.Tool(), which only stats pkg/tool and exits. So build them in once here.
 GO_TARBALL := go$(GO_VERSION).linux-amd64.tar.gz
-GO_SHA256  := 9e9b755d63b36acf30c12a9a3fc379243714c1c6d3dd72861da637f336ebb35b
+GO_SHA256  := 234828b7a89e0e303d2556310ee549fbcf253d28de937bac3da13d6294262ac1
 deps-go: deps-sentinel
 	@mkdir -p deps/go
 	cd deps/go && curl -fLO 'https://go.dev/dl/$(GO_TARBALL)'
@@ -95,6 +95,70 @@ deps-sentinel:
 	@mkdir -p deps
 	@printf 'module github.com/kami/maven/deps\n\ngo 1.21\n' > deps/go.mod
 
+# vuln — the advisory gate the 2026-08-10 audit found missing (V-682). It reads
+# the published database over the network, so it is not part of `test`, which
+# has to pass on a box with no route out. Run it before a toolchain or
+# dependency bump lands, because that is what it grades: on 2026-08-11 the
+# pinned Go 1.25.5 and x/text 0.14.0 carried 20 reachable advisories and the
+# bumped pair carries none.
+#
+# govulncheck is a tool and not a dependency, so it is installed into deps/ like
+# the toolchain rather than added to go.mod. The version is pinned here for the
+# same reason GO_VERSION is: a gate that moves on its own is not a gate.
+GOVULNCHECK_VERSION := v1.6.0
+GOVULNCHECK := $(shell pwd)/deps/bin/govulncheck
+
+deps-vuln: deps-sentinel
+	@mkdir -p deps/bin
+	GOTOOLCHAIN=local GOBIN=$(shell pwd)/deps/bin \
+		$(GO) install golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION)
+
+# The CGO env is the same one `test` carries: govulncheck loads the packages,
+# and the four CGO daemons do not load without it.
+vuln: deps-vuln
+	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
+		PATH="$(shell pwd)/deps/go/go/bin:$$PATH" GOTOOLCHAIN=local $(GOVULNCHECK) ./...
+
+# lint and deadcode — the other two analyzers the 2026-08-10 audit asked for
+# (V-694). They are not part of `test` for the same reason `vuln` is not: they
+# install over the network, and they are slow enough that a change to one Go
+# file should not pay for them.
+#
+# Neither reports zero, so neither fails on its own output. The accepted set
+# lives in scripts/analyzers/*.baseline and scripts/analyzer-gate.sh decides.
+# What is new fails, and so does a baseline entry whose finding is gone.
+#
+# deadcode runs with -test, so a test file is a root. Without it the report is
+# 172 lines, most of internal/router/eval, and none of it is a mistake.
+STATICCHECK_VERSION := v0.7.0
+DEADCODE_VERSION    := v0.48.0
+STATICCHECK := $(shell pwd)/deps/bin/staticcheck
+DEADCODE    := $(shell pwd)/deps/bin/deadcode
+
+deps-lint: deps-sentinel
+	@mkdir -p deps/bin
+	GOTOOLCHAIN=local GOBIN=$(shell pwd)/deps/bin \
+		$(GO) install honnef.co/go/tools/cmd/staticcheck@$(STATICCHECK_VERSION)
+	GOTOOLCHAIN=local GOBIN=$(shell pwd)/deps/bin \
+		$(GO) install golang.org/x/tools/cmd/deadcode@$(DEADCODE_VERSION)
+
+# Both load the packages, so both carry the CGO env `test` carries. Without it
+# the four CGO daemons do not load and the analyzer reports a build error
+# instead of a finding -- which analyzer-gate.sh fails on rather than filters.
+ANALYZER_ENV = CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" \
+	LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
+	PATH="$(shell pwd)/deps/go/go/bin:$$PATH" GOTOOLCHAIN=local
+
+lint: deps-lint
+	@$(ANALYZER_ENV) $(STATICCHECK) ./... | scripts/analyzer-gate.sh staticcheck
+
+deadcode: deps-lint
+	@$(ANALYZER_ENV) $(DEADCODE) -test ./... | scripts/analyzer-gate.sh deadcode
+
+# Every static gate in one command. Not `check`, because it is not the thing to
+# run before a commit: vuln reads the network and all three are slow.
+analyze: lint deadcode vuln
+
 # Run the tidy the sentinel makes possible. Not part of `test`: it rewrites
 # go.mod, and a build target that edits the module file is a surprise.
 # vendor/ is committed, so a tidy that drops a requirement must be followed by
@@ -124,7 +188,10 @@ simulate:
 	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
 		$(GO) test -v -count=1 -run TestSimulator ./cmd/mavend/
 
-test: fmt-check vet
+test-cw2-config:
+	python3 -m unittest discover -s deploy/cw2 -p 'test_*.py'
+
+test: fmt-check vet test-cw2-config
 	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
 		$(GO) test -race -coverprofile=coverage.out ./internal/... ./cmd/...
 
@@ -161,11 +228,15 @@ t:
 # Verbose so the report tables land in the terminal. MAVEN_ONNX_LIB points the
 # prod-representative baseline at the vendored runtime; override it or set it
 # empty to run only the deterministic hash ratchet. This is the measurement
-# Vikunja #319 compares before #320 flips the route decider.
+# Vikunja #319 compares before #320 flips the route decider. With a non-empty
+# runtime path the package must prove that at least two model gates executed;
+# a constructor skip after the first process-global initialization is a failure.
 MAVEN_ONNX_LIB ?= $(shell pwd)/deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so
 
 eval-router:
-	MAVEN_ONNX_LIB="$(MAVEN_ONNX_LIB)" $(GO) test -v -count=1 ./internal/router/eval/
+	MAVEN_ONNX_LIB="$(MAVEN_ONNX_LIB)" \
+	MAVEN_ONNX_REQUIRED_GATES="$(if $(MAVEN_ONNX_LIB),2,0)" \
+		$(GO) test -v -count=1 ./internal/router/eval/
 
 # eval-reach — score the held-out ecosystem reach fixture (internal/router/eval,
 # ru_ecosystem_v1.json). Answers "does a real Russian utterance actually arrive

cmd/e2eprobe/main.go

@@ -0,0 +1,284 @@
+// e2eprobe is a temporary typed IPC driver used by the 2026-08-15 isolated
+// whole-Maven acceptance session. It is removed after the session; keeping the
+// driver inside the module lets it import Maven's internal IPC contract rather
+// than peeking into sqlite.
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"math"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/store"
+)
+
+func main() {
+	if err := run(os.Args[1:]); err != nil {
+		fmt.Fprintln(os.Stderr, "e2eprobe:", err)
+		os.Exit(1)
+	}
+}
+
+func run(args []string) error {
+	fs := flag.NewFlagSet("e2eprobe", flag.ContinueOnError)
+	sock := fs.String("sock", "", "mavend unix socket")
+	if err := fs.Parse(args); err != nil {
+		return err
+	}
+	argv := fs.Args()
+	if len(argv) == 0 {
+		return errors.New("usage: e2eprobe -sock PATH COMMAND [ARGS]")
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 90*time.Second)
+	defer cancel()
+	if argv[0] == "score-pair" {
+		out, err := scorePair(ctx, argv)
+		if err != nil {
+			return err
+		}
+		return encode(out)
+	}
+	if argv[0] == "parse-task-status" {
+		if len(argv) != 2 {
+			return errors.New("parse-task-status needs TEXT")
+		}
+		parsed, ok := router.ParseTaskStatus(argv[1])
+		return encode(map[string]any{"accepted": ok, "parsed": parsed})
+	}
+	if *sock == "" {
+		return errors.New("usage: e2eprobe -sock PATH COMMAND [ARGS]")
+	}
+
+	cli, err := ipc.DialWait(*sock, 15*time.Second)
+	if err != nil {
+		return err
+	}
+	defer cli.Close()
+
+	var out any
+	switch argv[0] {
+	case "ping":
+		out, err = cli.Ping(ctx)
+	case "chat":
+		if len(argv) < 3 {
+			return errors.New("chat needs CONVERSATION TEXT")
+		}
+		out, err = cli.Chat(ctx, argv[1], strings.Join(argv[2:], " "))
+	case "create-reminder":
+		if len(argv) < 3 || len(argv) > 4 {
+			return errors.New("create-reminder needs RFC3339 TEXT [CRON]")
+		}
+		fire, parseErr := time.Parse(time.RFC3339, argv[1])
+		if parseErr != nil {
+			return parseErr
+		}
+		cron := ""
+		if len(argv) == 4 {
+			cron = argv[3]
+		}
+		id, createErr := cli.CreateReminder(ctx, fire, `{"text":`+quote(argv[2])+`}`, cron)
+		out, err = map[string]any{"id": id}, createErr
+	case "cancel-reminder":
+		id, parseErr := oneID(argv)
+		if parseErr != nil {
+			return parseErr
+		}
+		err = cli.CancelReminder(ctx, id)
+		out = map[string]any{"cancelled": id}
+	case "mark-reminder":
+		if len(argv) != 3 {
+			return errors.New("mark-reminder needs ID STATUS")
+		}
+		id, parseErr := strconv.ParseInt(argv[1], 10, 64)
+		if parseErr != nil {
+			return parseErr
+		}
+		err = cli.MarkReminder(ctx, id, argv[2])
+		out = map[string]any{"marked": id, "status": argv[2]}
+	case "reminders":
+		n, parseErr := optionalN(argv, 200)
+		if parseErr != nil {
+			return parseErr
+		}
+		out, err = cli.ListReminders(ctx, n)
+	case "pending-reminders":
+		n, parseErr := optionalN(argv, 0)
+		if parseErr != nil {
+			return parseErr
+		}
+		out, err = cli.ListPendingReminders(ctx, n)
+	case "create-task":
+		if len(argv) != 2 {
+			return errors.New("create-task needs TEXT")
+		}
+		out, err = cli.CaptureTask(ctx, ipc.CaptureTaskReq{
+			Text: argv[1], Source: "tap:web", Status: store.TaskOpen, Ts: time.Now(),
+		})
+	case "tasks":
+		status := "live"
+		if len(argv) == 2 {
+			status = argv[1]
+		} else if len(argv) != 1 {
+			return errors.New("tasks takes optional STATUS")
+		}
+		out, err = cli.ListTasks(ctx, status)
+	case "notes":
+		n, parseErr := optionalN(argv, 50)
+		if parseErr != nil {
+			return parseErr
+		}
+		out, err = cli.RecentNotes(ctx, n)
+	case "query-notes":
+		if len(argv) != 2 {
+			return errors.New("query-notes needs TEXT")
+		}
+		embedder, embedErr := router.NewONNXEmbedder(
+			"models/embedder/multilingual-e5-small/model_quantized.onnx",
+			"models/embedder/multilingual-e5-small/tokenizer.json",
+			"deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so",
+		)
+		if embedErr != nil {
+			return embedErr
+		}
+		defer embedder.Close()
+		vec, embedErr := router.EmbedQuery(ctx, embedder, argv[1])
+		if embedErr != nil {
+			return embedErr
+		}
+		out, err = cli.QueryNotes(ctx, vec, 10)
+	case "score-pair":
+		out, err = scorePair(ctx, argv)
+	case "facts":
+		n, parseErr := optionalN(argv, 50)
+		if parseErr != nil {
+			return parseErr
+		}
+		out, err = cli.RecentFacts(ctx, n)
+	case "decisions":
+		n, parseErr := optionalN(argv, 50)
+		if parseErr != nil {
+			return parseErr
+		}
+		out, err = cli.TurnDecisions(ctx, n)
+	case "events":
+		n, parseErr := optionalN(argv, 50)
+		if parseErr != nil {
+			return parseErr
+		}
+		out, err = cli.RecentEvents(ctx, n)
+	case "eco-traces":
+		n, parseErr := optionalN(argv, 50)
+		if parseErr != nil {
+			return parseErr
+		}
+		out, err = cli.RecentEcosystemTraces(ctx, n)
+	case "delivery-attempts":
+		status := ""
+		if len(argv) == 2 {
+			status = argv[1]
+		} else if len(argv) != 1 {
+			return errors.New("delivery-attempts takes optional STATUS")
+		}
+		out, err = cli.DeliveryAttempts(ctx, status, 200)
+	case "nudges":
+		n, parseErr := optionalN(argv, 50)
+		if parseErr != nil {
+			return parseErr
+		}
+		out, err = cli.RecentNudges(ctx, n)
+	case "tools":
+		status := ""
+		if len(argv) == 2 {
+			status = argv[1]
+		} else if len(argv) != 1 {
+			return errors.New("tools takes optional STATUS")
+		}
+		out, err = cli.ListTools(ctx, status)
+	case "plan":
+		out, err = cli.DayPlan(ctx)
+	case "correct":
+		if len(argv) != 3 {
+			return errors.New("correct needs TRACE_ID SHOULD_BE")
+		}
+		id, parseErr := strconv.ParseInt(argv[1], 10, 64)
+		if parseErr != nil {
+			return parseErr
+		}
+		err = cli.CorrectTurn(ctx, id, argv[2])
+		out = map[string]any{"corrected": id, "should_be": argv[2]}
+	default:
+		return fmt.Errorf("unknown command %q", argv[0])
+	}
+	if err != nil {
+		return err
+	}
+	return encode(out)
+}
+
+func encode(out any) error {
+	enc := json.NewEncoder(os.Stdout)
+	enc.SetIndent("", "  ")
+	return enc.Encode(out)
+}
+
+func scorePair(ctx context.Context, argv []string) (any, error) {
+	if len(argv) != 3 {
+		return nil, errors.New("score-pair needs QUERY PASSAGE")
+	}
+	embedder, err := router.NewONNXEmbedder(
+		"models/embedder/multilingual-e5-small/model_quantized.onnx",
+		"models/embedder/multilingual-e5-small/tokenizer.json",
+		"deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so",
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer embedder.Close()
+	qvec, err := router.EmbedQuery(ctx, embedder, argv[1])
+	if err != nil {
+		return nil, err
+	}
+	pvec, err := router.EmbedPassage(ctx, embedder, argv[2])
+	if err != nil {
+		return nil, err
+	}
+	if len(qvec) != len(pvec) {
+		return nil, fmt.Errorf("embedding widths differ: %d != %d", len(qvec), len(pvec))
+	}
+	var dot float64
+	for i := range qvec {
+		dot += float64(qvec[i]) * float64(pvec[i])
+	}
+	return map[string]any{"score": math.Round(dot*1e9) / 1e9}, nil
+}
+
+func quote(s string) string {
+	b, _ := json.Marshal(s)
+	return string(b)
+}
+
+func oneID(argv []string) (int64, error) {
+	if len(argv) != 2 {
+		return 0, errors.New("command needs ID")
+	}
+	return strconv.ParseInt(argv[1], 10, 64)
+}
+
+func optionalN(argv []string, fallback int) (int, error) {
+	if len(argv) == 1 {
+		return fallback, nil
+	}
+	if len(argv) != 2 {
+		return 0, errors.New("command takes optional N")
+	}
+	return strconv.Atoi(argv[1])
+}

cmd/labelgen/main.go

@@ -40,34 +40,19 @@ type label struct {
 	Labeled   bool   `json:"labeled"`
 }
 
-// grammars mirrors buildRouter's order in cmd/mavend/voicewire.go. Order is
-// load-bearing there and so it is here: the agenda rules must sit after the
-// clock rules, Praxis before the capture marker, the narrative rules last.
+// grammars is the daemon's canonical ordered stage-zero set. Label generation
+// must not maintain a second copy: that drift was the defect fixed by V-693.
 func grammars() []router.Grammar {
-	var g []router.Grammar
-	g = append(g, router.SystemTimeDateGrammars()...)
-	g = append(g, router.AgendaQueryGrammars()...)
-	g = append(g, router.FeedQueryGrammar())
-	g = append(g, router.TaskListGrammar())
-	g = append(g, router.ListGrammars()...)
-	g = append(g, router.ReminderGrammar())
-	g = append(g, router.PraxisGrammars()...)
-	g = append(g, router.TaskCaptureGrammar())
-	g = append(g, router.NarrativeQueryGrammars()...)
-	return g
+	return router.StageZeroGrammars(router.DefaultActMatcher{})
 }
 
 func match(gs []router.Grammar, utterance string) label {
 	out := label{Utterance: utterance}
 	for _, g := range gs {
-		m := g.Pattern.FindStringSubmatch(utterance)
-		if m == nil {
+		d, matched, ok := g.Evaluate(utterance)
+		if !matched || !ok {
 			continue
 		}
-		d, ok := g.Build(m)
-		if !ok {
-			continue // the rule saw its shape and declined it
-		}
 		out.Intent = string(d.Intent)
 		out.Grammar = g.Name
 		out.Key = d.Slots.Key

cmd/mavend/actions_act.go

@@ -15,6 +15,14 @@ import (
 // it to the ecosystems first, and run it behind the confirm gate and the
 // allowlist. proposeGap and the confirm gate itself live in confirm.go.
 func (h *reactiveHandler) actionAct(ctx context.Context, dec router.Decision) string {
+	// An allowlist or a model route is evidence about WHAT could run, never
+	// authority to run it. Keep the user's negative command at the execution
+	// boundary too: actionAct is also reached by rebuilt decisions outside the
+	// ordinary pre-route ladder.
+	if refusesCommand(dec) {
+		return commandProhibitionReply
+	}
+
 	// tool executor: run the matched fn against the enabled allowlist.
 	// HasFn=false ⇒ try the matcher (for LLM-routed acts where the verb
 	// didn't go through the stage-0 act grammar).
@@ -41,7 +49,7 @@ func (h *reactiveHandler) actionAct(ctx context.Context, dec router.Decision) st
 
 	// Hexis ecosystem action: if ecosystem is configured and we have a verb
 	// + entity text, try to resolve the entity and execute via Hexis.
-	if h.ecosystem != nil && h.ecosystem.hexis != nil && dec.Slots.Text != "" {
+	if h.ecosystem != nil && h.ecosystem.hexis != nil && router.ActHasEntityTarget(dec) {
 		if reply := h.handleHexisAct(ctx, dec); reply != "" {
 			return reply
 		}

cmd/mavend/actions_fact.go

@@ -38,6 +38,15 @@ func (h *reactiveHandler) actionFact(ctx context.Context, dec router.Decision) s
 		// claim the turn before any real source ran.
 		q.Slots.Key, q.Slots.HasKey = "", false
 		q.Slots.Value = ""
+		// Defensive reconstruction must preserve the same literal destination
+		// the stage-0 router would have named. A learned fact decision has no
+		// source, and without restoring this anchored world frame the personal
+		// boundary can claim "latest Go version" by similarity and prevent the
+		// live source from ever being asked.
+		if world, ok := router.WorldQueryDecision(dec.Utterance); ok {
+			q.Source = world.Source
+			q.SourceAnchored = world.SourceAnchored
+		}
 		return h.actionQuery(ctx, q)
 	}
 	// A complaint is not a fact either (#481). "сеть какая-то медленная" and

cmd/mavend/actions_note.go

@@ -16,10 +16,11 @@ const nothingToCorrectReply = "не поняла, что поправить. с
 // actionNote handles router.IntentNote: embed the note, persist it, and
 // index it for recall.
 //
-// The stored body is dec.Utterance and nothing else (V-576). It is not
-// Slots.Text, not phraser output and not any other model string: a note is
-// durable, the embedder indexes it, and it comes back later as recall in his
-// own words. Phrasing belongs in the spoken confirmation.
+// The stored body comes only from dec.Utterance (V-576/V-721). An explicit
+// leading capture frame is structurally removed; an unmarked note is otherwise
+// byte-for-byte his utterance. It is never Slots.Text, phraser output or any
+// other model string: a note is durable, the embedder indexes it, and it comes
+// back later as recall in his own words. Phrasing belongs in the confirmation.
 func (h *reactiveHandler) actionNote(ctx context.Context, dec router.Decision) string {
 	// A correction with no referent. Everything that could own one has already
 	// run by here: clarify, confirm and repair are all resolved before routing,
@@ -39,16 +40,20 @@ func (h *reactiveHandler) actionNote(ctx context.Context, dec router.Decision) s
 	if reply, ok := h.captureListFromNote(ctx, dec); ok {
 		return reply
 	}
+	noteText := dec.Utterance
+	if body, explicit := router.ParseNoteCapture(dec.Utterance); explicit {
+		noteText = body
+	}
 	// embed the note text with the same model the classifier uses, persist
 	// via CoreAPI (source=tap:voice). Semantic recall lives in `notes`, not
 	// facts — no predicate reads it (spec's two-memory split).
-	vec, err := router.EmbedPassage(ctx, h.recall.embedder, dec.Utterance)
+	vec, err := router.EmbedPassage(ctx, h.recall.embedder, noteText)
 	if err != nil {
 		log.Printf("voice: embed note: %v", err)
 		return phraser.Ack(phraser.FailNote, nil)
 	}
 	noteTs := h.now()
-	noteID, err := h.api.WriteNote(ctx, noteTs, dec.Utterance, vec, "tap:voice")
+	noteID, err := h.api.WriteNote(ctx, noteTs, noteText, vec, "tap:voice")
 	if err != nil {
 		log.Printf("voice: write note: %v", err)
 		return phraser.Ack(phraser.FailNote, nil)
@@ -59,7 +64,7 @@ func (h *reactiveHandler) actionNote(ctx context.Context, dec router.Decision) s
 		if err := h.recall.memStore.Insert(ctx, "note:"+strconv.FormatInt(noteID, 10), vec, map[string]string{
 			"source": "voice",
 			"type":   "note",
-			"text":   dec.Utterance,
+			"text":   noteText,
 			"ts":     strconv.FormatInt(noteTs.Unix(), 10),
 		}); err != nil {
 			log.Printf("voice: memory insert: %v", err)

cmd/mavend/actions_query.go

@@ -641,10 +641,11 @@ const (
 // небо синее?", because the right-note and must-be-silent score ranges overlap
 // and no threshold sits between them.
 func recallOnTopic(utterance, text string) bool {
-	if memory.RecallAllowed(utterance, text) {
+	if memory.RecallAllowed(utterance, text,
+		router.IsOpenQuestionShaped(utterance), router.IsLocativeQuestionShaped(utterance)) {
 		return true
 	}
-	log.Printf("voice: recall %q rejected for %q: a world question and no shared topic word", text, utterance)
+	log.Printf("voice: recall %q rejected for %q: no structural ask with a shared topic, or a world/locative question with no shared topic", text, utterance)
 	return false
 }
 

cmd/mavend/actions_reminder.go

@@ -14,6 +14,12 @@ import (
 // actionReminder handles router.IntentReminder: parse the time when stage-0
 // skipped the extractor, then create the reminder.
 func (h *reactiveHandler) actionReminder(ctx context.Context, dec router.Decision) string {
+	// The pre-route belt normally answers this before routing. Keep the write
+	// boundary guarded as well: a model calling the sentence a reminder does
+	// not turn "don't ..." into permission to create a row.
+	if refusesCommand(dec) {
+		return commandProhibitionReply
+	}
 	if !dec.Slots.HasTime {
 		// Stage-0 (reminder-wakeword grammar) skips the extractor, so the
 		// time wasn't parsed. Run the parser as a fallback.

cmd/mavend/actions_task_test.go

@@ -294,6 +294,36 @@ func TestResolveTaskStatusMovesTheNamedTask(t *testing.T) {
 	}
 }
 
+// The regression crosses the grammar/action seam instead of handing the
+// action a repaired Decision. The stored title is a normal imperative title,
+// while the spoken marker names only its topic; framing words must not become
+// identity and the unrelated live row must remain untouched.
+func TestActionActMarkerReferentMovesOnlyTheNamedStoredTask(t *testing.T) {
+	api := &taskAPI{tasks: []ipc.Task{
+		{ID: 17, Text: "настроить бэкапы", Status: "open"},
+		{ID: 18, Text: "обновить сертификаты", Status: "open"},
+	}}
+	h := taskHandler(api)
+	dec, matched, accepted := router.TaskStatusGrammar().Evaluate("отметь задачу про бэкапы как сделанную")
+	if !matched || !accepted {
+		t.Fatalf("task-status grammar matched=%v accepted=%v", matched, accepted)
+	}
+
+	reply := h.actionAct(context.Background(), dec)
+	if api.listArg != "live" {
+		t.Errorf("listed %q, want live", api.listArg)
+	}
+	if len(api.moved) != 1 {
+		t.Fatalf("moved %+v, want exactly the named stored task", api.moved)
+	}
+	if got := api.moved[0]; got.id != 17 || got.status != "done" || got.by != "tap:voice" {
+		t.Errorf("moved %+v, want task 17 → done by tap:voice", got)
+	}
+	if !strings.Contains(reply, "настроить бэкапы") {
+		t.Errorf("reply = %q, want the transitioned stored title", reply)
+	}
+}
+
 func TestResolveTaskStatusRefusesToGuess(t *testing.T) {
 	cases := []struct {
 		name  string

cmd/mavend/clarify.go

@@ -342,7 +342,7 @@ func (h *reactiveHandler) resolveClarifyAnswer(ctx context.Context, text string)
 
 	switch role {
 	case roleCancel:
-		h.clarifyStore.Delete(dialogueIDOf(ctx))
+		h.completeClarifyTop(ctx)
 		return clarifyCancelled, true
 	case roleSideQuery:
 		// He asked something of his own WITHOUT leaving the flow. The question
@@ -419,19 +419,6 @@ func (h *reactiveHandler) resolveClarifyAnswer(ctx context.Context, text string)
 	if stillOpen(q.Missing, whenTextOf(q), merged) {
 		return h.reaskOrGiveUp(ctx, q, merged, text, taken), true
 	}
-	h.clarifyStore.Delete(dialogueIDOf(ctx))
-
-	// One gap filled is not the same as a complete request. askClarify parks
-	// only the first gap, because one question per turn is the rule, but a
-	// reminder wants both a subject and a time. "напомни" with neither used to
-	// ask "О чём напомнить?", accept "позвонить маме", and then hand applyAction
-	// a reminder with no time, which answered "не получилось разобрать время
-	// напоминания." — an error for a request she never finished asking about.
-	// Re-enter the loop instead, one question at a time as before.
-	if reply, asked := h.askRemainingGap(ctx, q, intent, merged); asked {
-		return reply, true
-	}
-
 	// Rebuild the decision as if it had routed cleanly, then run it down the
 	// normal path. Clarify is deliberately false and the intent is unchanged:
 	// filling in an argument never grants authority, so the completed decision
@@ -443,7 +430,44 @@ func (h *reactiveHandler) resolveClarifyAnswer(ctx context.Context, text string)
 		Intent:    intent,
 		Slots:     applyDialogueSlots(answer, merged),
 	}
-	return h.finishClarified(ctx, dec), true
+	// Time answers stay out of dec.Utterance because it is also the reminder
+	// payload. The action schema still needs that evidence, so validate a copy
+	// carrying the full time exchange while executing the clean decision.
+	schemaDec := dec
+	schemaDec.Utterance = whenTextOf(q)
+
+	// One gap filled is not the same as a complete request. askClarify parks
+	// only the first gap, because one question per turn is the rule, but a
+	// reminder wants both a subject and a time. Re-enter the schema one question
+	// at a time. If the shared attempt budget is spent, askRemainingGap visibly
+	// gives up and removes this stack level; it must never turn an incomplete
+	// decision into permission to act (V-717).
+	if reply, handled := h.askRemainingGap(ctx, q, schemaDec); handled {
+		return reply, true
+	}
+	h.completeClarifyTop(ctx)
+	return h.finishClarified(ctx, dec, schemaDec), true
+}
+
+// completeClarifyTop finishes only the active question. A nested question can
+// sit above a flow that was suspended by a side request or repair; deleting the
+// dialogue id here erased both. If one survives underneath, restart its clock
+// from the moment it is spoken again and attach its question to this turn.
+func (h *reactiveHandler) completeClarifyTop(ctx context.Context) {
+	if h.clarifyStore == nil {
+		return
+	}
+	_, resumed := h.clarifyStore.CompleteTop(dialogueIDOf(ctx), h.now())
+	if resumed == nil || len(resumed.Missing) == 0 {
+		return
+	}
+	question, ok := clarifyResumedFor(resumed.Missing[0])
+	if !ok {
+		return
+	}
+	if rt := turnRouteFrom(ctx); rt != nil {
+		rt.resume = question
+	}
 }
 
 // noteDropped records that the parked request was let go this turn, so runTurn
@@ -487,7 +511,7 @@ func (h *reactiveHandler) noteSuspended(ctx context.Context, q *dialogue.Pending
 		return
 	}
 	if !q.CanResume() {
-		h.clarifyStore.Delete(dialogueIDOf(ctx))
+		h.completeClarifyTop(ctx)
 		h.noteDropped(ctx)
 		log.Printf("voice: clarify — letting the question about %s go: %d asides in a row, %d rides in all", q.Missing[0], q.Suspends, q.Rides)
 		return
@@ -520,26 +544,27 @@ func foldAnswerIntoUtterance(utterance, subject string) string {
 	return strings.TrimSpace(utterance) + " " + subject
 }
 
-// askRemainingGap re-parks the request when the answer closed one gap and
-// wantedSlots still names another. Returns ("", false) when the request is
-// complete, when there is no question for what is left, or when she is out of
-// attempts — in all three the caller runs the decision as it stands, which for
-// the out-of-attempts case is the old behaviour and is the right one: she has
-// already asked enough.
+// askRemainingGap re-parks the request when the answer closed one gap and the
+// action schema still names another. Returns ("", false) only when the request
+// is complete. A remaining gap is always handled here: one next question while
+// budget remains, otherwise an explicit give-up with no partial action (V-717).
 //
 // The attempt budget is shared with the re-ask path on purpose. A second gap
 // costs a question exactly like a second try at the first one does, so the cap
 // still bounds how many times she can speak before acting or letting go.
-func (h *reactiveHandler) askRemainingGap(ctx context.Context, q *dialogue.PendingQuestion, intent router.Intent, merged dialogue.Slots) (string, bool) {
-	remaining := stillMissingFor(intent, whenTextOf(q), merged)
+func (h *reactiveHandler) askRemainingGap(ctx context.Context, q *dialogue.PendingQuestion, dec router.Decision) (string, bool) {
+	remaining := missingFor(dec)
 	if len(remaining) == 0 {
 		return "", false
 	}
 	// Attempts+1 is the question she is about to ask, and the budget is shared
 	// with the re-ask path, so the second gap is worded like a second try.
-	question, ok := h.questionFor(remaining[0], q.Attempts+1, whenTextOf(q), merged, "")
+	merged := toDialogueSlots(dec.Slots)
+	question, ok := h.questionFor(remaining[0], q.Attempts+1, dec.Utterance, merged, "")
 	if !ok || !q.CanAsk() {
-		return "", false
+		h.completeClarifyTop(ctx)
+		log.Printf("voice: clarify — gave up with required gap %s still open after %d question(s); no action ran", remaining[0], q.Attempts)
+		return clarifyGaveUp, true
 	}
 	// Suspends is not carried, and by this point it is already zero: the answer
 	// path resets it (V-654). Left off the literal so the zero is stated where
@@ -561,7 +586,7 @@ func (h *reactiveHandler) askRemainingGap(ctx context.Context, q *dialogue.Pendi
 		MaxAttempts: q.MaxAttempts,
 		Rides:       q.Rides,
 	})
-	log.Printf("voice: clarify — one gap filled, still missing %s for intent=%s, asking again (attempt %d)", remaining[0], intent, q.Attempts+1)
+	log.Printf("voice: clarify — one gap filled, still missing %s for intent=%s, asking again (attempt %d)", remaining[0], dec.Intent, q.Attempts+1)
 	return question, true
 }
 
@@ -576,7 +601,7 @@ func (h *reactiveHandler) reaskOrGiveUp(ctx context.Context, q *dialogue.Pending
 		question, _ = h.questionFor(q.Missing[0], q.Attempts+1, whenTextOf(q), merged, taken)
 	}
 	if question == "" || !q.CanAsk() {
-		h.clarifyStore.Delete(dialogueIDOf(ctx))
+		h.completeClarifyTop(ctx)
 		log.Printf("voice: clarify — gave up on %v after %d question(s), answer was %q", q.Missing, q.Attempts, text)
 		return clarifyGaveUp
 	}
@@ -590,15 +615,48 @@ func (h *reactiveHandler) reaskOrGiveUp(ctx context.Context, q *dialogue.Pending
 	return question
 }
 
-// finishClarified runs a completed decision through the same steps a freshly
-// routed one takes: remember the turn, act, then phrase.
-func (h *reactiveHandler) finishClarified(ctx context.Context, dec router.Decision) string {
+// finishClarified completes a decision whose parked gaps were already checked
+// by resolveClarifyAnswer. It still records the turn for a later correction;
+// the old path made anything completed through dialogue uncorrectable (V-573).
+func (h *reactiveHandler) finishClarified(ctx context.Context, dec, schemaDec router.Decision) string {
+	return h.finishRebuilt(ctx, dec, schemaDec, false)
+}
+
+// finishRepaired validates a decision rebuilt from an older utterance. Unlike
+// resolveClarifyAnswer, repair has not passed the current slot gate, so it must
+// ask about any missing argument before acting (V-573).
+func (h *reactiveHandler) finishRepaired(ctx context.Context, dec router.Decision) string {
+	return h.finishRebuilt(ctx, dec, dec, true)
+}
+
+// finishRebuilt is the execution boundary for decisions reconstructed from
+// dialogue. schemaDec is the same action with all validation evidence present;
+// a clarified reminder includes the separately-held time answers there while
+// dec keeps the clean reminder payload. No rebuilt action crosses this boundary
+// while missingFor still names a required slot.
+func (h *reactiveHandler) finishRebuilt(ctx context.Context, dec, schemaDec router.Decision, ask bool) string {
+	missing := missingFor(schemaDec)
+	if ask && (schemaDec.Clarify || len(missing) > 0) {
+		if reply := h.hexisBeforeClarify(ctx, dec); reply != "" {
+			return reply
+		}
+		if question, asked := h.askClarify(ctx, dec); asked {
+			return question
+		}
+	}
+	if len(missing) > 0 {
+		log.Printf("voice: clarify — refusing incomplete rebuilt intent=%s with required gaps %v; no action ran", dec.Intent, missing)
+		return clarifyGaveUp
+	}
 	if h.dialogueSessions != nil {
 		now := h.now()
 		prev := h.dialogueSessions.Get(dialogueIDOf(ctx), now)
 		dec = followUpMerge(prev, dec, now)
 		h.rememberTurn(ctx, prev, dec, now)
 	}
+	if !dec.Clarify {
+		h.recordTurn(dec.Utterance, dec.Intent)
+	}
 	reply := h.applyAction(ctx, dec)
 	if reply == "" {
 		reply = h.replier.Reply(ctx, dec)
@@ -622,15 +680,23 @@ const maxCarriedHistory = 3
 func (h *reactiveHandler) rememberTurn(ctx context.Context, prev *dialogue.Session, dec router.Decision, now time.Time) {
 	var history []dialogue.Turn
 	if prev != nil {
-		history = append(history, sessionAsTurn(prev))
-		maxHist := len(prev.History)
-		if maxHist > maxCarriedHistory {
-			maxHist = maxCarriedHistory
+		// History is chronological. Keep the newest tail of the older history,
+		// then append the immediate prior turn. The previous implementation put
+		// the newest turn first while the type contract said newest-last, so the
+		// model read a conversation backwards.
+		from := len(prev.History) - maxCarriedHistory
+		if from < 0 {
+			from = 0
 		}
-		history = append(history, prev.History[:maxHist]...)
+		history = append(history, prev.History[from:]...)
+		history = append(history, sessionAsTurn(prev))
+	}
+	conversational := dec.Intent == router.IntentChat || opensConversation(dec.Utterance)
+	if prev != nil && (prev.Conversational || prev.Intent == dialogue.IntentChat) {
+		conversational = true
 	}
 	ttl := time.Duration(0) // use the store default (2 min)
-	if dec.Intent == router.IntentChat {
+	if conversational {
 		ttl = 15 * time.Minute // conversational turns should last longer
 	}
 	// A system or query turn often carries no Text slot at all — a stage-0
@@ -652,10 +718,12 @@ func (h *reactiveHandler) rememberTurn(ctx context.Context, prev *dialogue.Sessi
 		slots.Text = dec.Utterance
 	}
 	h.dialogueSessions.Put(dialogueIDOf(ctx), &dialogue.Session{
-		Intent:    dialogue.Intent(dec.Intent),
-		Slots:     slots,
-		Timestamp: now,
-		TTL:       ttl,
-		History:   history,
+		Intent:         dialogue.Intent(dec.Intent),
+		Slots:          slots,
+		Utterance:      dec.Utterance,
+		Conversational: conversational,
+		Timestamp:      now,
+		TTL:            ttl,
+		History:        history,
 	})
 }

cmd/mavend/clarify_test.go

@@ -394,25 +394,86 @@ func TestClarifyAsksAboutTheSecondGapToo(t *testing.T) {
 
 // TestClarifySecondGapRespectsTheAttemptCap — the second gap spends a question
 // out of the same budget, so it cannot turn a capped exchange into an endless
-// one. With one attempt allowed she acts on what she has instead of asking.
+// one. With one attempt allowed she gives up visibly and creates nothing: the
+// cap is a bound on dialogue, never a path around the action schema (V-717).
 func TestClarifySecondGapRespectsTheAttemptCap(t *testing.T) {
 	ctx := context.Background()
-	h, _, _ := newClarifyHandler(t)
+	h, st, _ := newClarifyHandler(t)
 	h.clarifyMaxAttempts = 1
 
 	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder, router.Slots{}, "напомни")); !asked {
 		t.Fatal("expected the subject question")
 	}
 	reply, handled := h.resolveClarifyAnswer(ctx, "позвонить маме")
-	if !handled {
-		t.Fatal("the answer must be consumed")
+	if !handled || reply != clarifyGaveUp {
+		t.Fatalf("out of attempts she must give up visibly, handled=%v reply=%q", handled, reply)
 	}
-	if reply == "Когда?" {
-		t.Fatal("out of attempts she must not ask a second question")
+	if isAnyClarifyQuestion(reply) {
+		t.Fatalf("out of attempts she must not ask another question: %q", reply)
 	}
 	if h.clarifyStore.Get(voiceDialogueID, h.now()) != nil {
 		t.Fatal("no question may stay armed past the cap")
 	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 0 {
+		t.Fatalf("an incomplete exhausted request created a reminder: reminders=%+v err=%v", reminders, err)
+	}
+}
+
+// Exhausting a nested top request removes only that request and makes the
+// lower flow audible again in the same reply. This is the multi-gap exhaustion
+// shape, not the ordinary failed-answer path covered in repair_test.go.
+func TestClarifySecondGapExhaustionResumesLowerFlow(t *testing.T) {
+	ctx := context.Background()
+	h, st, _ := newClarifyHandler(t)
+	older := &dialogue.PendingQuestion{
+		Intent: dialogue.IntentReminder,
+		Slots:  dialogue.Slots{Text: "позвонить маме"}, Missing: []dialogue.Slot{dialogue.SlotTime},
+		Utterance: "напомни позвонить маме", Asked: h.now(), TTL: clarifyTTL,
+		Attempts: 1, MaxAttempts: dialogue.DefaultMaxAttempts,
+	}
+	top := &dialogue.PendingQuestion{
+		Intent: dialogue.IntentReminder, Missing: []dialogue.Slot{dialogue.SlotText},
+		Utterance: "напомни", Asked: h.now(), TTL: clarifyTTL,
+		Attempts: 1, MaxAttempts: 1,
+	}
+	h.clarifyStore.Push(voiceDialogueID, older)
+	h.clarifyStore.Push(voiceDialogueID, top)
+
+	reply := h.runTurn(ctx, "купить хлеб", sourceText)
+	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
+	want := withResumed(clarifyGaveUp, resumed)
+	if reply != want {
+		t.Fatalf("reply=%q, want visible top give-up followed by resumed lower question %q", reply, want)
+	}
+	if depth := h.clarifyStore.Depth(voiceDialogueID); depth != 1 {
+		t.Fatalf("exhausting the top request left stack depth %d, want 1", depth)
+	}
+	if got := h.clarifyStore.Get(voiceDialogueID, h.now()); got != older {
+		t.Fatalf("resumed flow=%+v, want the older question", got)
+	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 0 {
+		t.Fatalf("nested exhaustion partially created a reminder: reminders=%+v err=%v", reminders, err)
+	}
+}
+
+// The rebuilt-action boundary repeats the schema invariant even though the
+// normal resolver checked it one branch earlier. A future dialogue caller must
+// not be able to bypass required slots by calling the completion wrapper.
+func TestFinishClarifiedRefusesIncompleteAction(t *testing.T) {
+	ctx := context.Background()
+	h, st, _ := newClarifyHandler(t)
+	dec := router.Decision{
+		Utterance: "напомни позвонить маме",
+		Stage:     2,
+		Intent:    router.IntentReminder,
+		Slots:     router.Slots{Text: "позвонить маме"},
+	}
+	if reply := h.finishClarified(ctx, dec, dec); reply != clarifyGaveUp {
+		t.Fatalf("incomplete rebuilt action reply=%q, want %q", reply, clarifyGaveUp)
+	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 0 {
+		t.Fatalf("rebuilt-action guard allowed a partial reminder: reminders=%+v err=%v", reminders, err)
+	}
 }
 
 // TestClarifyProseHoldsThePersona — these lines are hand-written Russian that

cmd/mavend/command_prohibition.go

@@ -0,0 +1,49 @@
+package main
+
+import (
+	"context"
+
+	"github.com/kami/maven/internal/router"
+)
+
+// commandProhibitionReply is deliberately operation-neutral. At this boundary
+// Maven may know only that the user denied authority, not whether the model
+// would have called it a reminder, board transition, local tool or Hexis act.
+const commandProhibitionReply = "хорошо, не буду."
+
+// resolveCommandProhibition is the first mutation boundary in a turn. It runs
+// before a parked clarify answer or candidate selection can consume the words,
+// and before any route/model is consulted. A direct prohibition is complete in
+// itself: it needs no target lookup and makes no external call.
+//
+// A parked clarify request is unrelated state. Preserve it and say the pending
+// question again, using the same bounded suspend policy as every other side
+// request. Candidate lists likewise remain untouched; no ordinal was selected.
+func (h *reactiveHandler) resolveCommandProhibition(ctx context.Context, text string) (string, bool) {
+	if !router.IsCommandProhibition(text) {
+		return "", false
+	}
+	// A later bare "да" must not revive authority the user has just revoked.
+	// Confirmation slots are all mutation authority and are process-local, so
+	// clearing the three under their shared mutex is both conservative and
+	// atomic. Clarify questions and candidate lists are not authority and stay.
+	h.mu.Lock()
+	h.pending = nil
+	h.pendingHexis = nil
+	h.pendingRoutine = nil
+	h.mu.Unlock()
+	if h.clarifyStore != nil {
+		if q := h.clarifyStore.Get(dialogueIDOf(ctx), h.now()); q != nil {
+			h.noteSuspended(ctx, q)
+		}
+	}
+	return commandProhibitionReply, true
+}
+
+// refusesCommand is the defense-in-depth form for execution entry points which
+// can also be called with a reconstructed or test decision outside runTurn.
+// The sentinel cannot be renamed into an enabled function, and the original
+// utterance remains the authority even when a model rewrites Slots.Text.
+func refusesCommand(dec router.Decision) bool {
+	return dec.Slots.Fn == router.ProhibitedActFn || router.IsCommandProhibition(dec.Utterance)
+}

cmd/mavend/conversation_context_test.go

@@ -0,0 +1,111 @@
+package main
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/router"
+)
+
+func TestRememberTurnKeepsIntentIndependentTranscriptInSpeakingOrder(t *testing.T) {
+	now := time.Date(2026, 8, 13, 1, 0, 0, 0, time.UTC)
+	h := &reactiveHandler{
+		now:              func() time.Time { return now },
+		dialogueSessions: dialogue.NewSessionStore(time.Hour),
+	}
+	ctx := context.Background()
+	turns := []router.Decision{
+		{Intent: router.IntentFact, Utterance: "я купил новый монитор", Slots: router.Slots{Key: "purchase", Value: "новый монитор", HasKey: true}},
+		{Intent: router.IntentQuery, Utterance: "а он большой?", Slots: router.Slots{Text: "normalized query"}},
+		{Intent: router.IntentChat, Utterance: "кажется, я переплатил", Slots: router.Slots{Text: "normalized chat"}},
+		{Intent: router.IntentQuery, Utterance: "стоит его вернуть?", Slots: router.Slots{Text: "normalized return query"}},
+	}
+	for i, dec := range turns {
+		prev := h.dialogueSessions.Get(voiceDialogueID, now)
+		h.rememberTurn(ctx, prev, dec, now.Add(time.Duration(i)*time.Second))
+	}
+
+	got := h.dialogueSessions.Get(voiceDialogueID, now.Add(4*time.Second))
+	if got == nil {
+		t.Fatal("no dialogue session")
+	}
+	if got.Utterance != turns[3].Utterance {
+		t.Fatalf("current utterance = %q, want %q", got.Utterance, turns[3].Utterance)
+	}
+	want := []string{turns[0].Utterance, turns[1].Utterance, turns[2].Utterance}
+	if len(got.History) != len(want) {
+		t.Fatalf("history = %+v, want %d prior turns", got.History, len(want))
+	}
+	for i := range want {
+		if got.History[i].Text != want[i] {
+			t.Errorf("history[%d] = %q, want %q", i, got.History[i].Text, want[i])
+		}
+	}
+
+	// actionChat runs after rememberTurn. It must receive only prior turns;
+	// handing over the current turn here would duplicate the model's user input.
+	history := h.chatHistory(ctx)
+	if len(history) != len(want) {
+		t.Fatalf("chat history = %+v, want exactly the prior turns", history)
+	}
+	for _, turn := range history {
+		if turn.Text == got.Utterance {
+			t.Fatalf("current utterance was duplicated into chat history: %+v", history)
+		}
+	}
+}
+
+func TestSessionAsTurnReadsLegacySlotText(t *testing.T) {
+	legacy := &dialogue.Session{
+		Intent: dialogue.IntentQuery,
+		Slots:  dialogue.Slots{Text: "старый сохранённый вопрос"},
+	}
+	if got := sessionAsTurn(legacy).Text; got != legacy.Slots.Text {
+		t.Fatalf("legacy turn text = %q, want %q", got, legacy.Slots.Text)
+	}
+}
+
+func TestExplicitConversationOpenerKeepsCrossIntentSessionAlive(t *testing.T) {
+	now := time.Date(2026, 8, 13, 1, 0, 0, 0, time.UTC)
+	h := &reactiveHandler{
+		now:              func() time.Time { return now },
+		dialogueSessions: dialogue.NewSessionStore(2 * time.Minute),
+	}
+	ctx := context.Background()
+	h.rememberTurn(ctx, nil, router.Decision{
+		Intent: router.IntentFact, Utterance: "давай поболтаем: я купил новый монитор",
+		Slots: router.Slots{Key: "purchase", Value: "новый монитор", HasKey: true},
+	}, now)
+
+	later := now.Add(10 * time.Minute)
+	prev := h.dialogueSessions.Get(voiceDialogueID, later)
+	if prev == nil {
+		t.Fatal("explicit conversation expired at the ordinary two-minute TTL")
+	}
+	if !prev.Conversational || prev.TTL != 15*time.Minute {
+		t.Fatalf("conversation state = %+v, want conversational 15m session", prev)
+	}
+	got := followUpMerge(prev, router.Decision{
+		Intent: router.IntentQuery, Utterance: "а он большой?",
+	}, later)
+	if got.Intent != router.IntentChat {
+		t.Fatalf("anaphoric follow-up intent = %s, want chat", got.Intent)
+	}
+}
+
+func TestConversationOpenerDoesNotMatchAnotherDavaiCommand(t *testing.T) {
+	if opensConversation("давай запишем новый монитор") {
+		t.Fatal("an ordinary cooperative command opened a conversation")
+	}
+	for _, text := range []string{
+		"давай поговорим: я купил монитор",
+		"давайте пообщаемся",
+		"let's talk: I bought a monitor",
+	} {
+		if !opensConversation(text) {
+			t.Errorf("%q did not open a conversation", text)
+		}
+	}
+}

cmd/mavend/decisiontrace.go

@@ -31,8 +31,8 @@ import (
 // and nothing should: a missing name costs one line of the record, while a
 // check that walks the ladder would have to run the ladder.
 var preRouteLadder = []string{
-	"confirm", "clarify-answer", "quiet-toggle", "snooze", "ack", "repair",
-	"repair-negative", "ordinal",
+	"confirm", "repair", "repair-negative", "command-prohibition", "clarify-answer", "quiet-toggle",
+	"snooze", "ack", "reminder-cancel", "ordinal",
 }
 
 // notePreRoute records one rung of that ladder and passes its verdict through

cmd/mavend/dialogue_contract_test.go

@@ -651,7 +651,7 @@ func dialogueTraces() []trace {
 			end: endState{},
 		},
 
-		// ---- rows below carry the CORRECT expectation and fail today ----
+		// ---- formerly failing interleavings; kept as permanent contracts ----
 
 		// The owner's own sentence from V-577 shape 2, in his words. It needs
 		// an engine that can route it: the hash embedder marks it note with
@@ -660,7 +660,6 @@ func dialogueTraces() []trace {
 		// floor's deterministic fact parser reads.
 		{
 			name: "a note stated mid-flow is stored, not dropped",
-			skip: "the offline floor cannot route «у меня новый ноутбук» confidently; needs the resident model",
 			turns: []turn{
 				{say: "напомни позвонить врачу", question: dialogue.SlotTime, attempt: 1,
 					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "врачу"}},
@@ -747,7 +746,6 @@ func dialogueTraces() []trace {
 		// written yet and is not this task's to invent.
 		{
 			name: "cancel: a parked question, then never mind",
-			skip: "V-560: a cancel is scored as a failed answer, not as a cancel",
 			turns: []turn{
 				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
 					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1}},
@@ -761,7 +759,6 @@ func dialogueTraces() []trace {
 		// scores "нет, это была заметка" as a bad time answer and asks again.
 		{
 			name: "correction while a question is parked",
-			skip: "V-560: clarify pre-empts the repair marker, so a correction cannot be spoken mid-flow",
 			turns: []turn{
 				{say: "добавь в задачи купить молоко", contains: []string{"купить молоко"}},
 				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
@@ -771,21 +768,17 @@ func dialogueTraces() []trace {
 			},
 			end: endState{tasks: []string{"купить молоко"}},
 		},
-		// A reminder said whole, in one breath, with the hour in it — and she
-		// asks when. ReminderGrammar (stage0.go) builds its slots by hand and
-		// never runs the extractor, so a stage-0 reminder carries no time
-		// whatever the sentence says, and the clarify gate reads the gap as
-		// real. It costs a turn on the commonest reminder shape there is.
-		//
-		// Hermetic despite the date parser: stage 0 calls no parser at all, so
-		// this fails the same way with or without python dateparser installed.
+		// Stage 0 has extracted the hour since V-572. The day remains genuinely
+		// absent, and V-579 deliberately refuses to invent it even when 11:00 is
+		// still ahead on today's clock. This stale skipped row used to expect a
+		// commit and contradicted every neighbouring time-contract row.
 		{
-			name: "a reminder said whole is not asked about",
-			skip: "V-562: a stage-0 decision never meets the extractor, so its slots are never validated",
+			name: "a stage-zero reminder keeps its hour and asks for the missing day",
 			turns: []turn{
-				{say: "напомни в 11:00 позвонить маме", contains: []string{"11:00"}, noQuestion: true},
+				{say: "напомни в 11:00 позвонить маме", question: dialogue.SlotTime, attempt: 1,
+					gap: whenNoDay, parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "маме"}},
 			},
-			end: endState{reminders: []reminderWant{{payload: "позвонить маме", fireAt: "2026-07-31 11:00"}}},
+			end: endState{},
 		},
 		// The same gap on the repair path. A correction redoes the request
 		// through finishClarified, which goes straight to applyAction — it never
@@ -795,7 +788,6 @@ func dialogueTraces() []trace {
 		// with no time.
 		{
 			name: "a correction that lands short asks rather than failing",
-			skip: "V-562: finishClarified skips the clarify gate, so a repaired decision is never checked for gaps",
 			turns: []turn{
 				{say: "добавь в задачи купить молоко", contains: []string{"купить молоко"}},
 				{say: "нет, это было напоминание", contains: []string{"поняла, это напоминание"},

cmd/mavend/digest_test.go

@@ -2,13 +2,26 @@ package main
 
 import (
 	"context"
+	"path/filepath"
 	"testing"
 	"time"
 
+	"github.com/kami/maven/internal/delivery"
 	"github.com/kami/maven/internal/loop"
+	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/store"
 )
 
+type nudgeCountingPhraser struct {
+	phraser.Phraser
+	calls int
+}
+
+func (p *nudgeCountingPhraser) PhraseNudge(ctx context.Context, c loop.Candidate) (delivery.PhrasedNudge, error) {
+	p.calls++
+	return p.Phraser.PhraseNudge(ctx, c)
+}
+
 // Vikunja #281 — the fourth delivery outcome: a care candidate the restraint
 // gate suppresses (quiet hours / away / calendar-busy) is not necessarily
 // lost. If it's worth resurfacing (loop.DigestEligible), it's durably held
@@ -38,7 +51,7 @@ func TestSuppressedCareDigestsAcrossQuietHours(t *testing.T) {
 	ctx := context.Background()
 	now := refNow()
 
-	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present}
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
 	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
 
 	entries, err := st.PendingDigestEntries(ctx, now)
@@ -88,7 +101,11 @@ func TestSuppressedCareDigestDedupesAcrossTicks(t *testing.T) {
 	now := refNow()
 
 	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present}
+	quiet.Facts = breakCandidateFacts(now, 1)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
 	for i := 0; i < 3; i++ {
+		quiet.Now = now.Add(time.Duration(i) * time.Minute)
 		tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now.Add(time.Duration(i)*time.Minute))
 	}
 
@@ -99,6 +116,154 @@ func TestSuppressedCareDigestDedupesAcrossTicks(t *testing.T) {
 	if len(entries) != 1 {
 		t.Fatalf("3 suppressions of the same nudge must collapse to 1 pending entry, got %d", len(entries))
 	}
+	if counting.calls != 1 {
+		t.Fatalf("3 suppressed ticks phrased %d times, want exactly 1", counting.calls)
+	}
+}
+
+func TestSuppressedCareDigestAcrossRealTicksDoesOnePhraseCall(t *testing.T) {
+	st := newTestStore(t)
+	ctx := context.Background()
+	now := refNow()
+	markPresent(t, st, ctx, now)
+	if _, err := st.SetValue(ctx, store.KindSelf, "break", "tap:test", "done", now.Add(-2*time.Hour)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.SetValue(ctx, store.KindConfig, "quiet_hours", "promote", true, now); err != nil {
+		t.Fatal(err)
+	}
+
+	tl := newTestTickLoop(t, st, &fakeSink{}, nil)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
+	for i := 0; i < 3; i++ {
+		tl.tick(ctx, now.Add(time.Duration(i)*30*time.Second))
+	}
+
+	if counting.calls != 1 {
+		t.Fatalf("3 complete suppressed ticks phrased %d times, want exactly 1", counting.calls)
+	}
+	entries, err := st.PendingDigestEntries(ctx, now.Add(time.Minute))
+	if err != nil || len(entries) != 1 {
+		t.Fatalf("complete ticks should retain one durable entry: entries=%+v err=%v", entries, err)
+	}
+}
+
+// TestSuppressedCareDigestDedupeSurvivesRestart proves V-687 at its actual
+// boundary: a fresh tickLoop has no memory of the first call, yet durable
+// candidate identity still prevents a second PhraseNudge.
+func TestSuppressedCareDigestDedupeSurvivesRestart(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "digest-restart.db")
+	ctx := context.Background()
+	now := refNow()
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 9)}
+
+	firstStore, err := store.Open(ctx, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	first := newTestTickLoop(t, firstStore, &fakeSink{}, nil)
+	firstPhraser := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	first.phraser = firstPhraser
+	first.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
+	if firstPhraser.calls != 1 {
+		t.Fatalf("first loop phrase calls = %d, want 1", firstPhraser.calls)
+	}
+	if err := firstStore.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	secondStore, err := store.Open(ctx, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = secondStore.Close() })
+	second := newTestTickLoop(t, secondStore, &fakeSink{}, nil)
+	secondPhraser := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	second.phraser = secondPhraser
+	quiet.Now = now.Add(time.Minute)
+	second.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, quiet.Now)
+	if secondPhraser.calls != 0 {
+		t.Fatalf("same candidate after restart phrased %d times, want 0", secondPhraser.calls)
+	}
+}
+
+func TestSuppressedCareDigestRephrasesWhenMeaningChanges(t *testing.T) {
+	st := newTestStore(t)
+	tl := newTestTickLoop(t, st, &fakeSink{}, nil)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
+	ctx := context.Background()
+	now := refNow()
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
+
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
+	quiet.Facts = breakCandidateFacts(now.Add(time.Minute), 2)
+	quiet.Now = now.Add(time.Minute)
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, quiet.Now)
+
+	if counting.calls != 2 {
+		t.Fatalf("two semantic occurrences phrased %d times, want 2", counting.calls)
+	}
+	entries, err := st.PendingDigestEntries(ctx, quiet.Now)
+	if err != nil || len(entries) != 2 {
+		t.Fatalf("changed meaning should create a second entry: entries=%+v err=%v", entries, err)
+	}
+}
+
+func TestSuppressedCareDigestRephrasesAfterExpiry(t *testing.T) {
+	st := newTestStore(t)
+	tl := newTestTickLoop(t, st, &fakeSink{}, nil)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
+	ctx := context.Background()
+	now := refNow()
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
+
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
+	// Deliberately do not run the expiry sweep. The pre-phrase lookup and
+	// enqueue path must agree that this occurrence is no longer live.
+	afterExpiry := now.Add(digestExpiry + time.Minute)
+	quiet.Now = afterExpiry
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, afterExpiry)
+
+	if counting.calls != 2 {
+		t.Fatalf("expired occurrence phrased %d times total, want 2", counting.calls)
+	}
+	entries, err := st.PendingDigestEntries(ctx, afterExpiry)
+	if err != nil || len(entries) != 1 || !entries[0].CreatedTs.Equal(afterExpiry) {
+		t.Fatalf("expired row was not replaced by one fresh row: entries=%+v err=%v", entries, err)
+	}
+}
+
+func TestSuppressedCareDigestRephrasesAfterDrain(t *testing.T) {
+	st := newTestStore(t)
+	sink := &fakeSink{}
+	tl := newTestTickLoop(t, st, sink, nil)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
+	ctx := context.Background()
+	now := refNow()
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
+
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
+	clearAt := now.Add(time.Minute)
+	tl.maybeDrainDigest(ctx, loop.State{Now: clearAt, Presence: store.Present}, clearAt)
+	quiet.Now = clearAt.Add(time.Minute)
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, quiet.Now)
+
+	if counting.calls != 2 {
+		t.Fatalf("same occurrence after drain phrased %d times, want 2", counting.calls)
+	}
+}
+
+func breakCandidateFacts(now time.Time, occurrenceID int64) map[string]store.Fact {
+	return map[string]store.Fact{
+		"break": {
+			ID: occurrenceID, Ts: now.Add(-2 * time.Hour), Kind: store.KindSelf,
+			Key: "break", Value: "done", Source: "tap:test", Confidence: 1,
+		},
+	}
 }
 
 // TestSuppressedCareDigestExpiresRatherThanDeliveringLate — an entry that
@@ -111,7 +276,7 @@ func TestSuppressedCareDigestExpiresRatherThanDeliveringLate(t *testing.T) {
 	ctx := context.Background()
 	now := refNow()
 
-	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present}
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
 	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
 
 	// well past digestExpiry (24h) before the suppression ever clears.

cmd/mavend/ecosystem_acts.go

@@ -658,6 +658,12 @@ func (h *reactiveHandler) resolveEntityCandidates(ctx context.Context, refs []st
 // matching capabilities through Hexis. Returns a reply string when handled,
 // or "" to fall through to the system command executor.
 func (h *reactiveHandler) handleHexisAct(ctx context.Context, dec router.Decision) string {
+	// This method is intentionally callable outside runTurn by ecosystem
+	// harnesses. Refuse before correlation ids, Nexus resolution or capability
+	// discovery so the no-op sentinel can never leak into Hexis as a verb.
+	if refusesCommand(dec) {
+		return commandProhibitionReply
+	}
 	if h.ecosystem == nil {
 		return ""
 	}
@@ -841,10 +847,15 @@ func (h *reactiveHandler) execHexis(ctx context.Context, capID, capName, entityI
 // resolution stops on ambiguity and a mutating capability still goes through
 // the spoken confirm in handleHexisAct.
 func (h *reactiveHandler) hexisBeforeClarify(ctx context.Context, dec router.Decision) string {
+	// A thinned model act reaches this hook before actionAct. Negative authority
+	// must therefore stop here as well, before even a read to Nexus/Hexis.
+	if refusesCommand(dec) {
+		return commandProhibitionReply
+	}
 	if h.ecosystem == nil || h.ecosystem.hexis == nil {
 		return ""
 	}
-	if dec.Intent != router.IntentAct || dec.Slots.HasFn || dec.Slots.Text == "" {
+	if dec.Intent != router.IntentAct || dec.Slots.HasFn || !router.ActHasEntityTarget(dec) {
 		return ""
 	}
 	return h.handleHexisAct(ctx, dec)

cmd/mavend/entityname_test.go

@@ -147,6 +147,48 @@ func TestClarifyStillAsksWithoutHexis(t *testing.T) {
 	}
 }
 
+// A verb is not an entity. Before the reach gate, an exact local matcher hit
+// with no arguments still sent the raw verb to Nexus and could discover a
+// similarly named entity through Hexis. The local tool lane may handle or
+// reject it, but the ecosystem must not be consulted without a target.
+func TestBareMatchedActNeverReachesNexus(t *testing.T) {
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_power", "Power", "service"))
+	hexis := newFakeHexis(t, restartCaps(), fixtureHexisExecuted("exec_1", "succeeded"))
+	h, _, _ := newClarifyHandler(t)
+	h.ecosystem = ecoHandler(t, nexus, nil, hexis).ecosystem
+
+	reply := h.actionAct(context.Background(), router.Decision{
+		Utterance: "выключи",
+		Intent:    router.IntentAct,
+		Slots:     router.Slots{Fn: "выключи", HasFn: true, Text: "выключи"},
+	})
+	if len(nexus.Requests()) != 0 {
+		t.Fatalf("bare verb reached Nexus: %+v", nexus.Requests())
+	}
+	if reply == "" {
+		t.Fatal("bare act disappeared instead of staying in Maven's local lane")
+	}
+}
+
+func TestUnresolvedActNeverReachesNexusBeforeClarify(t *testing.T) {
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_it", "It", "service"))
+	hexis := newFakeHexis(t, restartCaps(), fixtureHexisExecuted("exec_1", "succeeded"))
+	h := ecoHandler(t, nexus, nil, hexis)
+	dec := router.Decision{
+		Utterance: "сделай это",
+		Intent:    router.IntentAct,
+		Stage:     3,
+		Clarify:   true,
+		Slots:     router.Slots{Text: "сделай это"},
+	}
+	if reply := h.hexisBeforeClarify(context.Background(), dec); reply != "" {
+		t.Fatalf("unresolved act was answered by Hexis: %q", reply)
+	}
+	if len(nexus.Requests()) != 0 {
+		t.Fatalf("unresolved act reached Nexus: %+v", nexus.Requests())
+	}
+}
+
 // nexusInOrder serves one resolve answer per call, in order, so a test can say
 // what Nexus knows about the first name and what it knows about the second. The
 // last body repeats once the list runs out.

cmd/mavend/eval_scenarios_test.go

@@ -106,7 +106,12 @@ func TestSystemSafetyScenarios(t *testing.T) {
 				hexis := newFakeHexis(t, fixtureHexisCapabilities(map[string]any{"id": "restart", "name": "restart", "read_only": false}), fixtureHexisExecuted("exec_1", "succeeded"))
 				h, _ := newSafetyHandler(t)
 				h.ecosystem = stubEcosystem(nexus.URL, hexis.URL)
-				reply := h.applyAction(ctx, router.Decision{Intent: router.IntentAct, Slots: router.Slots{Fn: "restart", HasFn: true, Text: "indexer"}})
+				// A matched function carries its entity target in Args. Text may be
+				// model phrasing, but Args is the production matcher contract and the
+				// ecosystem reach gate deliberately requires that evidence.
+				reply := h.applyAction(ctx, router.Decision{Intent: router.IntentAct, Slots: router.Slots{
+					Fn: "restart", HasFn: true, Args: []string{"indexer"}, Text: "indexer",
+				}})
 				if !strings.Contains(reply, "Indexer A") || !strings.Contains(reply, "Indexer B") {
 					t.Fatalf("ambiguous entity must prompt for clarification, got %q", reply)
 				}

cmd/mavend/factgate_test.go

@@ -2,6 +2,9 @@ package main
 
 import (
 	"context"
+	"net/http"
+	"net/url"
+	"strings"
 	"testing"
 	"time"
 
@@ -33,6 +36,10 @@ func newFactGateHandler(t *testing.T, now time.Time) (*reactiveHandler, ipc.Core
 func TestActionFact_QuestionIsNotWritten(t *testing.T) {
 	ctx := context.Background()
 	h, api := newFactGateHandler(t, time.Now())
+	searchH, seen := searchHandler(t,
+		`{"answers":["Актуальная версия Go — 1.25."],"results":[]}`,
+		http.StatusOK)
+	h.search = searchH.search
 
 	reply := h.actionFact(ctx, router.Decision{
 		Intent:    router.IntentFact,
@@ -50,11 +57,14 @@ func TestActionFact_QuestionIsNotWritten(t *testing.T) {
 	if len(hits) != 0 {
 		t.Fatalf("the question was indexed for recall: %+v", hits)
 	}
-	// It went down the query chain instead. Nothing is configured to answer a
-	// world question in this harness, so "не знаю." is the honest outcome —
-	// what matters is that the turn was answered, not stored.
-	if reply == "" {
-		t.Fatal("the turn was neither stored nor answered")
+	// It went down the world query chain instead. This asserts the actual
+	// destination, not merely that the write was refused: the regression was
+	// the personal boundary claiming this question before search.
+	if !strings.Contains(reply, "1.25") {
+		t.Fatalf("reply = %q, want live world evidence", reply)
+	}
+	if !strings.Contains(*seen, "q="+url.QueryEscape("какая последняя версия языка Go?")) {
+		t.Fatalf("search query = %q; world source was not reached verbatim", *seen)
 	}
 }
 

cmd/mavend/followup.go

@@ -5,6 +5,8 @@ import (
 	"time"
 
 	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/lexicon"
+	"github.com/kami/maven/internal/morph"
 	"github.com/kami/maven/internal/router"
 )
 
@@ -94,15 +96,18 @@ func applyDialogueSlots(base router.Slots, d dialogue.Slots) router.Slots {
 // anaphoraResolver is a shared instance for pronoun detection.
 var anaphoraResolver router.AnaphoraResolver
 
-// followUpMerge fills the current turn's missing slots from a prior
-// non-expired session — the multi-turn seam. It handles three cases:
+// followUpMerge carries the current conversation across a prior non-expired
+// session — the multi-turn seam. It handles four cases:
 //
 //  1. Same-intent: inherit missing slots via InheritSlots (existing behavior),
 //     except a reminder time the current sentence named and the parser missed.
-//  2. Cross-intent anaphora: if the current utterance contains a pronoun
+//  2. An anaphoric query becomes chat. A question whose subject lives in this
+//     conversation is answered from its transcript, not sent through unrelated
+//     note, web and encyclopedia sources as a context-free lookup.
+//  3. Cross-intent anaphora: if the current utterance contains a pronoun
 //     ("это" / "он" / "она" etc.) AND the prior session has a key, inherit
 //     the key for fact-lookup queries and reminder creation.
-//  3. Query after Fact: a query that references the prior fact's subject
+//  4. Query after Fact: a query that references the prior fact's subject
 //     inherits the key so the handler can do a fact-by-key lookup.
 //
 // A clarify turn resolves nothing, so it never inherits. InheritSlots only
@@ -112,6 +117,33 @@ func followUpMerge(prev *dialogue.Session, dec router.Decision, now time.Time) r
 		return dec
 	}
 
+	ref, isAnaphoric := anaphoraResolver.Resolve(dec.Utterance)
+	if dec.Intent == router.IntentQuery && isAnaphoric && ref != "mine" && sessionHasContext(prev) {
+		// The router correctly identified a question. What it cannot know from
+		// one utterance is that its subject is in the live dialogue. Chat is the
+		// only action path that receives that dialogue, so preserve the route's
+		// slots but answer it there. Clear query-only provenance: no query source
+		// was selected and an anchored destination must not survive an intent
+		// change the daemon made from state the router could not see.
+		dec.Intent = router.IntentChat
+		dec.Source = router.SourceUnknown
+		dec.SourceAnchored = false
+		// Keep a structured referent when the prior route had one. The chat
+		// phraser primarily reads the transcript, but the session must not lose
+		// the fact identity merely because one follow-up crossed an intent.
+		if !dec.Slots.HasKey && prev.Slots.HasKey {
+			dec.Slots.Key = prev.Slots.Key
+			dec.Slots.HasKey = true
+		}
+		if dec.Slots.Value == "" {
+			dec.Slots.Value = prev.Slots.Value
+		}
+		if !dec.Slots.HasTime && prev.Slots.HasTime {
+			dec.Slots.Time = prev.Slots.Time
+			dec.Slots.HasTime = true
+		}
+	}
+
 	// Case 1: same-intent inheritance (existing).
 	if prev.Intent == dialogue.Intent(dec.Intent) {
 		// A reminder that named an hour nobody could read must not borrow the
@@ -133,9 +165,8 @@ func followUpMerge(prev *dialogue.Session, dec router.Decision, now time.Time) r
 		return dec
 	}
 
-	// Cases 2 & 3: cross-intent anaphora + query-after-fact.
+	// Cases 3 & 4: cross-intent anaphora + query-after-fact.
 	// A query after a fact may reference the fact's subject by pronoun.
-	_, isAnaphoric := anaphoraResolver.Resolve(dec.Utterance)
 	if !isAnaphoric && !dec.Slots.HasKey {
 		// No anaphora and no explicit key — this is a truly new topic.
 		return dec
@@ -161,3 +192,49 @@ func followUpMerge(prev *dialogue.Session, dec router.Decision, now time.Time) r
 
 	return dec
 }
+
+// sessionHasContext distinguishes a live transcript from a session that only
+// carries timing/candidate bookkeeping. The raw utterance is the primary
+// source. The slot fallback keeps sessions persisted by older binaries useful
+// after an upgrade: those blobs have no Utterance field, but may still carry
+// the exact turn in Text or a structured fact key/value.
+func sessionHasContext(s *dialogue.Session) bool {
+	if s == nil {
+		return false
+	}
+	return s.Utterance != "" || s.Slots.Text != "" || s.Slots.HasKey || s.Slots.Value != ""
+}
+
+// opensConversation recognises an explicit cooperative opener without making
+// it a competing route. The substantive clause after the colon may still be a
+// fact worth storing; this function only chooses the session's lifetime.
+//
+// The marker is grammatical and closed (Russian давай/давайте, English let's),
+// and the action vocabulary lives in lexicon rather than a substring pattern.
+// A bare chat route needs none of this — rememberTurn marks it conversational
+// from its intent. This catches the compound shape whose fact clause otherwise
+// hides the opener from the single-intent router.
+func opensConversation(text string) bool {
+	tokens := quietTokens(text)
+	if len(tokens) < 2 {
+		return false
+	}
+	from := 1
+	switch {
+	case tokens[0] == "давай" || tokens[0] == "давайте":
+	case tokens[0] == "lets":
+	case len(tokens) >= 3 && tokens[0] == "let" && tokens[1] == "s":
+		from = 2
+	default:
+		return false
+	}
+	verbs := lexicon.ConversationVerbs()
+	for _, token := range tokens[from:] {
+		for _, verb := range verbs {
+			if token == verb || morph.SameWord(token, verb) {
+				return true
+			}
+		}
+	}
+	return false
+}

cmd/mavend/followup_test.go

@@ -138,6 +138,7 @@ func TestFollowUpMerge(t *testing.T) {
 		prior := &dialogue.Session{
 			Intent:    dialogue.IntentFact,
 			Slots:     dialogue.Slots{Key: "water", HasKey: true},
+			Utterance: "я выпил воду",
 			Timestamp: base,
 			TTL:       2 * time.Minute,
 		}
@@ -152,6 +153,72 @@ func TestFollowUpMerge(t *testing.T) {
 		if got.Slots.Key != "water" {
 			t.Errorf("query after fact: got key=%q, want water", got.Slots.Key)
 		}
+		if got.Intent != router.IntentChat {
+			t.Errorf("anaphoric query intent = %s, want chat with dialogue context", got.Intent)
+		}
+	})
+
+	t.Run("anaphoric query after unkeyed query uses raw dialogue context", func(t *testing.T) {
+		prior := &dialogue.Session{
+			Intent:    dialogue.IntentQuery,
+			Slots:     dialogue.Slots{Text: "кто изобрёл телефон?"},
+			Utterance: "кто изобрёл телефон?",
+			Timestamp: base,
+			TTL:       2 * time.Minute,
+		}
+		cur := router.Decision{
+			Intent:         router.IntentQuery,
+			Utterance:      "а когда он это сделал?",
+			Source:         router.SourceWorld,
+			SourceAnchored: true,
+		}
+		got := followUpMerge(prior, cur, base.Add(30*time.Second))
+		if got.Intent != router.IntentChat {
+			t.Fatalf("intent = %s, want chat", got.Intent)
+		}
+		if got.Source != router.SourceUnknown || got.SourceAnchored {
+			t.Errorf("query-only source survived contextual chat: source=%s anchored=%v", got.Source, got.SourceAnchored)
+		}
+	})
+
+	t.Run("anaphora without a usable prior session stays routed", func(t *testing.T) {
+		prior := &dialogue.Session{
+			Intent:    dialogue.IntentQuery,
+			Timestamp: base,
+			TTL:       2 * time.Minute,
+		}
+		cur := router.Decision{Intent: router.IntentQuery, Utterance: "что это?"}
+		got := followUpMerge(prior, cur, base.Add(30*time.Second))
+		if got.Intent != router.IntentQuery {
+			t.Errorf("empty session changed intent to %s", got.Intent)
+		}
+	})
+
+	t.Run("possessive determiner does not turn an explicit query into chat", func(t *testing.T) {
+		prior := &dialogue.Session{
+			Intent: dialogue.IntentChat, Utterance: "привет",
+			Timestamp: base, TTL: 2 * time.Minute,
+		}
+		cur := router.Decision{Intent: router.IntentQuery, Utterance: "где мой телефон?"}
+		got := followUpMerge(prior, cur, base.Add(30*time.Second))
+		if got.Intent != router.IntentQuery {
+			t.Errorf("explicit possessive query changed intent to %s", got.Intent)
+		}
+	})
+
+	t.Run("anaphoric act is never widened into chat", func(t *testing.T) {
+		prior := &dialogue.Session{
+			Intent: dialogue.IntentChat, Utterance: "сервер homesrv",
+			Timestamp: base, TTL: 2 * time.Minute,
+		}
+		cur := router.Decision{Intent: router.IntentAct, Utterance: "выключи его"}
+		got := followUpMerge(prior, cur, base.Add(30*time.Second))
+		if got.Intent != router.IntentAct {
+			t.Errorf("act intent changed to %s", got.Intent)
+		}
+		if got.Slots.HasFn {
+			t.Error("anaphora invented an executable function")
+		}
 	})
 
 	t.Run("query after fact without anaphora does not inherit", func(t *testing.T) {

cmd/mavend/main.go

@@ -559,7 +559,7 @@ func run(args []string) error {
 func personaFacts(cfg *config.Config) persona.Facts {
 	f := persona.Facts{
 		// Telegram lives outside the voice block, so it counts either way.
-		Telegram: cfg.Telegram != nil && cfg.Telegram.BotToken != "" && cfg.Telegram.ChatID != "",
+		Telegram: cfg.Telegram != nil && !cfg.Telegram.Disabled && cfg.Telegram.BotToken != "" && cfg.Telegram.ChatID != "",
 	}
 	if cfg.Voice == nil {
 		return f
@@ -678,16 +678,12 @@ func wireGatherer(st *store.Store, cfg *config.Config, rules []loop.Rule) *loop.
 // reconciled to "unknown" here, before the tick loop resumes sending, so
 // nothing auto-resends into that ambiguity.
 func wireDispatcher(st *store.Store, cfg *config.Config, voiceW *voiceWiring) (*delivery.Dispatcher, error) {
-	var ntfy delivery.Sink
-	if cfg.Ntfy != nil {
-		s, err := ntfysink.New(*cfg.Ntfy)
-		if err != nil {
-			return nil, fmt.Errorf("wire ntfy sink: %w", err)
-		}
-		ntfy = s
+	ntfy, err := wireNtfySink(cfg.Ntfy)
+	if err != nil {
+		return nil, err
 	}
 	var telegram delivery.Sink
-	if cfg.Telegram != nil {
+	if cfg.Telegram != nil && !cfg.Telegram.Disabled {
 		s, err := telegramsink.New(*cfg.Telegram)
 		if err != nil {
 			return nil, fmt.Errorf("wire telegram sink: %w", err)
@@ -712,6 +708,22 @@ func wireDispatcher(st *store.Store, cfg *config.Config, voiceW *voiceWiring) (*
 	}), nil
 }
 
+// wireNtfySink keeps an optional reach optional without ever turning a missing
+// secret into anonymous publishing. A block is live unless it says disabled;
+// therefore an expanded-empty token in a live block fails startup instead of
+// spending days in a permanent 403 retry loop. Disabled is an explicit
+// operator choice and lets another away reach take over.
+func wireNtfySink(cfg *ntfysink.Config) (delivery.Sink, error) {
+	if cfg == nil || cfg.Disabled {
+		return nil, nil
+	}
+	sink, err := ntfysink.New(*cfg)
+	if err != nil {
+		return nil, fmt.Errorf("wire ntfy sink: %w", err)
+	}
+	return sink, nil
+}
+
 // wireTickLoop reads the loop's three intervals and its schedules out of the
 // config, so the two boot paths cannot disagree about them.
 func wireTickLoop(st *store.Store, gatherer *loop.Gatherer, dispatcher *delivery.Dispatcher, phr phraser.Phraser, rules []loop.Rule, cfg *config.Config) *tickLoop {

cmd/mavend/ntfy_wiring_test.go

@@ -0,0 +1,35 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/kami/maven/internal/delivery/ntfysink"
+)
+
+func TestWireNtfySinkRejectsMissingCredentialWhenEnabled(t *testing.T) {
+	_, err := wireNtfySink(&ntfysink.Config{
+		BaseURL: "https://ntfy.example", Topic: "maven",
+	})
+	if err == nil {
+		t.Fatal("expanded-empty credential did not fail an enabled reach")
+	}
+}
+
+func TestWireNtfySinkLeavesExplicitlyDisabledReachDark(t *testing.T) {
+	sink, err := wireNtfySink(&ntfysink.Config{
+		Disabled: true, BaseURL: "https://ntfy.example", Topic: "maven",
+	})
+	if err != nil {
+		t.Fatalf("wireNtfySink: %v", err)
+	}
+	if sink != nil {
+		t.Fatal("disabled reach built a live sink")
+	}
+}
+
+func TestWireNtfySinkRejectsMalformedEnabledConfig(t *testing.T) {
+	_, err := wireNtfySink(&ntfysink.Config{Token: "token", Topic: "maven"})
+	if err == nil {
+		t.Fatal("malformed enabled config did not fail wiring")
+	}
+}

cmd/mavend/onnx_testmain_test.go

@@ -0,0 +1,36 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/kami/maven/internal/router"
+)
+
+// TestMain holds one ONNX Runtime lease across the model-aware topic and
+// personal-boundary gates. Each test still owns and closes its model session;
+// the process-global environment is released only after the final test.
+func TestMain(m *testing.M) {
+	var lease *router.ONNXRuntimeLease
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib != "" {
+		if _, err := os.Stat(lib); err == nil {
+			var acquireErr error
+			lease, acquireErr = router.AcquireONNXRuntime(lib)
+			if acquireErr != nil {
+				fmt.Fprintf(os.Stderr, "initialize shared ONNX test runtime: %v\n", acquireErr)
+				os.Exit(2)
+			}
+		}
+	}
+
+	code := m.Run()
+	if lease != nil {
+		if err := lease.Close(); err != nil {
+			fmt.Fprintf(os.Stderr, "ONNX test runtime cleanup: %v\n", err)
+			code = 1
+		}
+	}
+	os.Exit(code)
+}

cmd/mavend/ordinal.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/kami/maven/internal/dialogue"
 	"github.com/kami/maven/internal/lexicon"
+	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/store"
 )
 
@@ -67,6 +68,44 @@ func parseOrdinal(text string) (int, bool) {
 	return 0, false
 }
 
+// parseReminderCancelChoice is intentionally narrower than parseOrdinal. A
+// task ordinal may appear inside a sentence carrying its transition verb; the
+// reminder list was already offered specifically for cancellation, so the next
+// mutation requires the whole turn to be one affirmative position answer.
+// Questions, negation, two positions and new requests all decline and route as
+// fresh turns instead of cancelling whichever ordinal happened to appear.
+func parseReminderCancelChoice(text string) (int, bool) {
+	if router.IsQuestionShaped(text) {
+		return 0, false
+	}
+	tokens := turnTokens(text)
+	nth, positions := 0, 0
+	for _, tok := range tokens {
+		if reminderCancelNegation(tok) {
+			return 0, false
+		}
+		if n, ok := candidateDigits[tok]; ok {
+			nth, positions = n, positions+1
+			continue
+		}
+		if n, ok := lexicon.Ordinal(tok); ok {
+			nth, positions = n, positions+1
+			continue
+		}
+		if lexicon.IsFillerParticle(tok) || reminderCancelVerbs[tok] ||
+			isReminderCancelTarget(tok) || reminderCancelFrame[tok] {
+			continue
+		}
+		switch tok {
+		case "номер", "вариант", "number", "option", "one":
+			continue
+		default:
+			return 0, false
+		}
+	}
+	return nth, positions == 1
+}
+
 // candidateVerbs — what he wants done with the one he picked. Nothing here is
 // destructive: a task moves forward or is dropped, and both are recorded with a
 // provenance the /tasks page shows.
@@ -112,7 +151,21 @@ func (h *reactiveHandler) resolveCandidate(ctx context.Context, text string, src
 	if sess == nil || len(sess.Candidates) == 0 {
 		return "", false
 	}
+	reminderList := true
+	for _, candidate := range sess.Candidates {
+		if candidate.Kind != "reminder-cancel" {
+			reminderList = false
+			break
+		}
+	}
+	if reminderList && classifyConfirm(text) == confirmNo {
+		h.dialogueSessions.SetCandidates(dialogueIDOf(ctx), h.now(), nil)
+		return "хорошо, ничего не отменяю.", true
+	}
 	nth, ok := parseOrdinal(text)
+	if reminderList {
+		nth, ok = parseReminderCancelChoice(text)
+	}
 	if !ok {
 		return "", false
 	}
@@ -125,6 +178,12 @@ func (h *reactiveHandler) resolveCandidate(ctx context.Context, text string, src
 		return fmt.Sprintf("я назвала только %d.", len(sess.Candidates)), true
 	}
 	pick := sess.Candidates[nth-1]
+	if pick.Kind == "reminder-cancel" {
+		// Unlike a task list, this list was offered in answer to the explicit
+		// question "which reminder should I cancel?" A bare ordinal is the
+		// answer to that question and therefore completes the cancellation.
+		return h.cancelReminderChoice(ctx, pick.Ref, pick.Label), true
+	}
 	status, say, hasVerb := parseCandidateVerb(text)
 	if !hasVerb || pick.Kind != "task" {
 		// Read it back and keep the list: naming one is often the first half of

cmd/mavend/personalboundary.go

@@ -2,6 +2,8 @@ package main
 
 import (
 	"context"
+	"encoding/base64"
+	"encoding/binary"
 	"log"
 	"math"
 	"sync"
@@ -23,31 +25,40 @@ import (
 // every utterance the list misses is one that reaches the world. It also drifts
 // silently — a missing verb looks exactly like no bug.
 //
-// So the boundary asks the embedder instead. Two frozen seed sets — questions
-// about him, questions about the world — are embedded once, and the turn's own
-// query vector, already computed by queryEmbed upstream, is scored against
-// both. Nearest side wins. Word order, verb form and unseen phrasing stop
-// mattering, which is exactly what a lexicon could not do.
+// So the boundary asks the embedder instead. A frozen bilingual corpus is
+// embedded at model-fit time, then a class-balanced logistic head is fitted
+// over those vectors. The head learns a direction in semantic space instead
+// of choosing whichever single example happens to share the most words. That
+// matters for a public noun inside a private question and for advice about an
+// owned object: nearest-neighbour scoring confuses both, while a trained head
+// combines the evidence across the whole sentence.
 //
-// Measured 03-08-2026 against multilingual-e5-small on 19 held-out utterances,
-// none of them a seed: 19 right (TestONNXPersonalBoundary). A 20th, "as i said,
-// what is the population of india", missed by +0.008 during the first pass and
-// is a world seed now, which is why it is not in the held-out set. True
-// positives clear the world side by +0.014 to +0.089 and the nearest true
-// negative sits at -0.005, so the gate is the sign of the difference and
-// nothing tighter: the margins are too thin to justify a threshold, and the
-// asymmetry favours claiming anyway. A false claim costs one honest "не знаю";
-// a false pass sends his life to an upstream engine.
+// The corpus covers six sentence shapes on both sides: remembered speech,
+// possession, narrative, first-person preambles, current advice/information,
+// and public proper nouns. Training weights each class equally, so the larger
+// world corpus cannot move the prior merely by containing more examples. A
+// small L2 term makes the solution stable; its value and the fixed optimiser
+// are measured by model-backed cross-validation, not adjusted at runtime.
 //
-// The embedder is the one model CLAUDE.md pins to homesrv permanently, and it
-// is what makes this affordable: no llama-server call, no network, one cosine
-// per seed against a vector the turn already has.
+// This linear head measures 29/29 on the historical regression suite and
+// 72/72 on the separate stratified fixture (V-702, 13-08-2026). The gate is
+// still probability 0.5: a false claim costs one honest "не знаю", while a
+// false pass can send his life to an upstream engine.
+//
+// The embedder is the one model CLAUDE.md pins to homesrv permanently. Its head
+// is fitted and verified by the model-backed gate, then frozen into the binary;
+// inference is one dot product against a vector the turn already has. Unknown
+// embedding spaces fit their own head once per process instead of applying
+// foreign weights. Neither path calls llama-server or the network.
 
-// personalSeeds — questions about him. Frozen: they are scoring data, so
-// editing one moves the boundary and must be re-measured, not eyeballed. Cover
-// both classes the boundary owns, possession and first-person speech, in both
-// languages.
+// personalSeeds and worldSeeds are the frozen training corpus for the linear
+// boundary head. Editing either changes a model, not a phrase list: every edit
+// therefore needs the model-backed regression, stratified evaluation and
+// training-corpus cross-validation. The examples describe where an answer can
+// come from, in both languages. None is a special case copied from an eval.
 var personalSeeds = []string{
+	// The original compact corpus. It remains here both as training signal and
+	// as provenance for the regressions that introduced the semantic boundary.
 	"что я говорил про это",
 	"я тебе рассказывал об этом?",
 	"что я записал про врача",
@@ -56,21 +67,79 @@ var personalSeeds = []string{
 	"когда моя встреча",
 	"what did i say about this",
 	"did i mention this to you",
+
+	// Remembered speech.
+	"какой адрес я тебе сообщал?",
+	"что я говорил о своём самочувствии?",
+	"какое решение по ремонту я озвучил?",
+	"что я обещал сделать после отпуска?",
+	"what reason did I give for declining the offer?",
+	"did I tell you where I grew up?",
+	"which restaurant did I say I wanted to visit?",
+	"what explanation did I give for missing the meeting?",
+
+	// Stored attributes of his possessions and records.
+	"где лежит мой договор аренды?",
+	"когда заканчивается моя подписка на спортзал?",
+	"какой размер у моей запасной куртки?",
+	"до какой даты действует мой пропуск?",
+	"какой размер у моего велосипедного шлема?",
+	"where is my vehicle registration document?",
+	"when is my museum membership renewal?",
+	"what number is on my travel insurance policy?",
+	"which shelf did I put my tax folder on?",
+	"what size is my waterproof coat?",
+
+	// Narratives that only his memories or records can supply.
+	"собери по моим записям рассказ о поездке в Самару",
+	"напомни, как прошёл мой первый урок вождения",
+	"восстанови из дневника, как я искал первую квартиру",
+	"перескажи по моим словам, как прошла встреча выпускников",
+	"summarize my account of moving into this apartment",
+	"tell me what happened during my first week at the new job",
+	"recreate the story of my graduation from my journal",
+	"piece together my account of adopting the dog",
+
+	// First-person framing around a private answer.
+	"возвращаясь к нашей беседе, какой банк я выбрал?",
+	"кажется, я уже говорил: на какую дату записался к врачу?",
+	"если мы это обсуждали, какую школу вождения я предпочёл?",
+	"напомню наш разговор: когда я решил менять работу?",
+	"as I mentioned before, which contractor did I hire?",
+	"coming back to our chat, what date did I book the inspection for?",
+	"if we covered this already, which course did I enroll in?",
+	"back to what I told you: where did I plan to stay in Oslo?",
+
+	// Current information that lives only in his records.
+	"какой счёт мне нужно оплатить на этой неделе?",
+	"сколько часов я работал в прошлом месяце?",
+	"какую процедуру мастер советовал выполнить утром?",
+	"какая из моих заявок всё ещё не закрыта?",
+	"which appointment do I have tomorrow morning?",
+	"how many kilometres did I run last week?",
+	"what maintenance did the mechanic tell me to schedule?",
+	"which item on my project list is overdue?",
+
+	// Public names inside questions that still require his records.
+	"какую цитату из Набокова я сохранил?",
+	"когда у меня созвон с Ириной Петровой?",
+	"что я думал о романе Умберто Эко?",
+	"какую оценку я дал выставке Айвазовского?",
+	"какую фотографию Эрмитажа я отметил для печати?",
+	"what did I note down after Margaret Hamilton's lecture?",
+	"when is my booking at the Royal Albert Hall?",
+	"which Nina Simone song did I call my favourite?",
+	"what opinion did I share about Zadie Smith's new novel?",
+	"what reminder did I attach to the Jira migration?",
 }
 
-// worldSeeds — questions the world can answer, including the two shapes that
-// look personal and are not: a first-person preamble on a world question ("как
-// я говорил, ..."), and first person without possession ("что я могу
-// посмотреть вечером"). Refusing those is the opposite mistake and the older
-// comment on personalMarkers already named it.
 var worldSeeds = []string{
+	// The original compact corpus, retained as above.
 	"почему небо синее",
 	"какая столица франции",
 	"как сварить борщ",
 	"кто написал эту книгу",
 	"what is the capital of france",
-	"how do i boil an egg",
-	"как я говорил, почему небо синее",
 	"as i said, why is the sky blue",
 	"as i said, what is the population of india",
 	"что я могу посмотреть вечером",
@@ -103,21 +172,89 @@ var worldSeeds = []string{
 	"расскажи про древний рим",
 	"объясни как работает двигатель",
 	"tell me about the roman empire",
+
+	// Speech and reports by somebody other than the owner.
+	"что Александр Пушкин писал о Москве?",
+	"как учёные объясняли исчезновение динозавров?",
+	"что Менделеев говорил о будущем химии?",
+	"какие выводы сделал Амундсен после экспедиции?",
+	"what did Virginia Woolf write about fiction?",
+	"how did researchers describe the Tunguska event?",
+	"what did witnesses report after the Lisbon earthquake?",
+	"which ideas did Ada Lovelace describe in her notes?",
+
+	// General advice about an owned object. Ownership supplies context, but an
+	// outside source can still supply the answer.
+	"как починить мой скрипящий стул?",
+	"почему мой роутер теряет соединение?",
+	"чем очистить мой велосипед от ржавчины?",
+	"какой бензин подходит для моего генератора?",
+	"какой чехол подобрать для моего планшета?",
+	"как защитить мой деревянный стол от влаги?",
+	"how do I remove a stain from my jacket?",
+	"why is my freezer building up ice?",
+	"which oil should I use in my lawn mower?",
+	"what detergent is safe for my washing machine?",
+	"which replacement blade should I buy for my circular saw?",
+	"how can I keep my garden tools from rusting?",
+
+	// Public narratives.
+	"расскажи историю строительства Транссибирской магистрали",
+	"опиши, как развивалась письменность",
+	"объясни, как появился периодический закон",
+	"опиши первую успешную зимовку в Антарктиде",
+	"tell the story of the discovery of penicillin",
+	"describe how the first transatlantic cable was laid",
+	"explain how the Olympic Games were revived",
+	"describe the expedition that first reached the South Pole",
+
+	// First-person framing around a public answer.
+	"как я уже спрашивал, почему звёзды мерцают?",
+	"повторю свой вопрос: как образуются коралловые рифы?",
+	"возможно, я повторяюсь: когда возвели собор Святого Петра?",
+	"я мог уже спрашивать: из чего делают фарфор?",
+	"as I asked earlier, why do leaves change colour?",
+	"to repeat my question, how are fjords formed?",
+	"I might be asking twice, when was Angkor Wat constructed?",
+	"I may have asked before, what causes bioluminescence?",
+
+	// Public current information and generally applicable advice.
+	"какие поезда сегодня идут из Москвы в Тверь?",
+	"как правильно хранить чугунную сковороду?",
+	"какие выставки проходят в Петербурге в этом месяце?",
+	"какой сейчас уровень воды в Волге?",
+	"what is the latest supported version of Ubuntu?",
+	"how should I prepare a wooden deck for winter?",
+	"which film festivals are taking place this season?",
+	"what is the current exchange rate for the Norwegian krone?",
+
+	// Public facts about named people, places and organisations.
+	"кто такая Софья Ковалевская?",
+	"когда была основана компания Nintendo?",
+	"чем прославился архитектор Фрэнк Ллойд Райт?",
+	"где находится музей Прадо?",
+	"who was James Baldwin?",
+	"what is the city of Petra known for?",
+	"when was the composer Philip Glass born?",
+	"where is the Uffizi Gallery located?",
 }
 
-// personalBoundary holds the embedded seeds. Zero value is usable and means
-// "not loaded yet"; a handler built without an embedder never loads and the
-// boundary falls back to personalMarkers.
+// personalBoundary holds the frozen or locally fitted head and, when fitting
+// was necessary, its embedded corpus. Zero value is usable and means "not
+// loaded yet"; a handler built without an embedder never loads and the boundary
+// falls back to personalMarkers.
 type personalBoundary struct {
 	once     sync.Once
 	personal [][]float32
 	world    [][]float32
+	head     personalBoundaryLinearHead
 	loaded   bool
 }
 
-// load embeds both seed sets, once per process. Seeds are embedded on the QUERY
-// side, like the utterance they are compared with — a question against a
-// question. Mixing sides would measure the e5 prefix, not the meaning.
+// load selects the pinned frozen head or embeds and fits the seed sets once per
+// process for another embedding space. Seeds are embedded on the QUERY side,
+// like the utterance they classify. Mixing sides would measure the e5 prefix,
+// not the meaning.
 func (b *personalBoundary) load(ctx context.Context, emb router.Embedder) {
 	b.once.Do(func() {
 		if emb == nil {
@@ -135,30 +272,149 @@ func (b *personalBoundary) load(ctx context.Context, emb router.Embedder) {
 			}
 			return out
 		}
+		// The deployed e5-small head is fitted offline from the corpus below and
+		// checked back against it by TestONNXPersonalBoundaryFrozenHead. Loading
+		// it directly keeps the first personal query from embedding 132 examples.
+		if router.EmbedderID(emb) == personalBoundaryHeadModelID {
+			head, ok := frozenPersonalBoundaryHead()
+			if ok && len(head.weights) == emb.Dim() {
+				b.head, b.loaded = head, true
+				return
+			}
+			log.Printf("voice: frozen personal boundary head is corrupt; rebuilding from its corpus")
+		}
+
 		p, w := embedAll(personalSeeds), embedAll(worldSeeds)
 		if p == nil || w == nil {
 			return
 		}
-		b.personal, b.world, b.loaded = p, w, true
+		epochs := personalBoundaryTrainingEpochs
+		if router.EmbedderID(emb) == personalBoundaryHashModelID {
+			epochs = personalBoundaryHashTrainingEpochs
+		}
+		head, ok := trainPersonalBoundaryLinearHeadEpochs(p, w, epochs)
+		if !ok {
+			log.Printf("voice: personal boundary training examples have inconsistent dimensions; falling back to possession markers")
+			return
+		}
+		b.personal, b.world, b.head, b.loaded = p, w, head, true
 	})
 }
 
-// score returns the best similarity to each side. ok is false when the seeds
-// are not loaded, which is the caller's signal to use the markers instead.
-func (b *personalBoundary) score(vec []float32) (personal, world float64, ok bool) {
-	if !b.loaded || len(vec) == 0 {
-		return 0, 0, false
+const (
+	personalBoundaryTrainingEpochs = 5000
+	personalBoundaryLearningRate   = 10.0
+	personalBoundaryL2             = 0.0003
+)
+
+const personalBoundaryHeadModelID = "model_quantized@384/tok2"
+
+const personalBoundaryHashModelID = "hash@1024"
+
+const personalBoundaryHeadWeights = "a3q5vmod2L7msrs+1RE8Pp5HDEBlv609AC9cvzm4D0CL7Fc/FU9cvxLmAMA638c/BgDBP6Is1r7PzBO/6MVAPsmEWT6XowjAouT0v8jMN79d2Sk+7XLlPX2akD+lmKi/q922vvLSFcBb0ma/cN3QP27zBMDl45i/iuE0P4KIJb+7dua+gTePP5unVz9H3q29Sxsev7YJe7+SvoQ+r6jyPxW2DL8sMQc/+iExQM5y8D/qJSZAtFyKP3PbyD8OK0dAHD+0v056qj4AbOS+AFHzP1KPeT9+cqu/aMIQv9wCqL8WbYe/xED1vu7pHMCPlxe/ZUGLPqFoDb8GPQ6/XE6cvqPVi7xKdr0/CE1PP4dPrj6TxoK+KokGP7xxu73h6DW/Lw8APsjd1D43aci/ZBMoQPyy8D8G6w/AMT1tPSEUU7/Sp+c+sjpRvyfl2L4KDs8/q/Ibv3urHj/+7ls/yxjaP8WS8jy8cd6+BO+4P/IcJkBTEPo/q2VGvqvsUD9anuk8UiO/PSw707+5+oY+zBpHP6e+UT4qaEe/zqjGvypN1j45TFY+nZ36v9rP8L9bmyE/Rn8UwONI0D5Yhs6/InCYv4kGgz/LNXO/rhK+Pu2Qdz/W8ijAdi3hv5qT5D9383k8Ir2wP0MRD0AxCCQ/0CUDP5kWoz+TQjdAOxI0vSbxDb/xj54/N/G6v86Ixr932Lk/jQ2jvqn2nr9y3JC96jDDPsyPlj9q/OQ/cOcCQJ+15z9747s/8Zh8PoS4oL0GKma/lfuPv/Clgb9GPKW+2OR3vimzAUBVYxXARcw0vynpsr/IUqe/bsUhv5kwWcCZtnE/fr87vjvfdr4mHis/xMpzvn20HL4SHFu/1DFXvVgOg76GXEq/pB2QP2u6e71q7w0+7F3APlte1j9YKXK/1cljPkFx0L/CndS9b4CeP4BIvj/fP5Q99jbZvL1h778WhC0/pNhov4+x1r+lYeE/9Y6gP9gtqr75dIe/wGiKv4q56D10ckY+UuvDvoIUnz/3TVM/moHcP6FkUz6//pY+FYhcwFEkD8B2a2c9mC+UP/ZeTb5FgIq+rgEOvylj8D9dvx8/OngmPyiplT9oiLy/AJwswKOJdL+i8/m9GPNfvyyWk77jVPC/0u+IPpx/Fz/QdvG/Ag9gP41l2rxmXUo/hdL0vx1XX0BUp+w9hmYyPk21dT6UJmK/zajGP7gBSD0FqoXAkis4P7kehz94wNa//nfZvxA0Fz8b9ze/IETPv3xEb76BG8k/SpyVP9xkEUC2/jlAcv8/wKKxU75E0xM+9BItPzlQKr6S0wdAMa39v0GKA8AMB3G/IeKvvyTZkz+es62/UEYTP3j+lj4SRM+/Dbfgvupdsj/wcUbAbjqRv/WV/r5WRaO/iB67P3/UyD8AK5Q+LzvJPsjPPL/fwkS/atd9P56MHz9CIJu9ugjgvp7J2D8otQC/YYoowKGEFD4eMVC/xy3UP2UEND9nU0i/ol4GQJuwfb+xeaa/B3IjwDK6Gz8dVv8/2wbLPlUo6j+FDCk/4Q/VP/J8JkCYVd0/gMS/P9Bwhj9R94a9M0Mjv/hKdL8cl6Y/lD73vwgior9+56Q/YI+1v9Wd0j8ltAjAmD5dP56Hnb+rdrA+gn2jP0bFA7/lkZU/tK6VP63ItT5Oi7O+YjfUv5iUzT+n5H8/zXMpvjefvj67z66/GA71Pj2h2T5bXxW/EyfLP1LZxr/B758/iCd2v0jnoT8twoG/oAO9vjpYDr61q6I+AEVFv1OP2b1VQpO/5FYdP5vgaz/4Lbm9CMCjvhbWlL9pYQk/1l5hPjCTYj8dtiJATXjavb6SlL7rp0E/cMBgP9UIXLwVYXC+rFS2v9yeFUD88JBAbwWcvt7s1D/bsuU/BCv0PzSdQEA7l36/FULEvmxlo79jjzc+gFvav1vptb/YjkS/Zo76vqK+3j+qvqi/qyfpPj1BLj+ehSzA4Z8nPyS/1b8kz5a9NIuZv31beL/k0oXAXFO/P8cCh8BSPzS+N7agvhjPUD6/G24/GIP0PYlNOsAFe6q+"
+
+// HashEmbedder is a deterministic offline floor. Its 1024-dimensional head is
+// trained on first use instead of embedded here because the binary form is
+// still tiny but not meaningful as a production quality claim. The floor's
+// optimizer uses fewer steps: the hash vectors are sparse and converge long
+// before the semantic head, keeping an unconfigured box responsive.
+const personalBoundaryHashTrainingEpochs = 400
+
+type personalBoundaryLinearHead struct {
+	weights []float64
+	bias    float64
+}
+
+func frozenPersonalBoundaryHead() (personalBoundaryLinearHead, bool) {
+	raw, err := base64.StdEncoding.DecodeString(personalBoundaryHeadWeights)
+	if err != nil || len(raw)%4 != 0 {
+		return personalBoundaryLinearHead{}, false
 	}
-	best := func(seeds [][]float32) float64 {
-		m := -1.0
-		for _, s := range seeds {
-			if c := cosine(vec, s); c > m {
-				m = c
+	weights := make([]float64, len(raw)/4)
+	for i := range weights {
+		weights[i] = float64(math.Float32frombits(binary.LittleEndian.Uint32(raw[4*i:])))
+	}
+	return personalBoundaryLinearHead{weights: weights, bias: -3.122734201373742}, true
+}
+
+// trainPersonalBoundaryLinearHead fits binary logistic regression with full
+// batch gradient descent. Each side contributes total weight 0.5 regardless
+// of its number of examples. The optimiser is intentionally tiny and local:
+// the embedder supplies all learned language knowledge; this only learns one
+// separating hyperplane over its 384-dimensional vectors.
+func trainPersonalBoundaryLinearHead(personal, world [][]float32) (personalBoundaryLinearHead, bool) {
+	return trainPersonalBoundaryLinearHeadEpochs(personal, world, personalBoundaryTrainingEpochs)
+}
+
+func trainPersonalBoundaryLinearHeadEpochs(personal, world [][]float32, epochs int) (personalBoundaryLinearHead, bool) {
+	if len(personal) == 0 || len(world) == 0 || len(personal[0]) == 0 {
+		return personalBoundaryLinearHead{}, false
+	}
+	dim := len(personal[0])
+	for _, vectors := range [][][]float32{personal, world} {
+		for _, vector := range vectors {
+			if len(vector) != dim {
+				return personalBoundaryLinearHead{}, false
 			}
 		}
-		return m
 	}
-	return best(b.personal), best(b.world), true
+
+	head := personalBoundaryLinearHead{weights: make([]float64, dim)}
+	personalWeight := 0.5 / float64(len(personal))
+	worldWeight := 0.5 / float64(len(world))
+	for epoch := 0; epoch < epochs; epoch++ {
+		gradient := make([]float64, dim)
+		biasGradient := 0.0
+		accumulate := func(vectors [][]float32, target, sampleWeight float64) {
+			for _, vector := range vectors {
+				probability := logistic(head.logit(vector))
+				error := (probability - target) * sampleWeight
+				biasGradient += error
+				for i, value := range vector {
+					gradient[i] += error * float64(value)
+				}
+			}
+		}
+		accumulate(personal, 1, personalWeight)
+		accumulate(world, 0, worldWeight)
+
+		step := personalBoundaryLearningRate / (1 + float64(epoch)/1000)
+		for i := range head.weights {
+			head.weights[i] -= step * (gradient[i] + personalBoundaryL2*head.weights[i])
+		}
+		head.bias -= step * biasGradient
+	}
+	return head, true
+}
+
+func (h personalBoundaryLinearHead) logit(vec []float32) float64 {
+	if len(vec) != len(h.weights) {
+		return 0
+	}
+	score := h.bias
+	for i, value := range vec {
+		score += h.weights[i] * float64(value)
+	}
+	return score
+}
+
+func logistic(value float64) float64 {
+	if value >= 0 {
+		return 1 / (1 + math.Exp(-value))
+	}
+	exp := math.Exp(value)
+	return exp / (1 + exp)
+}
+
+// score returns complementary class probabilities. ok is false when the
+// corpus is not loaded or the query vector belongs to another embedding
+// space, which is the caller's signal to use the offline marker floor.
+func (b *personalBoundary) score(vec []float32) (personal, world float64, ok bool) {
+	if !b.loaded || len(vec) != len(b.head.weights) {
+		return 0, 0, false
+	}
+	personal = logistic(b.head.logit(vec))
+	return personal, 1 - personal, true
 }
 
 // cosine — same math as internal/router and internal/memory, small enough that

cmd/mavend/personalboundary_eval_test.go

@@ -0,0 +1,405 @@
+package main
+
+import (
+	"context"
+	_ "embed"
+	"encoding/json"
+	"math"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+	"unicode"
+
+	"github.com/kami/maven/internal/router"
+)
+
+// This fixture is intentionally separate from personalboundary_test.go. The
+// small regression table there explains individual fixes; this matrix measures
+// the boundary as a classifier and prevents a repaired sentence shape from
+// standing in for language and subject coverage.
+//
+//go:embed testdata/personal_boundary_v1.json
+var personalBoundaryFixtureJSON []byte
+
+type personalBoundaryEvalCase struct {
+	ID        string `json:"id"`
+	Utterance string `json:"utterance"`
+	Lang      string `json:"lang"`
+	Want      string `json:"want"`
+	Stratum   string `json:"stratum"`
+}
+
+type personalBoundaryEvalFixture struct {
+	SchemaVersion int                        `json:"schema_version"`
+	Name          string                     `json:"name"`
+	Notes         []string                   `json:"notes"`
+	Cases         []personalBoundaryEvalCase `json:"cases"`
+}
+
+var personalBoundaryEvalStrata = []string{
+	"remembered_speech",
+	"possession",
+	"narrative",
+	"first_person_preamble",
+	"advice_current_info",
+	"public_proper_nouns",
+}
+
+func loadPersonalBoundaryEvalFixture(t *testing.T) personalBoundaryEvalFixture {
+	t.Helper()
+	var fixture personalBoundaryEvalFixture
+	if err := json.Unmarshal(personalBoundaryFixtureJSON, &fixture); err != nil {
+		t.Fatalf("parse personal boundary fixture: %v", err)
+	}
+	if fixture.SchemaVersion != 1 {
+		t.Fatalf("personal boundary fixture schema_version = %d, want 1", fixture.SchemaVersion)
+	}
+	if fixture.Name != "personal_boundary_v1" {
+		t.Fatalf("personal boundary fixture name = %q, want personal_boundary_v1", fixture.Name)
+	}
+	return fixture
+}
+
+// TestPersonalBoundaryEvalFixture enforces the sampling contract separately
+// from the model measurement. It runs in ordinary CI even when ONNX Runtime is
+// absent, so a fixture edit cannot silently unbalance a language, side or
+// sentence shape, or turn a production seed into a held-out case.
+func TestPersonalBoundaryEvalFixture(t *testing.T) {
+	fixture := loadPersonalBoundaryEvalFixture(t)
+	const wantPerCell = 3
+	const wantTotal = 6 * 2 * 2 * wantPerCell
+	if len(fixture.Cases) != wantTotal {
+		t.Errorf("fixture has %d cases, want %d", len(fixture.Cases), wantTotal)
+	}
+
+	validStrata := make(map[string]bool, len(personalBoundaryEvalStrata))
+	for _, stratum := range personalBoundaryEvalStrata {
+		validStrata[stratum] = true
+	}
+	seedSource := make(map[string]string, len(personalSeeds)+len(worldSeeds))
+	for _, seed := range personalSeeds {
+		seedSource[normalizePersonalBoundaryEval(seed)] = "personalSeeds"
+	}
+	for _, seed := range worldSeeds {
+		seedSource[normalizePersonalBoundaryEval(seed)] = "worldSeeds"
+	}
+
+	seenID := make(map[string]bool, len(fixture.Cases))
+	seenUtterance := make(map[string]string, len(fixture.Cases))
+	cells := make(map[string]int)
+	for _, c := range fixture.Cases {
+		if strings.TrimSpace(c.ID) == "" || seenID[c.ID] {
+			t.Errorf("case %q: empty or duplicate id", c.ID)
+		}
+		seenID[c.ID] = true
+		if c.Lang != "ru" && c.Lang != "en" {
+			t.Errorf("%s: lang = %q, want ru|en", c.ID, c.Lang)
+		}
+		if c.Want != "personal" && c.Want != "world" {
+			t.Errorf("%s: want = %q, want personal|world", c.ID, c.Want)
+		}
+		if !validStrata[c.Stratum] {
+			t.Errorf("%s: stratum = %q, not one of the six declared strata", c.ID, c.Stratum)
+		}
+
+		normalized := normalizePersonalBoundaryEval(c.Utterance)
+		if normalized == "" {
+			t.Errorf("%s: empty utterance", c.ID)
+		}
+		if previous, ok := seenUtterance[normalized]; ok {
+			t.Errorf("%s: utterance duplicates %s after normalization", c.ID, previous)
+		}
+		seenUtterance[normalized] = c.ID
+		if source, ok := seedSource[normalized]; ok {
+			t.Errorf("%s: %q is verbatim in %s, so it is not held out", c.ID, c.Utterance, source)
+		}
+		// The original failure names Baikal. Replacing that sentence's verb or
+		// punctuation would measure an exception, not the boundary. This corpus
+		// instead varies people, places, products and events.
+		if strings.Contains(normalized, "байкал") || strings.Contains(normalized, "baikal") {
+			t.Errorf("%s: the stratified fixture must not copy the Baikal regression", c.ID)
+		}
+		cells[c.Stratum+"/"+c.Lang+"/"+c.Want]++
+	}
+
+	for _, stratum := range personalBoundaryEvalStrata {
+		for _, lang := range []string{"ru", "en"} {
+			for _, want := range []string{"personal", "world"} {
+				cell := stratum + "/" + lang + "/" + want
+				if got := cells[cell]; got != wantPerCell {
+					t.Errorf("fixture cell %s has %d cases, want %d", cell, got, wantPerCell)
+				}
+			}
+		}
+	}
+}
+
+// normalizePersonalBoundaryEval compares content rather than typography:
+// case, punctuation and repeated whitespace cannot disguise a copied seed or
+// duplicate case. This is fixture hygiene only; it does not participate in the
+// production boundary.
+func normalizePersonalBoundaryEval(s string) string {
+	var b strings.Builder
+	space := true
+	for _, r := range strings.ToLower(s) {
+		if unicode.IsLetter(r) || unicode.IsNumber(r) {
+			b.WriteRune(r)
+			space = false
+			continue
+		}
+		if !space {
+			b.WriteByte(' ')
+			space = true
+		}
+	}
+	return strings.TrimSpace(b.String())
+}
+
+type personalBoundaryEvalStat struct {
+	Correct int
+	Total   int
+}
+
+type personalBoundaryEvalReport struct {
+	Name            string
+	Correct         int
+	Total           int
+	MinimumMargin   float64
+	ByStratum       map[string]personalBoundaryEvalStat
+	ByLanguage      map[string]personalBoundaryEvalStat
+	ByExpectedClass map[string]personalBoundaryEvalStat
+	ByCell          map[string]personalBoundaryEvalStat
+}
+
+func newPersonalBoundaryEvalReport(name string) *personalBoundaryEvalReport {
+	return &personalBoundaryEvalReport{
+		Name:            name,
+		MinimumMargin:   math.Inf(1),
+		ByStratum:       make(map[string]personalBoundaryEvalStat),
+		ByLanguage:      make(map[string]personalBoundaryEvalStat),
+		ByExpectedClass: make(map[string]personalBoundaryEvalStat),
+		ByCell:          make(map[string]personalBoundaryEvalStat),
+	}
+}
+
+func (r *personalBoundaryEvalReport) add(c personalBoundaryEvalCase, gotPersonal bool, personal, world float64) {
+	wantPersonal := c.Want == "personal"
+	correct := gotPersonal == wantPersonal
+	r.Total++
+	if correct {
+		r.Correct++
+	}
+	signedMargin := personal - world
+	if !wantPersonal {
+		signedMargin = -signedMargin
+	}
+	if signedMargin < r.MinimumMargin {
+		r.MinimumMargin = signedMargin
+	}
+	add := func(stats map[string]personalBoundaryEvalStat, key string) {
+		stat := stats[key]
+		stat.Total++
+		if correct {
+			stat.Correct++
+		}
+		stats[key] = stat
+	}
+	add(r.ByStratum, c.Stratum)
+	add(r.ByLanguage, c.Lang)
+	add(r.ByExpectedClass, c.Want)
+	add(r.ByCell, c.Stratum+"/"+c.Lang+"/"+c.Want)
+}
+
+// TestONNXPersonalBoundaryStratified scores the model homesrv actually runs.
+// Production is read from personalBoundary.score; top1, top2, top3 and a
+// whole-class centroid are diagnostics over the same embedded seeds. Today
+// production and top3 coincide, but keeping them separate means a later scoring
+// experiment can be compared without rewriting this evaluation or putting its
+// candidate math in runtime code. The privacy boundary is a hard contract, so
+// every production miss is a test failure rather than an accuracy target to
+// average away.
+func TestONNXPersonalBoundaryStratified(t *testing.T) {
+	if os.Getenv("MAVEN_EVAL_PERSONAL_BOUNDARY") == "" {
+		t.Skip("set MAVEN_EVAL_PERSONAL_BOUNDARY=1 to run the deliberately strict V-702 matrix")
+	}
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	modelDir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	model := filepath.Join(modelDir, "model_quantized.onnx")
+	tokenizer := filepath.Join(modelDir, "tokenizer.json")
+	for _, path := range []string{lib, model, tokenizer} {
+		if _, err := os.Stat(path); err != nil {
+			t.Skipf("personal boundary eval dependency %s unavailable: %v", path, err)
+		}
+	}
+
+	embedder, err := router.NewONNXEmbedder(model, tokenizer, lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer embedder.Close()
+
+	ctx := context.Background()
+	boundary := &personalBoundary{}
+	boundary.load(ctx, embedder)
+	if !boundary.loaded {
+		t.Fatal("personal boundary seeds did not load with a working embedder")
+	}
+	// Production loads its model-ID-pinned frozen head and deliberately skips
+	// the 132 corpus embeddings on a user's first query. This test still needs
+	// those vectors for the historical top-k/centroid diagnostics, so build
+	// them here without putting that latency back in runtime code.
+	embedCorpus := func(values []string) [][]float32 {
+		vectors := make([][]float32, len(values))
+		for i, value := range values {
+			vector, err := router.EmbedQuery(ctx, embedder, value)
+			if err != nil {
+				t.Fatalf("embed diagnostic corpus %q: %v", value, err)
+			}
+			vectors[i] = vector
+		}
+		return vectors
+	}
+	boundary.personal = embedCorpus(personalSeeds)
+	boundary.world = embedCorpus(worldSeeds)
+	personalCentroid := personalBoundaryEvalCentroid(boundary.personal)
+	worldCentroid := personalBoundaryEvalCentroid(boundary.world)
+	if len(personalCentroid) == 0 || len(worldCentroid) == 0 {
+		t.Fatal("personal boundary seed vectors do not share a dimension")
+	}
+
+	type candidate struct {
+		name  string
+		score func([]float32) (float64, float64)
+	}
+	candidates := []candidate{
+		{name: "production", score: func(vec []float32) (float64, float64) {
+			personal, world, ok := boundary.score(vec)
+			if !ok {
+				t.Fatal("loaded personal boundary declined to score")
+			}
+			return personal, world
+		}},
+		{name: "top1", score: func(vec []float32) (float64, float64) {
+			return meanNearest(vec, boundary.personal, 1), meanNearest(vec, boundary.world, 1)
+		}},
+		{name: "top2", score: func(vec []float32) (float64, float64) {
+			return meanNearest(vec, boundary.personal, 2), meanNearest(vec, boundary.world, 2)
+		}},
+		{name: "top3", score: func(vec []float32) (float64, float64) {
+			return meanNearest(vec, boundary.personal, 3), meanNearest(vec, boundary.world, 3)
+		}},
+		{name: "centroid", score: func(vec []float32) (float64, float64) {
+			return cosine(vec, personalCentroid), cosine(vec, worldCentroid)
+		}},
+	}
+	reports := make(map[string]*personalBoundaryEvalReport, len(candidates))
+	for _, candidate := range candidates {
+		reports[candidate.name] = newPersonalBoundaryEvalReport(candidate.name)
+	}
+
+	fixture := loadPersonalBoundaryEvalFixture(t)
+	for _, c := range fixture.Cases {
+		vec, err := router.EmbedQuery(ctx, embedder, c.Utterance)
+		if err != nil {
+			t.Fatalf("%s: embed %q: %v", c.ID, c.Utterance, err)
+		}
+		for _, candidate := range candidates {
+			personal, world := candidate.score(vec)
+			gotPersonal := personal > world
+			reports[candidate.name].add(c, gotPersonal, personal, world)
+			if candidate.name == "production" && gotPersonal != (c.Want == "personal") {
+				t.Errorf("%s [%s/%s]: got %s, want %s (personal %.4f world %.4f delta %+.4f): %q",
+					c.ID, c.Lang, c.Stratum, boundaryEvalSide(gotPersonal), c.Want,
+					personal, world, personal-world, c.Utterance)
+			}
+		}
+	}
+
+	for _, candidate := range candidates {
+		report := reports[candidate.name]
+		t.Logf("candidate %-15s %2d/%d (%.1f%%), minimum signed margin %+.4f",
+			report.Name, report.Correct, report.Total,
+			100*float64(report.Correct)/float64(report.Total), report.MinimumMargin)
+	}
+	production := reports["production"]
+	for _, lang := range []string{"ru", "en"} {
+		stat := production.ByLanguage[lang]
+		t.Logf("production language %-2s %2d/%d", lang, stat.Correct, stat.Total)
+	}
+	for _, side := range []string{"personal", "world"} {
+		stat := production.ByExpectedClass[side]
+		t.Logf("production expected %-8s %2d/%d", side, stat.Correct, stat.Total)
+	}
+	strata := append([]string(nil), personalBoundaryEvalStrata...)
+	sort.Strings(strata)
+	for _, stratum := range strata {
+		stat := production.ByStratum[stratum]
+		ruPersonal := production.ByCell[stratum+"/ru/personal"]
+		ruWorld := production.ByCell[stratum+"/ru/world"]
+		enPersonal := production.ByCell[stratum+"/en/personal"]
+		enWorld := production.ByCell[stratum+"/en/world"]
+		t.Logf("production stratum %-21s %2d/%d | ru personal %d/%d world %d/%d | en personal %d/%d world %d/%d",
+			stratum, stat.Correct, stat.Total,
+			ruPersonal.Correct, ruPersonal.Total, ruWorld.Correct, ruWorld.Total,
+			enPersonal.Correct, enPersonal.Total, enWorld.Correct, enWorld.Total)
+	}
+}
+
+func personalBoundaryEvalCentroid(vectors [][]float32) []float32 {
+	if len(vectors) == 0 {
+		return nil
+	}
+	centroid := make([]float32, len(vectors[0]))
+	for _, vector := range vectors {
+		if len(vector) != len(centroid) {
+			return nil
+		}
+		for i, value := range vector {
+			centroid[i] += value
+		}
+	}
+	for i := range centroid {
+		centroid[i] /= float32(len(vectors))
+	}
+	return centroid
+}
+
+func boundaryEvalSide(personal bool) string {
+	if personal {
+		return "personal"
+	}
+	return "world"
+}
+
+// meanNearest is an evaluation baseline retained beside the strict fixture;
+// production uses the linear head in personalboundary.go.
+func meanNearest(vec []float32, seeds [][]float32, k int) float64 {
+	if len(seeds) == 0 || k <= 0 {
+		return -1
+	}
+	if k > len(seeds) {
+		k = len(seeds)
+	}
+	top := make([]float64, k)
+	for i := range top {
+		top[i] = -1
+	}
+	for _, seed := range seeds {
+		candidate := cosine(vec, seed)
+		for i := range top {
+			if candidate > top[i] {
+				candidate, top[i] = top[i], candidate
+			}
+		}
+	}
+	var sum float64
+	for _, similarity := range top {
+		sum += similarity
+	}
+	return sum / float64(k)
+}

cmd/mavend/personalboundary_test.go

@@ -2,13 +2,230 @@ package main
 
 import (
 	"context"
+	"math"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/kami/maven/internal/router"
 )
 
+func TestPersonalBoundaryLinearHeadSeparatesSemanticDirections(t *testing.T) {
+	personal := [][]float32{{1, 0}, {0.9, 0.1}, {0.8, -0.1}}
+	world := [][]float32{{-1, 0}, {-0.9, 0.1}, {-0.8, -0.1}}
+	head, ok := trainPersonalBoundaryLinearHead(personal, world)
+	if !ok {
+		t.Fatal("valid training vectors were rejected")
+	}
+	b := personalBoundary{personal: personal, world: world, head: head, loaded: true}
+	for _, tc := range []struct {
+		vector   []float32
+		personal bool
+	}{
+		{vector: []float32{0.75, 0.2}, personal: true},
+		{vector: []float32{-0.75, 0.2}, personal: false},
+	} {
+		personalScore, worldScore, ok := b.score(tc.vector)
+		if !ok {
+			t.Fatal("loaded boundary did not score")
+		}
+		if got := personalScore > worldScore; got != tc.personal {
+			t.Fatalf("vector %v classified personal=%v (scores %.4f/%.4f), want %v",
+				tc.vector, got, personalScore, worldScore, tc.personal)
+		}
+		if math.Abs(personalScore+worldScore-1) > 1e-12 {
+			t.Fatalf("scores %.8f and %.8f are not complementary probabilities", personalScore, worldScore)
+		}
+	}
+}
+
+func TestPersonalBoundaryTrainingBalancesClasses(t *testing.T) {
+	personal := [][]float32{{1, 0}, {0.8, 0.2}}
+	world := [][]float32{{-1, 0}}
+	oneWorld, ok := trainPersonalBoundaryLinearHead(personal, world)
+	if !ok {
+		t.Fatal("valid training vectors were rejected")
+	}
+	repeatedWorld := make([][]float32, 12)
+	for i := range repeatedWorld {
+		repeatedWorld[i] = world[0]
+	}
+	twelveWorld, ok := trainPersonalBoundaryLinearHead(personal, repeatedWorld)
+	if !ok {
+		t.Fatal("valid repeated training vectors were rejected")
+	}
+	if math.Abs(oneWorld.bias-twelveWorld.bias) > 1e-10 {
+		t.Fatalf("duplicating one class moved bias from %.12f to %.12f", oneWorld.bias, twelveWorld.bias)
+	}
+	for i := range oneWorld.weights {
+		if math.Abs(oneWorld.weights[i]-twelveWorld.weights[i]) > 1e-10 {
+			t.Fatalf("duplicating one class moved weight %d from %.12f to %.12f",
+				i, oneWorld.weights[i], twelveWorld.weights[i])
+		}
+	}
+}
+
+func TestPersonalBoundaryTrainingRejectsMixedDimensions(t *testing.T) {
+	if _, ok := trainPersonalBoundaryLinearHead(
+		[][]float32{{1, 0}},
+		[][]float32{{-1, 0, 0}},
+	); ok {
+		t.Fatal("mixed embedding dimensions were accepted")
+	}
+}
+
+// The corpus is grouped by sentence shape in personalboundary.go. This test
+// leaves one entire shape out of training at a time, then requires the linear
+// head to classify the omitted examples from the semantics learned from the
+// other shapes. It is ordinary deterministic CI: the small axis vectors stand
+// in for frozen embedding directions, so the test proves the training code
+// generalises across groups rather than memorising one row at a time.
+func TestPersonalBoundaryLinearHeadLeaveOneShapeOut(t *testing.T) {
+	type example struct {
+		vector []float32
+		shape  int
+		want   bool
+	}
+	const shapeCount = 6
+	examples := make([]example, 0, shapeCount*4)
+	for shape := 0; shape < shapeCount; shape++ {
+		for variant := 0; variant < 2; variant++ {
+			personal := make([]float32, shapeCount+1)
+			world := make([]float32, shapeCount+1)
+			personal[0], world[0] = 1, -1
+			personal[shape+1] = float32(0.1 * float64(variant+1))
+			world[shape+1] = float32(-0.1 * float64(variant+1))
+			examples = append(examples,
+				example{vector: personal, shape: shape, want: true},
+				example{vector: world, shape: shape, want: false},
+			)
+		}
+	}
+
+	for omitted := 0; omitted < shapeCount; omitted++ {
+		var personal, world [][]float32
+		for _, example := range examples {
+			if example.shape == omitted {
+				continue
+			}
+			if example.want {
+				personal = append(personal, example.vector)
+			} else {
+				world = append(world, example.vector)
+			}
+		}
+		head, ok := trainPersonalBoundaryLinearHead(personal, world)
+		if !ok {
+			t.Fatalf("fold %d rejected valid vectors", omitted)
+		}
+		for _, example := range examples {
+			if example.shape != omitted {
+				continue
+			}
+			if got := head.logit(example.vector) > 0; got != example.want {
+				t.Errorf("fold %d classified %v as personal=%v, want %v", omitted, example.vector, got, example.want)
+			}
+		}
+	}
+}
+
+func TestPersonalBoundaryTrainingCorpusIsIndependent(t *testing.T) {
+	// The strict stratified fixture already enforces this for its 72 rows. The
+	// historical regression table lives here, so protect it here too: a future
+	// seed addition must not copy a regression sentence into training.
+	training := make(map[string]bool, len(personalSeeds)+len(worldSeeds))
+	for _, seed := range append(append([]string(nil), personalSeeds...), worldSeeds...) {
+		training[normalizePersonalBoundaryTraining(seed)] = true
+	}
+	for _, regression := range []string{
+		"что я говорил про бэкапы?",
+		"что я сказал вчера про отпуск",
+		"я писал что-нибудь про сервер",
+		"я упоминал про конференцию?",
+		"что я отмечал по поводу переезда",
+		"я рассказывал тебе про новую работу?",
+		"во сколько у меня встреча",
+		"когда мой следующий отпуск",
+		"what did i say about backups",
+		"did i tell you about the doctor",
+		"как я говорил, почему небо синее",
+		"как уже я говорил, какая столица франции",
+		"почему трава зелёная",
+		"столица франции",
+		"как мне сварить борщ",
+		"что мне посмотреть вечером",
+		"я хочу узнать про рим",
+		"кто такой гагарин",
+		"how do i boil an egg",
+		"во сколько закат сегодня",
+		"когда сегодня заканчивается концерт",
+		"во сколько завтра открывается аптека",
+		"какой сегодня праздник",
+		"что интересного произошло сегодня в мире",
+		"кто выиграл вчера матч",
+		"расскажи про эверест",
+		"расскажи про войну 1812 года",
+		"объясни что такое инфляция",
+		"я рассказывал тебе про байкал?",
+	} {
+		if training[normalizePersonalBoundaryTraining(regression)] {
+			t.Errorf("regression utterance leaked into training: %q", regression)
+		}
+	}
+}
+
+func TestPersonalBoundaryFrozenHeadDecodes(t *testing.T) {
+	head, ok := frozenPersonalBoundaryHead()
+	if !ok {
+		t.Fatal("frozen head did not decode")
+	}
+	if len(head.weights) != 384 {
+		t.Fatalf("frozen head has %d weights, want 384", len(head.weights))
+	}
+}
+
+func TestPersonalBoundaryHashFloorFitsAndScores(t *testing.T) {
+	b := &personalBoundary{}
+	embedder := router.NewHashEmbedder(1024)
+	query, err := router.EmbedQuery(context.Background(), embedder, "когда моя встреча")
+	if err != nil {
+		t.Fatal(err)
+	}
+	b.load(context.Background(), embedder)
+	if _, _, ok := b.score(query); !ok {
+		t.Fatal("hash-floor boundary declined to score")
+	}
+	if len(b.head.weights) != 1024 {
+		t.Fatalf("hash-floor boundary has %d weights, want 1024", len(b.head.weights))
+	}
+}
+
+// BenchmarkPersonalBoundaryHashFloorFitAndScore keeps startup cost measurable
+// without making ambient CI load a correctness condition. In particular,
+// -race and coverage instrumentation both multiply the cost of this numeric
+// training loop; the functional test above is the deterministic gate.
+func BenchmarkPersonalBoundaryHashFloorFitAndScore(b *testing.B) {
+	embedder := router.NewHashEmbedder(1024)
+	query, err := router.EmbedQuery(context.Background(), embedder, "когда моя встреча")
+	if err != nil {
+		b.Fatal(err)
+	}
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		boundary := &personalBoundary{}
+		boundary.load(context.Background(), embedder)
+		if _, _, ok := boundary.score(query); !ok {
+			b.Fatal("hash-floor boundary declined to score")
+		}
+	}
+}
+
+func normalizePersonalBoundaryTraining(value string) string {
+	return strings.Join(strings.Fields(strings.ToLower(value)), " ")
+}
+
 // A handler with no embedder never loads the seeds, so the boundary falls back
 // to the possession markers. That is the offline floor and it must keep working
 // — an embedder that fails to load must not open the boundary.
@@ -113,3 +330,419 @@ func TestONNXPersonalBoundary(t *testing.T) {
 	}
 	t.Logf("personal boundary: %d/%d held-out utterances correct", len(cases)-wrong, len(cases))
 }
+
+func TestONNXPersonalBoundaryFourFold(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+	ctx := context.Background()
+	embedAll := func(values []string) [][]float32 {
+		vectors := make([][]float32, len(values))
+		for i, value := range values {
+			vector, err := router.EmbedQuery(ctx, emb, value)
+			if err != nil {
+				t.Fatalf("embed %q: %v", value, err)
+			}
+			vectors[i] = vector
+		}
+		return vectors
+	}
+	personalVectors := embedAll(personalSeeds)
+	worldVectors := embedAll(worldSeeds)
+
+	type group struct {
+		name                         string
+		personalStart, personalCount int
+		worldStart, worldCount       int
+	}
+	groups := []group{
+		{name: "remembered_speech", personalStart: 8, personalCount: 8, worldStart: 20, worldCount: 8},
+		{name: "possession", personalStart: 16, personalCount: 10, worldStart: 28, worldCount: 12},
+		{name: "narrative", personalStart: 26, personalCount: 8, worldStart: 40, worldCount: 8},
+		{name: "first_person_preamble", personalStart: 34, personalCount: 8, worldStart: 48, worldCount: 8},
+		{name: "advice_current_info", personalStart: 42, personalCount: 8, worldStart: 56, worldCount: 8},
+		{name: "public_proper_nouns", personalStart: 50, personalCount: 10, worldStart: 64, worldCount: 8},
+	}
+
+	const foldCount = 4
+	aggregateCorrect, aggregateTotal := 0, 0
+	for omittedFold := 0; omittedFold < foldCount; omittedFold++ {
+		trainingPersonal := append([][]float32(nil), personalVectors[:8]...)
+		trainingWorld := append([][]float32(nil), worldVectors[:20]...)
+		var heldPersonal, heldWorld [][]float32
+		partition := func(vectors [][]float32, start, count int, training, held *[][]float32) {
+			for relative, vector := range vectors[start : start+count] {
+				if relative%foldCount == omittedFold {
+					*held = append(*held, vector)
+				} else {
+					*training = append(*training, vector)
+				}
+			}
+		}
+		for _, group := range groups {
+			partition(personalVectors, group.personalStart, group.personalCount, &trainingPersonal, &heldPersonal)
+			partition(worldVectors, group.worldStart, group.worldCount, &trainingWorld, &heldWorld)
+		}
+		head, ok := trainPersonalBoundaryLinearHead(
+			trainingPersonal,
+			trainingWorld,
+		)
+		if !ok {
+			t.Fatalf("fold %d: valid training fold rejected", omittedFold)
+		}
+		correct, total := 0, 0
+		for _, vector := range heldPersonal {
+			total++
+			if head.logit(vector) > 0 {
+				correct++
+			}
+		}
+		for _, vector := range heldWorld {
+			total++
+			if head.logit(vector) <= 0 {
+				correct++
+			}
+		}
+		t.Logf("fold %d: %d/%d held-out training examples", omittedFold+1, correct, total)
+		aggregateCorrect += correct
+		aggregateTotal += total
+	}
+	t.Logf("four-fold aggregate: %d/%d", aggregateCorrect, aggregateTotal)
+	if aggregateCorrect < 99 {
+		t.Errorf("four-fold aggregate %d/%d, want at least 99/104", aggregateCorrect, aggregateTotal)
+	}
+}
+
+func TestONNXPersonalBoundarySemanticGroupHoldout(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+	ctx := context.Background()
+	embedAll := func(values []string) [][]float32 {
+		vectors := make([][]float32, len(values))
+		for i, value := range values {
+			vector, err := router.EmbedQuery(ctx, emb, value)
+			if err != nil {
+				t.Fatalf("embed %q: %v", value, err)
+			}
+			vectors[i] = vector
+		}
+		return vectors
+	}
+	personalVectors := embedAll(personalSeeds)
+	worldVectors := embedAll(worldSeeds)
+
+	type group struct {
+		name                         string
+		personalStart, personalCount int
+		worldStart, worldCount       int
+	}
+	groups := []group{
+		{name: "remembered_speech", personalStart: 8, personalCount: 8, worldStart: 20, worldCount: 8},
+		{name: "possession", personalStart: 16, personalCount: 10, worldStart: 28, worldCount: 12},
+		{name: "narrative", personalStart: 26, personalCount: 8, worldStart: 40, worldCount: 8},
+		{name: "first_person_preamble", personalStart: 34, personalCount: 8, worldStart: 48, worldCount: 8},
+		{name: "advice_current_info", personalStart: 42, personalCount: 8, worldStart: 56, worldCount: 8},
+		{name: "public_proper_nouns", personalStart: 50, personalCount: 10, worldStart: 64, worldCount: 8},
+	}
+
+	aggregateCorrect, aggregateTotal := 0, 0
+	for _, omitted := range groups {
+		excluding := func(vectors [][]float32, start, count int) [][]float32 {
+			result := make([][]float32, 0, len(vectors)-count)
+			result = append(result, vectors[:start]...)
+			return append(result, vectors[start+count:]...)
+		}
+		head, ok := trainPersonalBoundaryLinearHead(
+			excluding(personalVectors, omitted.personalStart, omitted.personalCount),
+			excluding(worldVectors, omitted.worldStart, omitted.worldCount),
+		)
+		if !ok {
+			t.Fatalf("%s: valid training fold rejected", omitted.name)
+		}
+		correct, total := 0, 0
+		for _, vector := range personalVectors[omitted.personalStart : omitted.personalStart+omitted.personalCount] {
+			total++
+			if head.logit(vector) > 0 {
+				correct++
+			}
+		}
+		for _, vector := range worldVectors[omitted.worldStart : omitted.worldStart+omitted.worldCount] {
+			total++
+			if head.logit(vector) <= 0 {
+				correct++
+			}
+		}
+		t.Logf("leave %-21s out: %d/%d", omitted.name, correct, total)
+		aggregateCorrect += correct
+		aggregateTotal += total
+		// Whole-shape holdout is an honest diagnostic, not a 100% release gate:
+		// some shapes (notably private-vs-general possession) define a distinct
+		// semantic ambiguity. The separately authored challenge set remains the
+		// strict generalisation gate.
+	}
+	if aggregateCorrect < 92 {
+		t.Errorf("whole-shape aggregate %d/%d, want at least 92/104", aggregateCorrect, aggregateTotal)
+	}
+}
+
+// This challenge set was originally authored after the six-shape training
+// corpus and the 72-case matrix were frozen. Its sole miss then informed the
+// regularisation comparison, so it is now a strict regression gate rather than
+// independent evidence. It remains outside the production corpus.
+func TestONNXPersonalBoundaryChallenge(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+
+	cases := []struct {
+		utterance string
+		personal  bool
+	}{
+		{"какой пароль приложения я задал для почтового клиента?", true},
+		{"на каком порту я решил поднять тестовый сервис?", true},
+		{"какую причину я указал, когда отменил бронь?", true},
+		{"где в гараже я сложил зимние шины?", true},
+		{"какой сериал я бросил после второго сезона?", true},
+		{"о чём мы договорились с Олегом на прошлой неделе?", true},
+		{"почему мой монитор мерцает при частоте 144 герца?", false},
+		{"подойдёт ли кабель Thunderbolt 3 к разъёму USB4?", false},
+		{"как вывести запах дыма из моей куртки?", false},
+		{"что означают кольца на флаге Олимпиады?", false},
+		{"почему после дождя на асфальте видна радуга?", false},
+		{"какой формат файлов поддерживает Kindle Paperwhite?", false},
+		{"which SSH key did I install on the build server?", true},
+		{"what spending limit did I set for the travel card?", true},
+		{"where did I store the spare apartment fob?", true},
+		{"which objection did I raise during the design review?", true},
+		{"what route did I plan for the Sunday hike?", true},
+		{"when did I promise Maya I would send the draft?", true},
+		{"why does my mechanical keyboard sometimes chatter?", false},
+		{"can my USB-C charger safely power a Steam Deck?", false},
+		{"how do I stop condensation inside my camera lens?", false},
+		{"what caused the Tacoma Narrows Bridge to collapse?", false},
+		{"why are some auroras red instead of green?", false},
+		{"which codecs does the current Firefox release support?", false},
+	}
+
+	b := &personalBoundary{}
+	b.load(context.Background(), emb)
+	correct := 0
+	minimumMargin := math.Inf(1)
+	for _, testCase := range cases {
+		vector, err := router.EmbedQuery(context.Background(), emb, testCase.utterance)
+		if err != nil {
+			t.Fatalf("embed %q: %v", testCase.utterance, err)
+		}
+		personal, world, ok := b.score(vector)
+		if !ok {
+			t.Fatal("loaded boundary declined to score")
+		}
+		got := personal > world
+		signedMargin := personal - world
+		if !testCase.personal {
+			signedMargin = -signedMargin
+		}
+		if signedMargin < minimumMargin {
+			minimumMargin = signedMargin
+		}
+		if got == testCase.personal {
+			correct++
+		} else {
+			t.Logf("miss %q: personal=%v want %v (%.4f/%.4f)", testCase.utterance, got, testCase.personal, personal, world)
+		}
+	}
+	t.Logf("regularisation challenge: %d/%d, minimum signed margin %+.4f", correct, len(cases), minimumMargin)
+	if correct != len(cases) {
+		t.Errorf("regularisation challenge %d/%d, want every case correct", correct, len(cases))
+	}
+}
+
+// TestONNXPersonalBoundaryPostRetuneChallenge was authored only after the L2
+// coefficient and frozen head had been selected using corpus cross-validation.
+// It deliberately returns to private configuration, commitments and stored
+// choices with new objects, and contrasts them with public technical facts,
+// compatibility and maintenance. No result from this table may be used to
+// tune the current head; a miss is evidence for the next independently
+// evaluated model revision.
+func TestONNXPersonalBoundaryPostRetuneChallenge(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+
+	cases := []struct {
+		utterance string
+		personal  bool
+	}{
+		{"какое имя я выбрал для гостевой сети Wi-Fi?", true},
+		{"на какой день я перенёс техосмотр машины?", true},
+		{"какую сумму мы с Мариной согласовали за ремонт кухни?", true},
+		{"где я сохранил резервные коды от GitHub?", true},
+		{"какой из макетов визитки я одобрил?", true},
+		{"что я решил делать со страховкой перед поездкой?", true},
+		{"какой диапазон частот использует Wi-Fi 6E?", false},
+		{"почему OLED-экраны со временем выгорают?", false},
+		{"можно ли подключить монитор DisplayPort к Thunderbolt 4?", false},
+		{"чем безопасно чистить замшевые ботинки?", false},
+		{"когда появился протокол WebSocket?", false},
+		{"почему соль ускоряет таяние льда?", false},
+		{"which hostname did I assign to the home NAS?", true},
+		{"what date did I move the annual checkup to?", true},
+		{"where did I save the recovery phrase for the hardware wallet?", true},
+		{"which catering quote did we accept for the party?", true},
+		{"what did I decide about renewing the domain?", true},
+		{"which paint sample did I approve for the hallway?", true},
+		{"does Wi-Fi 7 work with older wireless clients?", false},
+		{"why can an SSD slow down when it is nearly full?", false},
+		{"how should suede shoes be cleaned?", false},
+		{"when was the WebSocket protocol standardized?", false},
+		{"what does a hardware-wallet recovery phrase do?", false},
+		{"why does road salt damage concrete?", false},
+	}
+
+	b := &personalBoundary{}
+	b.load(context.Background(), emb)
+	correct := 0
+	minimumMargin := math.Inf(1)
+	for _, testCase := range cases {
+		vector, err := router.EmbedQuery(context.Background(), emb, testCase.utterance)
+		if err != nil {
+			t.Fatalf("embed %q: %v", testCase.utterance, err)
+		}
+		personal, world, ok := b.score(vector)
+		if !ok {
+			t.Fatal("loaded boundary declined to score")
+		}
+		got := personal > world
+		signedMargin := personal - world
+		if !testCase.personal {
+			signedMargin = -signedMargin
+		}
+		if signedMargin < minimumMargin {
+			minimumMargin = signedMargin
+		}
+		if got == testCase.personal {
+			correct++
+		} else {
+			t.Logf("miss %q: personal=%v want %v (%.4f/%.4f)", testCase.utterance, got, testCase.personal, personal, world)
+		}
+	}
+	t.Logf("post-retune challenge: %d/%d, minimum signed margin %+.4f", correct, len(cases), minimumMargin)
+	if correct != len(cases) {
+		t.Errorf("post-retune challenge %d/%d, want every case correct", correct, len(cases))
+	}
+}
+
+func TestONNXPersonalBoundaryLatency(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+	ctx := context.Background()
+	query, err := router.EmbedQuery(ctx, emb, "что я решил насчёт переезда?")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	b := &personalBoundary{}
+	coldStart := time.Now()
+	b.load(ctx, emb)
+	if _, _, ok := b.score(query); !ok {
+		t.Fatal("loaded boundary declined to score")
+	}
+	cold := time.Since(coldStart)
+
+	const iterations = 100000
+	steadyStart := time.Now()
+	for i := 0; i < iterations; i++ {
+		if _, _, ok := b.score(query); !ok {
+			t.Fatal("loaded boundary declined to score")
+		}
+	}
+	steady := time.Since(steadyStart) / iterations
+	t.Logf("boundary cold load+train+score: %s; steady score: %s/op", cold, steady)
+	// This is a user-visible first-turn path. Keep a generous ceiling to avoid
+	// noisy CI while making an accidental per-turn training/load regression
+	// unmistakable.
+	if cold > 5*time.Second {
+		t.Errorf("cold boundary load %s exceeds 5s local usability ceiling", cold)
+	}
+	if steady > 100*time.Microsecond {
+		t.Errorf("steady boundary score %s exceeds 100µs ceiling", steady)
+	}
+}
+
+func TestONNXPersonalBoundaryFrozenHeadMatchesCorpusFit(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+	ctx := context.Background()
+	embedAll := func(values []string) [][]float32 {
+		vectors := make([][]float32, len(values))
+		for i, value := range values {
+			vector, err := router.EmbedQuery(ctx, emb, value)
+			if err != nil {
+				t.Fatalf("embed %q: %v", value, err)
+			}
+			vectors[i] = vector
+		}
+		return vectors
+	}
+	fitted, ok := trainPersonalBoundaryLinearHead(embedAll(personalSeeds), embedAll(worldSeeds))
+	if !ok {
+		t.Fatal("corpus fit failed")
+	}
+	frozen, ok := frozenPersonalBoundaryHead()
+	if !ok {
+		t.Fatal("frozen head did not decode")
+	}
+	if math.Abs(fitted.bias-frozen.bias) > 1e-9 {
+		t.Fatalf("frozen bias %.12f != fitted %.12f", frozen.bias, fitted.bias)
+	}
+	for i := range fitted.weights {
+		if math.Abs(fitted.weights[i]-frozen.weights[i]) > 5e-7 {
+			t.Fatalf("frozen weight %d %.12f != fitted %.12f", i, frozen.weights[i], fitted.weights[i])
+		}
+	}
+}

cmd/mavend/query_recall_test.go

@@ -193,9 +193,9 @@ func TestQueryRecallNoteCanWin(t *testing.T) {
 	t.Run("the better-matching fact answers", func(t *testing.T) {
 		h, _ := buildRecallHandler(t, q, []recallCase{
 			{text: "молоко стоит в холодильнике", score: 0.80, kind: "note"},
-			{text: "купил молоко в среду", score: 0.95, kind: "fact"},
+			{text: "молоко было в холодильнике в среду", score: 0.95, kind: "fact"},
 		})
-		if reply := askQuery(t, h, q); reply != "купил молоко в среду" {
+		if reply := askQuery(t, h, q); reply != "молоко было в холодильнике в среду" {
 			t.Errorf("reply %q, want the fact read back", reply)
 		}
 	})
@@ -212,3 +212,63 @@ func TestQueryRecallNoteCanWin(t *testing.T) {
 		}
 	})
 }
+
+// TestQueryRecallRequiresStructuralOrTopicEvidence — the whole-assistant
+// cold-start regression. The routing heads called an ordinary past-tense
+// report a query; with one note in the store the margin gate has no runner-up,
+// and cosine 0.825 was enough to speak a completely unrelated spare-key note.
+// A bare question mark does not turn the proposition into an open information
+// question, negation must not weaken the refusal, and a locative question must
+// corroborate the target it asks Maven to locate (V-719).
+func TestQueryRecallRequiresStructuralOrTopicEvidence(t *testing.T) {
+	const unrelated = "запомни: запасной ключ лежит в синей коробке"
+	for _, tc := range []struct {
+		query string
+		score float64
+	}{
+		{"я отменил напоминание про молоко", 0.825031306},
+		{"я отменил напоминание про молоко?", 0.825031306},
+		{"я не отменил напоминание про молоко", 0.825031306},
+		{"я не отменил напоминание про молоко?", 0.825031306},
+		{"где мой паспорт?", 0.817210},
+		{"где я отменил напоминание про молоко?", 0.805800},
+		{"где лежит синяя рубашка?", 0.837694},
+		{"где лежит синяя папка?", 0.837472},
+		{"где мой запасной паспорт?", 0.831662},
+		{"где лежит запасная флешка?", 0.838980},
+		{"где находится синяя коробка с документами?", 0.866553},
+		{"где лежит ключ от машины?", 0.843853},
+		{"где синяя коробка?", 0.90},
+	} {
+		t.Run(tc.query, func(t *testing.T) {
+			h, phr := buildRecallHandler(t, tc.query, []recallCase{
+				{text: unrelated, score: tc.score, kind: "note"},
+			})
+			reply := askQuery(t, h, tc.query)
+			if strings.Contains(reply, "запасной ключ") {
+				t.Fatalf("unrelated note escaped into reply %q", reply)
+			}
+			if len(phr.notes) != 0 {
+				t.Fatalf("unrelated note reached the phraser: %q", phr.notes)
+			}
+		})
+	}
+
+	// Voice punctuation is optional. A nominal request with no interrogative
+	// still works when the candidate itself corroborates the named topic.
+	const nominal = "адрес домашнего сервера"
+	h, _ := buildRecallHandler(t, nominal, []recallCase{
+		{text: "домашний сервер на 192.168.1.104", score: 0.90, kind: "note"},
+	})
+	if reply := askQuery(t, h, nominal); !strings.Contains(reply, "домашний сервер") {
+		t.Fatalf("nominal recall lost its shared-topic answer: %q", reply)
+	}
+
+	const locative = "где лежит запасной ключ?"
+	h, _ = buildRecallHandler(t, locative, []recallCase{
+		{text: "запасной ключ лежит в синей коробке", score: 0.90, kind: "note"},
+	})
+	if reply := askQuery(t, h, locative); !strings.Contains(reply, "запасной ключ") {
+		t.Fatalf("locative recall lost its corroborated target: %q", reply)
+	}
+}

cmd/mavend/reactive_notes_test.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/kami/maven/internal/ipc"
 	"github.com/kami/maven/internal/memory"
+	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/store"
 	"github.com/kami/maven/internal/tool"
@@ -84,12 +85,76 @@ func TestReactiveNotesReminders(t *testing.T) {
 			t.Fatal("expected at least one note, got none")
 		}
 		last := notes[0]
-		if last.Text != "запомни что кофе закончился" {
-			t.Errorf("note text = %q, want %q", last.Text, "запомни что кофе закончился")
+		if last.Text != "кофе закончился" {
+			t.Errorf("note text = %q, want %q", last.Text, "кофе закончился")
 		}
 	})
 }
 
+// TestRunTurnExplicitNoteStoresOnlyTheBody pins the live failure end to end:
+// a routed text turn reaches actionNote, stores only the dictated body in both
+// durable and vector memory, and cannot ask the resident model to choose the
+// acknowledgement's grammatical gender (V-721).
+func TestRunTurnExplicitNoteStoresOnlyTheBody(t *testing.T) {
+	ctx := context.Background()
+	st := newTestStore(t)
+	api := ipc.NewStoreAPI(st)
+	now := time.Date(2026, 8, 15, 8, 0, 0, 0, time.FixedZone("+04", 4*60*60))
+	emb := router.NewHashEmbedder(1024)
+	mem := memory.NewInMemoryStore()
+	rtr := router.New(router.Config{
+		Grammars: []router.Grammar{{
+			Name: "explicit-note-test",
+			Decide: func(string) (router.Decision, bool) {
+				return router.Decision{
+					Stage: 0, Intent: router.IntentNote, Confidence: 1,
+					// Deliberately hostile model slot: neither persistence nor
+					// acknowledgement may use it.
+					Slots: router.Slots{Text: "ты поедешь на дачу"},
+				}, true
+			},
+		}},
+		Threshold: 0.55,
+	})
+	model := &countingCompleter{out: `{"response":"Хорошо, сохранил.","mood":"neutral"}`}
+	h := &reactiveHandler{
+		api: api, router: rtr,
+		recall:    recallWiring{embedder: emb, memStore: mem},
+		replier:   newLLMReplier(model, nil),
+		now:       func() time.Time { return now },
+		dataStore: st,
+	}
+
+	const utterance = "запомни: запасной ключ лежит в синей коробке"
+	if reply := h.runTurn(ctx, utterance, sourceText); reply != "сохранила заметку." {
+		t.Fatalf("reply = %q, want the fixed feminine acknowledgement", reply)
+	}
+	if model.calls != 0 {
+		t.Fatalf("resident model was called %d time(s) for a note acknowledgement", model.calls)
+	}
+	notes, err := st.RecentNotes(ctx, 10)
+	if err != nil {
+		t.Fatalf("RecentNotes: %v", err)
+	}
+	const body = "запасной ключ лежит в синей коробке"
+	if len(notes) != 1 || notes[0].Text != body || notes[0].Source != "tap:voice" || !notes[0].Ts.Equal(now) {
+		t.Fatalf("stored notes = %+v, want one exact body at the turn time", notes)
+	}
+	records, err := mem.ByPrefix(ctx, "note:")
+	if err != nil {
+		t.Fatalf("vector catalog: %v", err)
+	}
+	if len(records) != 1 || records[0].Meta["text"] != body {
+		t.Fatalf("vector records = %+v, want the same extracted body", records)
+	}
+	if records[0].Meta["text"] == utterance || records[0].Meta["text"] == "ты поедешь на дачу" {
+		t.Fatalf("vector metadata used a command or model rewrite: %+v", records[0].Meta)
+	}
+	if !phraser.IsAck(phraser.AckNote, nil, "сохранила заметку.") {
+		t.Fatal("fixed acknowledgement is not registered as the note acknowledgement")
+	}
+}
+
 // TestSpokenTaskCaptureFilesATask — the whole path, from the utterance to the
 // task table. It went dead when the router started claiming the marker as an
 // act: capture rides the note intent, so nothing below actionNote was ever

cmd/mavend/recall.go

@@ -56,7 +56,7 @@ type recallWiring struct {
 	// minScore — the note-recall confidence gate. Top cosine below this ⇒
 	// "I don't know" instead of a guess. Tuned for the ONNX embedder; a knob,
 	// not load-bearing math (same posture as the presence thresholds). Set by
-	// wireVoice from VoiceConfig; default 0.55.
+	// wireVoice from VoiceConfig; default 0.80.
 	minScore float64
 
 	// minMargin — the second half of that gate: how far the top hit must beat

cmd/mavend/reminder_cancel.go

@@ -0,0 +1,383 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/lexicon"
+	"github.com/kami/maven/internal/morph"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/store"
+)
+
+// reminderCancelRequest exists to make the parser's contract explicit: a hit
+// proves only that the turn is an addressed imperative naming the reminder
+// store. Subject and time are resolved separately after that safety boundary.
+type reminderCancelRequest struct{}
+
+var reminderCancelVerbs = func() map[string]bool {
+	out := make(map[string]bool)
+	for _, word := range lexicon.ReminderCancelVerbs() {
+		out[strings.ToLower(word)] = true
+	}
+	return out
+}()
+
+var reminderCancelFrame = func() map[string]bool {
+	out := make(map[string]bool)
+	for _, word := range lexicon.ReminderCancelFrame() {
+		out[strings.ToLower(word)] = true
+	}
+	return out
+}()
+
+// isReminderCancelTarget is deliberately a noun test, not a substring test.
+// A committed reminder must be named, otherwise "убери со стола" would reach
+// the reminder store. Russian cases are grammar and go through morph; the
+// English singular/plural forms are closed command vocabulary.
+func isReminderCancelTarget(tok string) bool {
+	if morph.SameWord(tok, "напоминание") || morph.SameWord(tok, "будильник") {
+		return true
+	}
+	switch tok {
+	case "reminder", "reminders", "alarm", "alarms":
+		return true
+	default:
+		return false
+	}
+}
+
+// reminderCancelLead reports which words may precede the imperative without
+// becoming a subject of their own. Filler/politeness vocabulary already has
+// one home in the lexicon; Maven's name is an address, not a Russian class.
+func reminderCancelLead(tok string) bool {
+	return lexicon.IsFillerParticle(tok) || tok == "мавен" || tok == "maven"
+}
+
+// parseReminderCancelRequest recognizes an exact cancel imperative at the
+// start of the addressed command plus an explicit reminder noun. Both are
+// whole tokens. Requiring command position is the safety boundary: infinitive
+// questions ("как отменить ..."), reported speech ("он сказал: отмени ...")
+// and past-tense remarks never reach the reminder store. A relative clause
+// after a real command remains valid even though it may contain a question
+// pronoun, so this is stronger and more precise than a punctuation test.
+func parseReminderCancelRequest(text string) (reminderCancelRequest, bool) {
+	tokens := turnTokens(text)
+	verbAt := -1
+	for i, tok := range tokens {
+		if reminderCancelVerbs[tok] {
+			verbAt = i
+			break
+		}
+	}
+	if verbAt < 0 {
+		return reminderCancelRequest{}, false
+	}
+	for _, tok := range tokens[:verbAt] {
+		if !reminderCancelLead(tok) {
+			return reminderCancelRequest{}, false
+		}
+	}
+	for _, tok := range tokens[verbAt+1:] {
+		if isReminderCancelTarget(tok) {
+			return reminderCancelRequest{}, true
+		}
+	}
+	return reminderCancelRequest{}, false
+}
+
+func reminderCancelNegation(tok string) bool {
+	switch tok {
+	case "не", "ни", "not", "no", "don't", "dont":
+		return true
+	default:
+		return false
+	}
+}
+
+func reminderCancelTimeLead(tok string) bool {
+	switch tok {
+	case "в", "во", "на", "к", "ко", "через", "спустя",
+		"at", "in", "by", "until", "after", "before":
+		return true
+	default:
+		return false
+	}
+}
+
+func reminderCancelTimeUnit(tok string) bool {
+	if lexicon.IsHourUnit(tok) || lexicon.IsMinuteUnit(tok) {
+		return true
+	}
+	for _, part := range lexicon.PartsOfDay() {
+		if tok == part {
+			return true
+		}
+	}
+	return tok == "утра" || tok == "дня" || tok == "вечера" || tok == "ночи" ||
+		tok == "am" || tok == "pm" || tok == "noon" || tok == "midnight"
+}
+
+func reminderCancelNumeral(tok string) (int, bool) {
+	if n, ok := lexicon.Cardinal(tok); ok {
+		return n, true
+	}
+	if n, ok := lexicon.Ordinal(tok); ok && n > 0 {
+		return n, true
+	}
+	n, err := strconv.Atoi(tok)
+	return n, err == nil
+}
+
+// reminderClockTokenBudget records the numeric pieces that came from a written
+// clock. turnTokens deliberately splits 21:30 into 21 and 30, so a small
+// multiset lets subject extraction ignore exactly those occurrences without
+// discarding the same number when it also belongs to the reminder text.
+func reminderClockTokenBudget(text string) map[string]int {
+	out := make(map[string]int)
+	for _, field := range strings.Fields(strings.ToLower(text)) {
+		field = strings.Trim(field, ".,!?;()[]{}«»\"'")
+		hour, minute, ok := strings.Cut(field, ":")
+		if !ok || len(minute) != 2 {
+			continue
+		}
+		h, herr := strconv.Atoi(hour)
+		m, merr := strconv.Atoi(minute)
+		if herr != nil || merr != nil || h < 0 || h > 23 || m < 0 || m > 59 {
+			continue
+		}
+		out[hour]++
+		out[minute]++
+	}
+	return out
+}
+
+// reminderCancellationTerms keeps identity-bearing words, including negation
+// and quantities. The old ownContent shortcut erased both, so "не звонить" and
+// "звонить", or "одну таблетку" and "две таблетки", could select the same
+// row. Time framing is removed only after the shared parser proved that this
+// turn actually carries a readable time; numerals are removed only in a clock
+// position, never merely because they are numbers.
+func reminderCancellationTerms(text string, hasTime bool) []string {
+	tokens := turnTokens(text)
+	clockBudget := reminderClockTokenBudget(text)
+	out := make([]string, 0, len(tokens))
+	for i, tok := range tokens {
+		if reminderCancelVerbs[tok] || isReminderCancelTarget(tok) ||
+			reminderCancelFrame[tok] || lexicon.IsFillerParticle(tok) {
+			continue
+		}
+		if !hasTime || reminderCancelNegation(tok) {
+			out = append(out, tok)
+			continue
+		}
+		if clockBudget[tok] > 0 {
+			clockBudget[tok]--
+			continue
+		}
+		if _, numeric := reminderCancelNumeral(tok); numeric {
+			prevTime := i > 0 && reminderCancelTimeLead(tokens[i-1])
+			nextTime := i+1 < len(tokens) && reminderCancelTimeUnit(tokens[i+1])
+			if prevTime || nextTime {
+				continue
+			}
+		}
+		// frameWords is assembled exclusively from the closed time/grammar
+		// lexicons. At this point a time was parsed, and negation has already
+		// been preserved above, so these words identify the time rather than
+		// the stored reminder body.
+		if frameWords[tok] {
+			continue
+		}
+		out = append(out, tok)
+	}
+	return out
+}
+
+// reminderCancellationTime applies the same parse and resolved-hour gate as a
+// newly created reminder. A time expression that is present but unread is not
+// silently discarded: the caller asks for a clearer time instead of cancelling
+// whichever row happens to match the remaining words.
+func (h *reactiveHandler) reminderCancellationTime(ctx context.Context, text string) (time.Time, bool) {
+	if slots := h.extractor.Extract(ctx, router.IntentReminder, text, h.now()); slots.HasTime {
+		return slots.Time, true
+	}
+	if h.timeParser == nil {
+		return time.Time{}, false
+	}
+	parsed, ok, err := h.timeParser.Parse(ctx, text, h.now())
+	if err != nil || !ok || !router.ResolvedTheHour(text, parsed) {
+		return time.Time{}, false
+	}
+	return parsed, true
+}
+
+func reminderNextFire(r ipc.Reminder) time.Time {
+	if !r.NextFireTs.IsZero() {
+		return r.NextFireTs
+	}
+	return r.FireTs
+}
+
+// reminderTimeMatches lets state disambiguate a clock when the day was not
+// named. "На девять" can therefore select the sole 09:00/21:00 reminder, but
+// if both exist they both remain candidates and Maven asks. A named day or an
+// interval denotes an absolute minute and must match that minute exactly.
+func reminderTimeMatches(text string, parsed, fire time.Time) bool {
+	local := fire.In(parsed.Location())
+	if router.NamesADay(text) || router.NamesAnInterval(text) {
+		return local.Truncate(time.Minute).Equal(parsed.Truncate(time.Minute))
+	}
+	if router.HourIsAmbiguous(text) {
+		return local.Minute() == parsed.Minute() && local.Hour()%12 == parsed.Hour()%12
+	}
+	return local.Hour() == parsed.Hour() && local.Minute() == parsed.Minute()
+}
+
+func reminderTextMatchesTerms(r ipc.Reminder, terms []string) bool {
+	if len(terms) == 0 {
+		return true
+	}
+	words := turnTokens(store.ReminderText(r.Payload))
+	used := make([]bool, len(words))
+	for _, term := range terms {
+		found := false
+		for i, word := range words {
+			if used[i] {
+				continue
+			}
+			tn, tok := reminderCancelNumeral(term)
+			wn, wok := reminderCancelNumeral(word)
+			if term == word || morph.SameWord(term, word) || (tok && wok && tn == wn) {
+				used[i] = true
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+	return true
+}
+
+func reminderCancellationLabel(r ipc.Reminder, now time.Time) string {
+	fire := reminderNextFire(r).In(now.Location())
+	when := dayPrefix(now, fire)
+	if when == "это" {
+		when = fmt.Sprintf("%d %s", fire.Day(), lexicon.MonthGenitive(int(fire.Month())))
+	}
+	return fmt.Sprintf("%s в %s — %s", when, fire.Format("15:04"), store.ReminderText(r.Payload))
+}
+
+// offerReminderCancellations binds exactly the rows Maven names, in that order.
+// An ordinal on the next turn therefore points at the spoken list, never at a
+// fresh query whose order may have changed in between.
+func (h *reactiveHandler) offerReminderCancellations(ctx context.Context, text string, matches []ipc.Reminder) string {
+	const maxSpoken = 5
+	truncated := len(matches) > maxSpoken
+	if len(matches) > maxSpoken {
+		matches = matches[:maxSpoken]
+	}
+	candidates := make([]dialogue.Candidate, 0, len(matches))
+	parts := make([]string, 0, len(matches))
+	for i, r := range matches {
+		label := reminderCancellationLabel(r, h.now())
+		candidates = append(candidates, dialogue.Candidate{Kind: "reminder-cancel", Ref: r.ID, Label: label})
+		parts = append(parts, fmt.Sprintf("%d: %s", i+1, label))
+	}
+
+	if h.dialogueSessions == nil {
+		return "нашла несколько подходящих напоминаний — уточни текст или время."
+	}
+	id, now := dialogueIDOf(ctx), h.now()
+	// This command is its own turn. Reusing an older session would keep stale
+	// intent/slots alive after the choice and let the next utterance inherit
+	// unrelated state, so the offered list gets a fresh system session.
+	h.dialogueSessions.Put(id, &dialogue.Session{
+		Intent: dialogue.IntentSystem, Utterance: text, Timestamp: now,
+		Candidates: candidates,
+	})
+	prefix := "нашла несколько подходящих. какое отменить? "
+	if truncated {
+		prefix = "нашла больше пяти подходящих; называю первые пять. если нужного здесь нет, уточни текст или время. какое отменить? "
+	}
+	return prefix + strings.Join(parts, "; ") + ". ответь одним порядковым словом, например «второе»."
+}
+
+func (h *reactiveHandler) clearReminderCandidates(ctx context.Context) {
+	if h.dialogueSessions != nil {
+		h.dialogueSessions.SetCandidates(dialogueIDOf(ctx), h.now(), nil)
+	}
+}
+
+func (h *reactiveHandler) cancelReminderChoice(ctx context.Context, id int64, label string) string {
+	if err := h.api.CancelReminder(ctx, id); err != nil {
+		switch {
+		case errors.Is(err, ipc.ErrReminderNotFound), errors.Is(err, ipc.ErrReminderState):
+			h.clearReminderCandidates(ctx)
+			return "это напоминание уже не ожидает отправки."
+		case errors.Is(err, ipc.ErrReminderInFlight):
+			h.clearReminderCandidates(ctx)
+			return "я уже начала отправлять это напоминание — надёжно отменить его уже нельзя."
+		default:
+			log.Printf("voice: cancel reminder %d: %v", id, err)
+			return "не получилось отменить напоминание."
+		}
+	}
+	h.clearReminderCandidates(ctx)
+	log.Printf("voice: cancelled reminder %d (%q)", id, label)
+	return "отменила напоминание: " + label + "."
+}
+
+// resolveReminderCancellation is the stateful pre-route resolver for a
+// committed reminder. It claims only the explicit structural command above,
+// resolves against every pending row, and never ranks an ambiguous set down to
+// one. One match cancels; more than one is an offered, ordinal-bound question.
+func (h *reactiveHandler) resolveReminderCancellation(ctx context.Context, text string) (string, bool) {
+	_, ok := parseReminderCancelRequest(text)
+	if !ok {
+		return "", false
+	}
+	rows, err := h.api.ListPendingReminders(ctx, 0)
+	if err != nil {
+		log.Printf("voice: list reminders for cancellation: %v", err)
+		return "не получилось посмотреть напоминания.", true
+	}
+	if len(rows) == 0 {
+		return "ожидающих напоминаний нет.", true
+	}
+
+	parsed, hasTime := h.reminderCancellationTime(ctx, text)
+	if router.MentionsTime(text) && !hasTime {
+		return "не смогла разобрать время напоминания — уточни его.", true
+	}
+	terms := reminderCancellationTerms(text, hasTime)
+	matches := make([]ipc.Reminder, 0, len(rows))
+	for _, r := range rows {
+		if !reminderTextMatchesTerms(r, terms) {
+			continue
+		}
+		if hasTime && !reminderTimeMatches(text, parsed, reminderNextFire(r)) {
+			continue
+		}
+		matches = append(matches, r)
+	}
+
+	switch len(matches) {
+	case 0:
+		return "не нашла такого ожидающего напоминания.", true
+	case 1:
+		label := reminderCancellationLabel(matches[0], h.now())
+		return h.cancelReminderChoice(ctx, matches[0].ID, label), true
+	default:
+		return h.offerReminderCancellations(ctx, text, matches), true
+	}
+}

cmd/mavend/reminder_cancel_test.go

@@ -0,0 +1,425 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/decision"
+	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/store"
+	"github.com/kami/maven/internal/tts"
+)
+
+func TestParseReminderCancelRequest(t *testing.T) {
+	for _, tc := range []struct {
+		text string
+		ok   bool
+	}{
+		{"отмени напоминание про врача", true},
+		{"убери моё напоминание о визите", true},
+		{"удали будильник на девять", true},
+		{"пожалуйста, Maven, cancel the reminder about doctor", true},
+		{"отмени напоминание, которое стоит на завтра", true},
+		{"напоминание про врача", false},
+		{"отмени задачу про врача", false},
+		{"я отменил напоминание про врача", false},
+		{"как отменить напоминание про врача?", false},
+		{"можно отменить напоминание про врача?", false},
+		{"он сказал: отмени напоминание про врача", false},
+		{"how to cancel the reminder about doctor?", false},
+		{"can you cancel the reminder about doctor?", false},
+		{"убери со стола", false},
+		{"отмена", false},
+	} {
+		_, ok := parseReminderCancelRequest(tc.text)
+		if ok != tc.ok {
+			t.Errorf("parseReminderCancelRequest(%q) ok = %v, want %v", tc.text, ok, tc.ok)
+		}
+	}
+}
+
+func TestReminderCancellationTermsPreserveIdentity(t *testing.T) {
+	for _, tc := range []struct {
+		text    string
+		hasTime bool
+		want    []string
+	}{
+		{"отмени напоминание про врача", false, []string{"врача"}},
+		{"отмени напоминание не звонить врачу", false, []string{"не", "звонить", "врачу"}},
+		{"отмени напоминание принять две таблетки", false, []string{"принять", "две", "таблетки"}},
+		{"отмени напоминание принять две таблетки на девять", true, []string{"принять", "две", "таблетки"}},
+		{"cancel the reminder to take 2 pills at 21:30", true, []string{"take", "2", "pills"}},
+	} {
+		got := reminderCancellationTerms(tc.text, tc.hasTime)
+		if strings.Join(got, "|") != strings.Join(tc.want, "|") {
+			t.Errorf("reminderCancellationTerms(%q) = %v, want %v", tc.text, got, tc.want)
+		}
+	}
+}
+
+func seedVoiceReminder(t *testing.T, st *store.Store, fire time.Time, text string) int64 {
+	t.Helper()
+	id, err := st.CreateReminder(context.Background(), fire, `{"text":"`+text+`"}`, "")
+	if err != nil {
+		t.Fatalf("create reminder: %v", err)
+	}
+	return id
+}
+
+func reminderStatuses(t *testing.T, st *store.Store) map[int64]string {
+	t.Helper()
+	rows, err := st.ListReminders(context.Background(), 100)
+	if err != nil {
+		t.Fatalf("list reminders: %v", err)
+	}
+	out := make(map[int64]string, len(rows))
+	for _, row := range rows {
+		out[row.ID] = row.Status
+	}
+	return out
+}
+
+func TestReminderCancellationResolvesSubjectByMorphology(t *testing.T) {
+	h, st, now := newClarifyHandler(t)
+	h.timeParser = router.StubDateTimeParser{}
+	doctor := seedVoiceReminder(t, st, now.Add(3*time.Hour), "позвонить врачу")
+	bread := seedVoiceReminder(t, st, now.Add(4*time.Hour), "купить хлеб")
+
+	reply, handled := h.resolveReminderCancellation(context.Background(), "отмени напоминание про врача")
+	if !handled || !strings.Contains(reply, "отменила") || !strings.Contains(reply, "позвонить врачу") {
+		t.Fatalf("reply = %q, handled=%v", reply, handled)
+	}
+	statuses := reminderStatuses(t, st)
+	if statuses[doctor] != store.ReminderCancelled || statuses[bread] != store.ReminderPending {
+		t.Fatalf("statuses = %+v, want doctor cancelled and bread pending", statuses)
+	}
+}
+
+func TestReminderCancellationKeepsNegationAndQuantityDistinct(t *testing.T) {
+	t.Run("negation", func(t *testing.T) {
+		h, st, now := newClarifyHandler(t)
+		positive := seedVoiceReminder(t, st, now.Add(time.Hour), "звонить врачу")
+		negative := seedVoiceReminder(t, st, now.Add(2*time.Hour), "не звонить врачу")
+
+		reply, handled := h.resolveReminderCancellation(context.Background(), "отмени напоминание не звонить врачу")
+		if !handled || !strings.Contains(reply, "не звонить врачу") {
+			t.Fatalf("reply = %q, handled=%v", reply, handled)
+		}
+		statuses := reminderStatuses(t, st)
+		if statuses[positive] != store.ReminderPending || statuses[negative] != store.ReminderCancelled {
+			t.Fatalf("negation selected the wrong row: %+v", statuses)
+		}
+	})
+
+	t.Run("quantity", func(t *testing.T) {
+		h, st, now := newClarifyHandler(t)
+		one := seedVoiceReminder(t, st, now.Add(time.Hour), "принять одну таблетку")
+		two := seedVoiceReminder(t, st, now.Add(2*time.Hour), "принять две таблетки")
+
+		reply, handled := h.resolveReminderCancellation(context.Background(), "удали напоминание принять две таблетки")
+		if !handled || !strings.Contains(reply, "две таблетки") {
+			t.Fatalf("reply = %q, handled=%v", reply, handled)
+		}
+		statuses := reminderStatuses(t, st)
+		if statuses[one] != store.ReminderPending || statuses[two] != store.ReminderCancelled {
+			t.Fatalf("quantity selected the wrong row: %+v", statuses)
+		}
+	})
+}
+
+func TestReminderCancellationQuestionNeverMutates(t *testing.T) {
+	h, st, now := newClarifyHandler(t)
+	id := seedVoiceReminder(t, st, now.Add(time.Hour), "позвонить врачу")
+	for _, text := range []string{
+		"как отменить напоминание про врача?",
+		"можно отменить напоминание про врача?",
+		"он сказал: отмени напоминание про врача",
+	} {
+		if reply, handled := h.resolveReminderCancellation(context.Background(), text); handled || reply != "" {
+			t.Fatalf("non-command %q was claimed: reply=%q handled=%v", text, reply, handled)
+		}
+		if got := reminderStatuses(t, st)[id]; got != store.ReminderPending {
+			t.Fatalf("non-command %q changed reminder to %q", text, got)
+		}
+	}
+}
+
+func TestReminderCancellationUsesClockAndAsksWhenStateIsAmbiguous(t *testing.T) {
+	t.Run("one matching half of day is enough", func(t *testing.T) {
+		h, st, now := newClarifyHandler(t)
+		h.timeParser = router.StubDateTimeParser{}
+		evening := seedVoiceReminder(t, st, time.Date(now.Year(), now.Month(), now.Day(), 21, 0, 0, 0, now.Location()), "вечернее лекарство")
+		seedVoiceReminder(t, st, now.Add(2*time.Hour), "купить хлеб")
+
+		reply, handled := h.resolveReminderCancellation(context.Background(), "убери напоминание на девять")
+		if !handled || !strings.Contains(reply, "отменила") {
+			t.Fatalf("reply = %q, handled=%v", reply, handled)
+		}
+		if got := reminderStatuses(t, st)[evening]; got != store.ReminderCancelled {
+			t.Fatalf("21:00 status = %q, want cancelled", got)
+		}
+	})
+
+	t.Run("two matching halves are offered and ordinal is bound", func(t *testing.T) {
+		h, st, now := newClarifyHandler(t)
+		h.timeParser = router.StubDateTimeParser{}
+		evening := seedVoiceReminder(t, st, time.Date(now.Year(), now.Month(), now.Day(), 21, 0, 0, 0, now.Location()), "вечернее лекарство")
+		morning := seedVoiceReminder(t, st, time.Date(now.Year(), now.Month(), now.Day()+1, 9, 0, 0, 0, now.Location()), "утреннее лекарство")
+
+		reply, handled := h.resolveReminderCancellation(context.Background(), "убери напоминание на девять")
+		if !handled || !strings.Contains(reply, "порядковым словом") {
+			t.Fatalf("ambiguous reply = %q, handled=%v", reply, handled)
+		}
+		statuses := reminderStatuses(t, st)
+		if statuses[evening] != store.ReminderPending || statuses[morning] != store.ReminderPending {
+			t.Fatalf("ambiguous command mutated rows: %+v", statuses)
+		}
+		sess := h.dialogueSessions.Get(dialogueIDOf(context.Background()), h.now())
+		if sess == nil || len(sess.Candidates) != 2 || sess.Candidates[1].Ref != morning {
+			t.Fatalf("bound candidates = %+v", sess)
+		}
+
+		reply, handled = h.resolveCandidate(context.Background(), "второе", sourceVoice)
+		if !handled || !strings.Contains(reply, "утреннее лекарство") {
+			t.Fatalf("ordinal reply = %q, handled=%v", reply, handled)
+		}
+		statuses = reminderStatuses(t, st)
+		if statuses[evening] != store.ReminderPending || statuses[morning] != store.ReminderCancelled {
+			t.Fatalf("ordinal cancelled the wrong row: %+v", statuses)
+		}
+		if sess := h.dialogueSessions.Get(dialogueIDOf(context.Background()), h.now()); sess == nil || len(sess.Candidates) != 0 {
+			t.Fatalf("spent candidates survived: %+v", sess)
+		}
+	})
+}
+
+func TestReminderCancellationChoiceRequiresAWholeAffirmativeOrdinal(t *testing.T) {
+	unsafe := []string{
+		"почему второе?",
+		"не второе",
+		"второе не отменяй",
+		"первое и второе",
+		"напомни мне первого сентября оплатить счёт",
+	}
+	for _, answer := range unsafe {
+		t.Run(answer, func(t *testing.T) {
+			h, st, now := newClarifyHandler(t)
+			h.timeParser = router.StubDateTimeParser{}
+			first := seedVoiceReminder(t, st, now.Add(time.Hour), "первое лекарство")
+			second := seedVoiceReminder(t, st, now.Add(2*time.Hour), "второе лекарство")
+			if _, handled := h.resolveReminderCancellation(context.Background(), "отмени напоминание"); !handled {
+				t.Fatal("ambiguous cancellation was not offered")
+			}
+			if reply, handled := h.resolveCandidate(context.Background(), answer, sourceVoice); handled || reply != "" {
+				t.Fatalf("unsafe answer was claimed: reply=%q handled=%v", reply, handled)
+			}
+			statuses := reminderStatuses(t, st)
+			if statuses[first] != store.ReminderPending || statuses[second] != store.ReminderPending {
+				t.Fatalf("unsafe answer mutated rows: %+v", statuses)
+			}
+		})
+	}
+}
+
+func TestReminderCancellationChoiceCanBeAbandoned(t *testing.T) {
+	for _, answer := range []string{"отмена", "не надо", "no"} {
+		t.Run(answer, func(t *testing.T) {
+			h, st, now := newClarifyHandler(t)
+			first := seedVoiceReminder(t, st, now.Add(time.Hour), "первое")
+			second := seedVoiceReminder(t, st, now.Add(2*time.Hour), "второе")
+			if _, handled := h.resolveReminderCancellation(context.Background(), "отмени напоминание"); !handled {
+				t.Fatal("ambiguous cancellation was not offered")
+			}
+			reply, handled := h.resolveCandidate(context.Background(), answer, sourceVoice)
+			if !handled || !strings.Contains(reply, "ничего не отменяю") {
+				t.Fatalf("cancel answer = %q handled=%v", reply, handled)
+			}
+			statuses := reminderStatuses(t, st)
+			if statuses[first] != store.ReminderPending || statuses[second] != store.ReminderPending {
+				t.Fatalf("abandoning the choice mutated rows: %+v", statuses)
+			}
+			if sess := h.dialogueSessions.Get(dialogueIDOf(context.Background()), h.now()); sess == nil || len(sess.Candidates) != 0 {
+				t.Fatalf("abandoned candidates survived: %+v", sess)
+			}
+		})
+	}
+}
+
+func TestReminderCancellationOfferStartsFreshAndNamesTruncation(t *testing.T) {
+	h, st, now := newClarifyHandler(t)
+	id := dialogueIDOf(context.Background())
+	h.dialogueSessions.Put(id, &dialogue.Session{
+		Intent:    dialogue.IntentReminder,
+		Slots:     dialogue.Slots{Text: "stale subject", HasTime: true, Time: now.Add(time.Hour)},
+		Timestamp: now.Add(-time.Minute),
+	})
+	for i := 0; i < 6; i++ {
+		seedVoiceReminder(t, st, now.Add(time.Duration(i+1)*time.Hour), fmt.Sprintf("row %d", i+1))
+	}
+	reply, handled := h.resolveReminderCancellation(context.Background(), "отмени напоминание")
+	if !handled || !strings.Contains(reply, "первые пять") || !strings.Contains(reply, "уточни текст или время") {
+		t.Fatalf("truncated offer = %q handled=%v", reply, handled)
+	}
+	sess := h.dialogueSessions.Get(id, h.now())
+	if sess == nil || sess.Intent != dialogue.IntentSystem || sess.Slots.Text != "" ||
+		len(sess.Candidates) != 5 || sess.Utterance != "отмени напоминание" {
+		t.Fatalf("offer reused stale dialogue state: %+v", sess)
+	}
+}
+
+func TestReminderCancellationNeverGuesses(t *testing.T) {
+	t.Run("bare command over several rows", func(t *testing.T) {
+		h, st, now := newClarifyHandler(t)
+		first := seedVoiceReminder(t, st, now.Add(time.Hour), "первое")
+		second := seedVoiceReminder(t, st, now.Add(2*time.Hour), "второе")
+		reply, handled := h.resolveReminderCancellation(context.Background(), "отмени напоминание")
+		if !handled || !strings.Contains(reply, "порядковым словом") {
+			t.Fatalf("reply = %q, handled=%v", reply, handled)
+		}
+		statuses := reminderStatuses(t, st)
+		if statuses[first] != store.ReminderPending || statuses[second] != store.ReminderPending {
+			t.Fatalf("bare ambiguous command mutated rows: %+v", statuses)
+		}
+	})
+
+	t.Run("unread time", func(t *testing.T) {
+		h, st, now := newClarifyHandler(t)
+		h.timeParser = router.StubDateTimeParser{}
+		id := seedVoiceReminder(t, st, now.Add(time.Hour), "позвонить врачу")
+		reply, handled := h.resolveReminderCancellation(context.Background(), "отмени напоминание через вечность")
+		if !handled || !strings.Contains(reply, "не смогла разобрать время") {
+			t.Fatalf("reply = %q, handled=%v", reply, handled)
+		}
+		if got := reminderStatuses(t, st)[id]; got != store.ReminderPending {
+			t.Fatalf("unread time cancelled reminder: %q", got)
+		}
+	})
+}
+
+type cancelReminderAPI struct {
+	ipc.UnimplementedCoreAPI
+
+	rows      []ipc.Reminder
+	listErr   error
+	cancelErr error
+	calls     []int64
+}
+
+func (a *cancelReminderAPI) ListPendingReminders(context.Context, int) ([]ipc.Reminder, error) {
+	return a.rows, a.listErr
+}
+
+func (a *cancelReminderAPI) CancelReminder(_ context.Context, id int64) error {
+	a.calls = append(a.calls, id)
+	return a.cancelErr
+}
+
+func cancelHandler(api ipc.CoreAPI) *reactiveHandler {
+	now := time.Date(2026, 8, 15, 9, 0, 0, 0, time.UTC)
+	parser := router.StubDateTimeParser{}
+	return &reactiveHandler{
+		api: api, now: func() time.Time { return now }, timeParser: parser,
+		extractor:        router.Extractor{Time: parser},
+		dialogueSessions: dialogue.NewSessionStore(2 * time.Minute),
+	}
+}
+
+func TestReminderCancellationReportsStoreOutcomes(t *testing.T) {
+	row := ipc.Reminder{
+		ID: 7, FireTs: time.Date(2026, 8, 15, 12, 0, 0, 0, time.UTC),
+		NextFireTs: time.Date(2026, 8, 15, 12, 0, 0, 0, time.UTC),
+		Payload:    `{"text":"позвонить врачу"}`, Status: store.ReminderPending,
+	}
+	for _, tc := range []struct {
+		name string
+		err  error
+		want string
+	}{
+		{"already terminal", ipc.ErrReminderState, "уже не ожидает"},
+		{"delivery in flight", ipc.ErrReminderInFlight, "уже начала отправлять"},
+		{"transport", errors.New("socket closed"), "не получилось отменить"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			api := &cancelReminderAPI{rows: []ipc.Reminder{row}, cancelErr: tc.err}
+			reply, handled := cancelHandler(api).resolveReminderCancellation(context.Background(), "отмени напоминание про врача")
+			if !handled || !strings.Contains(reply, tc.want) || len(api.calls) != 1 || api.calls[0] != 7 {
+				t.Fatalf("reply=%q handled=%v calls=%v", reply, handled, api.calls)
+			}
+		})
+	}
+
+	t.Run("list failure", func(t *testing.T) {
+		api := &cancelReminderAPI{listErr: errors.New("offline")}
+		reply, handled := cancelHandler(api).resolveReminderCancellation(context.Background(), "отмени напоминание")
+		if !handled || !strings.Contains(reply, "не получилось посмотреть") || len(api.calls) != 0 {
+			t.Fatalf("reply=%q handled=%v calls=%v", reply, handled, api.calls)
+		}
+	})
+
+	t.Run("nothing pending", func(t *testing.T) {
+		api := &cancelReminderAPI{}
+		reply, handled := cancelHandler(api).resolveReminderCancellation(context.Background(), "отмени напоминание")
+		if !handled || !strings.Contains(reply, "ожидающих напоминаний нет") || len(api.calls) != 0 {
+			t.Fatalf("reply=%q handled=%v calls=%v", reply, handled, api.calls)
+		}
+	})
+}
+
+func TestReminderCancellationIsAPreRouteTurnAndDoesNotGetSwallowedByClarify(t *testing.T) {
+	h, st, now := newClarifyHandler(t)
+	h.timeParser = router.StubDateTimeParser{}
+	h.decisions = decision.NewRing()
+	id := seedVoiceReminder(t, st, now.Add(time.Hour), "позвонить врачу")
+	ctx := withDialogueID(context.Background(), dialogueIDFor(sourceText, "web"))
+	h.clarifyStore.Put(dialogueIDOf(ctx), &dialogue.PendingQuestion{
+		Intent: dialogue.IntentReminder, Missing: []dialogue.Slot{dialogue.SlotTime},
+		Utterance: "напомни позвонить маме", Asked: h.now(), TTL: clarifyTTL,
+	})
+
+	reply := h.runTurn(ctx, "отмени напоминание про врача", sourceText)
+	if !strings.Contains(reply, clarifyDropped) || !strings.Contains(reply, "отменила напоминание") {
+		t.Fatalf("reply = %q, want dropped clarify notice and cancellation", reply)
+	}
+	if h.clarifyStore.Get(dialogueIDOf(ctx), h.now()) != nil {
+		t.Fatal("the superseded clarify question survived the cancellation request")
+	}
+	if got := reminderStatuses(t, st)[id]; got != store.ReminderCancelled {
+		t.Fatalf("status = %q, want cancelled", got)
+	}
+	recs := h.decisions.Recent(1)
+	if len(recs) != 1 {
+		t.Fatalf("decision records = %d, want 1", len(recs))
+	}
+	claim := findClaim(recs[0], "reminder-cancel")
+	if claim == nil || claim.Outcome != decision.Won {
+		t.Fatalf("reminder-cancel claim = %+v, want pre-route winner", claim)
+	}
+}
+
+func TestReminderCancellationThroughPushToTalk(t *testing.T) {
+	h, st, now := newClarifyHandler(t)
+	h.stt = simTranscriber{text: "отмени напоминание про врача"}
+	h.tts = tts.NewStub()
+	h.timeParser = router.StubDateTimeParser{}
+	h.router = buildRouter(router.NewHashEmbedder(64), h.matcher, 0.55, nil, nil)
+	doctor := seedVoiceReminder(t, st, now.Add(time.Hour), "позвонить врачу")
+	bread := seedVoiceReminder(t, st, now.Add(2*time.Hour), "купить хлеб")
+
+	resp, err := h.HandlePushToTalk(context.Background(), voicePTT(), 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(resp.ReplyText, "отменила напоминание") || len(resp.ReplyAudio.Bytes) == 0 {
+		t.Fatalf("PTT response = text %q audio=%d bytes", resp.ReplyText, len(resp.ReplyAudio.Bytes))
+	}
+	statuses := reminderStatuses(t, st)
+	if statuses[doctor] != store.ReminderCancelled || statuses[bread] != store.ReminderPending {
+		t.Fatalf("PTT cancellation changed the wrong rows: %+v", statuses)
+	}
+}

cmd/mavend/repair.go

@@ -172,14 +172,57 @@ func (h *reactiveHandler) stampLastTurn(utterance string, traceID int64) {
 	h.lastRouted.traceID = traceID
 }
 
-func (h *reactiveHandler) takeLastTurn() *routedTurn {
+// takeLastTurnIf atomically claims the previous acted turn only when the
+// caller can actually handle it. A declined repair must not spend the pointer:
+// "нет, это заметка" may name the intent Maven already chose and be followed
+// immediately by the real correction. The older read-then-clear helper lost
+// the original before checking either that case or the repair window (V-573).
+func (h *reactiveHandler) takeLastTurnIf(accept func(*routedTurn) bool) *routedTurn {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	last := h.lastRouted
-	// Taken, not read: one utterance is corrected once. Saying "нет, не так"
-	// twice would otherwise redo the same request twice.
+	if h.lastRouted == nil || !accept(h.lastRouted) {
+		return nil
+	}
+	last := *h.lastRouted
+	// A handled correction is still spent once. Returning a copy prevents a
+	// later trace stamp from mutating the evidence after this resolver owns it.
 	h.lastRouted = nil
-	return last
+	return &last
+}
+
+// takeTargetedRepair atomically distinguishes the three outcomes a targeted
+// correction needs. A recent, differently-routed turn is claimed and spent; a
+// recent turn already carrying that intent is retained and reported as
+// already-correct; everything else declines. Treating the second case as a
+// generic decline lets runTurn route the correction words as a fresh turn and
+// record them over the very pointer this helper was meant to preserve.
+func (h *reactiveHandler) takeTargetedRepair(now time.Time, corrected router.Intent) (last *routedTurn, already bool) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.lastRouted == nil || now.Sub(h.lastRouted.at) > repairWindow {
+		return nil, false
+	}
+	if h.lastRouted.intent == corrected {
+		return nil, true
+	}
+	copy := *h.lastRouted
+	h.lastRouted = nil
+	return &copy, false
+}
+
+// suspendClarifyForRepair makes a correction an aside to any question already
+// parked in this dialogue. It is called only after a repair has actually found
+// a target, so an ordinary utterance that merely resembles one changes no
+// dialogue state. If the redo itself needs a question, askClarify sees the
+// suspended flag and pushes that question instead of overwriting the older
+// request.
+func (h *reactiveHandler) suspendClarifyForRepair(ctx context.Context) {
+	if h.clarifyStore == nil {
+		return
+	}
+	if q := h.clarifyStore.Get(dialogueIDOf(ctx), h.now()); q != nil {
+		h.noteSuspended(ctx, q)
+	}
 }
 
 // resolveUntargetedRepair handles the cheap half of a spoken correction: he says
@@ -199,15 +242,16 @@ func (h *reactiveHandler) resolveUntargetedRepair(ctx context.Context, text stri
 	if !isRepairNegative(text) {
 		return "", false
 	}
-	last := h.takeLastTurn()
-	if last == nil || h.now().Sub(last.at) > repairWindow {
-		return "", false
-	}
-	if last.traceID == 0 {
+	now := h.now()
+	last := h.takeLastTurnIf(func(last *routedTurn) bool {
+		return now.Sub(last.at) <= repairWindow && last.traceID != 0
+	})
+	if last == nil {
 		// No row to point at, so there is no label to write and nothing this
 		// resolver can do. Routing the words normally is the honest outcome.
 		return "", false
 	}
+	h.suspendClarifyForRepair(ctx)
 	h.labelCorrection(ctx, last, "")
 	log.Printf("voice: repair — %q marked wrong, no target given", last.utterance)
 	return phraser.A(phraser.RepairNoted, nil), true
@@ -239,16 +283,20 @@ func (h *reactiveHandler) resolveRepair(ctx context.Context, text string) (strin
 	if !ok || h.router == nil {
 		return "", false
 	}
-	last := h.takeLastTurn()
-	if last == nil || h.now().Sub(last.at) > repairWindow {
-		return "", false
-	}
-	if last.intent == corrected {
-		// She already did what he is asking for. Correcting the classifier
-		// here would teach it the label it produced, and redoing the request
-		// would file it twice.
+	last, already := h.takeTargetedRepair(h.now(), corrected)
+	if already {
+		// This is still a correction turn, not slot material and not a fresh note.
+		// Say why nothing ran, retain the original pointer, and keep any parked
+		// question audible for the next breath.
+		h.suspendClarifyForRepair(ctx)
+		return "это уже " + say + " — ничего не переделываю.", true
+	}
+	if last == nil {
+		// Nothing recent to correct. Routing the words normally is the honest
+		// outcome; an expired pointer cannot become usable again.
 		return "", false
 	}
+	h.suspendClarifyForRepair(ctx)
 	learned := true
 	if err := h.router.CorrectMisroute(ctx, last.utterance, corrected); err != nil {
 		// The redo is still worth doing: he asked for something and it did not
@@ -271,7 +319,7 @@ func (h *reactiveHandler) resolveRepair(ctx context.Context, text string) (strin
 	if dec.Slots.Text == "" && corrected != router.IntentReminder {
 		dec.Slots.Text = last.utterance
 	}
-	return repairLine(say, learned) + " " + h.finishClarified(ctx, dec), true
+	return repairLine(say, learned) + " " + h.finishRepaired(ctx, dec), true
 }
 
 // repairLine — what she says before redoing it, so the correction is visible

cmd/mavend/repair_test.go

@@ -6,6 +6,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/kami/maven/internal/dialogue"
 	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/store"
 )
@@ -93,7 +94,7 @@ func TestRepairNeedsARecentTurnToPointAt(t *testing.T) {
 }
 
 func TestRepairIsSpentOnce(t *testing.T) {
-	h, _, _ := newClarifyHandler(t)
+	h, st, _ := newClarifyHandler(t)
 	emb := router.NewHashEmbedder(256)
 	h.recall.embedder = emb
 	h.router = router.New(router.Config{Classifier: router.NewClassifier(emb), Extractor: h.extractor})
@@ -103,8 +104,17 @@ func TestRepairIsSpentOnce(t *testing.T) {
 	if _, handled := h.resolveRepair(ctx, "нет, это заметка"); !handled {
 		t.Fatal("the first correction was not handled")
 	}
-	if _, handled := h.resolveRepair(ctx, "нет, это заметка"); handled {
-		t.Error("the same turn was corrected twice")
+	before, err := st.RecentNotes(ctx, 10)
+	if err != nil || len(before) != 1 {
+		t.Fatalf("first repair notes=%+v err=%v", before, err)
+	}
+	reply, handled := h.resolveRepair(ctx, "нет, это заметка")
+	if !handled || !strings.Contains(reply, "уже") {
+		t.Fatalf("the repeated correction was not acknowledged as already applied: handled=%v reply=%q", handled, reply)
+	}
+	after, err := st.RecentNotes(ctx, 10)
+	if err != nil || len(after) != 1 {
+		t.Fatalf("the same turn was redone twice: notes=%+v err=%v", after, err)
 	}
 }
 
@@ -114,8 +124,119 @@ func TestRepairPassesWhenSheAlreadyDidThat(t *testing.T) {
 	h, _, _ := newClarifyHandler(t)
 	h.router = router.New(router.Config{Classifier: router.NewClassifier(router.NewHashEmbedder(256))})
 	h.recordTurn("купить хлеб", router.IntentNote)
+	reply, handled := h.resolveRepair(context.Background(), "нет, это заметка")
+	if !handled || !strings.Contains(reply, "уже") {
+		t.Fatalf("a redundant correction must be acknowledged without redoing it: handled=%v reply=%q", handled, reply)
+	}
+	// Acknowledging the redundant target must not spend the original. If this
+	// resolver declines instead, runTurn routes the correction as a fresh turn
+	// and recordTurn overwrites the pointer even though takeLastTurn retained it.
+	if _, handled := h.resolveRepair(context.Background(), "нет, это факт"); !handled {
+		t.Error("a redundant same-intent repair spent the original turn")
+	}
+}
+
+func TestRepairResumesQuestionParkedAfterTheCorrectedTurn(t *testing.T) {
+	h, _, _ := newClarifyHandler(t)
+	emb := router.NewHashEmbedder(256)
+	h.recall.embedder = emb
+	h.router = router.New(router.Config{Classifier: router.NewClassifier(emb), Extractor: h.extractor})
+	ctx := context.Background()
+
+	h.recordTurn("купить хлеб", router.IntentFact)
+	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder,
+		router.Slots{Text: "позвонить маме"}, "напомни позвонить маме")); !asked {
+		t.Fatal("expected a parked reminder question")
+	}
+
+	reply := h.runTurn(ctx, "нет, это был вопрос", sourceText)
+	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
+	if !strings.HasSuffix(reply, resumed) {
+		t.Fatalf("the correction hid the still-live question: reply=%q want suffix=%q", reply, resumed)
+	}
+	q := h.clarifyStore.Get(voiceDialogueID, h.now())
+	if q == nil {
+		t.Fatal("the correction dropped the parked question")
+	}
+	if q.Attempts != 1 || q.Suspends != 1 {
+		t.Fatalf("the correction spent a retry instead of suspending the question: %+v", q)
+	}
+}
+
+func TestRepairedClarifyCompletesWithoutDroppingTheOlderQuestion(t *testing.T) {
+	h, st, _ := newClarifyHandler(t)
+	emb := router.NewHashEmbedder(256)
+	h.recall.embedder = emb
+	h.router = router.New(router.Config{Classifier: router.NewClassifier(emb), Extractor: h.extractor})
+	ctx := context.Background()
+
+	h.recordTurn("купить хлеб", router.IntentFact)
+	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder,
+		router.Slots{Text: "позвонить маме"}, "напомни позвонить маме")); !asked {
+		t.Fatal("expected the older reminder question")
+	}
+
+	if reply := h.runTurn(ctx, "нет, это было напоминание", sourceText); !strings.Contains(reply, "Когда") {
+		t.Fatalf("the repaired reminder did not ask for its missing time: %q", reply)
+	}
+	if depth := h.clarifyStore.Depth(voiceDialogueID); depth != 2 {
+		t.Fatalf("the repaired question overwrote the older one: depth=%d want=2", depth)
+	}
+
+	reply := h.runTurn(ctx, "сегодня в 15:00", sourceText)
+	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
+	if !strings.HasSuffix(reply, resumed) {
+		t.Fatalf("completing the repaired request did not resume the older one: reply=%q", reply)
+	}
+	q := h.clarifyStore.Get(voiceDialogueID, h.now())
+	if q == nil || !strings.Contains(q.Utterance, "маме") {
+		t.Fatalf("the older question was lost after the top one completed: %+v", q)
+	}
+	reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour))
+	if err != nil || len(reminders) != 1 || !strings.Contains(reminders[0].Payload, "хлеб") {
+		t.Fatalf("the repaired reminder did not land exactly once: reminders=%+v err=%v", reminders, err)
+	}
+}
+
+func TestRepairedClarifyGiveUpKeepsTheOlderQuestion(t *testing.T) {
+	h, _, _ := newClarifyHandler(t)
+	ctx := context.Background()
+	older := &dialogue.PendingQuestion{
+		Intent: dialogue.IntentReminder, Missing: []dialogue.Slot{dialogue.SlotTime},
+		Utterance: "напомни позвонить маме", Asked: h.now(), TTL: clarifyTTL,
+	}
+	top := &dialogue.PendingQuestion{
+		Intent: dialogue.IntentReminder, Missing: []dialogue.Slot{dialogue.SlotTime},
+		Utterance: "напомни купить хлеб", Asked: h.now(), TTL: clarifyTTL,
+		Attempts: dialogue.DefaultMaxAttempts, MaxAttempts: dialogue.DefaultMaxAttempts,
+	}
+	h.clarifyStore.Push(voiceDialogueID, older)
+	h.clarifyStore.Push(voiceDialogueID, top)
+
+	if reply := h.reaskOrGiveUp(ctx, top, top.Slots, "не знаю", ""); reply != clarifyGaveUp {
+		t.Fatalf("reply=%q, want the explicit give-up line", reply)
+	}
+	if depth := h.clarifyStore.Depth(voiceDialogueID); depth != 1 {
+		t.Fatalf("giving up on the top request erased the older flow: depth=%d", depth)
+	}
+	q := h.clarifyStore.Get(voiceDialogueID, h.now())
+	if q != older {
+		t.Fatalf("survivor=%+v, want the older parked question", q)
+	}
+}
+
+func TestStaleRepairDoesNotSpendTheOriginal(t *testing.T) {
+	h, _, now := newClarifyHandler(t)
+	h.router = router.New(router.Config{Classifier: router.NewClassifier(router.NewHashEmbedder(256))})
+	h.recordTurn("купить хлеб", router.IntentFact)
+	*now = now.Add(repairWindow + time.Minute)
 	if _, handled := h.resolveRepair(context.Background(), "нет, это заметка"); handled {
-		t.Error("a correction to the intent she already used was handled")
+		t.Fatal("a stale correction was handled")
+	}
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.lastRouted == nil || h.lastRouted.utterance != "купить хлеб" {
+		t.Fatal("a stale declined correction spent the original turn")
 	}
 }
 

cmd/mavend/replier_llm.go

@@ -39,6 +39,13 @@ func (r *llmReplier) Reply(ctx context.Context, d router.Decision) string {
 		// что ты выпел стакан воды" for "я выпил воды".
 		return phraser.FactAck(d.Utterance)
 	}
+	if d.Intent == router.IntentNote {
+		// A successful durable write needs no generation. The resident model
+		// answered one live capture with masculine self-reference ("сохранил")
+		// despite the prompt; the hand-written line is both faster and a hard
+		// persona guarantee on the daemon's reply path (V-721).
+		return phraser.Ack(phraser.AckNote, nil)
+	}
 	out, err := r.p.PhraseReply(ctx, d)
 	if err != nil || out == "" {
 		return r.stub.Reply(ctx, d)

cmd/mavend/replier_llm_test.go

@@ -20,22 +20,46 @@ type stubCompleter struct {
 
 func (s stubCompleter) Complete(_ context.Context, _ llm.Req) (string, error) { return s.out, s.err }
 
-func TestLLMReplierPassesTheModelReplyThrough(t *testing.T) {
+func TestLLMReplierPassesTheModelReplyThroughForOtherIntents(t *testing.T) {
 	r := newLLMReplier(stubCompleter{out: `{"response":"записала, кофе закончился","mood":"neutral"}`}, nil)
-	got := r.Reply(context.Background(), router.Decision{Intent: router.IntentNote, Slots: router.Slots{Text: "кофе закончился"}})
+	got := r.Reply(context.Background(), router.Decision{Intent: router.IntentReminder, Slots: router.Slots{Text: "кофе закончился"}})
 	if got != "записала, кофе закончился" {
 		t.Errorf("got %q, want %q", got, "записала, кофе закончился")
 	}
 }
 
+type countingCompleter struct {
+	out   string
+	calls int
+}
+
+func (c *countingCompleter) Complete(_ context.Context, _ llm.Req) (string, error) {
+	c.calls++
+	return c.out, nil
+}
+
+func TestLLMReplierNoteUsesFixedFeminineAcknowledgement(t *testing.T) {
+	c := &countingCompleter{out: `{"response":"Хорошо, сохранил.","mood":"neutral"}`}
+	r := newLLMReplier(c, nil)
+	got := r.Reply(context.Background(), router.Decision{
+		Intent: router.IntentNote, Slots: router.Slots{Text: "запасной ключ лежит в синей коробке"},
+	})
+	if c.calls != 0 {
+		t.Fatalf("note acknowledgement called the resident model %d time(s), want none", c.calls)
+	}
+	if got != "сохранила заметку." {
+		t.Fatalf("note acknowledgement = %q, want the fixed feminine line", got)
+	}
+}
+
 func TestLLMReplierFallsBackToStubOnError(t *testing.T) {
 	r := newLLMReplier(stubCompleter{err: errReplierTest}, nil)
-	assertAck(t, r, router.Decision{Intent: router.IntentNote}, phraser.AckNote, "llm error")
+	assertAck(t, r, router.Decision{Intent: router.IntentReminder}, phraser.AckReminder, "llm error")
 }
 
 func TestLLMReplierFallsBackToStubOnEmpty(t *testing.T) {
 	r := newLLMReplier(stubCompleter{out: ""}, nil)
-	assertAck(t, r, router.Decision{Intent: router.IntentNote}, phraser.AckNote, "empty llm")
+	assertAck(t, r, router.Decision{Intent: router.IntentReminder}, phraser.AckReminder, "empty llm")
 }
 
 // A clarify never reaches the model, and since Vikunja #457 it is answered from

cmd/mavend/self.go

@@ -6,6 +6,7 @@ import (
 	"regexp"
 
 	"github.com/kami/maven/internal/phraser"
+	"github.com/kami/maven/internal/router"
 )
 
 // A question about her — "что ты умеешь", "кто ты" — used to have no answer at
@@ -98,6 +99,16 @@ func selfFloor(utterance string) bool {
 // asked — "что ты умеешь" and "кто ты" want different halves of it — and falls
 // back to the text itself, which is already readable, if the model is down.
 func (h *reactiveHandler) querySelf(ctx context.Context, t *queryTurn) (string, bool) {
+	// Product help is self knowledge too (Vikunja V-720), but unlike the prose description it
+	// must be exact: these examples name the grammar Maven actually accepts.
+	// Answer them before topic scoring so a phrasing such as "как отменить
+	// задачу" cannot leak to SearXNG as generic third-party instructions.
+	switch router.LocalHelpTopic(t.dec.Utterance) {
+	case router.HelpReminderCancel:
+		return "Скажи, например: «отмени напоминание про молоко». Если совпадений несколько, я попрошу выбрать одно.", true
+	case router.HelpTaskDrop:
+		return "Скажи, например: «убери из задач настроить бэкапы». Я уберу задачу из активного списка, не отмечая её выполненной.", true
+	}
 	if !h.turnIsAbout(ctx, t, topicSelf, selfFloor) {
 		return "", false
 	}

cmd/mavend/self_test.go

@@ -65,6 +65,36 @@ func TestSelfSourceAnswersFromTheDescription(t *testing.T) {
 	}
 }
 
+// V-720: asking how to operate Maven is never a third-party web-search query.
+func TestMavenHowToAnswersLocallyWithoutSearch(t *testing.T) {
+	for _, testCase := range []struct {
+		utterance string
+		want      string
+	}{
+		{"как отменить напоминание про молоко?", "отмени напоминание"},
+		{"как отменить задачу настроить бэкапы?", "убери из задач"},
+		{"можно ли отменить напоминание?", "отмени напоминание"},
+		{"can I cancel a reminder?", "отмени напоминание"},
+		{"could I cancel a task?", "убери из задач"},
+	} {
+		h, seen := searchHandler(t,
+			`{"answers":["Инструкция стороннего приложения"],"results":[]}`,
+			200)
+		reply := h.actionQuery(context.Background(), router.Decision{
+			Intent:         router.IntentQuery,
+			Utterance:      testCase.utterance,
+			Source:         router.SourceSelf,
+			SourceAnchored: true,
+		})
+		if !strings.Contains(reply, testCase.want) {
+			t.Errorf("%q reply = %q, want local usage example containing %q", testCase.utterance, reply, testCase.want)
+		}
+		if *seen != "" {
+			t.Errorf("%q leaked to search as %q", testCase.utterance, *seen)
+		}
+	}
+}
+
 // TestSelfDescriptionHoldsThePersona — it is her own text and she reads it out,
 // so the same rules the phrasing eval enforces apply to it. Feminine
 // self-reference, informal address, no pet names.

cmd/mavend/simulator_test.go

@@ -12,6 +12,7 @@
 //	what was SENT            — every delivery.Sendable the dispatcher emitted
 //	what ARRIVED             — the unified intake journal from #283
 //	what TOOLS were called   — the recorded requests against fake Praxis/Nexis/Hexis
+//	what is DURABLE          — typed notes/tasks/reminders/facts store state
 //	what did NOT happen      — expect_no_send / expect_no_call, first-class
 //
 // The last one is the point. Maven's hard constraints are mostly negative —
@@ -127,10 +128,14 @@ type toolRow struct {
 // Route and Reply are separate because the same model serves both contracts
 // (CLAUDE.md, "LLM output contract"): a grammar-constrained call is a routing
 // call and gets Route, an unconstrained one is a phrasing call and gets Reply.
+// HistoryContains makes a chat reply conditional on the transcript the daemon
+// supplied. It prevents a canned answer from making a continuity scenario pass
+// while the referent is still absent from the model input.
 type scriptEntry struct {
-	Match string `json:"match"`
-	Route string `json:"route,omitempty"`
-	Reply string `json:"reply,omitempty"`
+	Match           string   `json:"match"`
+	Route           string   `json:"route,omitempty"`
+	Reply           string   `json:"reply,omitempty"`
+	HistoryContains []string `json:"history_contains,omitempty"`
 }
 
 // step — one scripted moment. At is "HH:MM" or "HH:MM:SS", interpreted in the
@@ -186,14 +191,81 @@ type step struct {
 
 	// --- assertions ---
 
-	ExpectReply     []string `json:"expect_reply_contains,omitempty"`
-	ExpectNotReply  []string `json:"expect_reply_lacks,omitempty"`
-	ExpectSent      []string `json:"expect_sent_contains,omitempty"`
-	ExpectNoSend    bool     `json:"expect_no_send,omitempty"`
-	ExpectCalled    []string `json:"expect_called,omitempty"`
-	ExpectNotCalled []string `json:"expect_not_called,omitempty"`
-	ExpectEvents    []string `json:"expect_events,omitempty"`
-	ExpectNoEvents  bool     `json:"expect_no_events,omitempty"`
+	ExpectReply     []string               `json:"expect_reply_contains,omitempty"`
+	ExpectNotReply  []string               `json:"expect_reply_lacks,omitempty"`
+	ExpectSent      []string               `json:"expect_sent_contains,omitempty"`
+	ExpectNoSend    bool                   `json:"expect_no_send,omitempty"`
+	ExpectCalled    []string               `json:"expect_called,omitempty"`
+	ExpectNotCalled []string               `json:"expect_not_called,omitempty"`
+	ExpectEvents    []string               `json:"expect_events,omitempty"`
+	ExpectNoEvents  bool                   `json:"expect_no_events,omitempty"`
+	ExpectStore     *storeStateExpectation `json:"expect_store,omitempty"`
+}
+
+// storeStateExpectation is a typed, exact read of Maven's four user-visible
+// durable stores. Reply assertions prove what she said; these prove what the
+// turn actually committed. Each selected collection can assert its total row
+// count and exact row identity independently, so a duplicate insert cannot be
+// hidden by finding one matching row.
+type storeStateExpectation struct {
+	Notes     *noteStateExpectation     `json:"notes,omitempty"`
+	Tasks     *taskStateExpectation     `json:"tasks,omitempty"`
+	Reminders *reminderStateExpectation `json:"reminders,omitempty"`
+	Facts     *factStateExpectation     `json:"facts,omitempty"`
+}
+
+type noteStateExpectation struct {
+	Count *int                 `json:"count,omitempty"`
+	Rows  []noteRowExpectation `json:"rows,omitempty"`
+}
+
+type noteRowExpectation struct {
+	ID     int64  `json:"id,omitempty"`
+	At     string `json:"at,omitempty"`
+	Text   string `json:"text,omitempty"`
+	Source string `json:"source,omitempty"`
+}
+
+type taskStateExpectation struct {
+	Count *int                 `json:"count,omitempty"`
+	Rows  []taskRowExpectation `json:"rows,omitempty"`
+}
+
+type taskRowExpectation struct {
+	ID         int64  `json:"id,omitempty"`
+	CreatedAt  string `json:"created_at,omitempty"`
+	Text       string `json:"text,omitempty"`
+	Source     string `json:"source,omitempty"`
+	Status     string `json:"status,omitempty"`
+	ResolvedAt string `json:"resolved_at,omitempty"`
+	ResolvedBy string `json:"resolved_by,omitempty"`
+}
+
+type reminderStateExpectation struct {
+	Count *int                     `json:"count,omitempty"`
+	Rows  []reminderRowExpectation `json:"rows,omitempty"`
+}
+
+type reminderRowExpectation struct {
+	ID     int64  `json:"id,omitempty"`
+	FireAt string `json:"fire_at,omitempty"`
+	Text   string `json:"text,omitempty"`
+	Status string `json:"status,omitempty"`
+}
+
+type factStateExpectation struct {
+	Count *int                 `json:"count,omitempty"`
+	Rows  []factRowExpectation `json:"rows,omitempty"`
+}
+
+type factRowExpectation struct {
+	ID         int64    `json:"id,omitempty"`
+	At         string   `json:"at,omitempty"`
+	Kind       string   `json:"kind,omitempty"`
+	Key        string   `json:"key,omitempty"`
+	Value      string   `json:"value,omitempty"`
+	Source     string   `json:"source,omitempty"`
+	Confidence *float64 `json:"confidence,omitempty"`
 }
 
 type signalStep struct {
@@ -369,7 +441,7 @@ type scriptedPhraser struct {
 // matches scriptedLLM: actionChat logs it and falls back to ChatFallback(), so a
 // scenario that never meant to assert on a chat reply behaves exactly as it did
 // before, and one that DID means to is told its script has a hole.
-func (p *scriptedPhraser) PhraseChat(_ context.Context, utterance string, _ []dialogue.Turn) (string, error) {
+func (p *scriptedPhraser) PhraseChat(_ context.Context, utterance string, history []dialogue.Turn) (string, error) {
 	for _, e := range p.entries {
 		if e.Reply == "" {
 			continue
@@ -377,6 +449,19 @@ func (p *scriptedPhraser) PhraseChat(_ context.Context, utterance string, _ []di
 		if e.Match != "" && !strings.Contains(strings.ToLower(utterance), strings.ToLower(e.Match)) {
 			continue
 		}
+		for _, want := range e.HistoryContains {
+			found := false
+			for _, turn := range history {
+				if containsFold(turn.Text, want) {
+					found = true
+					break
+				}
+			}
+			if !found {
+				return "", fmt.Errorf("simulator: chat history for %q does not contain %q: %+v",
+					truncateRunes(utterance, 60), want, history)
+			}
+		}
 		return chatReplyText(e.Reply), nil
 	}
 	return "", fmt.Errorf("simulator: no scripted chat reply for %q", truncateRunes(utterance, 60))
@@ -423,6 +508,17 @@ func newSimWorld(t *testing.T, sc scenario) *simWorld {
 	})
 	tl := newTickLoop(st, gatherer, dispatcher, phraser.NewStub(), rules,
 		time.Minute, 5*time.Minute, 0, nil, nil, nil, nil)
+	// Production upgrades the voice handler from the direct store adapter to
+	// daemonAPI after the tick loop exists. Mirror that seam so a simulated
+	// day-plan query reads the real store-backed plan instead of the direct
+	// adapter's "not available" refusal. The fake clock is the one deliberate
+	// difference from production's time.Now.
+	api = &daemonAPI{
+		CoreAPI: api,
+		getDayPlan: func(ctx context.Context) ipc.DayPlan {
+			return tl.dayPlan(ctx, clock.Now())
+		},
+	}
 
 	scripted := &scriptedLLM{entries: sc.Script}
 
@@ -475,6 +571,7 @@ func newSimWorld(t *testing.T, sc scenario) *simWorld {
 	// act panicked the moment the matcher was consulted.
 	matcher := tool.NewMatcher(api)
 	rtr := buildRouter(emb, matcher, config.DefaultRouterThreshold, router.NewLLMRouter(scripted), nil)
+	timeParser := router.NewPythonDateParser()
 
 	w.handler = &reactiveHandler{
 		stt:    simTranscriber{},
@@ -493,10 +590,11 @@ func newSimWorld(t *testing.T, sc scenario) *simWorld {
 		replier:            newLLMReplier(scripted, nil),
 		now:                clock.Now,
 		dataStore:          st,
-		timeParser:         router.StubDateTimeParser{},
+		timeParser:         timeParser,
 		dialogueSessions:   dialogue.NewSessionStore(time.Hour),
 		clarifyStore:       dialogue.NewClarifyStore(time.Hour),
 		clarifyMaxAttempts: dialogue.DefaultMaxAttempts,
+		extractor:          router.Extractor{Time: timeParser, Acts: matcher, Facts: router.DefaultFactParser{}},
 		ecosystem:          eco,
 	}
 	return w
@@ -582,7 +680,7 @@ func (w *simWorld) run(sc scenario) {
 		eventsBefore := w.publishCount()
 
 		w.stimulate(ctx, s)
-		w.assert(i, s, sendsBefore, callsBefore, eventsBefore)
+		w.assert(ctx, i, s, sendsBefore, callsBefore, eventsBefore)
 	}
 }
 
@@ -783,7 +881,7 @@ func (w *simWorld) callPaths() []string { return w.callPathsSince(nil) }
 // Assertions
 // ---------------------------------------------------------------------------
 
-func (w *simWorld) assert(i int, s step, sendsBefore int, callsBefore []int, eventsBefore int) {
+func (w *simWorld) assert(ctx context.Context, i int, s step, sendsBefore int, callsBefore []int, eventsBefore int) {
 	w.t.Helper()
 	where := fmt.Sprintf("step %d (%s)", i+1, s.At)
 	if s.Note != "" {
@@ -847,6 +945,197 @@ func (w *simWorld) assert(i int, s step, sendsBefore int, callsBefore []int, eve
 		fail("expected nothing to arrive, %d event(s) were published",
 			w.publishCount()-eventsBefore)
 	}
+	if s.ExpectStore != nil {
+		w.assertStoreState(ctx, *s.ExpectStore, fail)
+	}
+}
+
+const simStateReadLimit = 10_000
+
+func (w *simWorld) assertStoreState(ctx context.Context, want storeStateExpectation, fail func(string, ...any)) {
+	if want.Notes != nil {
+		rows, err := w.store.RecentNotes(ctx, simStateReadLimit)
+		if err != nil {
+			fail("read notes for store assertion: %v", err)
+		} else {
+			assertStateCount("notes", want.Notes.Count, len(rows), fail)
+			used := make([]bool, len(rows))
+			for _, expected := range want.Notes.Rows {
+				matched, matchErr := matchDistinct(rows, used, func(row store.Note) (bool, error) {
+					return w.noteStateMatches(row, expected)
+				})
+				if matchErr != nil {
+					fail("invalid note expectation %+v: %v", expected, matchErr)
+				} else if !matched {
+					fail("no distinct note matches %+v; notes: %+v", expected, rows)
+				}
+			}
+		}
+	}
+
+	if want.Tasks != nil {
+		rows, err := w.store.ListTasks(ctx, "")
+		if err != nil {
+			fail("read tasks for store assertion: %v", err)
+		} else {
+			if want.Tasks.Count != nil && *want.Tasks.Count > store.MaxTaskRows {
+				fail("task count assertion %d exceeds the store read bound %d", *want.Tasks.Count, store.MaxTaskRows)
+			} else {
+				assertStateCount("tasks", want.Tasks.Count, len(rows), fail)
+			}
+			used := make([]bool, len(rows))
+			for _, expected := range want.Tasks.Rows {
+				matched, matchErr := matchDistinct(rows, used, func(row store.Task) (bool, error) {
+					return w.taskStateMatches(row, expected)
+				})
+				if matchErr != nil {
+					fail("invalid task expectation %+v: %v", expected, matchErr)
+				} else if !matched {
+					fail("no distinct task matches %+v; tasks: %+v", expected, rows)
+				}
+			}
+		}
+	}
+
+	if want.Reminders != nil {
+		rows, err := w.store.ListReminders(ctx, simStateReadLimit)
+		if err != nil {
+			fail("read reminders for store assertion: %v", err)
+		} else {
+			assertStateCount("reminders", want.Reminders.Count, len(rows), fail)
+			used := make([]bool, len(rows))
+			for _, expected := range want.Reminders.Rows {
+				matched, matchErr := matchDistinct(rows, used, func(row store.Reminder) (bool, error) {
+					return w.reminderStateMatches(row, expected)
+				})
+				if matchErr != nil {
+					fail("invalid reminder expectation %+v: %v", expected, matchErr)
+				} else if !matched {
+					fail("no distinct reminder matches %+v; reminders: %+v", expected, rows)
+				}
+			}
+		}
+	}
+
+	if want.Facts != nil {
+		rows, err := w.store.RecentFacts(ctx, simStateReadLimit)
+		if err != nil {
+			fail("read facts for store assertion: %v", err)
+		} else {
+			assertStateCount("facts", want.Facts.Count, len(rows), fail)
+			used := make([]bool, len(rows))
+			for _, expected := range want.Facts.Rows {
+				matched, matchErr := matchDistinct(rows, used, func(row store.Fact) (bool, error) {
+					return w.factStateMatches(row, expected)
+				})
+				if matchErr != nil {
+					fail("invalid fact expectation %+v: %v", expected, matchErr)
+				} else if !matched {
+					fail("no distinct fact matches %+v; facts: %+v", expected, rows)
+				}
+			}
+		}
+	}
+}
+
+func assertStateCount(kind string, want *int, got int, fail func(string, ...any)) {
+	if want != nil && got != *want {
+		fail("%s count = %d, want %d", kind, got, *want)
+	}
+}
+
+// matchDistinct prevents two expectations from being satisfied by the same
+// durable row. This is important for identity assertions where two records may
+// intentionally carry the same text but have different lifecycle states.
+func matchDistinct[T any](rows []T, used []bool, matches func(T) (bool, error)) (bool, error) {
+	for i, row := range rows {
+		if used[i] {
+			continue
+		}
+		ok, err := matches(row)
+		if err != nil {
+			return false, err
+		}
+		if ok {
+			used[i] = true
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func (w *simWorld) noteStateMatches(got store.Note, want noteRowExpectation) (bool, error) {
+	if want.ID != 0 && got.ID != want.ID || want.Text != "" && got.Text != want.Text ||
+		want.Source != "" && got.Source != want.Source {
+		return false, nil
+	}
+	return w.stateTimeMatches(got.Ts, want.At)
+}
+
+func (w *simWorld) taskStateMatches(got store.Task, want taskRowExpectation) (bool, error) {
+	if want.ID != 0 && got.ID != want.ID || want.Text != "" && got.Text != want.Text ||
+		want.Source != "" && got.Source != want.Source || want.Status != "" && got.Status != want.Status ||
+		want.ResolvedBy != "" && got.ResolvedBy != want.ResolvedBy {
+		return false, nil
+	}
+	if ok, err := w.stateTimeMatches(got.CreatedTs, want.CreatedAt); err != nil || !ok {
+		return ok, err
+	}
+	if want.ResolvedAt == "" {
+		return true, nil
+	}
+	if got.ResolvedTs == nil {
+		return false, nil
+	}
+	return w.stateTimeMatches(*got.ResolvedTs, want.ResolvedAt)
+}
+
+func (w *simWorld) reminderStateMatches(got store.Reminder, want reminderRowExpectation) (bool, error) {
+	if want.ID != 0 && got.ID != want.ID || want.Text != "" && got.Text() != want.Text ||
+		want.Status != "" && got.Status != want.Status {
+		return false, nil
+	}
+	return w.stateTimeMatches(got.FireTs, want.FireAt)
+}
+
+func (w *simWorld) factStateMatches(got store.Fact, want factRowExpectation) (bool, error) {
+	if want.ID != 0 && got.ID != want.ID || want.Kind != "" && string(got.Kind) != want.Kind ||
+		want.Key != "" && got.Key != want.Key || want.Value != "" && got.Value != want.Value ||
+		want.Source != "" && got.Source != want.Source ||
+		want.Confidence != nil && got.Confidence != *want.Confidence {
+		return false, nil
+	}
+	return w.stateTimeMatches(got.Ts, want.At)
+}
+
+func (w *simWorld) stateTimeMatches(got time.Time, raw string) (bool, error) {
+	if raw == "" {
+		return true, nil
+	}
+	want, err := w.stateTime(raw)
+	if err != nil {
+		return false, err
+	}
+	return got.Equal(want), nil
+}
+
+// stateTime accepts either an absolute RFC3339 instant or the same local
+// HH:MM[:SS] shape scenario steps use. The latter keeps fixtures readable
+// while still comparing exact instants after the store normalises to UTC.
+func (w *simWorld) stateTime(raw string) (time.Time, error) {
+	if strings.Contains(raw, "T") {
+		return time.Parse(time.RFC3339, raw)
+	}
+	layout := "15:04"
+	if strings.Count(raw, ":") == 2 {
+		layout = "15:04:05"
+	}
+	hm, err := time.Parse(layout, raw)
+	if err != nil {
+		return time.Time{}, fmt.Errorf("expected HH:MM[:SS] or RFC3339, got %q: %w", raw, err)
+	}
+	return time.Date(w.start.Year(), w.start.Month(), w.start.Day(),
+		hm.Hour(), hm.Minute(), hm.Second(), 0, w.loc), nil
 }
 
 func sendableTexts(sends []delivery.Sendable) []string {
@@ -916,6 +1205,64 @@ func TestSimulatorScenarios(t *testing.T) {
 	}
 }
 
+// TestSimulatorWorldMirrorsProductionConversationSeams pins the two daemon
+// constructor upgrades the continuous scenario needs. A bare store API cannot
+// answer DayPlan, and a nil handler extractor cannot complete a parked reminder
+// from the next turn; either drift would make the simulator exercise a smaller
+// system than production while still producing plausible replies.
+func TestSimulatorWorldMirrorsProductionConversationSeams(t *testing.T) {
+	sc := scenario{SchemaVersion: 1, Name: "constructor-seams", Start: "2026-08-15T08:00:00+04:00"}
+	w := newSimWorld(t, sc)
+	if w.handler.api != w.api {
+		t.Fatal("handler did not receive the simulator's upgraded daemon API")
+	}
+	plan, err := w.handler.api.DayPlan(context.Background())
+	if err != nil {
+		t.Fatalf("simulator day-plan seam is unavailable: %v", err)
+	}
+	planY, planM, planD := plan.Date.In(w.loc).Date()
+	wantY, wantM, wantD := w.start.Date()
+	if plan.Date.IsZero() || planY != wantY || planM != wantM || planD != wantD {
+		t.Fatalf("day plan date = %v, want the fake-clock day %v", plan.Date, w.start)
+	}
+	if w.handler.extractor.Time == nil || w.handler.timeParser == nil {
+		t.Fatal("simulator left the clarify time parser unwired")
+	}
+	slots := w.handler.extractor.Extract(context.Background(), router.IntentReminder,
+		"сегодня в 10:00", w.clock.Now())
+	if !slots.HasTime || !slots.Time.Equal(w.timeOf("10:00")) {
+		t.Fatalf("clarify extractor parsed %+v, want the fake-clock day at 10:00", slots)
+	}
+}
+
+// The reported duplicate transcript was a diagnostic artefact: two adjacent
+// sed ranges both included boundary line 620. Source had one log call. Keep an
+// executable exact-count assertion so a real duplicate cannot be introduced
+// later and mistaken for another display artefact.
+func TestSimulatorTranscriptRecordsEachSpokenTurnOnce(t *testing.T) {
+	sc := scenario{
+		SchemaVersion: 1,
+		Name:          "transcript-count",
+		Start:         "2026-08-15T08:00:00+04:00",
+		Script: []scriptEntry{{
+			Match: "привет", Route: `[{"intent":"chat","text":"привет"}]`,
+			Reply: `{"response":"Привет.","mood":"happy"}`,
+		}},
+	}
+	w := newSimWorld(t, sc)
+	w.stimulate(context.Background(), step{Say: "привет"})
+	want := "08:00:00  он: привет"
+	count := 0
+	for _, line := range w.transcript {
+		if line == want {
+			count++
+		}
+	}
+	if count != 1 {
+		t.Fatalf("owner transcript line occurred %d times, want exactly once: %v", count, w.transcript)
+	}
+}
+
 func loadScenario(t *testing.T, path string) scenario {
 	t.Helper()
 	raw, err := os.ReadFile(path)

cmd/mavend/telegramintake.go

@@ -25,7 +25,7 @@ import (
 // already failed the boot in wireDispatcher for the same config, so a second
 // hard failure would only lose that message.
 func wireTelegramIntake(ctx context.Context, wg *sync.WaitGroup, api ipc.CoreAPI, cfg *config.Config) {
-	if cfg == nil || cfg.Telegram == nil || !cfg.Telegram.Intake || api == nil {
+	if cfg == nil || cfg.Telegram == nil || cfg.Telegram.Disabled || !cfg.Telegram.Intake || api == nil {
 		return
 	}
 	sink, err := telegramsink.New(*cfg.Telegram)

cmd/mavend/testdata/personal_boundary_v1.json

@@ -0,0 +1,521 @@
+{
+  "schema_version": 1,
+  "name": "personal_boundary_v1",
+  "notes": [
+    "Held-out personal-boundary fixture for V-702. Cases are not production seeds and the fixture test enforces that after case folding and punctuation removal.",
+    "The matrix is balanced: three cases for every stratum × language × expected side cell (6 × 2 × 2 × 3 = 72).",
+    "Personal means that only the owner's local data can answer. World means that an outside knowledge source can answer even when the wording uses first person or possession.",
+    "Public subjects are deliberately varied. No case repeats the Baikal regression or changes only its place name."
+  ],
+  "cases": [
+    {
+      "id": "pb-ru-remembered-personal-01",
+      "utterance": "что я раньше говорил насчёт бессонницы?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-personal-02",
+      "utterance": "помнишь, какие причины увольнения я называл?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-personal-03",
+      "utterance": "упоминал ли я, куда хочу переехать?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-world-01",
+      "utterance": "что Чехов говорил о краткости?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-world-02",
+      "utterance": "какие причины кризиса называли экономисты?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-world-03",
+      "utterance": "что свидетели рассказывали об извержении Кракатау?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-personal-01",
+      "utterance": "what was it I told you about changing careers?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-personal-02",
+      "utterance": "have I ever mentioned where I studied?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-personal-03",
+      "utterance": "do you remember which camera I said I preferred?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-world-01",
+      "utterance": "what did Marie Curie write about radium?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-world-02",
+      "utterance": "which causes of inflation do economists usually mention?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-world-03",
+      "utterance": "what did the Apollo astronauts report about lunar dust?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+
+    {
+      "id": "pb-ru-possession-personal-01",
+      "utterance": "какой номер у моего страхового полиса?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-personal-02",
+      "utterance": "где я оставил свои запасные ключи?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-personal-03",
+      "utterance": "до какого числа действует мой абонемент?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-world-01",
+      "utterance": "как убрать царапину с моего стола?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-world-02",
+      "utterance": "почему у меня запотевают окна зимой?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-world-03",
+      "utterance": "чем зарядить мой телефон в поездке?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-personal-01",
+      "utterance": "when does my library card expire?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-personal-02",
+      "utterance": "where did I put my passport copy?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-personal-03",
+      "utterance": "what size are my hiking boots?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-world-01",
+      "utterance": "how can I descale my kettle safely?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-world-02",
+      "utterance": "why does my laptop fan get loud under load?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-world-03",
+      "utterance": "which adapter should I use for my phone abroad?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "possession"
+    },
+
+    {
+      "id": "pb-ru-narrative-personal-01",
+      "utterance": "напомни историю о том, как я познакомился с Антоном",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-personal-02",
+      "utterance": "расскажи, что со мной случилось в первый день на новой работе",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-personal-03",
+      "utterance": "восстанови по моим заметкам историю поездки в Казань",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-world-01",
+      "utterance": "опиши восхождение на Эверест",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-world-02",
+      "utterance": "расскажи историю создания языка Rust",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-world-03",
+      "utterance": "объясни, как возникли кольца Сатурна",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-personal-01",
+      "utterance": "retell the story of how I met Lena from what I told you",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-personal-02",
+      "utterance": "walk me through what happened on my first day at university",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-personal-03",
+      "utterance": "reconstruct my Prague trip from my notes",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-world-01",
+      "utterance": "tell me the story of the first Moon landing",
+      "lang": "en",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-world-02",
+      "utterance": "describe how the printing press spread through Europe",
+      "lang": "en",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-world-03",
+      "utterance": "explain how the Panama Canal was built",
+      "lang": "en",
+      "want": "world",
+      "stratum": "narrative"
+    },
+
+    {
+      "id": "pb-ru-preamble-personal-01",
+      "utterance": "если помнишь наш разговор, что я решил насчёт переезда?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-personal-02",
+      "utterance": "как я уже упоминал, когда мне продлевать страховку?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-personal-03",
+      "utterance": "возвращаясь к тому, что я рассказывал, какую модель велосипеда я выбрал?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-world-01",
+      "utterance": "как я уже говорил, почему самолёты оставляют белый след?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-world-02",
+      "utterance": "возвращаясь к моему вопросу, из чего состоит базальт?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-world-03",
+      "utterance": "я, возможно, повторяюсь, но когда построили Колизей?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-personal-01",
+      "utterance": "as I mentioned earlier, which dentist did I choose?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-personal-02",
+      "utterance": "coming back to what I told you, when am I taking leave?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-personal-03",
+      "utterance": "I may have said this already, which Linux distro did I settle on?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-world-01",
+      "utterance": "as I was saying, why do tides happen?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-world-02",
+      "utterance": "coming back to my question, how are auroras formed?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-world-03",
+      "utterance": "I may be repeating myself, when was Machu Picchu built?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+
+    {
+      "id": "pb-ru-advice-personal-01",
+      "utterance": "что из моих дел нужно закончить до пятницы?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-personal-02",
+      "utterance": "какое лекарство врач велел мне принимать утром?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-personal-03",
+      "utterance": "сколько денег я потратил на продукты в этом месяце?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-world-01",
+      "utterance": "как безопасно заменить розетку?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-world-02",
+      "utterance": "какая сейчас версия Debian stable?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-world-03",
+      "utterance": "что сегодня происходит на мировых рынках?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-personal-01",
+      "utterance": "which of my tasks is due before Friday?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-personal-02",
+      "utterance": "what dosage did my doctor tell me to take at breakfast?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-personal-03",
+      "utterance": "how much did I spend on groceries this month?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-world-01",
+      "utterance": "how should I clean a cast-iron pan?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-world-02",
+      "utterance": "what is the current stable release of PostgreSQL?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-world-03",
+      "utterance": "which major elections are happening this month?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+
+    {
+      "id": "pb-ru-proper-personal-01",
+      "utterance": "что я записал после доклада Линуса Торвальдса?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-personal-02",
+      "utterance": "какое мнение я высказал о фильмах Куросавы?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-personal-03",
+      "utterance": "когда у меня билеты на концерт Земфиры?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-world-01",
+      "utterance": "кто такой Алан Тьюринг?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-world-02",
+      "utterance": "чем известна Фрида Кало?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-world-03",
+      "utterance": "когда родился Юрий Гагарин?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-personal-01",
+      "utterance": "what notes did I make after Grace Hopper's talk?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-personal-02",
+      "utterance": "which David Bowie album did I say I liked most?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-personal-03",
+      "utterance": "when are my tickets for the Radiohead show?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-world-01",
+      "utterance": "who was Katherine Johnson?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-world-02",
+      "utterance": "what is Antoni Gaudí famous for?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-world-03",
+      "utterance": "when was Nelson Mandela born?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    }
+  ]
+}

cmd/mavend/testdata/scenarios/assistant_workday.json

@@ -0,0 +1,219 @@
+{
+  "schema_version": 1,
+  "name": "assistant_workday",
+  "description": "One continuous, deterministic workday through Maven's real conversation pipeline. It proves note capture and grounded high-overlap recall; a reminder that remains uncommitted while Maven clarifies its day, then survives a reported-action no-op, is cancelled exactly once, and stays cancelled on a repeated command; task capture, listing, completion, and a second live task; and the same calendar fact read through both agenda and composed day-plan sources. Store assertions are primary: every mutation and no-op pins exact row count, identity, lifecycle state, provenance, and fake-clock time.",
+  "start": "2026-08-15T08:00:00+04:00",
+  "script": [
+    {
+      "match": "запомни: запасной ключ лежит",
+      "route": "[{\"intent\":\"note\",\"text\":\"запомни: запасной ключ лежит в синей коробке\"}]"
+    },
+    {
+      "match": "запасной ключ лежит в синей коробке",
+      "route": "[{\"intent\":\"query\",\"text\":\"запасной ключ лежит в синей коробке?\",\"source\":\"recall\"}]"
+    },
+    {
+      "match": "я отменил напоминание",
+      "route": "[{\"intent\":\"chat\",\"text\":\"я отменил напоминание про молоко\"}]",
+      "reply": "{\"response\":\"Поняла.\",\"mood\":\"neutral\"}"
+    },
+    {
+      "match": "",
+      "route": "[{\"intent\":\"chat\",\"text\":\"\"}]",
+      "reply": "{\"response\":\"Поняла.\",\"mood\":\"neutral\"}"
+    }
+  ],
+  "steps": [
+    {
+      "at": "08:00",
+      "note": "Capture only the dictated body as one durable note: the command frame is not memory, and no task, reminder, or fact is created.",
+      "say": "запомни: запасной ключ лежит в синей коробке",
+      "expect_no_send": true,
+      "expect_store": {
+        "notes": { "count": 1, "rows": [{ "id": 1, "at": "08:00", "text": "запасной ключ лежит в синей коробке", "source": "tap:voice" }] },
+        "tasks": { "count": 0 },
+        "reminders": { "count": 0 },
+        "facts": { "count": 0 }
+      }
+    },
+    {
+      "at": "08:01",
+      "note": "Recall reads the stored note and does not create a second row.",
+      "say": "запасной ключ лежит в синей коробке?",
+      "expect_reply_contains": ["синей коробке"],
+      "expect_no_send": true,
+      "expect_store": {
+        "notes": { "count": 1, "rows": [{ "id": 1, "text": "запасной ключ лежит в синей коробке", "source": "tap:voice" }] }
+      }
+    },
+    {
+      "at": "08:02",
+      "note": "A clock without a day is not a committed reminder. Maven asks, and the reminder table remains empty.",
+      "say": "напомни купить молоко в 10:00",
+      "expect_reply_contains": ["В какой день"],
+      "expect_no_send": true,
+      "expect_store": {
+        "reminders": { "count": 0 }
+      }
+    },
+    {
+      "at": "08:03",
+      "note": "The clarification completes the parked request against the fake clock and creates exactly one pending reminder.",
+      "say": "сегодня",
+      "expect_reply_contains": ["10:00"],
+      "expect_no_send": true,
+      "expect_store": {
+        "reminders": { "count": 1, "rows": [{ "id": 1, "fire_at": "10:00", "text": "купить молоко", "status": "pending" }] }
+      }
+    },
+    {
+      "at": "08:04",
+      "note": "A first-person report is not another cancellation command and cannot mutate the pending row.",
+      "say": "я отменил напоминание про молоко",
+      "expect_reply_contains": ["Поняла"],
+      "expect_no_send": true,
+      "expect_store": {
+        "reminders": { "count": 1, "rows": [{ "id": 1, "fire_at": "10:00", "text": "купить молоко", "status": "pending" }] }
+      }
+    },
+    {
+      "at": "08:05",
+      "note": "The addressed imperative cancels that exact durable reminder in place.",
+      "say": "отмени напоминание про молоко",
+      "expect_reply_contains": ["отменила напоминание", "купить молоко"],
+      "expect_no_send": true,
+      "expect_store": {
+        "reminders": { "count": 1, "rows": [{ "id": 1, "fire_at": "10:00", "text": "купить молоко", "status": "cancelled" }] }
+      }
+    },
+    {
+      "at": "08:06",
+      "note": "Repeating the cancellation is an explicit no-op: no replacement row and no resurrection.",
+      "say": "отмени напоминание про молоко",
+      "expect_reply_contains": ["ожидающих напоминаний нет"],
+      "expect_no_send": true,
+      "expect_store": {
+        "reminders": { "count": 1, "rows": [{ "id": 1, "fire_at": "10:00", "text": "купить молоко", "status": "cancelled" }] }
+      }
+    },
+    {
+      "at": "08:07",
+      "note": "An explicit task marker creates one open task, not a note.",
+      "say": "добавь в задачи настроить бэкапы",
+      "expect_reply_contains": ["настроить бэкапы"],
+      "expect_no_send": true,
+      "expect_store": {
+        "notes": { "count": 1 },
+        "tasks": { "count": 1, "rows": [{ "id": 1, "created_at": "08:07", "text": "настроить бэкапы", "source": "tap:voice", "status": "open" }] }
+      }
+    },
+    {
+      "at": "08:08",
+      "note": "Listing is read-only and returns the live task without duplicating it.",
+      "say": "какие у меня задачи?",
+      "expect_reply_contains": ["настроить бэкапы"],
+      "expect_no_send": true,
+      "expect_store": {
+        "tasks": { "count": 1, "rows": [{ "id": 1, "text": "настроить бэкапы", "status": "open" }] }
+      }
+    },
+    {
+      "at": "08:09",
+      "note": "Naming the task moves the same row forward to done and records who resolved it.",
+      "say": "закрой задачу настроить бэкапы",
+      "expect_reply_contains": ["настроить бэкапы"],
+      "expect_no_send": true,
+      "expect_store": {
+        "tasks": { "count": 1, "rows": [{ "id": 1, "created_at": "08:07", "text": "настроить бэкапы", "source": "tap:voice", "status": "done", "resolved_at": "08:09", "resolved_by": "tap:voice" }] }
+      }
+    },
+    {
+      "at": "08:10",
+      "note": "A second task remains live for the rest of the workday while the completed row remains durable history.",
+      "say": "добавь в задачи отправить отчёт",
+      "expect_reply_contains": ["отправить отчёт"],
+      "expect_no_send": true,
+      "expect_store": {
+        "tasks": { "count": 2, "rows": [
+          { "id": 1, "text": "настроить бэкапы", "status": "done", "resolved_by": "tap:voice" },
+          { "id": 2, "created_at": "08:10", "text": "отправить отчёт", "source": "tap:voice", "status": "open" }
+        ] }
+      }
+    },
+    {
+      "at": "08:11",
+      "note": "A fully specified reminder commits directly and coexists with the cancelled history row.",
+      "say": "напомни сегодня в 12:00 размяться",
+      "expect_reply_contains": ["12:00"],
+      "expect_no_send": true,
+      "expect_store": {
+        "reminders": { "count": 2, "rows": [
+          { "id": 1, "fire_at": "10:00", "text": "купить молоко", "status": "cancelled" },
+          { "id": 2, "fire_at": "12:00", "text": "размяться", "status": "pending" }
+        ] }
+      }
+    },
+    {
+      "at": "08:12",
+      "note": "A calendar poll contributes one exact env fact at the event instant.",
+      "arrive": {
+        "source": "poll:caldav",
+        "as_of": "11:00",
+        "fact": {
+          "key": "calendar_event_20260815_Планёрка",
+          "value": "Планёрка @ 11:00-11:30",
+          "kind": "env"
+        }
+      },
+      "expect_events": ["calendar_event_20260815_Планёрка"],
+      "expect_no_send": true,
+      "expect_store": {
+        "facts": { "count": 1, "rows": [{ "id": 1, "at": "11:00", "kind": "env", "key": "calendar_event_20260815_Планёрка", "value": "Планёрка @ 11:00-11:30", "source": "poll:caldav", "confidence": 1.0 }] }
+      }
+    },
+    {
+      "at": "08:13",
+      "note": "The agenda source reads the calendar fact without changing any durable state.",
+      "say": "что у меня сегодня?",
+      "expect_reply_contains": ["Планёрка"],
+      "expect_no_send": true,
+      "expect_store": {
+        "facts": { "count": 1, "rows": [{ "id": 1, "key": "calendar_event_20260815_Планёрка", "source": "poll:caldav" }] },
+        "tasks": { "count": 2 },
+        "reminders": { "count": 2 }
+      }
+    },
+    {
+      "at": "08:14",
+      "note": "The daemon day-plan seam composes the same calendar fact with the still-pending reminder; cancelled reminders stay out.",
+      "say": "какие планы на сегодня?",
+      "expect_reply_contains": ["Планёрка", "размяться"],
+      "expect_reply_lacks": ["купить молоко"],
+      "expect_no_send": true,
+      "expect_store": {
+        "notes": { "count": 1, "rows": [{ "id": 1, "text": "запасной ключ лежит в синей коробке" }] },
+        "tasks": { "count": 2, "rows": [
+          { "id": 1, "text": "настроить бэкапы", "status": "done" },
+          { "id": 2, "text": "отправить отчёт", "status": "open" }
+        ] },
+        "reminders": { "count": 2, "rows": [
+          { "id": 1, "text": "купить молоко", "status": "cancelled" },
+          { "id": 2, "text": "размяться", "status": "pending" }
+        ] },
+        "facts": { "count": 1, "rows": [{ "id": 1, "key": "calendar_event_20260815_Планёрка", "value": "Планёрка @ 11:00-11:30" }] }
+      }
+    },
+    {
+      "at": "08:15",
+      "note": "A normal tick after the session remains silent; durable assistant state does not authorize an unsolicited message.",
+      "tick": true,
+      "expect_no_send": true,
+      "expect_store": {
+        "notes": { "count": 1 },
+        "tasks": { "count": 2 },
+        "reminders": { "count": 2 },
+        "facts": { "count": 1 }
+      }
+    }
+  ]
+}

cmd/mavend/testdata/scenarios/conversation_anaphora.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "name": "conversation_anaphora",
-  "description": "Five consecutive Russian turns about one object, replayed from the run that found V-542 on the box on 05-08-2026. He names a monitor, then asks four questions that all say \"он\" and never name it again.\n\nThis scenario exists because the shape had nowhere to fail. The routing fixture scores one utterance at a time, so a conversation that breaks on its second turn cannot lose a point there, and V-44 step 2 could only be verified by hand. That is item 3 of V-542.\n\nFour of the five replies below are WRONG, and the assertions pin them anyway. Read them as the recorded defect rather than the contract: she has the last four turns in front of her and never once names the thing he is asking about. Every wrong assertion is marked in its step note with what it must become. When V-542 lands, those flip and the ones marked correct do not move.\n\nWhat the four assert is that the reply LACKS \"монитор\". Absence is the defect itself: she is answering a question about a thing she wrote down two minutes ago and cannot name it. It also survives the fallback picker, which matters on the three query turns — they refuse from internal/phraser/fallbacks_ru_v1.json, four variants deep, and the same scenario returned \"тут я пас.\" one run and \"не знаю, честно.\" the next, so a string assertion there would pin the picker rather than the daemon.\n\nTurn 4 asserts its text as well, because that turn goes through the chat path and the chat path is now scriptable. scriptedPhraser in simulator_test.go answers PhraseChat from the same script entries the router reads (V-542 item 4); before it, the simulator wired phraser.NewStub() and no scenario could say what she SAYS on a chat turn at all.\n\nThe routes are scripted exactly as the box produced them, because the failure is not the model's. Turn 1 went to fact despite \"давай поболтаем\", every question after it went to query, and turn 4 went to chat. A scripted route is what lets this scenario pin the daemon's half without a llama-server in the loop.",
+  "description": "Five consecutive Russian turns about one object, replayed from the run that found V-542 on the box on 05-08-2026. He names a monitor once, then refers to it by pronoun or ellipsis for four turns.\n\nThe router decisions stay exactly as the box produced them: fact, query, query, chat, query. That is intentional. Routing sees one utterance; dialogue continuity owns what earlier turns make it mean. A grounded fact inside an explicit conversational opener is still stored, while its exact utterance also enters the transcript. Anaphoric queries are answered through chat with that transcript instead of walking note and world sources without their referent.\n\nEvery scripted chat answer below is conditional on history containing the original monitor turn. A canned reply therefore cannot make this scenario pass if session capture, cross-intent merge, history ordering or PhraseChat wiring loses the referent. The visible assertions require the answer to name the monitor, and the final tick remains the not-a-nag control.",
   "start": "2026-08-05T14:00:00+03:00",
   "script": [
     {
@@ -11,20 +11,27 @@
     },
     {
       "match": "он большой",
-      "route": "[{\"intent\":\"query\",\"text\":\"а он большой?\"}]"
+      "route": "[{\"intent\":\"query\",\"text\":\"а он большой?\"}]",
+      "reply": "{\"response\":\"Ты про новый монитор; диагональ ты пока не называл.\",\"mood\":\"neutral\"}",
+      "history_contains": ["купил новый монитор"]
     },
     {
       "match": "сколько он примерно стоит",
-      "route": "[{\"intent\":\"query\",\"text\":\"сколько он примерно стоит по-твоему?\"}]"
+      "route": "[{\"intent\":\"query\",\"text\":\"сколько он примерно стоит по-твоему?\"}]",
+      "reply": "{\"response\":\"Новый монитор без модели и диагонали я честно не оценю.\",\"mood\":\"thinking\"}",
+      "history_contains": ["купил новый монитор"]
     },
     {
       "match": "переплатил",
       "route": "[{\"intent\":\"chat\",\"text\":\"мне кажется я переплатил\"}]",
-      "reply": "{\"response\":\"я не знаю, о каком именно устройстве ты говоришь.\",\"mood\":\"neutral\"}"
+      "reply": "{\"response\":\"Про новый монитор поняла; цену лучше сравнить по точной модели.\",\"mood\":\"thinking\"}",
+      "history_contains": ["купил новый монитор"]
     },
     {
       "match": "стоит его вернуть",
-      "route": "[{\"intent\":\"query\",\"text\":\"стоит его вернуть?\"}]"
+      "route": "[{\"intent\":\"query\",\"text\":\"стоит его вернуть?\"}]",
+      "reply": "{\"response\":\"Новый монитор стоит вернуть, если сравнение подтвердит переплату или он тебе не подходит.\",\"mood\":\"neutral\"}",
+      "history_contains": ["купил новый монитор"]
     },
     {
       "match": "",
@@ -35,43 +42,42 @@
   "steps": [
     {
       "at": "14:00",
-      "note": "CORRECT, and it is the first half of the defect. \"давай поболтаем\" is an explicit request to converse and the turn is filed as a fact anyway. Storing what he said is not wrong on its own — he did buy a monitor — but the object then lives in the fact store and never enters the transcript PhraseChat reads. That is V-542 decision 2: either the marker claims the turn at stage 0, or it means nothing and comes out of the fixture.",
+      "note": "A substantive statement inside an explicit conversational opener remains a grounded fact, and the exact same utterance becomes dialogue context. Conversation is session state, not a competing storage intent.",
       "say": "давай поболтаем: я вчера купил новый монитор",
       "expect_events": ["purchase"],
       "expect_no_send": true
     },
     {
       "at": "14:01",
-      "note": "WRONG. \"он\" is the monitor from one turn ago, and she says she has no record of it. followUpMerge inherits prev.Slots.Key, and a query turn asking about a pronoun has no key to merge, so the question reaches the query sources naked and the notes source answers the only way it can. Must become: an answer about the monitor, or a route to chat where the transcript is.",
+      "note": "The query route cannot see earlier turns. The dialogue merge sees the anaphora and answers through chat with the transcript, which names the monitor.",
       "say": "а он большой?",
-      "expect_reply_lacks": ["монитор"],
+      "expect_reply_contains": ["монитор"],
       "expect_no_send": true
     },
     {
       "at": "14:02",
-      "note": "WRONG, and it rules out one explanation. This is not the previous turn failing to stick — it is the same wall a second time, two turns from where the monitor was named. Nothing accumulates across query turns.",
+      "note": "The referent survives a second routed-query boundary; the previous contextual turn did not replace the transcript anchor.",
       "say": "сколько он примерно стоит по-твоему?",
-      "expect_reply_lacks": ["монитор"],
+      "expect_reply_contains": ["монитор"],
       "expect_no_send": true
     },
     {
       "at": "14:03",
-      "note": "WRONG, and it is the same wall from the other side. This turn routed chat, so it HAD the history that Session.History holds, and it asks which device he means anyway — because turn 1's object went to the fact store rather than the transcript. So a source reading the conversation is not sufficient on its own; decision 1 has to say which store the referent comes from. This is the one step whose text is pinned: the reply is scripted and reaches PhraseChat, so it is the box's own words rather than a fallback pick. Must become: a reply that names the monitor.",
+      "note": "A native chat route reads the same cross-intent transcript, in chronological order, without receiving the current utterance twice.",
       "say": "мне кажется я переплатил",
-      "expect_reply_contains": ["о каком именно устройстве"],
-      "expect_reply_lacks": ["монитор"],
+      "expect_reply_contains": ["монитор"],
       "expect_no_send": true
     },
     {
       "at": "14:04",
-      "note": "WRONG. The fifth turn is the one that shows the cost. A returns question about a purchase two minutes old is answered with \"не нашла у тебя такой записи\", which is wrong in kind rather than merely unhelpful: the record exists, she wrote it herself at 14:00 under the key purchase.",
+      "note": "The fifth turn proves the oldest retained turn still supplies the referent after fact, query and chat crossings.",
       "say": "стоит его вернуть?",
-      "expect_reply_lacks": ["монитор"],
+      "expect_reply_contains": ["монитор"],
       "expect_no_send": true
     },
     {
       "at": "14:05",
-      "note": "CORRECT, and it is the control. Nothing in five conversational turns was sent at him unprompted, and a tick with him mid-conversation stays silent. Whatever V-542 changes must not change this.",
+      "note": "Control: session continuity is reactive state only. A tick during the conversation sends nothing unprompted.",
       "tick": true,
       "expect_no_send": true
     }

cmd/mavend/tick.go

@@ -10,11 +10,13 @@ package main
 
 import (
 	"context"
+	"crypto/sha256"
 	"errors"
 	"fmt"
 	"log"
 	"os"
 	"path/filepath"
+	"sort"
 	"sync"
 	"time"
 
@@ -226,18 +228,11 @@ func (t *tickLoop) tick(ctx context.Context, now time.Time) {
 	// detectPatterns below for how idempotence and dismissal are respected.
 	t.detectPatterns(ctx, now, state)
 
-	// reminders: gate-bypassing class. fired once, marked after a successful
-	// delivery.  a failed send leaves the reminder pending — the next tick
-	// re-gathers and re-attempts.
+	// reminders: gate-bypassing class. The presentation and retry clock live on
+	// the reminder occurrence, so a transport outage neither spends the model
+	// every tick nor changes what the reminder says after a restart.
 	for _, d := range loop.RemindDecisions(state, due) {
-		pr, err := t.phraser.PhraseReminder(ctx, d)
-		if err != nil {
-			log.Printf("tick: phrase reminder %d: %v", d.Reminder.ID, err)
-			continue
-		}
-		if _, err := t.dispatcher.DispatchReminder(ctx, pr, now); err != nil {
-			log.Printf("tick: dispatch reminder %d: %v", d.Reminder.ID, err)
-		}
+		t.deliverReminder(ctx, d, now)
 	}
 
 	// sev4-away repeats: re-send un-acked telegram nudges per repeatInterval.
@@ -263,6 +258,125 @@ func (t *tickLoop) tick(ctx context.Context, now time.Time) {
 	}
 }
 
+// deliverReminder advances one due reminder (or collapsed bundle) through the
+// durable delivery state. A phrase is cached before the first external send;
+// every definite failure advances the persisted bounded backoff.
+func (t *tickLoop) deliverReminder(ctx context.Context, d loop.ReminderDecision, now time.Time) {
+	originals := reminderOriginals(d.Reminder)
+	pr, cached := cachedReminderPhrase(d, originals)
+	if !cached {
+		var err error
+		pr, err = t.phraser.PhraseReminder(ctx, d)
+		if err == nil && pr.Body == "" {
+			err = errors.New("phraser returned an empty reminder body")
+		}
+		if err != nil {
+			log.Printf("tick: phrase reminder %d: %v", d.Reminder.ID, err)
+			t.scheduleReminderRetry(ctx, originals, now)
+			return
+		}
+		if pr.Mood == "" {
+			pr.Mood = "neutral"
+		}
+		group := reminderDeliveryGroup(originals)
+		if err := t.store.CacheReminderPhrase(
+			ctx, originals, group, pr.Body, pr.Summary, pr.Mood,
+		); err != nil {
+			// A cancellation or another completion can win while phrasing. Do
+			// not send a presentation that no longer owns every original.
+			log.Printf("tick: cache reminder %d phrase: %v", d.Reminder.ID, err)
+			return
+		}
+		// The store now owns the phrase, but this tick's value predates that
+		// write. Stamp the exact persisted occurrence identity onto the value
+		// handed to the dispatcher so its outbox row can suppress an ambiguous
+		// crash for both a real reminder and a synthetic collapsed bundle.
+		for i := range originals {
+			originals[i].DeliveryGroup = group
+			originals[i].PhraseBody = pr.Body
+			originals[i].PhraseSummary = pr.Summary
+			originals[i].PhraseMood = pr.Mood
+		}
+		if d.Reminder.ID == 0 {
+			d.Reminder.Collapsed = originals
+		} else {
+			d.Reminder = originals[0]
+		}
+	}
+	// A phraser is not allowed to substitute the reminder decision. In
+	// particular, the durable group stamped above must reach the outbox.
+	pr.Decision = d
+
+	if _, err := t.dispatcher.DispatchReminder(ctx, pr, now); err != nil {
+		log.Printf("tick: dispatch reminder %d: %v", d.Reminder.ID, err)
+		t.scheduleReminderRetry(ctx, originals, now)
+	}
+}
+
+func (t *tickLoop) scheduleReminderRetry(ctx context.Context, originals []store.Reminder, now time.Time) {
+	if err := t.store.ScheduleReminderRetry(ctx, originals, now); err != nil {
+		log.Printf("tick: schedule reminder retry: %v", err)
+	}
+}
+
+// reminderOriginals converts the synthetic ID=0 bundle back to real store
+// rows. Keeping this in one helper makes it impossible to accidentally persist
+// retry state against reminder zero.
+func reminderOriginals(r store.Reminder) []store.Reminder {
+	if r.ID == 0 {
+		return append([]store.Reminder(nil), r.Collapsed...)
+	}
+	return []store.Reminder{r}
+}
+
+// cachedReminderPhrase reconstructs a PhrasedReminder only when every original
+// agrees on one persisted group and presentation. That agreement is what lets
+// a collapsed bundle survive a restart without being re-phrased.
+func cachedReminderPhrase(d loop.ReminderDecision, originals []store.Reminder) (delivery.PhrasedReminder, bool) {
+	if len(originals) == 0 || !originals[0].HasDeliveryPhrase() {
+		return delivery.PhrasedReminder{}, false
+	}
+	first := originals[0]
+	for _, r := range originals[1:] {
+		if !r.HasDeliveryPhrase() ||
+			r.DeliveryGroup != first.DeliveryGroup ||
+			r.PhraseBody != first.PhraseBody ||
+			r.PhraseSummary != first.PhraseSummary ||
+			r.PhraseMood != first.PhraseMood {
+			return delivery.PhrasedReminder{}, false
+		}
+	}
+	mood := first.PhraseMood
+	if mood == "" {
+		mood = "neutral"
+	}
+	return delivery.PhrasedReminder{
+		Decision: d,
+		Body:     first.PhraseBody,
+		Summary:  first.PhraseSummary,
+		Mood:     mood,
+	}, true
+}
+
+// reminderDeliveryGroup deterministically names one occurrence or collapsed
+// set. The next-fire instant is part of the identity so a recurring reminder's
+// later occurrence can never inherit the previous occurrence's phrase.
+func reminderDeliveryGroup(originals []store.Reminder) string {
+	ordered := append([]store.Reminder(nil), originals...)
+	sort.Slice(ordered, func(i, j int) bool {
+		if ordered[i].ID == ordered[j].ID {
+			return ordered[i].NextFireTs.Before(ordered[j].NextFireTs)
+		}
+		return ordered[i].ID < ordered[j].ID
+	})
+	h := sha256.New()
+	for _, r := range ordered {
+		_, _ = fmt.Fprintf(h, "%d:%d;", r.ID, r.NextFireTs.UnixMilli())
+	}
+	sum := h.Sum(nil)
+	return fmt.Sprintf("reminder:%x", sum[:12])
+}
+
 // savePresence writes back the bucket GatherState just resolved.
 //
 // It lives here and not in GatherState because that method holds a read-only

cmd/mavend/tick_digest.go

@@ -125,12 +125,10 @@ const maxDigestSpokenItems = 3
 
 // enqueueSuppressedDigest scans this tick's trace for care candidates the
 // gate blocked for a genuine restraint reason and durably records the
-// digest-eligible ones (loop.DigestEligible). Phrasing happens once, here,
-// at enqueue time — not re-derived at drain time — the same way queueNudge
-// phrases once and caches, so a rule suppressed for hours isn't re-prompting
-// the LLM every tick it stays blocked (EnqueueDigestEntry's rule+body dedupe
-// makes repeat calls here harmless, but skipping the phrase call entirely
-// when a pending entry already exists avoids the LLM round-trip too).
+// digest-eligible ones (loop.DigestEligible). Before phrasing, the candidate's
+// rule-owned semantic fingerprint is checked against the durable queue. This
+// is intentionally not a prose hash or an in-memory cache: phrasing may vary,
+// and the first tick after a restart owes the same zero-model-work behavior.
 func (t *tickLoop) enqueueSuppressedDigest(ctx context.Context, trace *loop.TickTrace, state loop.State, now time.Time) {
 	if trace == nil {
 		return
@@ -142,7 +140,24 @@ func (t *tickLoop) enqueueSuppressedDigest(ctx context.Context, trace *loop.Tick
 		if !loop.DigestEligible(tr.Severity, tr.GateBlockedBy) {
 			continue
 		}
-		rule := loop.Rule{Name: tr.RuleName, Severity: tr.Severity}
+		rule, ok := t.ruleNamed(tr.RuleName)
+		if !ok {
+			log.Printf("tick: digest candidate %s has no configured rule", tr.RuleName)
+			continue
+		}
+		fingerprint, ok := loop.DigestCandidateFingerprint(rule, state)
+		if !ok {
+			log.Printf("tick: digest candidate %s has no semantic identity", tr.RuleName)
+			continue
+		}
+		if _, live, err := t.store.LiveDigestEntry(ctx, tr.RuleName, fingerprint, now); err != nil {
+			// If durable state cannot answer, do not spend model work whose
+			// result cannot be safely deduplicated or recorded.
+			log.Printf("tick: check digest candidate %s: %v", tr.RuleName, err)
+			continue
+		} else if live {
+			continue
+		}
 		cand := loop.Candidate{Rule: rule, Severity: tr.Severity, State: state}
 		pn, err := t.phraser.PhraseNudge(ctx, cand)
 		if err != nil {
@@ -150,15 +165,21 @@ func (t *tickLoop) enqueueSuppressedDigest(ctx context.Context, trace *loop.Tick
 			continue
 		}
 		expires := now.Add(digestExpiry)
-		if _, deduped, err := t.store.EnqueueDigestEntry(ctx, tr.RuleName, int(tr.Severity), pn.Body, now, expires); err != nil {
+		if _, _, err := t.store.EnqueueDigestEntry(ctx, tr.RuleName, fingerprint, int(tr.Severity), pn.Body, now, expires); err != nil {
 			log.Printf("tick: enqueue digest entry %s: %v", tr.RuleName, err)
-		} else if deduped {
-			// same suppressed nudge already pending — nothing new to say.
-			continue
 		}
 	}
 }
 
+func (t *tickLoop) ruleNamed(name string) (loop.Rule, bool) {
+	for _, rule := range t.rules {
+		if rule.Name == name {
+			return rule, true
+		}
+	}
+	return loop.Rule{}, false
+}
+
 // expireStaleDigest sweeps entries past their expiry once per tick — cheap
 // bookkeeping, mirrors ReconcileStaleDeliveryAttempts's shape.
 func (t *tickLoop) expireStaleDigest(ctx context.Context, now time.Time) {

cmd/mavend/tick_reminder_delivery_test.go

@@ -0,0 +1,170 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/delivery"
+	"github.com/kami/maven/internal/loop"
+	"github.com/kami/maven/internal/phraser"
+	"github.com/kami/maven/internal/store"
+)
+
+type reminderCountingPhraser struct {
+	phraser.Phraser
+	calls   int
+	body    string
+	summary string
+	mood    string
+}
+
+func (p *reminderCountingPhraser) PhraseReminder(_ context.Context, d loop.ReminderDecision) (delivery.PhrasedReminder, error) {
+	p.calls++
+	return delivery.PhrasedReminder{
+		Decision: d,
+		Body:     p.body,
+		Summary:  p.summary,
+		Mood:     p.mood,
+	}, nil
+}
+
+type reminderFailSink struct {
+	sends int
+}
+
+func (s *reminderFailSink) Send(_ context.Context, _ delivery.Sendable) error {
+	s.sends++
+	return errors.New("transport unavailable")
+}
+
+func newReminderDeliveryLoop(t *testing.T, st *store.Store, sink delivery.Sink, p phraser.Phraser) *tickLoop {
+	t.Helper()
+	rules := loop.DefaultRules()
+	return newTickLoop(
+		st,
+		loop.NewGatherer(st, rules),
+		delivery.NewDispatcher(delivery.Config{
+			Voice: sink, Ntfy: sink, Telegram: sink,
+			Nudges: st, Reminders: st, Outbox: st,
+		}),
+		p,
+		rules,
+		time.Second,
+		5*time.Minute,
+		0,
+		nil, nil, nil, nil,
+	)
+}
+
+func TestTickReminderRetryUsesPersistedPhraseAfterRestart(t *testing.T) {
+	st := newTestStore(t)
+	ctx := context.Background()
+	now := refNow()
+	if _, err := st.CreateReminder(ctx, now.Add(-time.Minute), `{"text":"позвонить маме"}`, ""); err != nil {
+		t.Fatal(err)
+	}
+
+	fail := &reminderFailSink{}
+	firstPhraser := &reminderCountingPhraser{
+		Phraser: phraser.NewStub(), body: "Не забудь позвонить маме.",
+		summary: "Позвонить маме", mood: "warm",
+	}
+	tl := newReminderDeliveryLoop(t, st, fail, firstPhraser)
+	tl.tick(ctx, now)
+	if firstPhraser.calls != 1 {
+		t.Fatalf("first tick phrased %d times, want 1", firstPhraser.calls)
+	}
+	rows, err := st.ListReminders(ctx, 1)
+	if err != nil || len(rows) != 1 {
+		t.Fatalf("list = %d, err=%v", len(rows), err)
+	}
+	if !rows[0].HasDeliveryPhrase() || rows[0].DeliveryAttempts != 1 {
+		t.Fatalf("failed delivery state was not persisted: %+v", rows[0])
+	}
+	if want := now.Add(store.ReminderRetryBase); !rows[0].NextAttemptTs.Equal(want) {
+		t.Fatalf("next attempt = %s, want %s", rows[0].NextAttemptTs, want)
+	}
+
+	// A normal tick inside the wait does no transport work and no model work.
+	sendsAfterFirst := fail.sends
+	tl.tick(ctx, now.Add(30*time.Second))
+	if firstPhraser.calls != 1 || fail.sends != sendsAfterFirst {
+		t.Fatalf("retry wait did work: phrase calls=%d, sends=%d (was %d)", firstPhraser.calls, fail.sends, sendsAfterFirst)
+	}
+
+	// Constructing a new loop is the daemon-restart boundary. Its phraser would
+	// say something different if called; the stored phrase must win instead.
+	success := &fakeSink{}
+	afterRestart := &reminderCountingPhraser{
+		Phraser: phraser.NewStub(), body: "WRONG NEW PHRASE", summary: "WRONG", mood: "neutral",
+	}
+	restarted := newReminderDeliveryLoop(t, st, success, afterRestart)
+	restarted.tick(ctx, now.Add(store.ReminderRetryBase))
+	if afterRestart.calls != 0 {
+		t.Fatalf("restart re-phrased the reminder %d times", afterRestart.calls)
+	}
+	if len(success.sends) != 1 {
+		t.Fatalf("retry sends = %d, want 1", len(success.sends))
+	}
+	if got := success.sends[0].Body; got != "Позвонить маме" {
+		t.Fatalf("away retry body = %q, want persisted summary", got)
+	}
+	rows, err = st.ListReminders(ctx, 1)
+	if err != nil || rows[0].Status != store.ReminderFired {
+		t.Fatalf("successful retry did not fire reminder: rows=%+v err=%v", rows, err)
+	}
+}
+
+func TestTickCollapsedReminderRetriesOnePhraseAndCompletesOriginals(t *testing.T) {
+	st := newTestStore(t)
+	ctx := context.Background()
+	now := refNow()
+	for _, text := range []string{"полить цветы", "записаться к врачу"} {
+		if _, err := st.CreateReminder(ctx, now.Add(-time.Minute), text, ""); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	fail := &reminderFailSink{}
+	firstPhraser := &reminderCountingPhraser{
+		Phraser: phraser.NewStub(), body: "У тебя два напоминания.",
+		summary: "Два напоминания", mood: "neutral",
+	}
+	newReminderDeliveryLoop(t, st, fail, firstPhraser).tick(ctx, now)
+	if firstPhraser.calls != 1 {
+		t.Fatalf("collapsed bundle phrased %d times, want 1", firstPhraser.calls)
+	}
+	rows, err := st.ListReminders(ctx, 10)
+	if err != nil || len(rows) != 2 {
+		t.Fatalf("list = %d, err=%v", len(rows), err)
+	}
+	for _, r := range rows {
+		if r.DeliveryGroup == "" || r.DeliveryGroup != rows[0].DeliveryGroup ||
+			r.PhraseBody != "У тебя два напоминания." || r.DeliveryAttempts != 1 {
+			t.Fatalf("collapsed original lost shared state: %+v", r)
+		}
+	}
+
+	success := &fakeSink{}
+	afterRestart := &reminderCountingPhraser{
+		Phraser: phraser.NewStub(), body: "WRONG", summary: "WRONG", mood: "neutral",
+	}
+	newReminderDeliveryLoop(t, st, success, afterRestart).tick(ctx, now.Add(store.ReminderRetryBase))
+	if afterRestart.calls != 0 {
+		t.Fatalf("collapsed retry re-phrased %d times", afterRestart.calls)
+	}
+	if len(success.sends) != 1 || success.sends[0].ReminderID != 0 {
+		t.Fatalf("collapsed retry sends = %+v, want one synthetic delivery", success.sends)
+	}
+	rows, err = st.ListReminders(ctx, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range rows {
+		if r.Status != store.ReminderFired {
+			t.Fatalf("collapsed original %d status = %q, want fired", r.ID, r.Status)
+		}
+	}
+}

cmd/mavend/turnrole.go

@@ -213,7 +213,8 @@ func isPleasantry(text string) bool {
 // It is also the whole answer when there is no route to read — the classifier
 // is the failure floor and a turn must never break on the model.
 func offlineOwnRequest(text string) bool {
-	return router.IsQuestionShaped(text) || router.CarriesCaptureVerb(text) || carriesReminderVerb(text)
+	_, cancelsReminder := parseReminderCancelRequest(text)
+	return router.IsQuestionShaped(text) || router.CarriesCaptureVerb(text) || carriesReminderVerb(text) || cancelsReminder
 }
 
 // classifyTurnRole decides what this utterance is against the pending action.

cmd/mavend/turnroute.go

@@ -121,5 +121,8 @@ func needsRoute(text string) bool {
 	if isCancel(text) {
 		return false
 	}
+	if _, ok := parseReminderCancelRequest(text); ok {
+		return false
+	}
 	return len(ownContent(text)) > 0 || router.IsQuestionShaped(text)
 }

cmd/mavend/voice.go

@@ -260,8 +260,9 @@ const (
 )
 
 // runTurn — the reactive turn pipeline shared by the voice and text entry
-// points: expired-clarify notice → confirm answer → clarify answer → quiet
-// toggle → route → dialogue merge → clarify question → action → replier.
+// points: expired-clarify notice → confirm answer → explicit correction →
+// clarify answer → quiet toggle → reminder cancellation → route → dialogue
+// merge → clarify question → action → replier.
 // Takes the already-transcribed utterance, returns the reply text; the voice
 // path wraps it in stt/tts, the text path returns it as-is.
 //
@@ -290,6 +291,14 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	now := h.now()
 	rt := h.newTurnRoute(text, now)
 	ctx = withTurnRoute(ctx, rt)
+	// A resolver may suspend an older clarify flow even when it handles this
+	// turn itself. Finalise that state at one choke point so early returns from
+	// confirm/repair/clarify cannot leave a live question parked without saying
+	// it again, or silently drop one when the suspension bound is reached.
+	defer func() {
+		reply = withNotice(rt.dropped, reply)
+		reply = withResumed(reply, rt.resume)
+	}()
 
 	// 1. expired clarify — a question was parked but its TTL ran out, so the
 	// request behind it is gone. Say that out loud (see clarify.go) and carry
@@ -310,7 +319,33 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 3. clarify answer — if she asked a live question last turn, this
+	// 3. spoken correction — an explicit "нет, это был вопрос" names both the
+	// prior mistake and its replacement. It is narrower evidence than a parked
+	// question merely being present, so it gets first refusal. Otherwise the
+	// clarify resolver treats the correction as a bad slot value and spends a
+	// retry on a turn that was never an answer (V-573).
+	if reply, handled := h.resolveRepair(ctx, text); notePreRoute(ctx, "repair", handled) {
+		return withNotice(expiredNotice, reply)
+	}
+
+	// 3b. The same correction without a target — "нет, не так". It cannot redo
+	// the turn, but it can durably label the previous decision as wrong. Like a
+	// targeted repair, it is not an answer to a parked slot question.
+	if reply, handled := h.resolveUntargetedRepair(ctx, text); notePreRoute(ctx, "repair-negative", handled) {
+		return withNotice(expiredNotice, reply)
+	}
+
+	// 3c. explicit command prohibition — negative authority must be settled
+	// before a parked slot or candidate can consume these words. In particular,
+	// "не отменяй напоминание" is not the subject/time answer to an older
+	// reminder request. Confirmation stays above it: "don't" is already a
+	// closed no-answer to a destructive confirm, and that narrower stateful
+	// contract must retain first refusal.
+	if reply, handled := h.resolveCommandProhibition(ctx, text); notePreRoute(ctx, "command-prohibition", handled) {
+		return withNotice(expiredNotice, reply)
+	}
+
+	// 4. clarify answer — if she asked a live question last turn, this
 	// utterance is its answer, not a fresh command. After the confirm check: a
 	// y/n gate is armed by her own prompt and is the narrower claim on the
 	// utterance.
@@ -321,20 +356,10 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	if reply, handled := h.resolveClarifyAnswer(ctx, text); notePreRoute(ctx, "clarify-answer", handled) {
 		return withNotice(expiredNotice, reply)
 	}
-	// It did not claim the turn. If it let a parked request go to get out of the
-	// way, that has to be said in front of whatever these words are answered
-	// with — carried on the same notice, so every exit below keeps it.
-	expiredNotice = withNotice(expiredNotice, rt.dropped)
+	// It did not claim the turn. Any drop notice or resumed question recorded on
+	// rt is attached by the turn finaliser above, including on an early return.
 
-	// 3b. and if it SUSPENDED a request instead of letting it go, the question
-	// comes back on the end of whatever these words are answered with (Vikunja
-	// #561). A deferred append rather than a call at each exit: there are eight
-	// returns between here and the replier, and the flow has to survive all of
-	// them — one that forgot would be a request parked for ever, waiting for an
-	// answer to a question he never heard asked.
-	defer func() { reply = withResumed(reply, rt.resume) }()
-
-	// 4. quiet-hours toggle — keyword match, not classifier-dependent.
+	// 5. quiet-hours toggle — keyword match, not classifier-dependent.
 	// "тихий режим" / "quiet on" would route through the classifier
 	// unreliably (it's a command, not a free-form query), so we match it
 	// before routing. Same pattern as the confirm turn above.
@@ -342,7 +367,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 4b. spoken snooze — "не сейчас" / "потом" answers the nudge she just
+	// 5b. spoken snooze — "не сейчас" / "потом" answers the nudge she just
 	// sent. Only handled when a pending nudge is actually inside the window
 	// (snooze.go); otherwise the words route normally, because "потом" is an
 	// ordinary word and eating every one of them would break real sentences.
@@ -350,30 +375,22 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 4c. spoken ack — "готово" closes that same nudge as `acted`. Only the
+	// 5c. spoken ack — "готово" closes that same nudge as `acted`. Only the
 	// contentless form is intercepted here; "выпил воды" keeps routing and
 	// closes the nudge after its fact lands (ackFromFact, step 8b).
 	if reply, handled := h.resolveAck(ctx, text, src); notePreRoute(ctx, "ack", handled) {
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 4d. spoken correction — "нет, это была заметка" points at the previous
-	// turn and names what it should have been (repair.go). Before routing,
-	// like the confirm and clarify turns: routing the correction as a fresh
-	// utterance files the correction itself instead of fixing anything.
-	if reply, handled := h.resolveRepair(ctx, text); notePreRoute(ctx, "repair", handled) {
+	// 5d. committed-reminder cancellation — an explicit cancel verb plus the
+	// reminder noun resolves against pending rows. It runs before ordinal so a
+	// clock such as "на девять" cannot be mistaken for a position in an older
+	// task list; an ambiguous result binds its own list for the next turn.
+	if reply, handled := h.resolveReminderCancellation(ctx, text); notePreRoute(ctx, "reminder-cancel", handled) {
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 4d-ii. and the same correction without a target — "нет, не так" (V-636).
-	// After the targeted one, which is the narrower claim: an utterance that
-	// names an intent is answered by redoing the request, and this rung only
-	// gets the ones that name nothing.
-	if reply, handled := h.resolveUntargetedRepair(ctx, text); notePreRoute(ctx, "repair-negative", handled) {
-		return withNotice(expiredNotice, reply)
-	}
-
-	// 4e. ordinal selection — "второй", "первую сделал" pick from the list she
+	// 5e. ordinal selection — "второй", "первую сделал" pick from the list she
 	// just read (ordinal.go). Before routing, and only when a list is actually
 	// bound to the session: with nothing offered, "второй" is an ordinary word
 	// and keeps routing.
@@ -381,7 +398,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 5. route. An elliptical follow-up — "а завтра?" — is answered from the
+	// 6. route. An elliptical follow-up — "а завтра?" — is answered from the
 	// previous turn instead (continuation.go): the intent is the part it is
 	// missing, so no amount of routing recovers it, and the model's guess
 	// costs seconds to obtain and is close to a coin flip. Everything else
@@ -398,7 +415,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	}
 	log.Printf("voice: route result: intent=%s slots=%+v", dec.Intent, dec.Slots)
 
-	// 6. dialogue — fill this turn's missing slots from a prior same-intent
+	// 7. dialogue — fill this turn's missing slots from a prior same-intent
 	// turn (follow-ups like «напомни завтра» → «…позвонить маме»), then remember
 	// this turn for the next follow-up. Only same-intent, non-expired, non-
 	// clarify turns carry (see followUpMerge). Best-effort: nil store ⇒ skipped.
@@ -416,7 +433,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		}
 	}
 
-	// 7. clarify — something she needs is missing. If one named thing is missing,
+	// 8. clarify — something she needs is missing. If one named thing is missing,
 	// ask about it and park the request (clarify.go); otherwise the replier's
 	// canned reply stands.
 	//
@@ -443,7 +460,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		h.recordTurn(text, dec.Intent)
 	}
 
-	// 8. action — execute the decision's intent. errors here surface as
+	// 9. action — execute the decision's intent. errors here surface as
 	// short reply text (the user wants to know the action didn't land);
 	// the round-trip stays alive.
 	replyText := h.applyAction(ctx, dec)
@@ -452,11 +469,11 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	// intent has no chain and no scoreboard, so the handler is the winner.
 	noteTerminal(ctx, "action-handler", dec.Intent, "")
 
-	// 8b. a fact that answers a live nudge closes it as `acted` (ack.go).
+	// 9b. a fact that answers a live nudge closes it as `acted` (ack.go).
 	// Silent: the fact reply stands, she does not congratulate him for it.
 	h.ackFromFact(ctx, dec)
 
-	// 9. replier — phrase the reply across the router decision.
+	// 10. replier — phrase the reply across the router decision.
 	if replyText == "" {
 		replyText = h.replier.Reply(ctx, dec)
 	}
@@ -555,10 +572,17 @@ func (h *reactiveHandler) replySystem(ctx context.Context, dec router.Decision)
 // history lists. Shared by chatHistory and rememberTurn (clarify.go) so the
 // same session is described the same way in both places.
 func sessionAsTurn(s *dialogue.Session) dialogue.Turn {
+	text := s.Utterance
+	if text == "" {
+		// Compatibility with a session blob written before Utterance became a
+		// first-class field. Slots.Text was the old transcript by convention
+		// for query/chat/system turns, and is still better than dropping it.
+		text = s.Slots.Text
+	}
 	return dialogue.Turn{
 		Intent: s.Intent,
 		Slots:  s.Slots,
-		Text:   s.Slots.Text,
+		Text:   text,
 	}
 }
 
@@ -574,11 +598,12 @@ func (h *reactiveHandler) chatHistory(ctx context.Context) []dialogue.Turn {
 	if prev == nil {
 		return nil
 	}
-	// History already includes the immediate prior turn (set by the dialogue
-	// merge in runTurn's step 6, above), plus up to 3 more from deeper history.
-	out := make([]dialogue.Turn, 0, 1+len(prev.History))
-	out = append(out, sessionAsTurn(prev))
-	out = append(out, prev.History...)
+	// rememberTurn runs before the action so query handlers can bind candidate
+	// lists to the current session. Therefore prev is the CURRENT turn here;
+	// its History is precisely the prior transcript. Adding sessionAsTurn(prev)
+	// would hand the model the current utterance twice.
+	out := make([]dialogue.Turn, len(prev.History))
+	copy(out, prev.History)
 	return out
 }
 

cmd/mavend/voicewire.go

@@ -377,17 +377,22 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 // degraded mode, so the seam is nil and the cascade routes with the classifier.
 func modelSeam(cfg *config.Config, resident *llm.Client) (router.Completer, *llm.Pair) {
 	if resident == nil {
-		if cfg.Workstation != nil {
+		if cfg.Workstation != nil && !cfg.Workstation.ModelDisabled {
 			log.Printf("voice: a workstation is configured but there is no resident model to floor it with — ignoring the block")
 		}
 		return nil, nil
 	}
-	if cfg.Workstation == nil {
+	if cfg.Workstation == nil || cfg.Workstation.ModelDisabled {
 		return resident, nil
 	}
 	ws := cfg.Workstation
+	remote := llm.New(ws.URL, time.Duration(ws.Timeout))
+	remote.SetToken(ws.Token)
+	if ws.Token == "" {
+		log.Printf("voice: unauthenticated workstation model endpoint is loopback-only")
+	}
 	pair := llm.NewPair(
-		llm.New(ws.URL, time.Duration(ws.Timeout)),
+		remote,
 		resident,
 		ws.Health,
 		time.Duration(ws.Probe),
@@ -429,7 +434,7 @@ func sttSeam(cfg *config.Config, floor stt.Transcriber) (stt.Transcriber, *stt.P
 	)
 	pair.Start(context.Background())
 	if s.Token == "" {
-		log.Print("voice: the workstation transcriber has no token, so anything on the LAN can post audio to it")
+		log.Print("voice: unauthenticated workstation transcriber endpoint is loopback-only")
 	}
 	log.Printf("voice: workstation transcriber at %s, probed every %s, mavsttd as the floor",
 		s.URL, time.Duration(s.Probe))
@@ -464,45 +469,9 @@ func buildRouter(emb router.Embedder, acts router.ActMatcher, threshold float64,
 	llmR *router.LLMRouter, heads *router.RouterHeads) *router.Router {
 	cls := router.NewClassifier(emb)
 	seedClassifier(cls)
-	grammars := router.DefaultGrammars(acts)
-	grammars = append(grammars, router.SystemTimeDateGrammars()...)
-	// After the time/date rules on purpose: "какой сегодня день" is a clock
-	// question and must keep reaching replySystem, while "что у меня сегодня"
-	// is an agenda question and must not.
-	grammars = append(grammars, router.AgendaQueryGrammars()...)
-	// Same reason as the agenda rules, for the feeds: "что нового в лентах?"
-	// routed system and answered "пока не умею" (Vikunja #474).
-	// After the agenda rules, which are the narrower claim, and BEFORE the feed
-	// and list rules, which are not: "что такое лента" is a definition question
-	// and the feed rule would take it on the noun alone (V-655).
-	grammars = append(grammars, router.WorldQueryGrammars()...)
-	grammars = append(grammars, router.FeedQueryGrammar())
-	// The list side of the same exposure: a phrasing with no possessive in it
-	// ("список дел") routed system and never reached queryTasks (Vikunja #467).
-	grammars = append(grammars, router.TaskListGrammar())
-	grammars = append(grammars, router.ListGrammars()...)
-	grammars = append(grammars, router.ReminderGrammar())
-	// Before the capture marker, because "отметь" is a capture verb and "отметь
-	// второй пункт" is not a note. The Praxis rules are the narrower claim — a
-	// lifecycle verb AND an item named — so they get first refusal (Vikunja #516).
-	grammars = append(grammars, router.PraxisGrammars()...)
-	// Last, and it matches any utterance shape — its Build is the filter. An
-	// explicit capture marker beats the model, which called it an act and
-	// rewrote the task text (Vikunja #467). After the rules above because a
-	// marker never collides with a clock or agenda question.
-	// After Praxis, whose bare "закрой" claim this rule cannot reach (it needs the
-	// board noun), and before the capture marker, which would otherwise read
-	// "убери из задач купить молоко" as a new task (Vikunja #512).
-	grammars = append(grammars, router.TaskStatusGrammar())
-	// Before the capture markers, which all need an object. A capture verb
-	// alone is a fact with no key, and the clarify path asks for it rather than
-	// letting the model invent an answer (Vikunja #557).
-	grammars = append(grammars, router.BareCaptureGrammar()...)
-	grammars = append(grammars, router.TaskCaptureGrammar())
-	// After the capture marker, so "запиши" still wins over "расскажи", and
-	// last overall because it matches on the first word alone: "расскажи про
-	// X" is a world question the model called a fact (Vikunja #498).
-	grammars = append(grammars, router.NarrativeQueryGrammars()...)
+	// The stage 0 set, in the router package, so the eval fixture runs the rules
+	// the daemon runs (V-693). Order and reasoning live with the list.
+	grammars := router.StageZeroGrammars(acts)
 	return router.New(router.Config{
 		Grammars:   grammars,
 		Classifier: cls,

cmd/mavgpud/auth.go

@@ -0,0 +1,145 @@
+package main
+
+import (
+	"crypto/sha256"
+	"crypto/subtle"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+)
+
+// The boundary in front of the card.
+//
+// mavgpud has to listen on the LAN, because homesrv is the client and a
+// loopback default takes the model arm down. That makes this the one hop on the
+// workstation anything on the network could reach, and until 2026-08-11 it
+// reverse-proxied every path to llama-server unauthenticated: any client could
+// spend the card, hold the model resident by touching the idle clock, and read
+// /slots, which carries the prompts of whoever else was using it.
+//
+// So: a bearer token every request must carry, read from a file, and a path
+// allowlist so a token that leaks buys the model API and not the admin one. The
+// CW2 transcriber beside this daemon has worked this way since it shipped; this
+// is the same arrangement, not a new one.
+
+// readToken loads the bearer token. The file holds the token and nothing else,
+// trailing newline allowed. A path that is set and unreadable is fatal to the
+// caller: a supervisor that silently ran without its boundary is the failure
+// this exists to prevent.
+func readToken(path string) (string, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("token_file: %w", err)
+	}
+	tok := strings.TrimSpace(string(b))
+	if tok == "" {
+		return "", fmt.Errorf("token_file %s is empty", path)
+	}
+	return tok, nil
+}
+
+// loopbackListen reports whether addr can only be reached from this machine.
+// An empty or wildcard host is not loopback, which is the case that matters:
+// ":8080" is the shipped default and it answers the whole LAN.
+func loopbackListen(addr string) bool {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		host = addr
+	}
+	host = strings.Trim(host, "[]")
+	if host == "" {
+		return false
+	}
+	if host == "localhost" {
+		return true
+	}
+	ip := net.ParseIP(host)
+	return ip != nil && ip.IsLoopback()
+}
+
+// allowed is what a token buys. Everything llama-server exposes beyond this is
+// refused, because the endpoints Maven does not call are the expensive ones to
+// hand out: /slots returns other callers' prompts, and its save/restore actions
+// write files chosen by the request.
+//
+// Adding a caller means adding its path here. That is deliberate — the list is
+// short because Maven's use of the workstation is.
+var allowed = map[string]string{
+	"/v1/chat/completions": http.MethodPost,
+	"/v1/completions":      http.MethodPost,
+	"/v1/embeddings":       http.MethodPost,
+	"/v1/models":           http.MethodGet,
+	"/props":               http.MethodGet,
+}
+
+// requireToken authenticates, then bounds. Order matters: an unauthenticated
+// client must not be able to make this daemon allocate a body buffer.
+//
+// /health is not exempt. It reports whether the card is loaded and free, which
+// is exactly what someone deciding whether to take it from him would ask.
+func requireToken(token string, maxBody int64, next http.Handler) http.Handler {
+	want := sha256.Sum256([]byte(token))
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		got := sha256.Sum256([]byte(bearer(r)))
+		if subtle.ConstantTimeCompare(got[:], want[:]) != 1 {
+			w.Header().Set("WWW-Authenticate", "Bearer")
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		r.Body = http.MaxBytesReader(w, r.Body, maxBody)
+		next.ServeHTTP(w, r)
+	})
+}
+
+// bearer pulls the credential out of the header. A malformed header yields the
+// empty string, which fails the comparison like any other wrong token — there
+// is no separate error for it, because telling a caller *how* it was wrong is
+// the only thing a probe learns from a 401.
+func bearer(r *http.Request) string {
+	h := r.Header.Get("Authorization")
+	const prefix = "Bearer "
+	if len(h) <= len(prefix) || !strings.EqualFold(h[:len(prefix)], prefix) {
+		return ""
+	}
+	return strings.TrimSpace(h[len(prefix):])
+}
+
+// allowlist refuses a path the model arm does not use. It answers 404 rather
+// than 403 so a scan cannot map llama-server's surface through this hop.
+func allowlist(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		method, ok := allowed[r.URL.Path]
+		if !ok {
+			http.NotFound(w, r)
+			return
+		}
+		if r.Method != method {
+			w.Header().Set("Allow", method)
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// limitInflight caps concurrent proxied requests. A waiter leaves when its own
+// context ends, so a client that gave up does not keep a slot: llama-server
+// runs with -np 1 and queueing here is cheaper than queueing inside the child
+// with a body held in memory on both sides.
+func limitInflight(n int, next http.Handler) http.Handler {
+	if n <= 0 {
+		return next
+	}
+	slots := make(chan struct{}, n)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		select {
+		case slots <- struct{}{}:
+			defer func() { <-slots }()
+			next.ServeHTTP(w, r)
+		case <-r.Context().Done():
+			http.Error(w, "client went away", http.StatusServiceUnavailable)
+		}
+	})
+}

cmd/mavgpud/auth_test.go

@@ -0,0 +1,180 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// ok is what the boundary is protecting: anything that reaches it has spent
+// the card.
+func ok(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusTeapot) }
+
+func TestRequireTokenRefusesEveryWrongCredential(t *testing.T) {
+	h := requireToken("s3cret", 1<<20, http.HandlerFunc(ok))
+	cases := []struct {
+		name string
+		auth string
+		want int
+	}{
+		{"no header", "", http.StatusUnauthorized},
+		{"wrong token", "Bearer wrong", http.StatusUnauthorized},
+		{"prefix of the token", "Bearer s3cre", http.StatusUnauthorized},
+		{"token with no scheme", "s3cret", http.StatusUnauthorized},
+		{"basic auth", "Basic czNjcmV0", http.StatusUnauthorized},
+		{"right token", "Bearer s3cret", http.StatusTeapot},
+		{"scheme is case-insensitive", "bearer s3cret", http.StatusTeapot},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/health", nil)
+			if tc.auth != "" {
+				r.Header.Set("Authorization", tc.auth)
+			}
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, r)
+			if w.Code != tc.want {
+				t.Errorf("status %d, want %d", w.Code, tc.want)
+			}
+		})
+	}
+}
+
+// The 401 must not say which part was wrong. A probe that can tell a malformed
+// header from a wrong token learns the header shape for free.
+func TestUnauthorizedSaysNothingUseful(t *testing.T) {
+	h := requireToken("s3cret", 1<<20, http.HandlerFunc(ok))
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/health", nil))
+	if got := strings.TrimSpace(w.Body.String()); got != "unauthorized" {
+		t.Errorf("body %q, want %q", got, "unauthorized")
+	}
+	if got := w.Header().Get("WWW-Authenticate"); got != "Bearer" {
+		t.Errorf("WWW-Authenticate %q, want Bearer", got)
+	}
+}
+
+// The body cap applies to an authenticated request. An unauthenticated one
+// never gets far enough to allocate anything.
+func TestRequireTokenCapsTheBody(t *testing.T) {
+	var read error
+	h := requireToken("t", 8, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		buf := make([]byte, 64)
+		for read == nil {
+			if _, read = r.Body.Read(buf); read != nil {
+				break
+			}
+		}
+	}))
+	r := httptest.NewRequest(http.MethodPost, "/v1/chat/completions", strings.NewReader(strings.Repeat("x", 4096)))
+	r.Header.Set("Authorization", "Bearer t")
+	h.ServeHTTP(httptest.NewRecorder(), r)
+	if read == nil || !strings.Contains(read.Error(), "too large") {
+		t.Errorf("read error %v, want the body cap", read)
+	}
+}
+
+func TestAllowlistRefusesWhatMavenDoesNotCall(t *testing.T) {
+	h := allowlist(http.HandlerFunc(ok))
+	cases := []struct {
+		method, path string
+		want         int
+	}{
+		{http.MethodPost, "/v1/chat/completions", http.StatusTeapot},
+		{http.MethodGet, "/v1/models", http.StatusTeapot},
+		// /slots returns the prompts of whoever else is using the card, and
+		// its actions write files the request names.
+		{http.MethodGet, "/slots", http.StatusNotFound},
+		{http.MethodPost, "/slots/0?action=save", http.StatusNotFound},
+		{http.MethodGet, "/", http.StatusNotFound},
+		{http.MethodGet, "/v1/chat/completions", http.StatusMethodNotAllowed},
+	}
+	for _, tc := range cases {
+		t.Run(tc.method+" "+tc.path, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, httptest.NewRequest(tc.method, tc.path, nil))
+			if w.Code != tc.want {
+				t.Errorf("status %d, want %d", w.Code, tc.want)
+			}
+		})
+	}
+}
+
+func TestLimitInflightCapsConcurrency(t *testing.T) {
+	const cap = 2
+	var mu sync.Mutex
+	now, peak := 0, 0
+	release := make(chan struct{})
+	h := limitInflight(cap, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		mu.Lock()
+		now++
+		if now > peak {
+			peak = now
+		}
+		mu.Unlock()
+		<-release
+		mu.Lock()
+		now--
+		mu.Unlock()
+	}))
+
+	var wg sync.WaitGroup
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			h.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodPost, "/v1/chat/completions", nil))
+		}()
+	}
+	// Let the first wave arrive, then drain. The assertion is the peak, and a
+	// peak that never reached the cap still cannot exceed it.
+	close(release)
+	wg.Wait()
+	if peak > cap {
+		t.Errorf("%d requests in flight at once, cap is %d", peak, cap)
+	}
+}
+
+func TestLoopbackListen(t *testing.T) {
+	cases := map[string]bool{
+		":8080":              false, // the shipped default, and the whole LAN
+		"0.0.0.0:8080":       false,
+		"[::]:8080":          false,
+		"192.168.1.105:8080": false,
+		"127.0.0.1:8080":     true,
+		"[::1]:8080":         true,
+		"localhost:8080":     true,
+	}
+	for addr, want := range cases {
+		if got := loopbackListen(addr); got != want {
+			t.Errorf("loopbackListen(%q) = %v, want %v", addr, got, want)
+		}
+	}
+}
+
+func TestReadToken(t *testing.T) {
+	dir := t.TempDir()
+	good := filepath.Join(dir, "tok")
+	if err := os.WriteFile(good, []byte("  abc123\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	got, err := readToken(good)
+	if err != nil || got != "abc123" {
+		t.Errorf("readToken = %q, %v; want abc123", got, err)
+	}
+
+	blank := filepath.Join(dir, "blank")
+	if err := os.WriteFile(blank, []byte("\n\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readToken(blank); err == nil {
+		t.Error("an empty token file is not a token")
+	}
+	if _, err := readToken(filepath.Join(dir, "absent")); err == nil {
+		t.Error("a missing token file is not a token")
+	}
+}

cmd/mavgpud/gpu_test.go

@@ -104,9 +104,11 @@ func TestHealthAndProxyRefuseWhenNotReady(t *testing.T) {
 	s := &supervisor{run: newRunner("fake", "/bin/true", nil, "")}
 	h := s.handler(mustURL(t, "http://127.0.0.1:1"))
 
-	for _, path := range []string{"/health", "/v1/chat/completions"} {
+	// The completion is a POST because the allowlist is in front of the
+	// readiness check now, and it answers 405 to a method it never serves.
+	for path, method := range map[string]string{"/health": http.MethodGet, "/v1/chat/completions": http.MethodPost} {
 		w := httptest.NewRecorder()
-		h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, path, nil))
+		h.ServeHTTP(w, httptest.NewRequest(method, path, nil))
 		if w.Code != http.StatusServiceUnavailable {
 			t.Errorf("%s with no model: got %d, want 503", path, w.Code)
 		}

cmd/mavgpud/main.go

@@ -36,6 +36,21 @@ type config struct {
 	Listen    string `json:"listen"`     // what Maven talks to
 	LlamaAddr string `json:"llama_addr"` // where llama-server binds
 	LlamaBin  string `json:"llama_bin"`
+
+	// TokenFile holds the bearer token every request must carry. It is a path
+	// and never the token itself, the rule mavpoll, mavmaild and the CW2
+	// transcriber already follow: a secret in a committed config is a secret
+	// in the history. Empty is allowed only on a loopback Listen, and
+	// requireToken is where that is decided.
+	TokenFile string `json:"token_file,omitempty"`
+
+	// MaxBody bounds a proxied request body. A completion is a prompt, and a
+	// prompt that does not fit here would not fit the context window either.
+	MaxBody int64 `json:"max_body_bytes,omitempty"`
+	// MaxInflight bounds how many proxied requests reach llama-server at once.
+	// It runs with -np 1, so anything above a handful only queues inside the
+	// child while holding a connection and a body in memory here.
+	MaxInflight int `json:"max_inflight,omitempty"`
 	// LlamaArgs must include the flags that bind LlamaAddr. They are passed
 	// through untouched so the model, context size and layer count stay the
 	// owner's business and not this daemon's schema.
@@ -88,6 +103,8 @@ func defaults() config {
 		MinFreeVRAM: 15 << 30,
 		EvictAfter:  2,
 		StartAfter:  5,
+		MaxBody:     8 << 20,
+		MaxInflight: 4,
 	}
 }
 
@@ -123,6 +140,20 @@ func main() {
 		log.Fatal("mavgpud: llama_bin is required")
 	}
 
+	// A LAN listener with no token is refused rather than downgraded to
+	// loopback. Downgrading would look like a safe default and would take the
+	// model arm down instead: homesrv is the client and it is on the LAN.
+	var token string
+	if cfg.TokenFile != "" {
+		var err error
+		if token, err = readToken(cfg.TokenFile); err != nil {
+			log.Fatalf("mavgpud: %v", err)
+		}
+	} else if !loopbackListen(cfg.Listen) {
+		log.Fatalf("mavgpud: listen %s is reachable from the network and token_file is unset — "+
+			"set token_file, or listen on 127.0.0.1 and accept that Maven cannot reach it", cfg.Listen)
+	}
+
 	base := "http://" + cfg.LlamaAddr
 	run := newRunner("llama-server", cfg.LlamaBin, cfg.LlamaArgs, base+"/health")
 	sup := &supervisor{
@@ -145,7 +176,20 @@ func main() {
 	if err != nil {
 		log.Fatalf("mavgpud: llama_addr: %v", err)
 	}
-	srv := &http.Server{Addr: cfg.Listen, Handler: sup.handler(target)}
+	var h http.Handler = sup.handler(target)
+	if token != "" {
+		h = requireToken(token, cfg.MaxBody, h)
+	}
+	srv := &http.Server{
+		Addr:    cfg.Listen,
+		Handler: h,
+		// A slow-loris client holds a connection and a header buffer for free
+		// otherwise. No ReadTimeout or WriteTimeout: a completion legitimately
+		// takes minutes on this card, and either one would cut it off.
+		ReadHeaderTimeout: 10 * time.Second,
+		IdleTimeout:       60 * time.Second,
+		MaxHeaderBytes:    1 << 16,
+	}
 	go func() {
 		log.Printf("mavgpud: listening on %s, model %s", cfg.Listen, cfg.LlamaBin)
 		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
@@ -203,14 +247,14 @@ func (s *supervisor) handler(target *url.URL) http.Handler {
 		w.Header().Set("Content-Type", "application/json")
 		_, _ = w.Write([]byte(`{"status":"ok"}`))
 	})
-	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+	mux.Handle("/", allowlist(limitInflight(s.cfg.MaxInflight, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if !s.run.isReady() {
 			http.Error(w, "model not loaded", http.StatusServiceUnavailable)
 			return
 		}
 		s.touch()
 		proxy.ServeHTTP(w, r)
-	})
+	}))))
 	return mux
 }
 

cmd/mavweb/ambient.go

@@ -4,6 +4,7 @@ import (
 	"crypto/subtle"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"log"
 	"net/http"
@@ -51,34 +52,41 @@ type ambientResp struct {
 // never registered, so it is treated as a hard failure here too.
 func handleAmbient(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, token string) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
 	if token == "" {
-		http.Error(w, "ambient ingest disabled (no -ambient-token)", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemIntegrationOff,
+			"ambient ingest disabled (no -ambient-token)", nil)
 		return
 	}
 	if !ambientAuthorized(r, token) {
-		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		writeProblem(w, r, http.StatusUnauthorized, problemUnauthorized,
+			"unauthorized", nil)
 		return
 	}
 	if core == nil {
-		http.Error(w, "ambient ingest disabled (no -core)", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemCoreUnavailable,
+			"ambient ingest disabled (no -core)", nil)
 		return
 	}
 
 	var n calendar.Notification
 	body, err := io.ReadAll(io.LimitReader(r.Body, ambientMaxBody))
 	if err != nil {
-		http.Error(w, "read failed", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"read failed", fmt.Errorf("read ambient request: %w", err))
 		return
 	}
 	if err := json.Unmarshal(body, &n); err != nil {
-		http.Error(w, "bad json", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"bad json", fmt.Errorf("decode ambient request: %w", err))
 		return
 	}
 	if n.Posted.IsZero() {
-		writeAmbient(w, http.StatusBadRequest, ambientResp{Reason: "posted_at is required"})
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"posted_at is required", nil)
 		return
 	}
 
@@ -99,8 +107,8 @@ func handleAmbient(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, tok
 		writeAmbient(w, http.StatusOK, ambientResp{Stored: false, Key: key, Reason: "unchanged"})
 		return
 	} else if err != nil && !errors.Is(err, ipc.ErrNoFact) {
-		log.Printf("ambient: read %s: %v", key, err)
-		http.Error(w, "read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"read failed", fmt.Errorf("read ambient fact %q: %w", key, err))
 		return
 	}
 
@@ -116,8 +124,8 @@ func handleAmbient(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, tok
 		Source:     calendar.SourceAmbient,
 		Confidence: calendar.AmbientConfidence,
 	}); err != nil {
-		log.Printf("ambient: write %s: %v", key, err)
-		http.Error(w, "write failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreWriteFailed,
+			"write failed", fmt.Errorf("write ambient fact %q: %w", key, err))
 		return
 	}
 	log.Printf("ambient: %s=%s (%s, pkg=%s)", key, val, calendar.SourceAmbient, n.Package)

cmd/mavweb/ambient_test.go

@@ -16,6 +16,18 @@ import (
 
 const ambientTestToken = "s3cret"
 
+func TestValidateAmbientConfig(t *testing.T) {
+	if err := validateAmbientConfig(false, ""); err != nil {
+		t.Fatalf("explicitly disabled ambient config: %v", err)
+	}
+	if err := validateAmbientConfig(true, ""); err == nil {
+		t.Fatal("enabled ambient ingest accepted an empty token")
+	}
+	if err := validateAmbientConfig(true, ambientTestToken); err != nil {
+		t.Fatalf("enabled authenticated ambient config: %v", err)
+	}
+}
+
 // ambientCore adds provenance-scoped reads to fakeCore, which the dedupe path
 // needs.
 type ambientCore struct {

cmd/mavweb/chat.go

@@ -3,7 +3,7 @@ package main
 import (
 	_ "embed"
 	"errors"
-	"log"
+	"fmt"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -47,7 +47,7 @@ var correctionTargets = []router.Intent{
 
 // handleChatPage renders the chat conversation page.
 func handleChatPage(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "chat") {
+	if !requireCore(w, r, core, "chat") {
 		return
 	}
 	msgs := []chatMsg{}
@@ -83,13 +83,14 @@ func handleChatPage(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 // denies, which is the point of that flag.
 func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !requireCore(w, core, "chat") {
+	if !requireCore(w, r, core, "chat") {
 		return
 	}
-	if !stepUpGate(w, session, requireStepUp) {
+	if !stepUpGate(w, r, session, requireStepUp) {
 		return
 	}
 	text := strings.TrimSpace(r.FormValue("text"))
@@ -105,8 +106,8 @@ func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, ses
 	// which is right for a single-owner box.
 	reply, err := core.Chat(r.Context(), "web", text)
 	if err != nil {
-		log.Printf("chat api: %v", err)
-		http.Redirect(w, r, "/chat", http.StatusSeeOther)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreChangeFailed,
+			"chat failed", fmt.Errorf("run web chat turn: %w", err))
 		return
 	}
 	// The claiming query source rides back on the redirect so the page can show
@@ -138,36 +139,40 @@ func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, ses
 // id could otherwise mislabel turns he never corrected.
 func handleCorrectAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !requireCore(w, core, "correct") {
+	if !requireCore(w, r, core, "correct") {
 		return
 	}
-	if !stepUpGate(w, session, requireStepUp) {
+	if !stepUpGate(w, r, session, requireStepUp) {
 		return
 	}
 	id, err := strconv.ParseInt(strings.TrimSpace(r.FormValue("trace_id")), 10, 64)
 	if err != nil || id <= 0 {
-		http.Error(w, "trace_id required", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"trace_id required", err)
 		return
 	}
 	shouldBe := strings.TrimSpace(r.FormValue("should_be"))
 	// Only one of the seven, or nothing. Free text here would put an unroutable
 	// label in the one table V-632 fits prototypes from.
 	if shouldBe != "" && !isCorrectionTarget(shouldBe) {
-		http.Error(w, "should_be must be one of the seven intents", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"should_be must be one of the seven intents", nil)
 		return
 	}
 	if err := core.CorrectTurn(r.Context(), id, shouldBe); err != nil {
-		log.Printf("correct turn %d: %v", id, err)
 		// A turn past the retention bound is gone, and saying so is different
 		// from saying the write broke.
 		if errors.Is(err, ipc.ErrNoSuchTrace) {
-			http.Error(w, "that turn is no longer stored", http.StatusNotFound)
+			writeProblem(w, r, http.StatusNotFound, problemResourceNotFound,
+				"that turn is no longer stored", fmt.Errorf("correct turn %d: %w", id, err))
 			return
 		}
-		http.Error(w, "correction failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreChangeFailed,
+			"correction failed", fmt.Errorf("correct turn %d: %w", id, err))
 		return
 	}
 	stamp := shouldBe

cmd/mavweb/ecosystem.go

@@ -33,17 +33,29 @@ func getEco(ctx context.Context, base, path string, out any) string {
 	}
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, base+path, nil)
 	if err != nil {
-		return err.Error()
+		log.Printf("ecosystem panel request_id=%s build %q: %v", requestIDFromContext(ctx), path, err)
+		return "invalid endpoint"
+	}
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("X-Requested-By", "mavweb")
+	// These are direct browser-surface reads rather than an action initiated in
+	// mavend, so the HTTP request ID is the natural correlation root. Calls that
+	// pass through core mint their action correlation inside mavend instead.
+	if id := requestIDFromContext(ctx); id != "" {
+		req.Header.Set("X-Correlation-ID", id)
 	}
 	resp, err := ecoClient.Do(req)
 	if err != nil {
+		log.Printf("ecosystem panel request_id=%s GET %s: %v", requestIDFromContext(ctx), path, err)
 		return "unreachable"
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != 200 {
+		log.Printf("ecosystem panel request_id=%s GET %s: HTTP %d", requestIDFromContext(ctx), path, resp.StatusCode)
 		return fmt.Sprintf("http %d", resp.StatusCode)
 	}
 	if err := json.NewDecoder(resp.Body).Decode(out); err != nil {
+		log.Printf("ecosystem panel request_id=%s decode %s: %v", requestIDFromContext(ctx), path, err)
 		return "bad json"
 	}
 	return ""
@@ -111,7 +123,7 @@ func handleEcosystem(w http.ResponseWriter, r *http.Request, urls ecoURLs, core
 	if core == nil {
 		d.Calls.Err = "not configured"
 	} else if rows, err := core.RecentEcosystemTraces(ctx, 50); err != nil {
-		log.Printf("ecosystem traces: %v", err)
+		log.Printf("ecosystem traces request_id=%s: %v", requestIDFromContext(ctx), err)
 		d.Calls.Err = "core read failed"
 	} else {
 		d.Calls.Rows = rows

cmd/mavweb/events_test.go

@@ -75,8 +75,13 @@ func TestEventsPageReportsAReadFailure(t *testing.T) {
 		t.Fatalf("status = %d, want 200 with the error rendered", w.Code)
 	}
 	body := w.Body.String()
-	if !strings.Contains(body, "journal unavailable") || !strings.Contains(body, "core is down") {
-		t.Errorf("page did not report the read failure: %s", body)
+	if !strings.Contains(body, "intake journal unavailable") ||
+		!strings.Contains(body, string(problemCoreReadFailed)) ||
+		!strings.Contains(body, "request ") {
+		t.Errorf("page did not report a traceable, sanitized read failure: %s", body)
+	}
+	if strings.Contains(body, "core is down") {
+		t.Errorf("page disclosed the internal read error: %s", body)
 	}
 	if strings.Contains(body, "nothing has arrived yet") {
 		t.Error("a failed read rendered as an empty journal")

cmd/mavweb/facts.go

@@ -3,6 +3,7 @@ package main
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"log"
 	"net/http"
 	"strings"
@@ -32,16 +33,18 @@ var presenceSignals = map[string]string{
 // is a marker. Only allowlisted keys are accepted (see presenceSignals).
 func handleSignal(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !requireCore(w, core, "presence ingest") {
+	if !requireCore(w, r, core, "presence ingest") {
 		return
 	}
 	key := r.URL.Query().Get("key")
 	source, ok := presenceSignals[key]
 	if !ok {
-		http.Error(w, "unknown signal key", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"unknown signal key", nil)
 		return
 	}
 	// kind=env: an observation about the device/surface, NOT a self-fact — a
@@ -56,8 +59,8 @@ func handleSignal(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 		Source:     source,
 		Confidence: 1.0,
 	}); err != nil {
-		log.Printf("signal %s: %v", key, err)
-		http.Error(w, "write failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreWriteFailed,
+			"write failed", fmt.Errorf("write presence signal %q: %w", key, err))
 		return
 	}
 	w.WriteHeader(http.StatusNoContent)
@@ -65,29 +68,32 @@ func handleSignal(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 
 func handleRevert(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !requireCore(w, core, "revert") {
+	if !requireCore(w, r, core, "revert") {
 		return
 	}
-	if !stepUpGate(w, session, requireStepUp) {
+	if !stepUpGate(w, r, session, requireStepUp) {
 		return
 	}
 
 	key := strings.TrimSpace(r.FormValue("key"))
 	if key == "" {
-		http.Error(w, "key required", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"key required", nil)
 		return
 	}
 	newID, err := core.RevertFact(r.Context(), key)
 	if err != nil {
-		log.Printf("revert %q: %v", key, err)
 		if errors.Is(err, ipc.ErrNoFact) {
-			http.Error(w, "no fact to revert", http.StatusNotFound)
+			writeProblem(w, r, http.StatusNotFound, problemResourceNotFound,
+				"no fact to revert", fmt.Errorf("revert fact %q: %w", key, err))
 			return
 		}
-		http.Error(w, "revert failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreChangeFailed,
+			"revert failed", fmt.Errorf("revert fact %q: %w", key, err))
 		return
 	}
 	log.Printf("reverted fact for key=%s, new_id=%d", key, newID)

cmd/mavweb/handlers_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -1218,7 +1219,7 @@ func TestHandleTools_GET_MCPUnavailable(t *testing.T) {
 
 // --- voice-path step-up gate (Vikunja #317) ---
 //
-// POST /api/ptt and GET /ws proxy audio into mavend's voice port, which runs
+// POST /api/ptt proxies audio into mavend's voice port, which runs
 // the same router, LLM and act path as POST /api/chat. They used to be
 // ungated on the grounds that the voice port is only reachable inside the
 // deploy, but mavweb is the thing proxying into it from outside. Speaking
@@ -1269,29 +1270,31 @@ func TestHandlePTT_FailOpenByDefault(t *testing.T) {
 	}
 }
 
-func TestHandleWS_RequireStepUp_FailsClosed(t *testing.T) {
+type endlessByteReader struct{}
+
+func (endlessByteReader) Read(p []byte) (int, error) {
+	for i := range p {
+		p[i] = 'x'
+	}
+	return len(p), nil
+}
+
+func TestHandlePTT_RejectsOversizeAudioBeforeDial(t *testing.T) {
+	req := httptest.NewRequest(http.MethodPost, "/api/ptt", nil)
+	req.Body = io.NopCloser(io.LimitReader(endlessByteReader{}, maxPTTAudioBytes+1))
+	req.ContentLength = maxPTTAudioBytes + 1
 	rr := httptest.NewRecorder()
-	handleWS(rr, httptest.NewRequest(http.MethodGet, "/ws", nil), unreachableVoice, nil, true)
-	if rr.Code != http.StatusForbidden {
-		t.Fatalf("status = %d, want 403; body=%s", rr.Code, rr.Body.String())
+	handlePTT(rr, req, unreachableVoice, nil, false)
+	if rr.Code != http.StatusRequestEntityTooLarge {
+		t.Fatalf("status = %d, want 413; body=%s", rr.Code, rr.Body.String())
 	}
 }
 
-func TestHandleWS_UnassertedSession_Denied(t *testing.T) {
-	rr := httptest.NewRecorder()
-	handleWS(rr, httptest.NewRequest(http.MethodGet, "/ws", nil), unreachableVoice, webauthn.NewPasskeySession(5*time.Minute), false)
-	if rr.Code != http.StatusForbidden {
-		t.Fatalf("status = %d, want 403; body=%s", rr.Code, rr.Body.String())
-	}
-}
-
-// Past the gate the handshake itself fails (httptest's recorder cannot be
-// hijacked), which is not a 403. That is all this asserts: the gate let it by.
-func TestHandleWS_AssertedSession_PassesGate(t *testing.T) {
-	rr := httptest.NewRecorder()
-	handleWS(rr, httptest.NewRequest(http.MethodGet, "/ws", nil), unreachableVoice, stepUpSession(), true)
-	if rr.Code == http.StatusForbidden {
-		t.Fatalf("status = 403 on an asserted session; body=%s", rr.Body.String())
+func TestMavwebHTTPServerHasTransportLimits(t *testing.T) {
+	srv := mavwebHTTPServer("127.0.0.1:0", http.NewServeMux())
+	if srv.ReadHeaderTimeout != mavwebReadHeaderTimeout || srv.ReadTimeout != mavwebReadTimeout ||
+		srv.IdleTimeout != mavwebIdleTimeout || srv.MaxHeaderBytes != mavwebMaxHeaderBytes {
+		t.Fatalf("server transport limits are incomplete: %+v", srv)
 	}
 }
 

cmd/mavweb/main.go

@@ -41,16 +41,21 @@ func main() {
 	coreSock := flag.String("core", "", "mavend IPC socket path for presence-signal ingest (empty = disabled)")
 	pkOrigin := flag.String("webauthn-origin", "", "WebAuthn origin URL (e.g. https://maven.kvmx.ru)")
 	pkRPID := flag.String("webauthn-rpid", "", "WebAuthn RP ID (e.g. maven.kvmx.ru)")
-	requireStepUp := flag.Bool("require-stepup", false, "fail closed on step-up-gated actions (POST /tools, /routines, /models, /api/revert, /api/chat, /api/ptt and GET /ws) when WebAuthn step-up cannot be asserted; default false preserves the historical fail-open behaviour")
+	requireStepUp := flag.Bool("require-stepup", false, "fail closed on step-up-gated actions (POST /tools, /routines, /models, /api/revert, /api/chat and /api/ptt) when WebAuthn step-up cannot be asserted; default false preserves the historical fail-open behaviour")
 	pkFile := flag.String("passkey-file", "./passkeys.json", "path to WebAuthn credential store (JSON)")
 	nexusURL := flag.String("nexus", "", "Nexus base URL for the /ecosystem panel (empty = not configured)")
 	praxisURL := flag.String("praxis", "", "Praxis base URL for the /ecosystem panel (empty = not configured)")
 	hexisURL := flag.String("hexis", "", "Hexis base URL for the /ecosystem panel (empty = not configured)")
 	// Shared secret for POST /api/ambient, the notification-relay ingest that
 	// reads the work calendar as a signal instead of holding a work credential
-	// (see ambient.go). Empty ⇒ the route is not registered at all.
-	ambientToken := flag.String("ambient-token", "", "shared secret for POST /api/ambient notification ingest (empty = ingest disabled, route not registered)")
+	// (see ambient.go). Enabling and authenticating are separate on purpose: an
+	// expanded-empty secret cannot silently turn a live integration off.
+	ambientEnabled := flag.Bool("ambient-enabled", false, "enable POST /api/ambient notification ingest (requires -ambient-token)")
+	ambientToken := flag.String("ambient-token", "", "shared secret for POST /api/ambient notification ingest")
 	flag.Parse()
+	if err := validateAmbientConfig(*ambientEnabled, *ambientToken); err != nil {
+		log.Fatal(err)
+	}
 
 	var core ipc.CoreAPI
 	// swapConn — a second connection, for /models and nothing else. A model swap
@@ -129,16 +134,18 @@ func main() {
 		w.Write([]byte(*ntfyWS))
 	})
 	mux.HandleFunc("/api/signal", corePage(handleSignal))
-	// Off unless configured: no token, no route — an unconfigured ingest is not
-	// a 503 waiting to be probed, it does not exist.
-	if *ambientToken != "" {
+	// Off unless explicitly enabled: a dark ingest has no route at all, while an
+	// enabled ingest with no token was rejected before the server was built.
+	if *ambientEnabled {
 		mux.HandleFunc("/api/ambient", func(w http.ResponseWriter, r *http.Request) {
 			handleAmbient(w, r, core, *ambientToken)
 		})
 		log.Printf("mavweb: ambient notification ingest enabled at POST /api/ambient")
 	}
 
-	// The read surfaces. Every one of them 503s without -core.
+	// The data surfaces. Every one of them 503s without -core. /reminders also
+	// accepts an ID-bound cancellation POST. It is deliberately not step-up
+	// gated: like dismissing a proposed routine, it can only make Maven quieter.
 	mux.HandleFunc("/dash", corePage(handleDash))
 	mux.HandleFunc("/history", corePage(handleHistory))
 	mux.HandleFunc("/trace", corePage(handleTrace))
@@ -194,7 +201,6 @@ func main() {
 	//   POST /api/chat   step-up  — reaches the router, LLM and the act path
 	//   POST /api/ptt    step-up  — audio into runTurn, so the same router,
 	//                               LLM and act path as /api/chat
-	//   GET  /ws         step-up  — same, streamed
 	//   POST /api/signal none     — appends a presence fact, no argv, no act
 	//   POST /api/ambient shared secret — notification relay, constant-time
 	//                               token compare, poster is a phone service
@@ -203,7 +209,7 @@ func main() {
 	// "step-up" means stepUpOK: asserted passkey when WebAuthn is configured,
 	// otherwise fail-open unless -require-stepup, which denies.
 	//
-	// /api/ptt and /ws used to be ungated, justified by mavend's voice port
+	// /api/ptt used to be ungated, justified by mavend's voice port
 	// being reachable only inside the deploy. That argument does not hold:
 	// mavweb is the thing proxying into it from outside. Speaking "выключи
 	// свет" is not a smaller act than typing it (Vikunja #317).
@@ -232,14 +238,11 @@ func main() {
 	mux.HandleFunc("/models", func(w http.ResponseWriter, r *http.Request) {
 		handleModels(w, r, core, swapConn, stepUpSession, *requireStepUp)
 	})
-	mux.HandleFunc("/ws", func(w http.ResponseWriter, r *http.Request) {
-		handleWS(w, r, *voiceAddr, stepUpSession, *requireStepUp)
-	})
 	mux.HandleFunc("/api/ptt", func(w http.ResponseWriter, r *http.Request) {
 		handlePTT(w, r, *voiceAddr, stepUpSession, *requireStepUp)
 	})
 
-	srv := &http.Server{Addr: *addr, Handler: mux}
+	srv := mavwebHTTPServer(*addr, mux)
 
 	go func() {
 		sig := make(chan os.Signal, 1)
@@ -255,6 +258,13 @@ func main() {
 	}
 }
 
+func validateAmbientConfig(enabled bool, token string) error {
+	if enabled && token == "" {
+		return errors.New("mavweb: ambient ingest is enabled but -ambient-token is empty")
+	}
+	return nil
+}
+
 // logUnguardedSurfaces names, at startup, what step-up would have covered had
 // WebAuthn been configured. One surface per line: these are read in a terminal
 // at the moment someone is deciding whether the box is safe to expose.
@@ -266,7 +276,6 @@ func logUnguardedSurfaces(requireStepUp bool) {
 		"POST /api/revert   voids the latest fact for a key",
 		"POST /api/chat     reaches the router, the LLM and, through applyAction, the act path",
 		"POST /api/ptt      the same, from audio",
-		"GET  /ws           the same, streamed",
 	}
 	if requireStepUp {
 		log.Printf("SECURITY: step-up verification is DISABLED (-webauthn-origin/-webauthn-rpid unset) and -require-stepup is set. These surfaces will be DENIED (403):")
@@ -282,3 +291,21 @@ func logUnguardedSurfaces(requireStepUp bool) {
 		log.Printf("SECURITY: they rest on the transport-level auth in front of mavweb (wg+nginx+auth). Do NOT expose -addr on a public interface. Set -webauthn-origin and -webauthn-rpid to require passkey step-up, or pass -require-stepup to fail closed instead.")
 	}
 }
+
+const (
+	mavwebReadHeaderTimeout = 10 * time.Second
+	mavwebReadTimeout       = 2 * time.Minute
+	mavwebIdleTimeout       = 2 * time.Minute
+	mavwebMaxHeaderBytes    = 32 << 10
+)
+
+func mavwebHTTPServer(addr string, handler http.Handler) *http.Server {
+	return &http.Server{
+		Addr:              addr,
+		Handler:           withRequestID(handler),
+		ReadHeaderTimeout: mavwebReadHeaderTimeout,
+		ReadTimeout:       mavwebReadTimeout,
+		IdleTimeout:       mavwebIdleTimeout,
+		MaxHeaderBytes:    mavwebMaxHeaderBytes,
+	}
+}

cmd/mavweb/models.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	_ "embed"
 	"errors"
+	"fmt"
 	"log"
 	"net/http"
 	"strconv"
@@ -57,7 +58,8 @@ type modelsPage struct {
 // the reply. On its own connection the swap only blocks the swap.
 func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swapConn modelController, session *webauthn.PasskeySession, requireStepUp bool) {
 	if core == nil {
-		http.Error(w, "models disabled (no -core)", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemCoreUnavailable,
+			"models disabled (no -core)", nil)
 		return
 	}
 	mc, ok := swapConn, swapConn != nil
@@ -65,7 +67,8 @@ func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swap
 		mc, ok = core.(modelController)
 	}
 	if !ok {
-		http.Error(w, "models unavailable: core connection does not support model swap", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemModelsUnavailable,
+			"models unavailable: core connection does not support model swap", nil)
 		return
 	}
 	ctx := r.Context()
@@ -73,12 +76,14 @@ func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swap
 
 	if r.Method == http.MethodPost {
 		if !stepUpOK(session, requireStepUp) {
-			http.Error(w, "step-up required: assert a passkey first", http.StatusForbidden)
+			writeProblem(w, r, http.StatusForbidden, problemStepUpRequired,
+				"step-up required: assert a passkey first", nil)
 			return
 		}
 		path := strings.TrimSpace(r.FormValue("model_path"))
 		if path == "" {
-			http.Error(w, "model_path required", http.StatusBadRequest)
+			writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+				"model_path required", nil)
 			return
 		}
 		// Only the path comes off the form. n_ctx and n_gpu_layers are load
@@ -93,20 +98,26 @@ func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swap
 			page.Msg = "loaded " + res.Model + " (" + strconv.FormatInt(res.TookMs, 10) + "ms)"
 			log.Printf("models: swapped to %s (%s) in %dms", res.ModelPath, res.Model, res.TookMs)
 		case errors.Is(err, ipc.ErrForbidden):
-			http.Error(w, "refused: that model is not in phraser.swap_models, or step-up was not asserted", http.StatusForbidden)
+			writeProblem(w, r, http.StatusForbidden, problemModelsForbidden,
+				"refused: that model is not in phraser.swap_models, or step-up was not asserted",
+				fmt.Errorf("swap model %q: %w", path, err))
 			return
 		case errors.Is(err, ipc.ErrUnknownMethod):
-			http.Error(w, "swap not configured on this core", http.StatusServiceUnavailable)
+			writeProblem(w, r, http.StatusServiceUnavailable, problemModelsUnavailable,
+				"swap not configured on this core", fmt.Errorf("swap model %q: %w", path, err))
 			return
 		case res.NoBackend:
-			page.Err = "swap failed AND the rollback failed — no model is loaded. She is answering from templates and routing on the classifier. Try loading a model again; a restart is not needed."
-			log.Printf("models: swap to %s failed and the rollback failed, no model loaded: %v", path, err)
+			page.Err = inlineProblem(r, problemModelsUnavailable,
+				"swap failed AND the rollback failed — no model is loaded. She is answering from templates and routing on the classifier. Try loading a model again; a restart is not needed.",
+				fmt.Errorf("swap model %q and rollback: %w", path, err))
 		case res.RolledBack:
-			page.Err = "swap failed, rolled back to " + res.Model + " — she is still answering, with the old model"
-			log.Printf("models: swap to %s failed, rolled back: %v", path, err)
+			page.Err = inlineProblem(r, problemModelsUnavailable,
+				"swap failed, rolled back to "+res.Model+" — she is still answering, with the old model",
+				fmt.Errorf("swap model %q, rolled back to %q: %w", path, res.Model, err))
 		default:
-			page.Err = "swap failed: " + err.Error()
-			log.Printf("models: swap to %s failed: %v", path, err)
+			page.Err = inlineProblem(r, problemModelsUnavailable,
+				"swap failed; the current model state is shown below",
+				fmt.Errorf("swap model %q: %w", path, err))
 		}
 	}
 
@@ -115,8 +126,8 @@ func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swap
 		if errors.Is(err, ipc.ErrUnknownMethod) {
 			page.Off = true
 		} else {
-			log.Printf("models: status: %v", err)
-			http.Error(w, "core read failed", http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+				"core read failed", fmt.Errorf("read model status: %w", err))
 			return
 		}
 	}

cmd/mavweb/models_test.go

@@ -149,6 +149,27 @@ type errBrokenModel struct{}
 
 func (errBrokenModel) Error() string { return "llm: server did not start" }
 
+type errPrivateModel struct{}
+
+func (errPrivateModel) Error() string { return "exec /private/llama-server: token rejected" }
+
+func TestModels_SwapFailureIsSanitizedAndTraceable(t *testing.T) {
+	core := &fakeModelCore{
+		swapErr: errPrivateModel{},
+		status:  ipc.ModelStatusResp{Model: "qwen3", ModelPath: "/m/old.gguf"},
+	}
+	w := modelsPOST(t, core, nil, false, "/m/cpt.gguf")
+	body := w.Body.String()
+	for _, want := range []string{"swap failed", string(problemModelsUnavailable), "request "} {
+		if !strings.Contains(body, want) {
+			t.Errorf("sanitized model error missing %q:\n%s", want, body)
+		}
+	}
+	if strings.Contains(body, "/private/llama-server") || strings.Contains(body, "token rejected") {
+		t.Errorf("model page disclosed the backend error:\n%s", body)
+	}
+}
+
 func TestModels_TotalFailureDoesNotSaySheIsStillAnswering(t *testing.T) {
 	// The load failed and so did the rollback: nothing is loaded. The page used
 	// to branch on RolledBack first and render "rolled back to  — she is still

cmd/mavweb/notifications.go

@@ -2,7 +2,7 @@ package main
 
 import (
 	_ "embed"
-	"log"
+	"fmt"
 	"net/http"
 	"strconv"
 
@@ -48,14 +48,14 @@ func deliveryRows(as []ipc.DeliveryAttempt) []deliveryRow {
 }
 
 func handleNotifications(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "notifications") {
+	if !requireCore(w, r, core, "notifications") {
 		return
 	}
 	ctx := r.Context()
 	nudges, err := core.RecentNudges(ctx, 50)
 	if err != nil {
-		log.Printf("notifications: %v", err)
-		http.Error(w, "notifications error: "+err.Error(), http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"notifications unavailable", fmt.Errorf("read recent nudges: %w", err))
 		return
 	}
 	// The outbox, on the page that already answers "what did she send".
@@ -66,7 +66,8 @@ func handleNotifications(w http.ResponseWriter, r *http.Request, core ipc.CoreAP
 	if err != nil {
 		// The nudge list is still worth showing, so this is a note on the page
 		// rather than a dead page.
-		log.Printf("notifications: delivery attempts: %v", err)
+		logProblem(r, http.StatusOK, problemCoreReadFailed,
+			"delivery attempts unavailable", fmt.Errorf("read delivery attempts: %w", err))
 	}
 	renderPage(w, notificationsTmpl, map[string]any{
 		"Nudges":   nudges,

cmd/mavweb/pages.go

@@ -3,8 +3,8 @@ package main
 import (
 	"cmp"
 	_ "embed"
+	"fmt"
 	"html/template"
-	"log"
 	"net/http"
 	"strings"
 	"time"
@@ -73,7 +73,7 @@ var voiceTmpl = parsePage("voice", voiceHTML, nil)
 var ecosystemTmpl = parsePage("ecosystem", ecosystemHTML, nil)
 
 func handleDash(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "dash") {
+	if !requireCore(w, r, core, "dash") {
 		return
 	}
 	ctx := r.Context()
@@ -82,8 +82,8 @@ func handleDash(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	nudges, err3 := core.RecentNudges(ctx, 50)
 	notes, err4 := core.RecentNotes(ctx, 50)
 	if err := cmp.Or(err1, err2, err3, err4); err != nil {
-		log.Printf("dash: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("read dashboard: %w", err))
 		return
 	}
 	renderPage(w, dashTmpl, struct {
@@ -95,13 +95,13 @@ func handleDash(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 }
 
 func handleHistory(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "history") {
+	if !requireCore(w, r, core, "history") {
 		return
 	}
 	facts, err := core.RecentFacts(r.Context(), 200)
 	if err != nil {
-		log.Printf("history: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("read fact history: %w", err))
 		return
 	}
 	renderPage(w, historyTmpl, struct {
@@ -110,13 +110,13 @@ func handleHistory(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 }
 
 func handleTrace(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "trace") {
+	if !requireCore(w, r, core, "trace") {
 		return
 	}
 	trace, err := core.TickTrace(r.Context())
 	if err != nil {
-		log.Printf("trace: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("read tick trace: %w", err))
 		return
 	}
 	// The turn records share this page rather than getting one of their own
@@ -127,7 +127,8 @@ func handleTrace(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	// deploy.
 	turns, err := core.TurnDecisions(r.Context(), 25)
 	if err != nil {
-		log.Printf("trace: turn decisions: %v", err)
+		logProblem(r, http.StatusOK, problemCoreReadFailed,
+			"turn decisions unavailable", fmt.Errorf("read turn decisions: %w", err))
 	}
 	renderPage(w, traceTmpl, traceData{Tick: trace, Turns: turns})
 }
@@ -149,14 +150,14 @@ type morningView struct {
 }
 
 func handleMorning(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "morning") {
+	if !requireCore(w, r, core, "morning") {
 		return
 	}
 	ctx := r.Context()
 	status, err := core.MorningStatus(ctx)
 	if err != nil {
-		log.Printf("morning: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("read morning status: %w", err))
 		return
 	}
 	view := morningView{Routines: status}
@@ -165,8 +166,8 @@ func handleMorning(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	// down with it — the page degrades to what it had before.
 	plan, err := core.DayPlan(ctx)
 	if err != nil {
-		log.Printf("morning: day plan: %v", err)
-		view.PlanErr = err.Error()
+		view.PlanErr = inlineProblem(r, problemCoreReadFailed,
+			"day plan unavailable", fmt.Errorf("read day plan: %w", err))
 	} else {
 		view.Plan = &plan
 	}
@@ -186,14 +187,14 @@ type eventsView struct {
 const eventsPageLimit = 200
 
 func handleEvents(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "intake journal") {
+	if !requireCore(w, r, core, "intake journal") {
 		return
 	}
 	var view eventsView
 	evs, err := core.RecentEvents(r.Context(), eventsPageLimit)
 	if err != nil {
-		log.Printf("events: %v", err)
-		view.Err = err.Error()
+		view.Err = inlineProblem(r, problemCoreReadFailed,
+			"intake journal unavailable", fmt.Errorf("read intake journal: %w", err))
 	} else {
 		view.Events = evs
 	}

cmd/mavweb/problems.go

@@ -0,0 +1,118 @@
+package main
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+)
+
+// problemCode is the stable, low-cardinality name a client can key on. The
+// request ID identifies one occurrence; the code identifies the class of
+// failure without exposing the wrapped implementation error.
+type problemCode string
+
+const (
+	problemMethodNotAllowed  problemCode = "request.method_not_allowed"
+	problemInvalidRequest    problemCode = "request.invalid"
+	problemPayloadTooLarge   problemCode = "request.payload_too_large"
+	problemUnauthorized      problemCode = "auth.unauthorized"
+	problemStepUpRequired    problemCode = "auth.step_up_required"
+	problemResourceNotFound  problemCode = "resource.not_found"
+	problemIntegrationOff    problemCode = "integration.disabled"
+	problemCoreUnavailable   problemCode = "core.unavailable"
+	problemCoreReadFailed    problemCode = "core.read_failed"
+	problemCoreWriteFailed   problemCode = "core.write_failed"
+	problemCoreChangeFailed  problemCode = "core.change_failed"
+	problemToolsChange       problemCode = "tools.change_failed"
+	problemRoutinesChange    problemCode = "routines.change_failed"
+	problemModelsUnavailable problemCode = "models.unavailable"
+	problemModelsForbidden   problemCode = "models.forbidden"
+	problemWebAuthnBegin     problemCode = "webauthn.begin_failed"
+	problemWebAuthnFinish    problemCode = "webauthn.finish_failed"
+	problemWebAuthnStepUp    problemCode = "webauthn.step_up_failed"
+	problemVoiceUnavailable  problemCode = "voice.unavailable"
+	problemVoiceTransport    problemCode = "voice.transport_failed"
+	problemVoiceResponse     problemCode = "voice.response_failed"
+)
+
+type requestIDKey struct{}
+
+// problemLogger is separate from the package-wide logger so the contract test
+// can capture exactly one problem line without redirecting unrelated output.
+var problemLogger = log.New(os.Stderr, "", log.LstdFlags)
+
+// problemResponse is the one non-success envelope returned by mavweb. Error is
+// deliberately a public message, never err.Error(). Code is stable across
+// occurrences; request_id joins this answer to the full server-side log line.
+type problemResponse struct {
+	Error     string      `json:"error"`
+	Code      problemCode `json:"code"`
+	RequestID string      `json:"request_id"`
+}
+
+// withRequestID mints the request identifier at the HTTP boundary. A caller's
+// X-Request-ID is ignored: accepting it would let an untrusted client forge a
+// link to another request's logs. The generated ID is also returned on success,
+// which lets an operator start from any surprising response, not errors alone.
+func withRequestID(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		id := rand.Text()
+		w.Header().Set("X-Request-ID", id)
+		ctx := context.WithValue(r.Context(), requestIDKey{}, id)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func requestIDFromContext(ctx context.Context) string {
+	id, _ := ctx.Value(requestIDKey{}).(string)
+	return id
+}
+
+func problemRequestID(r *http.Request) string {
+	id := requestIDFromContext(r.Context())
+	if id == "" {
+		id = rand.Text()
+	}
+	return id
+}
+
+func logProblem(r *http.Request, status int, code problemCode, public string, err error) string {
+	id := problemRequestID(r)
+	if err == nil {
+		err = errors.New(public)
+	}
+	problemLogger.Printf("mavweb problem request_id=%s code=%s status=%d method=%s path=%q: %v",
+		id, code, status, r.Method, r.URL.Path, err)
+	return id
+}
+
+// inlineProblem preserves a useful partial page when one panel fails, while
+// applying the same disclosure and correlation rules as an HTTP problem.
+func inlineProblem(r *http.Request, code problemCode, public string, err error) string {
+	id := logProblem(r, http.StatusOK, code, public, err)
+	return fmt.Sprintf("%s (code %s, request %s)", public, code, id)
+}
+
+// writeProblem is the only mavweb HTTP error writer. The wrapped error is
+// logged in full and only the explicit public message, stable code and request
+// ID cross the HTTP boundary.
+func writeProblem(w http.ResponseWriter, r *http.Request, status int, code problemCode, public string, err error) {
+	// Unit-level handlers and embedders may call a handler without installing
+	// the server middleware. They still get the same traceable contract.
+	id := logProblem(r, status, code, public, err)
+	w.Header().Set("X-Request-ID", id)
+
+	w.Header().Set("Content-Type", "application/problem+json; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(status)
+	// A failed client connection leaves nowhere useful to report an encoder
+	// error; the full problem is already in the server log before this write.
+	_ = json.NewEncoder(w).Encode(problemResponse{
+		Error: public, Code: code, RequestID: id,
+	})
+}

cmd/mavweb/problems_test.go

@@ -0,0 +1,135 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"io"
+	"log"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestWriteProblemSanitizesAndCorrelates(t *testing.T) {
+	var logs bytes.Buffer
+	old := problemLogger
+	problemLogger = logForTest(&logs)
+	t.Cleanup(func() { problemLogger = old })
+
+	const id = "TESTREQUESTID"
+	r := httptest.NewRequest(http.MethodPost, "/tools", nil)
+	r = r.WithContext(context.WithValue(r.Context(), requestIDKey{}, id))
+	w := httptest.NewRecorder()
+	internal := errors.New("dial unix /run/private/mavend.sock: bearer secret-token")
+	writeProblem(w, r, http.StatusBadGateway, problemToolsChange, "enable failed", internal)
+
+	if w.Code != http.StatusBadGateway {
+		t.Fatalf("status = %d, want 502", w.Code)
+	}
+	if got := w.Header().Get("X-Request-ID"); got != id {
+		t.Fatalf("X-Request-ID = %q, want %q", got, id)
+	}
+	if got := w.Header().Get("Content-Type"); !strings.HasPrefix(got, "application/problem+json") {
+		t.Fatalf("Content-Type = %q", got)
+	}
+	var got problemResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatalf("decode problem: %v", err)
+	}
+	if got.Error != "enable failed" || got.Code != problemToolsChange || got.RequestID != id {
+		t.Fatalf("problem = %+v", got)
+	}
+	if strings.Contains(w.Body.String(), "private") || strings.Contains(w.Body.String(), "secret-token") {
+		t.Fatalf("HTTP response disclosed the wrapped error: %s", w.Body.String())
+	}
+	for _, want := range []string{id, string(problemToolsChange), internal.Error()} {
+		if !strings.Contains(logs.String(), want) {
+			t.Errorf("server log missing %q: %s", want, logs.String())
+		}
+	}
+}
+
+func TestRequestIDMiddlewareMintsAndIgnoresCallerID(t *testing.T) {
+	var seen string
+	h := withRequestID(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		seen = requestIDFromContext(r.Context())
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	r := httptest.NewRequest(http.MethodGet, "/api/ping", nil)
+	r.Header.Set("X-Request-ID", "caller-chosen")
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+
+	if seen == "" || seen == "caller-chosen" {
+		t.Fatalf("request ID = %q; want a server-generated value", seen)
+	}
+	if got := w.Header().Get("X-Request-ID"); got != seen {
+		t.Fatalf("response request ID = %q, context ID = %q", got, seen)
+	}
+}
+
+func TestEcosystemPanelPropagatesRequestID(t *testing.T) {
+	const id = "WEBREQUESTCORRELATION"
+	var correlation, requester string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		correlation = r.Header.Get("X-Correlation-ID")
+		requester = r.Header.Get("X-Requested-By")
+		_, _ = io.WriteString(w, `[]`)
+	}))
+	defer srv.Close()
+	ctx := context.WithValue(context.Background(), requestIDKey{}, id)
+	var rows []ecoEntity
+	if got := getEco(ctx, srv.URL, "/entities", &rows); got != "" {
+		t.Fatalf("getEco error = %q", got)
+	}
+	if correlation != id || requester != "mavweb" {
+		t.Fatalf("correlation = %q, requester = %q", correlation, requester)
+	}
+}
+
+// The contract is architectural, not a convention people must remember. Keep
+// a syntax-level guard so a new handler cannot bypass writeProblem by adding
+// another http.Error call.
+func TestProductionHandlersUseOneProblemWriter(t *testing.T) {
+	entries, err := os.ReadDir(".")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, entry := range entries {
+		name := entry.Name()
+		if entry.IsDir() || !strings.HasSuffix(name, ".go") || strings.HasSuffix(name, "_test.go") {
+			continue
+		}
+		file, err := parser.ParseFile(token.NewFileSet(), filepath.Clean(name), nil, 0)
+		if err != nil {
+			t.Fatalf("parse %s: %v", name, err)
+		}
+		ast.Inspect(file, func(n ast.Node) bool {
+			call, ok := n.(*ast.CallExpr)
+			if !ok {
+				return true
+			}
+			sel, ok := call.Fun.(*ast.SelectorExpr)
+			if !ok || sel.Sel.Name != "Error" {
+				return true
+			}
+			pkg, ok := sel.X.(*ast.Ident)
+			if ok && pkg.Name == "http" {
+				t.Errorf("%s contains http.Error; use writeProblem", name)
+			}
+			return true
+		})
+	}
+}
+
+func logForTest(w io.Writer) *log.Logger {
+	return log.New(w, "", 0)
+}

cmd/mavweb/reminders.go

@@ -3,8 +3,10 @@ package main
 import (
 	_ "embed"
 	"encoding/json"
-	"log"
+	"errors"
+	"fmt"
 	"net/http"
+	"strconv"
 	"strings"
 
 	"github.com/kami/maven/internal/ipc"
@@ -23,10 +25,14 @@ var remindersTmpl = parsePage("reminders", remindersHTML, nil)
 // (Vikunja #469). Neither is a formatting nicety: the envelope is an internal
 // shape he never chose, and a time on a page he reads is the time on his wall.
 type reminderRow struct {
-	Created string
-	Fires   string
-	Status  string
-	Text    string
+	ID        int64
+	Created   string
+	Fires     string
+	Schedule  string
+	Status    string
+	Detail    string
+	Text      string
+	CanCancel bool
 }
 
 // reminderText unwraps the {"text":...} payload the router writes.
@@ -50,25 +56,125 @@ func reminderText(payload string) string {
 func reminderRows(rs []ipc.Reminder) []reminderRow {
 	out := make([]reminderRow, 0, len(rs))
 	for _, r := range rs {
+		fire := r.NextFireTs
+		if fire.IsZero() {
+			fire = r.FireTs
+		}
+		status := r.Status
+		detail := ""
+		schedule := ""
+		if r.Cron != "" {
+			schedule = "recurring · " + r.Cron
+		}
+		if !r.DeliveryBlockedTs.IsZero() {
+			status = "blocked"
+			detail = r.DeliveryBlockedError
+		} else if r.DeliveryAttempts > 0 && !r.NextAttemptTs.IsZero() {
+			detail = "retry " + r.NextAttemptTs.Local().Format("02 Jan 15:04")
+		}
 		out = append(out, reminderRow{
-			Created: r.CreatedTs.Local().Format("02 Jan 15:04"),
-			Fires:   r.FireTs.Local().Format("02 Jan 15:04"),
-			Status:  r.Status,
-			Text:    reminderText(r.Payload),
+			ID:        r.ID,
+			Created:   r.CreatedTs.Local().Format("02 Jan 15:04"),
+			Fires:     fire.Local().Format("02 Jan 15:04"),
+			Schedule:  schedule,
+			Status:    status,
+			Detail:    detail,
+			Text:      reminderText(r.Payload),
+			CanCancel: r.Status == "pending",
 		})
 	}
 	return out
 }
 
-func handleReminders(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "reminders") {
-		return
+// remindersForPage keeps every pending row reachable while retaining the
+// recent terminal history the page already showed. Pending rows come first in
+// firing order (the CoreAPI contract); IDs present in the recent window are not
+// duplicated below them.
+func remindersForPage(pending, recent []ipc.Reminder) []ipc.Reminder {
+	out := make([]ipc.Reminder, 0, len(pending)+len(recent))
+	seen := make(map[int64]bool, len(pending))
+	for _, reminder := range pending {
+		out = append(out, reminder)
+		seen[reminder.ID] = true
 	}
-	reminders, err := core.ListReminders(r.Context(), 50)
-	if err != nil {
-		log.Printf("reminders: %v", err)
-		http.Error(w, "reminders error: "+err.Error(), http.StatusBadGateway)
-		return
+	for _, reminder := range recent {
+		if seen[reminder.ID] {
+			continue
+		}
+		out = append(out, reminder)
 	}
-	renderPage(w, remindersTmpl, map[string]any{"Reminders": reminderRows(reminders)})
+	return out
+}
+
+func handleReminders(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
+	if !requireCore(w, r, core, "reminders") {
+		return
+	}
+	msg := ""
+	if r.Method == http.MethodGet && r.URL.Query().Get("cancelled") == "1" {
+		msg = "reminder cancelled"
+	}
+	switch r.Method {
+	case http.MethodGet:
+	case http.MethodPost:
+		if strings.TrimSpace(r.FormValue("action")) != "cancel" {
+			writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+				"unknown reminder action", nil)
+			return
+		}
+		id, err := strconv.ParseInt(strings.TrimSpace(r.FormValue("id")), 10, 64)
+		if err != nil || id <= 0 {
+			writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+				"invalid reminder id", err)
+			return
+		}
+		if err := core.CancelReminder(r.Context(), id); err != nil {
+			switch {
+			case errors.Is(err, ipc.ErrReminderNotFound):
+				writeProblem(w, r, http.StatusNotFound, problemResourceNotFound,
+					"reminder not found", err)
+			case errors.Is(err, ipc.ErrReminderInFlight):
+				writeProblem(w, r, http.StatusConflict, problemCoreChangeFailed,
+					"reminder delivery has already started", err)
+			case errors.Is(err, ipc.ErrReminderState):
+				writeProblem(w, r, http.StatusConflict, problemCoreChangeFailed,
+					"reminder is no longer pending", err)
+			default:
+				writeProblem(w, r, http.StatusBadGateway, problemCoreChangeFailed,
+					"reminder cancellation failed", fmt.Errorf("cancel reminder %d: %w", id, err))
+			}
+			return
+		}
+		http.Redirect(w, r, "/reminders?cancelled=1", http.StatusSeeOther)
+		return
+	default:
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"method not allowed", nil)
+		return
+	}
+	pending, err := core.ListPendingReminders(r.Context(), 0)
+	if err != nil {
+		public := "reminders unavailable"
+		if msg != "" {
+			public = "reminder cancelled; refreshed list unavailable"
+		}
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			public, fmt.Errorf("list pending reminders: %w", err))
+		return
+	}
+	recent, err := core.ListReminders(r.Context(), 50)
+	if err != nil {
+		public := "reminders unavailable"
+		if msg != "" {
+			public = "reminder cancelled; refreshed list unavailable"
+		}
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			public, fmt.Errorf("list reminders: %w", err))
+		return
+	}
+	reminders := remindersForPage(pending, recent)
+	renderPage(w, remindersTmpl, struct {
+		Msg       string
+		Reminders []reminderRow
+	}{msg, reminderRows(reminders)})
 }

cmd/mavweb/reminders.html

@@ -1,12 +1,17 @@
 {{template "shellTop" "reminders"}}
 <h1>Reminders</h1>
+{{if .Msg}}<div class="msg msg-ok">{{.Msg}}</div>{{end}}
 {{if .Reminders}}<div class=scroll><table>
-<tr><th>created</th><th>fires</th><th>status</th><th>what</th></tr>
+<tr><th>created</th><th>fires</th><th>status</th><th>what</th><th>action</th></tr>
 {{range .Reminders}}<tr>
 <td class=hint>{{.Created}}</td>
-<td>{{.Fires}}</td>
-<td><span class="badge {{.Status}}">{{.Status}}</span></td>
+<td>{{.Fires}}{{if .Schedule}}<div class=hint>{{.Schedule}}</div>{{end}}</td>
+<td><span class="badge {{.Status}}">{{.Status}}</span>{{if .Detail}}<div class=hint>{{.Detail}}</div>{{end}}</td>
 <td class=text-max>{{.Text}}</td>
+<td>{{if .CanCancel}}<form method="post" action="/reminders">
+  <input type="hidden" name="id" value="{{.ID}}">
+  <button type="submit" name="action" value="cancel">cancel</button>
+</form>{{end}}</td>
 </tr>{{end}}</table></div>
 {{else}}<div class=empty>
   <svg class=icon width="24" height="24"><use href="/ethos-icons.svg#i-calendar"/></svg>

cmd/mavweb/reminders_test.go

@@ -1,6 +1,11 @@
 package main
 
 import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
 	"strings"
 	"testing"
 	"time"
@@ -12,6 +17,7 @@ import (
 func TestReminderRowsUnwrapAndLocalise(t *testing.T) {
 	fire := time.Date(2026, 8, 4, 18, 30, 0, 0, time.UTC)
 	rows := reminderRows([]ipc.Reminder{{
+		ID:        17,
 		CreatedTs: fire.Add(-time.Hour),
 		FireTs:    fire,
 		Status:    "pending",
@@ -29,6 +35,49 @@ func TestReminderRowsUnwrapAndLocalise(t *testing.T) {
 	if strings.Contains(rows[0].Text, "{") {
 		t.Errorf("Text still carries JSON: %q", rows[0].Text)
 	}
+	if rows[0].ID != 17 || !rows[0].CanCancel {
+		t.Errorf("pending reminder action binding = %+v, want id 17 cancellable", rows[0])
+	}
+}
+
+func TestReminderRowsExposeBlockedDelivery(t *testing.T) {
+	blocked := time.Date(2026, 8, 13, 8, 0, 0, 0, time.UTC)
+	rows := reminderRows([]ipc.Reminder{{
+		Status:               "pending",
+		Payload:              `{"text":"позвонить врачу"}`,
+		DeliveryBlockedTs:    blocked,
+		DeliveryBlockedError: "ntfy credentials rejected",
+	}})
+	if len(rows) != 1 || rows[0].Status != "blocked" || rows[0].Detail != "ntfy credentials rejected" {
+		t.Fatalf("blocked reminder is not visible: %+v", rows)
+	}
+	if !rows[0].CanCancel {
+		t.Fatal("a blocked but still-pending reminder must remain cancellable")
+	}
+}
+
+func TestReminderRowsShowTheCurrentRecurringOccurrence(t *testing.T) {
+	original := time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC)
+	next := time.Date(2026, 8, 16, 9, 0, 0, 0, time.UTC)
+	rows := reminderRows([]ipc.Reminder{{
+		ID: 42, FireTs: original, NextFireTs: next, Cron: "0 9 * * *",
+		Status: "pending", Payload: `{"text":"принять лекарство"}`,
+	}})
+	if len(rows) != 1 || rows[0].Fires != next.Local().Format("02 Jan 15:04") {
+		t.Fatalf("recurring fire = %+v, want current occurrence %s", rows, next)
+	}
+	if rows[0].Schedule != "recurring · 0 9 * * *" || !rows[0].CanCancel {
+		t.Fatalf("recurring identity/action = %+v", rows[0])
+	}
+}
+
+func TestReminderRowsOnlyPendingCanCancel(t *testing.T) {
+	rows := reminderRows([]ipc.Reminder{{Status: "cancelled"}, {Status: "fired"}})
+	for _, row := range rows {
+		if row.CanCancel {
+			t.Errorf("terminal row %+v exposed a cancel action", row)
+		}
+	}
 }
 
 // A payload that is not the envelope is his own words, so it is shown as it is.
@@ -44,3 +93,169 @@ func TestReminderTextKeepsPlainPayload(t *testing.T) {
 		}
 	}
 }
+
+type reminderCore struct {
+	ipc.UnimplementedCoreAPI
+
+	reminders  []ipc.Reminder
+	pending    []ipc.Reminder
+	listErr    error
+	pendingErr error
+	cancelErr  error
+	cancelID   int64
+}
+
+func (c *reminderCore) ListReminders(context.Context, int) ([]ipc.Reminder, error) {
+	return c.reminders, c.listErr
+}
+
+func (c *reminderCore) ListPendingReminders(context.Context, int) ([]ipc.Reminder, error) {
+	return c.pending, c.pendingErr
+}
+
+func (c *reminderCore) CancelReminder(_ context.Context, id int64) error {
+	c.cancelID = id
+	if c.cancelErr != nil {
+		return c.cancelErr
+	}
+	for i := range c.reminders {
+		if c.reminders[i].ID == id {
+			c.reminders[i].Status = "cancelled"
+		}
+	}
+	return nil
+}
+
+func reminderPost(action, id string) *http.Request {
+	form := url.Values{"action": {action}, "id": {id}}
+	req := httptest.NewRequest(http.MethodPost, "/reminders", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	return req
+}
+
+func TestHandleRemindersCancel(t *testing.T) {
+	core := &reminderCore{reminders: []ipc.Reminder{{
+		ID: 23, Status: "pending", Payload: `{"text":"позвонить врачу"}`,
+	}}}
+	rr := httptest.NewRecorder()
+	handleReminders(rr, reminderPost("cancel", "23"), core)
+
+	if rr.Code != http.StatusSeeOther || rr.Header().Get("Location") != "/reminders?cancelled=1" {
+		t.Fatalf("status/location = %d %q, want 303 PRG", rr.Code, rr.Header().Get("Location"))
+	}
+	if core.cancelID != 23 {
+		t.Fatalf("cancel id = %d, want 23", core.cancelID)
+	}
+
+	rr = httptest.NewRecorder()
+	handleReminders(rr, httptest.NewRequest(http.MethodGet, "/reminders?cancelled=1", nil), core)
+	if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), "reminder cancelled") || strings.Contains(rr.Body.String(), "value=\"23\"") {
+		t.Fatalf("redirect outcome rendered incorrectly: status=%d body=%s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestHandleRemindersSuccessfulMutationDoesNotDependOnRefresh(t *testing.T) {
+	core := &reminderCore{listErr: errors.New("offline"), pendingErr: errors.New("offline")}
+	rr := httptest.NewRecorder()
+	handleReminders(rr, reminderPost("cancel", "23"), core)
+	if rr.Code != http.StatusSeeOther || core.cancelID != 23 {
+		t.Fatalf("successful cancellation became refresh failure: status=%d id=%d body=%s", rr.Code, core.cancelID, rr.Body.String())
+	}
+}
+
+func TestHandleRemindersIncludesPendingRowsOutsideRecentWindow(t *testing.T) {
+	old := ipc.Reminder{ID: 1, Status: "pending", Payload: `{"text":"old but pending"}`}
+	recent := make([]ipc.Reminder, 50)
+	for i := range recent {
+		recent[i] = ipc.Reminder{ID: int64(i + 2), Status: "fired", Payload: `{"text":"history"}`}
+	}
+	core := &reminderCore{pending: []ipc.Reminder{old}, reminders: recent}
+	rr := httptest.NewRecorder()
+	handleReminders(rr, httptest.NewRequest(http.MethodGet, "/reminders", nil), core)
+	if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), "old but pending") ||
+		!strings.Contains(rr.Body.String(), `value="1"`) {
+		t.Fatalf("old pending reminder is not reachable: status=%d body=%s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestHandleRemindersRejectsMalformedPosts(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		action string
+		id     string
+	}{
+		{"unknown action", "delete", "23"},
+		{"missing id", "cancel", ""},
+		{"non-numeric id", "cancel", "twenty-three"},
+		{"non-positive id", "cancel", "0"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			core := &reminderCore{}
+			rr := httptest.NewRecorder()
+			handleReminders(rr, reminderPost(tc.action, tc.id), core)
+			if rr.Code != http.StatusBadRequest {
+				t.Fatalf("status = %d, want 400; body=%s", rr.Code, rr.Body.String())
+			}
+			if core.cancelID != 0 {
+				t.Fatalf("CancelReminder called with %d for malformed post", core.cancelID)
+			}
+		})
+	}
+}
+
+func TestHandleRemindersCancelErrors(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		err    error
+		status int
+		public string
+	}{
+		{"missing", ipc.ErrReminderNotFound, http.StatusNotFound, "reminder not found"},
+		{"delivery started", ipc.ErrReminderInFlight, http.StatusConflict, "reminder delivery has already started"},
+		{"terminal", ipc.ErrReminderState, http.StatusConflict, "reminder is no longer pending"},
+		{"transport", errors.New("socket closed"), http.StatusBadGateway, "reminder cancellation failed"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			core := &reminderCore{cancelErr: tc.err}
+			rr := httptest.NewRecorder()
+			handleReminders(rr, reminderPost("cancel", "23"), core)
+			if rr.Code != tc.status || !strings.Contains(rr.Body.String(), tc.public) {
+				t.Fatalf("status/body = %d %q, want %d containing %q", rr.Code, rr.Body.String(), tc.status, tc.public)
+			}
+			if got := rr.Header().Get("Content-Type"); !strings.HasPrefix(got, "application/problem+json") {
+				t.Fatalf("content type = %q, want problem JSON", got)
+			}
+		})
+	}
+}
+
+func TestHandleRemindersMethodAndListErrors(t *testing.T) {
+	t.Run("method", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		handleReminders(rr, httptest.NewRequest(http.MethodDelete, "/reminders", nil), &reminderCore{})
+		if rr.Code != http.StatusMethodNotAllowed {
+			t.Fatalf("status = %d, want 405", rr.Code)
+		}
+	})
+	t.Run("pending list", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		handleReminders(rr, httptest.NewRequest(http.MethodGet, "/reminders", nil), &reminderCore{pendingErr: errors.New("offline")})
+		if rr.Code != http.StatusBadGateway || !strings.Contains(rr.Body.String(), "reminders unavailable") {
+			t.Fatalf("status/body = %d %q, want 502 problem", rr.Code, rr.Body.String())
+		}
+	})
+	t.Run("recent list", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		handleReminders(rr, httptest.NewRequest(http.MethodGet, "/reminders", nil), &reminderCore{listErr: errors.New("offline")})
+		if rr.Code != http.StatusBadGateway || !strings.Contains(rr.Body.String(), "reminders unavailable") {
+			t.Fatalf("status/body = %d %q, want 502 problem", rr.Code, rr.Body.String())
+		}
+	})
+	t.Run("successful outcome remains explicit when redirected refresh fails", func(t *testing.T) {
+		rr := httptest.NewRecorder()
+		handleReminders(rr, httptest.NewRequest(http.MethodGet, "/reminders?cancelled=1", nil), &reminderCore{listErr: errors.New("offline")})
+		if rr.Code != http.StatusBadGateway || !strings.Contains(rr.Body.String(), "reminder cancelled; refreshed list unavailable") {
+			t.Fatalf("status/body = %d %q, want truthful refresh problem", rr.Code, rr.Body.String())
+		}
+	})
+}

cmd/mavweb/routines.go

@@ -5,7 +5,6 @@ import (
 	_ "embed"
 	"errors"
 	"fmt"
-	"log"
 	"net/http"
 	"strconv"
 	"strings"
@@ -41,7 +40,7 @@ type routineView struct {
 // gated — it only ever removes a reason to speak, so the worst a weaker caller
 // can do is make maven quieter.
 func handleRoutines(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
-	if !requireCore(w, core, "routines") {
+	if !requireCore(w, r, core, "routines") {
 		return
 	}
 	ctx := r.Context()
@@ -54,8 +53,8 @@ func handleRoutines(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, se
 	}
 	proposed, err := core.ListProposedRoutines(ctx)
 	if err != nil {
-		log.Printf("routines: list: %v", err)
-		http.Error(w, "routines error: "+err.Error(), http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"routines unavailable", fmt.Errorf("list proposed routines: %w", err))
 		return
 	}
 	renderPage(w, routinesTmpl, struct {
@@ -76,44 +75,45 @@ func applyRoutinePost(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI,
 	// already the step-up-gated surface for this table, and a second gated
 	// surface is a second thing to get wrong.
 	if action == "seed" {
-		if !stepUpGate(w, session, requireStepUp) {
+		if !stepUpGate(w, r, session, requireStepUp) {
 			return "", false
 		}
 		out, err := seedRoutineEvent(ctx, core, r)
 		if err != nil {
-			log.Printf("routines: seed: %v", err)
-			http.Error(w, "seed failed: "+err.Error(), http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemRoutinesChange,
+				"seed failed", fmt.Errorf("seed routine event: %w", err))
 			return "", false
 		}
 		return out, true
 	}
 
-	idStr := r.FormValue("id")
-	var rid int64
-	if n, _ := fmt.Sscanf(idStr, "%d", &rid); n != 1 {
-		http.Error(w, "invalid id", http.StatusBadRequest)
+	rid, err := strconv.ParseInt(strings.TrimSpace(r.FormValue("id")), 10, 64)
+	if err != nil || rid <= 0 {
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"invalid id", err)
 		return "", false
 	}
 	switch action {
 	case "accept":
-		if !stepUpGate(w, session, requireStepUp) {
+		if !stepUpGate(w, r, session, requireStepUp) {
 			return "", false
 		}
 		if err := acceptRoutine(ctx, core, rid); err != nil {
-			log.Printf("routines: accept %d: %v", rid, err)
-			http.Error(w, "accept failed: "+err.Error(), http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemRoutinesChange,
+				"accept failed", fmt.Errorf("accept routine %d: %w", rid, err))
 			return "", false
 		}
 		return "accepted routine — maven will remind you", true
 	case "dismiss":
 		if err := core.DismissProposedRoutine(ctx, rid); err != nil {
-			log.Printf("routines: dismiss %d: %v", rid, err)
-			http.Error(w, "dismiss failed: "+err.Error(), http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemRoutinesChange,
+				"dismiss failed", fmt.Errorf("dismiss routine %d: %w", rid, err))
 			return "", false
 		}
 		return "dismissed routine", true
 	default:
-		http.Error(w, "unknown action", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"unknown action", nil)
 		return "", false
 	}
 }

cmd/mavweb/shell.go

@@ -159,9 +159,10 @@ func renderPage(w http.ResponseWriter, t *template.Template, data any) {
 // requireCore answers whether the surface has a core to read. mavweb runs
 // without -core (voice-only), and every page that needs mavend says so with a
 // 503 naming itself rather than a blank error.
-func requireCore(w http.ResponseWriter, core ipc.CoreAPI, surface string) bool {
+func requireCore(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, surface string) bool {
 	if core == nil {
-		http.Error(w, surface+" disabled (no -core)", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemCoreUnavailable,
+			surface+" disabled (no -core)", nil)
 		return false
 	}
 	return true
@@ -169,11 +170,12 @@ func requireCore(w http.ResponseWriter, core ipc.CoreAPI, surface string) bool {
 
 // stepUpGate reports whether the caller may proceed through the AuthStepUp
 // gate, writing the 403 itself when it may not. See stepUpOK for the policy.
-func stepUpGate(w http.ResponseWriter, session *webauthn.PasskeySession, requireStepUp bool) bool {
+func stepUpGate(w http.ResponseWriter, r *http.Request, session *webauthn.PasskeySession, requireStepUp bool) bool {
 	if stepUpOK(session, requireStepUp) {
 		return true
 	}
-	http.Error(w, "step-up required: assert a passkey first", http.StatusForbidden)
+	writeProblem(w, r, http.StatusForbidden, problemStepUpRequired,
+		"step-up required: assert a passkey first", nil)
 	return false
 }
 

cmd/mavweb/tasks.go

@@ -5,7 +5,6 @@ import (
 	_ "embed"
 	"errors"
 	"fmt"
-	"log"
 	"net/http"
 	"strconv"
 	"strings"
@@ -88,7 +87,7 @@ func rowOf(t ipc.Task) taskRow {
 // from something she read into work he owns. That review step is why derived
 // tasks are captured as candidates in the first place.
 func handleTasks(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "tasks") {
+	if !requireCore(w, r, core, "tasks") {
 		return
 	}
 	ctx := r.Context()
@@ -97,15 +96,14 @@ func handleTasks(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 		var err error
 		msg, err = applyTaskPost(ctx, core, r)
 		if err != nil {
-			log.Printf("tasks: %v", err)
-			errMsg = err.Error()
+			errMsg = inlineProblem(r, problemCoreChangeFailed, taskPublicMessage(err), err)
 		}
 	}
 
 	all, err := core.ListTasks(ctx, "")
 	if err != nil {
-		log.Printf("tasks: list: %v", err)
-		http.Error(w, "tasks error: "+err.Error(), http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"tasks unavailable", fmt.Errorf("list tasks: %w", err))
 		return
 	}
 	// Live rows are ordered by the same ranker the spoken list uses, so the page
@@ -162,6 +160,39 @@ func handleTasks(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	}{msg, errMsg, tasks.Stalls(live, now()), cands, open, resolved, resolvedTotal > len(resolved)})
 }
 
+// taskInputError is a form/domain refusal safe to show back to the owner. IPC,
+// storage and transport errors never use this type and therefore receive the
+// generic task failure text plus a request reference.
+type taskInputError struct{ message string }
+
+func (e *taskInputError) Error() string { return e.message }
+
+func taskInput(message string) error { return &taskInputError{message: message} }
+
+func taskInputf(format string, args ...any) error {
+	return &taskInputError{message: fmt.Sprintf(format, args...)}
+}
+
+type taskPartialError struct {
+	public string
+	err    error
+}
+
+func (e *taskPartialError) Error() string { return e.public + ": " + e.err.Error() }
+func (e *taskPartialError) Unwrap() error { return e.err }
+
+func taskPublicMessage(err error) string {
+	var input *taskInputError
+	if errors.As(err, &input) {
+		return input.message
+	}
+	var partial *taskPartialError
+	if errors.As(err, &partial) {
+		return partial.public
+	}
+	return "task update failed"
+}
+
 // applyTaskPost performs one write and returns the message to show. A bad
 // request returns an error, which the page renders inline rather than as a
 // bare 400 — this is a form surface, not an API.
@@ -170,7 +201,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 	if action == "add" {
 		text := strings.TrimSpace(r.FormValue("text"))
 		if text == "" {
-			return "", errors.New("empty task text")
+			return "", taskInput("empty task text")
 		}
 		req := ipc.CaptureTaskReq{Text: text, Source: "tap:web", Status: "open", Ts: now()}
 		wgt, err := formWeight(r)
@@ -198,7 +229,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 
 	id, err := strconv.ParseInt(r.FormValue("id"), 10, 64)
 	if err != nil {
-		return "", errors.New("invalid id")
+		return "", taskInput("invalid id")
 	}
 
 	if action == "promote" {
@@ -214,7 +245,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 		// is not editable here: that ladder is one-way and has its own buttons.
 		text := strings.TrimSpace(r.FormValue("text"))
 		if text == "" {
-			return "", errors.New("empty task text")
+			return "", taskInput("empty task text")
 		}
 		wgt, err := formWeight(r)
 		if err != nil {
@@ -230,9 +261,9 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 		case errors.Is(err, ipc.ErrTaskDuplicate):
 			// Naming the collision instead of merging: two live rows carry two
 			// provenances, and picking one is not the page's call.
-			return "", errors.New("another open task already says this — drop one of the two")
+			return "", taskInput("another open task already says this — drop one of the two")
 		case errors.Is(err, ipc.ErrTaskResolved):
-			return "", errors.New("a resolved task keeps the text it was finished under")
+			return "", taskInput("a resolved task keeps the text it was finished under")
 		default:
 			return "", err
 		}
@@ -247,7 +278,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 	case "drop":
 		status, msg = "dropped", "dropped task"
 	default:
-		return "", fmt.Errorf("unknown action %q", action)
+		return "", taskInputf("unknown action %q", action)
 	}
 	if err := core.SetTaskStatus(ctx, id, status, now(), "tap:web"); err != nil {
 		return "", statusWriteErr(err)
@@ -257,7 +288,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 
 // errNoDoneWhen — the refusal has to name what is missing, or the button looks
 // broken. The field it asks for arrives with the intake form (Vikunja #511).
-var errNoDoneWhen = errors.New("write a definition of done before confirming this candidate")
+var errNoDoneWhen = taskInput("write a definition of done before confirming this candidate")
 
 // statusWriteErr translates a SetTaskStatus failure into what the page says.
 func statusWriteErr(err error) error {
@@ -281,11 +312,11 @@ func statusWriteErr(err error) error {
 func promoteCandidate(ctx context.Context, core ipc.CoreAPI, r *http.Request, id int64) (string, error) {
 	doneWhen := strings.TrimSpace(r.FormValue("done_when"))
 	if doneWhen == "" {
-		return "", errors.New("write a definition of done — what has to be true for this to be finished")
+		return "", taskInput("write a definition of done — what has to be true for this to be finished")
 	}
 	text := strings.TrimSpace(r.FormValue("text"))
 	if text == "" {
-		return "", errors.New("empty task text")
+		return "", taskInput("empty task text")
 	}
 	due, err := formDue(r, now())
 	if err != nil {
@@ -326,7 +357,7 @@ func promoteCandidate(ctx context.Context, core ipc.CoreAPI, r *http.Request, id
 	if _, err := core.CreateReminder(ctx, fire, text, ""); err != nil {
 		// The task IS promoted; only the reminder failed. Saying "confirmed"
 		// and nothing else would leave him expecting a nudge that will not come.
-		return "", fmt.Errorf("confirmed, but the reminder did not save: %w", err)
+		return "", &taskPartialError{public: "task confirmed, but the reminder did not save", err: err}
 	}
 	return "confirmed, and maven will remind you that morning", nil
 }
@@ -343,15 +374,15 @@ func resolveBlocker(ctx context.Context, core ipc.CoreAPI, field string) (string
 	ref, err := core.ResolveEntity(ctx, name, []string{"person"})
 	switch {
 	case errors.Is(err, ipc.ErrNotImplemented):
-		return "", errors.New("no identity service here, so blocked-on cannot be stored — leave it empty")
+		return "", taskInput("no identity service here, so blocked-on cannot be stored — leave it empty")
 	case errors.Is(err, ipc.ErrNoEntity):
-		return "", fmt.Errorf("nexus does not know %q", name)
+		return "", taskInputf("nexus does not know %q", name)
 	case err != nil:
 		return "", fmt.Errorf("resolving %q: %w", name, err)
 	case ref.Ambiguous:
 		// Asking, not picking: a task blocked on the wrong person is a
 		// mistake nobody can see afterwards.
-		return "", fmt.Errorf("%q matches %s — say which", name, strings.Join(ref.Candidates, ", "))
+		return "", taskInputf("%q matches %s — say which", name, strings.Join(ref.Candidates, ", "))
 	}
 	return ref.ID, nil
 }
@@ -366,7 +397,7 @@ func formWeight(r *http.Request) (int, error) {
 	}
 	wgt, err := strconv.Atoi(v)
 	if err != nil || wgt < 0 {
-		return 0, fmt.Errorf("bad weight %q", v)
+		return 0, taskInputf("bad weight %q", v)
 	}
 	if wgt > tasks.MaxWeight {
 		wgt = tasks.MaxWeight
@@ -383,7 +414,7 @@ func formDue(r *http.Request, now time.Time) (*time.Time, error) {
 	}
 	due, err := time.ParseInLocation("2006-01-02", d, now.Location())
 	if err != nil {
-		return nil, fmt.Errorf("bad due date %q", d)
+		return nil, taskInputf("bad due date %q", d)
 	}
 	return &due, nil
 }

cmd/mavweb/tasks_test.go

@@ -191,6 +191,24 @@ func TestHandleTasksRejectsBadPost(t *testing.T) {
 	}
 }
 
+func TestHandleTasksSanitizesCoreWriteFailure(t *testing.T) {
+	core := &fakeTaskCore{captureErr: fmt.Errorf("sqlite /private/maven.db: key material rejected")}
+	form := url.Values{"action": {"add"}, "text": {"что-то"}}
+	req := httptest.NewRequest(http.MethodPost, "/tasks", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec := httptest.NewRecorder()
+	handleTasks(rec, req, core)
+	body := rec.Body.String()
+	for _, want := range []string{"task update failed", string(problemCoreChangeFailed), "request "} {
+		if !strings.Contains(body, want) {
+			t.Errorf("sanitized task error missing %q: %s", want, body)
+		}
+	}
+	if strings.Contains(body, "/private/maven.db") || strings.Contains(body, "key material") {
+		t.Errorf("task page disclosed the core error: %s", body)
+	}
+}
+
 func TestHandleTasksNoCore(t *testing.T) {
 	rec := httptest.NewRecorder()
 	handleTasks(rec, httptest.NewRequest(http.MethodGet, "/tasks", nil), nil)

cmd/mavweb/tools.go

@@ -3,8 +3,8 @@ package main
 import (
 	"cmp"
 	_ "embed"
+	"fmt"
 	"html/template"
-	"log"
 	"net/http"
 	"strings"
 	"time"
@@ -32,13 +32,13 @@ var toolsTmpl = parsePage("tools", toolsHTML, template.FuncMap{
 // shell-word parsing; the box owner controls this input, quote a wrapper script
 // if an arg needs spaces).
 func handleTools(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
-	if !requireCore(w, core, "tools") {
+	if !requireCore(w, r, core, "tools") {
 		return
 	}
 	ctx := r.Context()
 	var msg string
 	if r.Method == http.MethodPost {
-		if !stepUpGate(w, session, requireStepUp) {
+		if !stepUpGate(w, r, session, requireStepUp) {
 			return
 		}
 		action := r.FormValue("action")
@@ -49,54 +49,59 @@ func handleTools(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, sessi
 			cmd := strings.Fields(r.FormValue("cmd"))
 			destructive := r.FormValue("destructive") != ""
 			if name == "" || len(cmd) == 0 {
-				http.Error(w, "name and cmd required", http.StatusBadRequest)
+				writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+					"name and cmd required", nil)
 				return
 			}
 			if err := core.EnableTool(ctx, name, cmd, destructive, scope, time.Now()); err != nil {
-				log.Printf("tools: enable %q: %v", name, err)
-				http.Error(w, "enable failed: "+err.Error(), http.StatusBadGateway)
+				writeProblem(w, r, http.StatusBadGateway, problemToolsChange,
+					"enable failed", fmt.Errorf("enable tool %q: %w", name, err))
 				return
 			}
 			msg = "enabled " + name
 		case "disable":
 			if name == "" {
-				http.Error(w, "name required", http.StatusBadRequest)
+				writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+					"name required", nil)
 				return
 			}
 			if err := core.DisableTool(ctx, name); err != nil {
-				log.Printf("tools: disable %q: %v", name, err)
-				http.Error(w, "disable failed: "+err.Error(), http.StatusBadGateway)
+				writeProblem(w, r, http.StatusBadGateway, problemToolsChange,
+					"disable failed", fmt.Errorf("disable tool %q: %w", name, err))
 				return
 			}
 			msg = "disabled " + name
 		case "dismiss":
 			if name == "" {
-				http.Error(w, "name required", http.StatusBadRequest)
+				writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+					"name required", nil)
 				return
 			}
 			if err := core.DeleteTool(ctx, name); err != nil {
-				log.Printf("tools: dismiss %q: %v", name, err)
-				http.Error(w, "dismiss failed: "+err.Error(), http.StatusBadGateway)
+				writeProblem(w, r, http.StatusBadGateway, problemToolsChange,
+					"dismiss failed", fmt.Errorf("dismiss tool %q: %w", name, err))
 				return
 			}
 			msg = "dismissed " + name
 		default:
-			http.Error(w, "unknown action", http.StatusBadRequest)
+			writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+				"unknown action", nil)
 			return
 		}
 	}
 	proposed, err1 := core.ListTools(ctx, "proposed")
 	enabled, err2 := core.ListTools(ctx, "enabled")
 	if err := cmp.Or(err1, err2); err != nil {
-		log.Printf("tools: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("list tools: %w", err))
 		return
 	}
 	// MCP is off by default and an older core may not know the method at all,
 	// so a failure here renders an empty section rather than breaking the page.
 	servers, err := core.MCPServers(ctx)
 	if err != nil {
-		log.Printf("tools: mcp servers: %v", err)
+		logProblem(r, http.StatusOK, problemCoreReadFailed,
+			"MCP server status unavailable", fmt.Errorf("read MCP server status: %w", err))
 		servers = nil
 	}
 	// Enabled rows are shown grouped by capability domain (Vikunja #452). A

cmd/mavweb/voiceproxy.go

@@ -1,9 +1,9 @@
 package main
 
 import (
-	"context"
 	"encoding/binary"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -12,22 +12,26 @@ import (
 	"net/url"
 	"time"
 
-	"github.com/coder/websocket"
 	"github.com/kami/maven/internal/audio"
 	"github.com/kami/maven/internal/voice"
 	"github.com/kami/maven/internal/webauthn"
 )
 
-// The two proxies onto mavend's voice port: GET /ws streams turns over a
-// websocket, POST /api/ptt does one turn over plain HTTP. Both carry the same
-// step-up gate, because speaking an act is not a smaller act than typing one
-// (Vikunja #317). The length-prefixed framing they share is at the bottom.
+// POST /api/ptt proxies one turn onto mavend's voice port. It carries the same
+// step-up gate as typed chat, because speaking an act is not a smaller act than
+// typing one (Vikunja #317). The length-prefixed voice framing is at the bottom.
 
 // maxFrame caps a single voice frame in either direction.
 const maxFrame = 64 << 20
 
-// pushToTalk builds the one request either proxy sends. Surface is
-// SurfacePCClient for both: the browser is standing in for the PC client.
+// maxPTTAudioBytes is ten minutes of canonical 16 kHz mono int16 PCM. A PTT
+// turn should be seconds, but the generous cap preserves long dictation while
+// keeping both the HTTP allocation and the base64-expanded voice frame bounded.
+// Meeting capture has its own streaming/blob path and does not use this route.
+const maxPTTAudioBytes int64 = 10 * 60 * 16000 * 2
+
+// pushToTalk builds the request the HTTP proxy sends. SurfacePCClient records
+// that the browser is standing in for the PC client.
 func pushToTalk(pcm []byte) voice.Request {
 	return voice.Request{
 		ID:     uint64(time.Now().UnixNano()),
@@ -40,95 +44,30 @@ func pushToTalk(pcm []byte) voice.Request {
 	}
 }
 
-func handleWS(w http.ResponseWriter, r *http.Request, voiceAddr string, session *webauthn.PasskeySession, requireStepUp bool) {
-	if !stepUpGate(w, session, requireStepUp) {
-		return
-	}
-	conn, err := websocket.Accept(w, r, &websocket.AcceptOptions{
-		OriginPatterns: []string{"*"},
-	})
-	if err != nil {
-		log.Printf("ws accept: %v", err)
-		return
-	}
-	defer conn.Close(websocket.StatusNormalClosure, "bye")
-
-	ctx := r.Context()
-
-	var d net.Dialer
-	tc, err := d.DialContext(ctx, "tcp", voiceAddr)
-	if err != nil {
-		log.Printf("dial voice: %v", err)
-		writeWSErr(conn, ctx, "voice unavailable")
-		return
-	}
-	defer tc.Close()
-
-	for {
-		_, msg, err := conn.Read(ctx)
-		if err != nil {
-			log.Printf("ws read: %v", err)
-			return
-		}
-		if len(msg) < 4 {
-			log.Printf("ws msg too short (%d bytes)", len(msg))
-			continue
-		}
-
-		log.Printf("ws got %d bytes from client", len(msg))
-		req := pushToTalk(msg)
-		if err := writeFrame(tc, &req); err != nil {
-			log.Printf("write voice req: %v", err)
-			return
-		}
-
-		// Read frames until we get the matching Response (handling any interleaved Pushes)
-		for {
-			resp, push, err := readOneFrame(tc)
-			if err != nil {
-				log.Printf("read voice: %v", err)
-				return
-			}
-			if push != nil {
-				data, _ := json.Marshal(push)
-				conn.Write(ctx, websocket.MessageText, data)
-				continue
-			}
-			if resp.Error != nil {
-				writeWSErr(conn, ctx, resp.Error.Message)
-				break
-			}
-			var pttResp voice.PushToTalkResp
-			if err := json.Unmarshal(resp.Result, &pttResp); err != nil {
-				log.Printf("unmarshal resp: %v", err)
-				break
-			}
-			if pttResp.ReplyText != "" {
-				conn.Write(ctx, websocket.MessageText, []byte(pttResp.ReplyText))
-			}
-			if len(pttResp.ReplyAudio.Bytes) > 0 {
-				conn.Write(ctx, websocket.MessageBinary, pttResp.ReplyAudio.Bytes)
-			}
-			break
-		}
-	}
-}
-
 func handlePTT(w http.ResponseWriter, r *http.Request, voiceAddr string, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", 405)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !stepUpGate(w, session, requireStepUp) {
+	if !stepUpGate(w, r, session, requireStepUp) {
 		return
 	}
-	body, err := io.ReadAll(r.Body)
+	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, maxPTTAudioBytes))
 	if err != nil {
-		http.Error(w, err.Error(), 400)
+		var tooLarge *http.MaxBytesError
+		if errors.As(err, &tooLarge) {
+			writeProblem(w, r, http.StatusRequestEntityTooLarge, problemPayloadTooLarge,
+				"audio exceeds the ten-minute PTT limit", err)
+			return
+		}
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"read audio", fmt.Errorf("read PTT audio: %w", err))
 		return
 	}
 	if len(body) < 4 {
-		http.Error(w, "too short", 400)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"audio too short", nil)
 		return
 	}
 
@@ -137,36 +76,38 @@ func handlePTT(w http.ResponseWriter, r *http.Request, voiceAddr string, session
 	var d net.Dialer
 	tc, err := d.DialContext(r.Context(), "tcp", voiceAddr)
 	if err != nil {
-		log.Printf("ptt dial voice: %v", err)
-		http.Error(w, "voice unavailable", 503)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemVoiceUnavailable,
+			"voice unavailable", fmt.Errorf("dial voice service: %w", err))
 		return
 	}
 	defer tc.Close()
 
 	req := pushToTalk(body)
 	if err := writeFrame(tc, &req); err != nil {
-		log.Printf("ptt write: %v", err)
-		http.Error(w, err.Error(), 500)
+		writeProblem(w, r, http.StatusBadGateway, problemVoiceTransport,
+			"voice request failed", fmt.Errorf("write voice request: %w", err))
 		return
 	}
 
 	for {
 		resp, push, err := readOneFrame(tc)
 		if err != nil {
-			log.Printf("ptt read: %v", err)
-			http.Error(w, err.Error(), 500)
+			writeProblem(w, r, http.StatusBadGateway, problemVoiceTransport,
+				"voice response failed", fmt.Errorf("read voice response: %w", err))
 			return
 		}
 		if push != nil {
 			continue
 		}
 		if resp.Error != nil {
-			http.Error(w, resp.Error.Message, 500)
+			writeProblem(w, r, http.StatusBadGateway, problemVoiceResponse,
+				"voice turn failed", fmt.Errorf("voice RPC error: %s", resp.Error.Message))
 			return
 		}
 		var pttResp voice.PushToTalkResp
 		if err := json.Unmarshal(resp.Result, &pttResp); err != nil {
-			http.Error(w, err.Error(), 500)
+			writeProblem(w, r, http.StatusBadGateway, problemVoiceResponse,
+				"voice response failed", fmt.Errorf("decode voice response: %w", err))
 			return
 		}
 		w.Header().Set("Content-Type", "audio/l16;rate=16000;channels=1")
@@ -182,10 +123,6 @@ func handlePTT(w http.ResponseWriter, r *http.Request, voiceAddr string, session
 	}
 }
 
-func writeWSErr(conn *websocket.Conn, ctx context.Context, msg string) {
-	conn.Write(ctx, websocket.MessageText, []byte(`{"error":"`+msg+`"}`))
-}
-
 func writeFrame(w io.Writer, v any) error {
 	body, err := json.Marshal(v)
 	if err != nil {

cmd/mavweb/webauthn.go

@@ -92,8 +92,8 @@ var passkeyTmpl = parsePage("passkey", passkeyPageHTML, nil)
 func (h *PasskeyHandle) RegisterBegin(w http.ResponseWriter, r *http.Request) {
 	opts, challenge, err := h.rp.CreationOptions([]byte("maven-user"), "maven user")
 	if err != nil {
-		log.Printf("webauthn: register begin: %v", err)
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		writeProblem(w, r, http.StatusInternalServerError, problemWebAuthnBegin,
+			"passkey registration could not start", fmt.Errorf("webauthn register begin: %w", err))
 		return
 	}
 	w.Header().Set("Content-Type", "application/json")
@@ -102,7 +102,8 @@ func (h *PasskeyHandle) RegisterBegin(w http.ResponseWriter, r *http.Request) {
 
 func (h *PasskeyHandle) RegisterFinish(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
 	var body struct {
@@ -110,7 +111,8 @@ func (h *PasskeyHandle) RegisterFinish(w http.ResponseWriter, r *http.Request) {
 		Credential map[string]any `json:"credential"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		http.Error(w, "bad request: "+err.Error(), http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"invalid registration request", fmt.Errorf("decode webauthn registration: %w", err))
 		return
 	}
 	save := func(id string, publicKey []byte, _ []byte, _ string) error {
@@ -118,8 +120,8 @@ func (h *PasskeyHandle) RegisterFinish(w http.ResponseWriter, r *http.Request) {
 	}
 	credID, err := h.rp.FinishRegistration(save, body.Challenge, body.Credential)
 	if err != nil {
-		log.Printf("webauthn: register finish: %v", err)
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemWebAuthnFinish,
+			"passkey registration failed", fmt.Errorf("webauthn register finish: %w", err))
 		return
 	}
 	log.Printf("webauthn: registered credential %s", credID)
@@ -140,8 +142,8 @@ func (h *PasskeyHandle) RegisterFinish(w http.ResponseWriter, r *http.Request) {
 func (h *PasskeyHandle) AssertBegin(w http.ResponseWriter, r *http.Request) {
 	opts, challenge, err := h.rp.AssertionOptions()
 	if err != nil {
-		log.Printf("webauthn: assert begin: %v", err)
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		writeProblem(w, r, http.StatusInternalServerError, problemWebAuthnBegin,
+			"passkey assertion could not start", fmt.Errorf("webauthn assert begin: %w", err))
 		return
 	}
 	w.Header().Set("Content-Type", "application/json")
@@ -150,7 +152,8 @@ func (h *PasskeyHandle) AssertBegin(w http.ResponseWriter, r *http.Request) {
 
 func (h *PasskeyHandle) AssertFinish(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
 	var body struct {
@@ -176,7 +179,8 @@ func (h *PasskeyHandle) AssertFinish(w http.ResponseWriter, r *http.Request) {
 		Explicit bool `json:"explicit"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		http.Error(w, "bad request: "+err.Error(), http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"invalid assertion request", fmt.Errorf("decode webauthn assertion: %w", err))
 		return
 	}
 
@@ -189,8 +193,8 @@ func (h *PasskeyHandle) AssertFinish(w http.ResponseWriter, r *http.Request) {
 
 	credID, err := h.rp.FinishAssertion(lookup, update, body.Challenge, body.Credential)
 	if err != nil {
-		log.Printf("webauthn: assert finish: %v", err)
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemWebAuthnFinish,
+			"passkey assertion failed", fmt.Errorf("webauthn assert finish: %w", err))
 		return
 	}
 
@@ -201,8 +205,8 @@ func (h *PasskeyHandle) AssertFinish(w http.ResponseWriter, r *http.Request) {
 		ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
 		defer cancel()
 		if err := h.assertFn.AssertStepUp(ctx); err != nil {
-			log.Printf("webauthn: assert step-up: %v", err)
-			http.Error(w, "step-up assertion failed", http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemWebAuthnStepUp,
+				"step-up assertion failed", fmt.Errorf("assert step-up in core: %w", err))
 			return
 		}
 	}

deploy/README.md

@@ -11,6 +11,11 @@ dir and read-only models.
 cp deploy/db_key.env.example deploy/db_key.env
 printf 'MAVEN_DB_KEY=%s\n' "$(openssl rand 32 | base64 -w0)" > deploy/db_key.env
 
+# 1b. review the complete secret inventory. Copy homesrv values to
+# deploy/telegram.env, ambient enable/token values to .env, and workpc values
+# to the destinations named in the example. Live blocks reject empty secrets.
+cp deploy/telegram.env.example deploy/telegram.env
+
 # 2. build + start
 docker compose build
 docker compose up -d

deploy/asoundrc

@@ -0,0 +1,27 @@
+# mavmic — the Scarlett Solo 4th Gen microphone alone, for mavwaked.
+#
+# The card's USB capture stream is 4 channels, not 2:
+#
+#   ch1  PCM 01 <- DSP 1 <- Analogue 1   the line/instrument jack
+#   ch2  PCM 02 <- DSP 2 <- Analogue 2   the XLR microphone
+#   ch3  PCM 03 <- Mix C  <- PCM 1       loopback of workstation playback, L
+#   ch4  PCM 04 <- Mix D  <- PCM 2       loopback of workstation playback, R
+#
+# plughw asks ALSA for mono and gets a downmix of all four, so half of what
+# mavwaked scored was whatever the workstation was playing, at unity gain and
+# untouched by the front-panel gain knob. Measured 2026-08-09 with the gain at
+# 0 and a show playing: ch1 rms 0.00000, ch2 0.00002, ch3 0.08834, ch4 0.09045.
+#
+# Air and 48V are named for Line In 2, and both belong to a microphone preamp,
+# so Analogue 2 is the XLR input on this card and Analogue 1 is the jack.
+#
+# This takes slave channel 1 and nothing else. It does not change the card, so
+# the loopback stays available to everything else on the box.
+pcm.mavmic {
+    type plug
+    slave {
+        pcm "hw:CARD=Gen,DEV=0"
+        channels 4
+    }
+    ttable.0.1 1
+}

deploy/cw2/serve.py

@@ -20,6 +20,7 @@ every stutter on the way there.
 """
 
 import hmac
+import ipaddress
 import json
 import logging
 import os
@@ -71,6 +72,18 @@ def authorised(headers):
     return hmac.compare_digest(got, "Bearer " + TOKEN)
 
 
+def validate_listener_auth(host, token):
+    """Refuse a network listener without its bearer boundary."""
+    try:
+        loopback = ipaddress.ip_address(host).is_loopback
+    except ValueError:
+        loopback = host.casefold() == "localhost"
+    if not loopback and not token.strip():
+        raise ValueError(
+            f"CW2_TOKEN is required while CW2_HOST={host!r} is reachable from the network"
+        )
+
+
 class Handler(BaseHTTPRequestHandler):
     protocol_version = "HTTP/1.1"
 
@@ -142,8 +155,10 @@ class Handler(BaseHTTPRequestHandler):
 
 
 def main():
-    if not TOKEN:
-        log.warning("no CW2_TOKEN set: anything on the LAN can post audio here")
+    try:
+        validate_listener_auth(HOST, TOKEN)
+    except ValueError as exc:
+        raise SystemExit(str(exc)) from exc
     # Bind before loading, so a restart answers 503 rather than refusing the
     # connection. Both make Maven fall back, but only one of them says why.
     srv = ThreadingHTTPServer((HOST, PORT), Handler)

deploy/cw2/test_serve.py

@@ -0,0 +1,24 @@
+import unittest
+
+import serve
+
+
+class ListenerAuthTest(unittest.TestCase):
+    def test_network_listener_requires_token(self):
+        for host in ("0.0.0.0", "192.168.1.105", "::"):
+            for token in ("", "   "):
+                with self.subTest(host=host, token=token):
+                    with self.assertRaises(ValueError):
+                        serve.validate_listener_auth(host, token)
+
+    def test_loopback_listener_may_be_explicitly_unauthenticated(self):
+        for host in ("127.0.0.1", "::1", "localhost"):
+            with self.subTest(host=host):
+                serve.validate_listener_auth(host, "")
+
+    def test_network_listener_accepts_token(self):
+        serve.validate_listener_auth("0.0.0.0", "secret")
+
+
+if __name__ == "__main__":
+    unittest.main()

deploy/mavend.json

@@ -31,14 +31,14 @@
     "rule — three things in series that have each failed once, and when they do",
     "a sev4 nudge has nowhere to go. ntfy shares none of them: it is reached",
     "directly, no relay.",
-    "It is not only a spare. The routing table sends sev3-away and away",
-    "reminders here and NOWHERE else, so with this block absent those two",
-    "routes hit a nil sink and vanish without a log or an outbox row.",
+    "It is the preferred away reach. Reminders fall back to Telegram in order,",
+    "and every missing reach is recorded in the outbox rather than disappearing.",
     "The credential is an ntfy access token, scoped write-only to this one",
     "topic, so a popped sink can push to it and cannot read it back. Set it in",
     "deploy/telegram.env beside the telegram secrets; that file is gitignored."
   ],
   "ntfy": {
+    "disabled": true,
     "base_url": "https://ntfy.kvmx.ru",
     "topic": "maven",
     "token": "${NTFY_TOKEN}"
@@ -76,7 +76,9 @@
     "resident model without saying so. Deleting this block restores exactly",
     "the behaviour homesrv had before it existed.",
     "Addressed by LAN address, not container name: mavgpud runs on another",
-    "machine and there is no shared docker network to name it on."
+    "machine and there is no shared docker network to name it on.",
+    "model_disabled keeps only this model arm dark until MAVEN_GPU_TOKEN is",
+    "provisioned; the independently authenticated STT arm below stays live."
   ],
   "//workstation.stt": [
     "CrisperWhisper 2.0 turbo on the same machine, a second service on port",
@@ -93,7 +95,9 @@
     "The token is what stops anything on the LAN posting audio to that port."
   ],
   "workstation": {
+    "model_disabled": true,
     "url": "http://192.168.1.105:8080",
+    "token": "${MAVEN_GPU_TOKEN}",
     "probe": "15s",
     "timeout": "90s",
     "stt": {
@@ -255,7 +259,7 @@
       "heads_path": "/opt/maven/models/embedder/router-heads/router_heads.onnx"
     },
     "llm_router": true,
-    "query_min_score": 0.55,
+    "query_min_score": 0.80,
     "query_min_margin": 0.008,
     "clarify_max_attempts": 3,
     "tool_timeout": "30s",

deploy/mavgpud.json

@@ -1,5 +1,14 @@
 {
   "listen": ":8080",
+  "//token_file": [
+    "The bearer token every request must carry. homesrv is the client and it",
+    "is on the LAN, so this port cannot be loopback and the token is what",
+    "stops anything else on the network spending the card or reading /slots.",
+    "A path, never the token: mavgpud refuses to start when listen is",
+    "reachable from the network and this is unset.",
+    "Same value as MAVEN_GPU_TOKEN in homesrv's deploy/telegram.env."
+  ],
+  "token_file": "/home/kami/.config/mavgpud.token",
   "llama_addr": "127.0.0.1:10000",
   "llama_bin": "llama-server",
   "//llama_args": [

deploy/mavwaked.service

@@ -32,6 +32,7 @@
 # means out of this unit's own journal, never by guessing.
 #
 #   install: cp to ~/.config/systemd/user/ on workpc
+#            cp ../deploy/asoundrc to ~/.asoundrc on workpc
 #            systemctl --user enable --now mavwaked.service
 
 [Unit]
@@ -46,22 +47,30 @@ After=maven-voice-tunnel.service
 # it returns RMS 0.00004 with its capture switch on and its ALSA volume at the
 # full 496 of 496. That silence is in the hardware, so no flag reaches it.
 #
-# Named CARD=Gen and not card 4, because a USB card number moves when
-# something else is replugged and this daemon must not change ears quietly.
+# mavmic and not plughw:CARD=Gen,DEV=0. deploy/asoundrc defines mavmic and
+# carries the whole reason: the card's capture stream is 4 channels, and two of
+# them are a unity-gain loopback of everything the workstation plays. plughw
+# downmixes all four, so a TV show woke her with the gain knob at 0. Install
+# that file as ~/.asoundrc on workpc or this device does not resolve.
+#
+# Named CARD=Gen inside mavmic and not card 4, because a USB card number moves
+# when something else is replugged and this daemon must not change ears quietly.
 # Not "default" either: that follows whatever pipewire last decided.
 #
-# plughw and not hw. mavwaked asks arecord for 16kHz mono, which is what the
-# whole pipeline is canonical in. Neither microphone offers it, so bare hw
-# dies on "Channels count non available" before a frame is read. plughw puts
-# ALSA's downmix and resampler in front. Any replacement wants the same.
+# mavmic is a plug device and not hw. mavwaked asks arecord for 16kHz mono,
+# which is what the whole pipeline is canonical in. Neither microphone offers
+# it, so bare hw dies on "Channels count non available" before a frame is read.
+# Any replacement wants ALSA's resampler in front the same way.
 #
-# The Scarlett measured RMS 0.003 against 0.14 on the onboard input, so its
-# front-panel gain is the thing to raise if she mishears. That is a knob, not
-# a control ALSA exposes. The two loud devices, the onboard ALC897 and the
-# camera, both clip at peak 1.0 and are worse candidates, not better ones.
+# The mic is on the XLR, which is Analogue 2 on this card and not Analogue 1:
+# Air and 48V are both named for Line In 2 and both belong to a mic preamp.
+# Measured 2026-08-09 through mavmic at 16kHz mono, gain up: rms 0.01826 peak
+# 0.09290 spoken, against a 0.00031 preamp floor, and 0.00002 for the whole
+# stream with a show playing. Front-panel gain is still the thing to raise if
+# she mishears, and it is a knob, not a control ALSA exposes.
 Environment=LD_LIBRARY_PATH=%h/.local/lib
 ExecStart=%h/.local/bin/mavwaked \
-  -device plughw:CARD=Gen,DEV=0 \
+  -device mavmic \
   -addr 127.0.0.1:9100 \
   -lang ru \
   -vad-model %h/.local/share/maven/models/silero_vad.onnx \

deploy/telegram.env.example

@@ -10,3 +10,40 @@ TELEGRAM_CHAT_ID=
 #   ntfy token add --expires=never maven
 # Read access is not needed — mavend publishes and never subscribes.
 NTFY_TOKEN=
+
+# Bearer token for mavgpud, the workstation's GPU supervisor (V-673). It fronts
+# the big model on a LAN port, so the token is the whole boundary in front of
+# the card. Any long random string; mint one with:
+#   openssl rand -hex 32
+# The same value goes in a file on workpc, named by token_file in
+# deploy/mavgpud.json. Empty is valid only while workstation.model_disabled is
+# true; enabling the LAN model arm without it fails Maven's config validation.
+MAVEN_GPU_TOKEN=
+
+# Bearer token used by Maven when it sends audio to the workstation's
+# CrisperWhisper service. The matching CW2_TOKEN is installed on workpc; these
+# two values must be identical. Leaving both unset is only safe while that
+# remote STT service is bound to loopback or its STT block is disabled.
+MAVEN_STT_TOKEN=
+
+# Home Assistant is currently explicitly disabled in deploy/mavend.json. Keep
+# this name in the canonical inventory so enabling that block cannot turn into
+# a valid-looking configuration with an expanded-empty token.
+HA_TOKEN=
+
+# docker compose reads these from the repository-root `.env`, before it starts
+# containers; they are listed here even though their destination differs so
+# this remains the complete deployment inventory. Copy both lines to `.env`.
+# Enabling with an empty token fails startup; false is the explicit dark state.
+# MAVEN_AMBIENT_ENABLED=false
+# MAVEN_AMBIENT_TOKEN=
+
+# Workstation-side counterpart to MAVEN_STT_TOKEN. Install this line in the
+# EnvironmentFile named by deploy/mavgpud.service (currently
+# %h/Programs/cw2-service/cw2.env), not in homesrv's telegram.env.
+# CW2_TOKEN=
+
+# The encrypted database key has its own narrowly mounted file,
+# deploy/db_key.env, and its own generator in deploy/README.md. It is named
+# here so an operator auditing this one inventory sees every deployed secret.
+# MAVEN_DB_KEY=

docker-compose.yml

@@ -97,15 +97,17 @@ services:
     <<: *image
     # voice.bind is 0.0.0.0:9100 in deploy/mavend.json so mavweb can reach it
     # cross-container. Verified 2026-07-06.
-    # -ambient-token turns on POST /api/ambient (Vikunja #126): the phone posts
-    # notification text, mavweb keeps only a meeting time. Empty ⇒ no route at
-    # all, which is what a missing MAVEN_AMBIENT_TOKEN gives. The value comes
-    # from the gitignored .env docker compose reads for interpolation, NOT from
-    # an env_file — flags are interpolated before any service env exists.
+    # -ambient-enabled turns on POST /api/ambient (Vikunja #126): the phone posts
+    # notification text, mavweb keeps only a meeting time. The explicit enabled
+    # flag prevents an unset token from looking like an intentional dark state.
+    # Both values come from the gitignored .env docker compose reads for
+    # interpolation, NOT from an env_file — flags are interpolated before any
+    # service env exists.
     # Weakness worth naming: mavweb takes this as a flag, so it is visible in
     # `ps` inside this container, unlike the zenmoney and IMAP secrets which are
     # read from files.
     command: ["mavweb", "-addr", ":9201", "-voice", "mavend:9100", "-core", "/run/maven/mavend.sock",
+              "-ambient-enabled=${MAVEN_AMBIENT_ENABLED:-false}",
               "-ambient-token", "${MAVEN_AMBIENT_TOKEN:-}",
               "-nexus", "http://nexus:9740", "-praxis", "http://praxis:8989", "-hexis", "http://hexis:9741"]
     depends_on: [mavend]

docs/CLAUDE.md

@@ -0,0 +1,30 @@
+# docs/
+
+Everything an agent needs that is not a rule and not code. `CLAUDE.md` at the
+root carries the rules and points here. Nothing here restates a rule.
+
+The tier is the path, so staleness is visible from the filename.
+
+| path | holds | lifetime |
+| --- | --- | --- |
+| `docs/*.md` | living. One file per subsystem: the reasoning, corrected in place. Each carries `Last verified: <date> @ <sha>`. | until it is wrong |
+| `docs/evals/` | dated measurements, one file per measurement. **Never edited after the day.** A newer number is a new file. Indexed in `docs/evals/CLAUDE.md`, which marks each one live or superseded. | forever |
+| `docs/caveats/` | known limits, one entry per limit, each with a task id and a revisit trigger. Indexed in `docs/caveats/CLAUDE.md`. | until fixed, then deleted |
+| `docs/plans/` | the plan for one piece of work, frozen once it starts. Indexed in `docs/plans/CLAUDE.md`. | until the work lands |
+| `docs/archive/` | dead. Read by nobody by default. | forever |
+
+## Rules for this directory
+
+* One fact, one home. A measurement is cited from a living doc, never copied
+  into it. The two drift the moment they are both edited.
+* A living doc is corrected in place and its `Last verified` line moves with the
+  correction. Do not append a changelog to it.
+* A number in prose with no `docs/evals/` file behind it is an opinion.
+* Fixing something deletes its caveat. It does not edit the eval that found it.
+
+## Where a subsystem's reasoning lives
+
+`routing.md`, `language.md`, `world.md`, `offload.md`, `deployment.md`,
+`ecosystem.md`, `workflow.md`, `design.md`, `rearchitecture.md`,
+`determinism.md`, `protocol.md`, `handler-wiring.md`, `operations.md`, `qa.md`.
+The root `CLAUDE.md` says which one to read before touching what.

docs/caveats/CLAUDE.md

@@ -0,0 +1,47 @@
+# docs/caveats/
+
+One entry per known limit: something broken, deferred or unsafe that a session
+will otherwise walk into. An entry names what fails, who it costs, and the
+condition that makes it worth fixing.
+
+Two things do not belong here. The evidence is a dated file under `docs/evals/`.
+The reasoning behind a subsystem is its living doc directly under `docs/`. A
+caveat is the pointer between them plus the trigger.
+
+## Rules for this directory
+
+* One file per area, one `##` section per limit, each carrying its task id.
+* **A caveat with no revisit trigger is a complaint.** Give it one or delete it.
+* Closing a limit deletes its entry. It does not edit it to say "fixed", and it
+  never edits the frozen measurement it came from. The durable record of a fix
+  is the commit and the subsystem's living doc.
+* An entry whose task is closed but whose limit is still live is the failure
+  mode to watch for. The id joins the two directions, so check both.
+
+## Index
+
+Every entry below came from the 2026-08-10 deep audit
+(`docs/evals/2026-08-10-repo-audit.md`), except the last, which came from wiring
+the gate the audit asked for. Twelve of the twenty findings are fixed and have no
+entry. The unauthenticated mavgpud proxy was V-673. The 20 reachable advisories
+in the toolchain and `x/text` were V-682. The missing analyzers were V-694, and
+what they now report is the baseline entry under V-701. The invalid STT and
+weather responses were V-675/V-676, the stuck TCP close was V-679, and the
+unbounded PTT path was V-688. The two unguarded
+invariants were V-692 and V-693, and their guards are described in
+`docs/routing.md`. The complete secret inventory and fail-closed integration
+validation were V-691. The atomic reminder transition was V-678. The traceable,
+sanitized mavweb problem contract was V-689.
+
+| limit | severity |
+| --- | --- |
+| [Anyone past the proxy can enroll a passkey](security.md#enrollment) | high |
+| [Passkey credentials are rewritten in place](security.md#credentials) | medium |
+| [Dialogue persistence errors are swallowed](storage.md#dialogue) | medium |
+| [A recall miss scans two whole tables](storage.md#recall) | medium |
+| [Fact enrichment is a 20-call serial waterfall](workers.md#enrichment) | medium |
+| [Autonomous worker delegation is temporarily quota-gated](workers.md#agent-quota) | session |
+| [Committed absolute paths pin the build to this box](config.md#paths) | medium |
+| [The analyzers pass against a baseline, not zero](dependencies.md#baseline) | medium |
+| [Domain packages depend on store and IPC types](layering.md#dtos) | low |
+| [Eleven symbols are unreachable](layering.md#deadcode) | low |

docs/caveats/config.md

@@ -0,0 +1,10 @@
+# Configuration and environment
+
+## Committed absolute paths pin the build to this box [#690] {#paths}
+
+Costs: `go.mod` replaces Hexis with `/home/kami/apps/hexis`, `start-maven.sh`
+hardcodes the checkout and the data directory, and `deploy/mavgpud.json` holds
+workstation model and Python paths. Vendoring hides the `go.mod` problem for an
+ordinary build. `-mod=mod`, `go mod tidy` and a fresh checkout all fail.
+Revisit when: anyone clones this repo elsewhere, or a `tidy` is needed.
+Workaround: build only from this checkout, with the vendor directory.

docs/caveats/dependencies.md

@@ -0,0 +1,13 @@
+# Dependencies
+
+## The analyzers pass against a baseline, not against zero [#701] {#baseline}
+
+Costs: `make lint` and `make deadcode` are wired and green (V-694), but green
+means "nothing new since 2026-08-11". The accepted set is 16 staticcheck
+findings and 13 unreachable symbols, listed with a reason each in
+`scripts/analyzers/*.baseline`. Three of the unreachable symbols must stay:
+[layering.md](layering.md#deadcode).
+Revisit when: V-701 sweeps the baseline, or a fix deletes an entry. The gate
+fails on an entry whose finding is gone, so the deletion is not optional.
+Workaround: none needed. Reachability claims are checkable now. Read the
+baseline before trusting that a target reporting clean means the tree is clean.

docs/caveats/layering.md

@@ -0,0 +1,25 @@
+# Layering and dead surface
+
+Neither entry breaks anything today. Both make a later change cost more than it
+should, which is why they are low and not medium.
+
+## Domain packages depend on store and IPC types [#685] {#dtos}
+
+Costs: dialogue exposes `store.DialogueSessionRow` in its port, the pure
+morning planner takes a `store.Fact`, and auth policy imports IPC method and
+caller types. There is no Go import cycle. A schema change reaches further than
+it should.
+Revisit when: the dialogue or fact schema changes, or a second transport
+appears beside IPC.
+Workaround: none needed. It compiles and it is correct.
+
+## Eleven symbols are unreachable [#686] {#deadcode}
+
+Costs: extra API and test surface, and comments that claim callers which no
+longer exist. Three of the eleven must not be deleted. `HisGender` is a
+documented seam tied to V-399. `AudioDuration` duplicates `internal/audio` and
+should call it. `CountWord` is a one-line alias nobody uses and can go.
+Revisit when: `deadcode` is wired into the audit gate, which needs the
+allowlist this entry describes. **An unannotated list invites deleting the
+three above.**
+Workaround: none needed.

docs/caveats/security.md

@@ -0,0 +1,26 @@
+# Security
+
+Both entries are mavweb's passkey seam. Assertion itself is sound and is not
+the problem: `userVerification` is required, and a sign count that does not
+increase is rejected.
+
+## Anyone past the proxy can enroll a passkey [#683] {#enrollment}
+
+Costs: registration is gated on nothing, so any client that reaches mavweb can
+enroll its own key and become him. Step-up is worse than per-client: one
+process-global `assertedAt` means every client inherits the same five-minute
+window after any successful assertion. The voice WebSocket accepts every
+origin, which makes cross-site use easier. V-317 covers which routes are gated
+and V-605 covers challenge-map growth. Neither covers this.
+Revisit when: mavweb is reachable from anything but the tunnel, and before any
+new credential is enrolled.
+Workaround: the reverse proxy is the only boundary today. That is the finding.
+
+## Passkey credentials are rewritten in place [#684] {#credentials}
+
+Costs: `os.WriteFile` over the live file. A crash, a full disk or an
+interrupted write corrupts every enrolled credential at once, and mavweb will
+not start afterwards.
+Revisit when: a second credential is enrolled, since the blast radius grows
+with the count. Sooner if the box loses power unexpectedly.
+Workaround: back the file up before enrolling.

docs/caveats/storage.md

@@ -0,0 +1,22 @@
+# Storage
+
+The DB seam: what it loses quietly, and what it reads more of than it needs.
+
+## Dialogue persistence errors are swallowed [#677] {#dialogue}
+
+Costs: restart continuity can vanish with nothing in the log, and a failed
+delete can bring stale conversation state back. Current-turn dialogue is
+unaffected, which is why this has never been noticed.
+Revisit when: a restart is reported as losing context. Sooner if a turn starts
+reading dialogue rows back to him.
+Workaround: none. The failure is invisible from outside.
+
+## A recall miss scans two whole tables [#681] {#recall}
+
+Costs: every missed recall reads all of `memory_vectors` and then decodes and
+sorts every note vector. Not an N+1, and the memory scan is cheap per losing
+row on purpose. The duplicated decode is the legacy notes path alone.
+Revisit when: the note count makes a miss measurably slow. Also when the two
+exclusion filters are proven to agree. `QueryNotes` uses `notHisWordsSQL` and
+`Search` uses `memory.NonRecallPrefix`. The fallback cannot go until they match.
+Workaround: none needed at today's row counts.