Take the 19 standard library advisories off the box (V-682)

govulncheck found 20 reachable advisories on 2026-08-10: 19 in the
standard library and one in x/text. Go 1.25.12 closes the 19. The
reachable traces that mattered are mavweb's HTML template escaping and
the mavgpud proxy's TLS, both of which face the LAN.

deps/ is gitignored and make deps-go builds the toolchain, so the bump
is the version, its checksum and the go directive. Nothing is vendored
by this commit.

x/text stays at 0.14.0 (owner's call, 2026-08-11). Its one advisory is
reached only through the ONNX embedder normalizing his own text, so
nothing hostile arrives there, and 0.39.0 regenerates the Unicode
tables for 41,385 changed lines against a 300-line pre-commit cap that
exempts only markdown. The bump is worth doing when vendor/ is exempt
from the guard, not before.

No govulncheck make target either: it would fail on the x/text finding
from the day it landed, and a gate that is red on arrival teaches
people to skip it.

make fmt-check, make vet, make build and make test pass on 1.25.12,
65 packages ok. The four TestONNX measurements pass in 29.6s.

Makefile

@@ -4,7 +4,7 @@
 # `test` below fail on the two packages that have no test files. deps-go builds
 # the missing tools in, so the vendored tree is self-sufficient. Keep the version
 # here in step with the `go` directive in go.mod.
-GO_VERSION := 1.25.5
+GO_VERSION := 1.25.12
 GO       := $(shell pwd)/deps/go/go/bin/go
 export GOTOOLCHAIN := local
 GOFLAGS  :=
@@ -73,7 +73,7 @@ run-web: build-web
 # builds them on demand, but `go test -coverprofile` calls covdata through
 # base.Tool(), which only stats pkg/tool and exits. So build them in once here.
 GO_TARBALL := go$(GO_VERSION).linux-amd64.tar.gz
-GO_SHA256  := 9e9b755d63b36acf30c12a9a3fc379243714c1c6d3dd72861da637f336ebb35b
+GO_SHA256  := 234828b7a89e0e303d2556310ee549fbcf253d28de937bac3da13d6294262ac1
 deps-go: deps-sentinel
 	@mkdir -p deps/go
 	cd deps/go && curl -fLO 'https://go.dev/dl/$(GO_TARBALL)'

docs/deployment.md

@@ -166,9 +166,21 @@ the GPU. A model that will not load is logged and not fatal.
 `-barge-in` is not passed. The threshold is room-specific and this room has no
 number yet. Read the "suppressed while speaking" means out of the journal first.
 
-The device is `plughw:0,0` and not `hw:0,0`. The fifine offers 2 channels at
-44100 or 48000 and nothing else, and mavwaked asks arecord for 16kHz mono. Bare
-`hw` dies on "Channels count non available" before a frame is read.
+The device is `plughw:CARD=Gen,DEV=0`, the Scarlett Solo. It is `plughw` and
+not `hw` because mavwaked asks arecord for 16kHz mono. No microphone here
+offers that, so bare `hw` dies on "Channels count non available" before a
+frame is read. It is named `CARD=Gen` and not card 4 because a USB card number
+moves when something else is replugged.
+
+It used to be the fifine on card 0, and that cost three days. mavwaked logged
+zero completed utterances across them, before the wake word existed and after.
+The fifine returns RMS 0.00004 with its capture switch on and its ALSA volume
+at the full 496 of 496. That silence is in the hardware and no flag reaches
+it. Over the same eight seconds of speech the onboard ALC897 read 0.142 and
+the camera 0.289, both clipping at peak 1.0. The Scarlett read 0.003 clean.
+
+Check the level before blaming the gate. Stop the unit, run `arecord` against
+the device for five seconds, and measure. A live room floor reads near 0.001.
 
 The three `-wake-` flags require the keyword "Мэйвен" (V-487 stage two). Drop
 them and the loop runs open, which is what it did before. The threshold is the

go.mod

@@ -1,6 +1,6 @@
 module github.com/kami/maven
 
-go 1.25.5
+go 1.25.12
 
 require (
 	github.com/coder/websocket v1.8.12