Take the 19 standard library advisories off the box (V-682)

govulncheck found 20 reachable advisories on 2026-08-10: 19 in the
standard library and one in x/text. Go 1.25.12 closes the 19. The
reachable traces that mattered are mavweb's HTML template escaping and
the mavgpud proxy's TLS, both of which face the LAN.

deps/ is gitignored and make deps-go builds the toolchain, so the bump
is the version, its checksum and the go directive. Nothing is vendored
by this commit.

x/text stays at 0.14.0 (owner's call, 2026-08-11). Its one advisory is
reached only through the ONNX embedder normalizing his own text, so
nothing hostile arrives there, and 0.39.0 regenerates the Unicode
tables for 41,385 changed lines against a 300-line pre-commit cap that
exempts only markdown. The bump is worth doing when vendor/ is exempt
from the guard, not before.

No govulncheck make target either: it would fail on the x/text finding
from the day it landed, and a gate that is red on arrival teaches
people to skip it.

make fmt-check, make vet, make build and make test pass on 1.25.12,
65 packages ok. The four TestONNX measurements pass in 29.6s.

Makefile

@@ -4,7 +4,7 @@
 # `test` below fail on the two packages that have no test files. deps-go builds
 # the missing tools in, so the vendored tree is self-sufficient. Keep the version
 # here in step with the `go` directive in go.mod.
-GO_VERSION := 1.25.5
+GO_VERSION := 1.25.12
 GO       := $(shell pwd)/deps/go/go/bin/go
 export GOTOOLCHAIN := local
 GOFLAGS  :=
@@ -73,7 +73,7 @@ run-web: build-web
 # builds them on demand, but `go test -coverprofile` calls covdata through
 # base.Tool(), which only stats pkg/tool and exits. So build them in once here.
 GO_TARBALL := go$(GO_VERSION).linux-amd64.tar.gz
-GO_SHA256  := 9e9b755d63b36acf30c12a9a3fc379243714c1c6d3dd72861da637f336ebb35b
+GO_SHA256  := 234828b7a89e0e303d2556310ee549fbcf253d28de937bac3da13d6294262ac1
 deps-go: deps-sentinel
 	@mkdir -p deps/go
 	cd deps/go && curl -fLO 'https://go.dev/dl/$(GO_TARBALL)'

deploy/mavwaked.service

@@ -41,18 +41,27 @@ Requires=maven-voice-tunnel.service
 After=maven-voice-tunnel.service
 
 [Service]
-# card 0 is the fifine USB microphone. Named, and not "default", because the
-# default device follows whatever pipewire last decided and this daemon should
-# not change ears when he plugs in a headset.
+# The Scarlett Solo 4th Gen, and not the fifine. The fifine was the device
+# here for three days and mavwaked never logged one utterance in them, because
+# it returns RMS 0.00004 with its capture switch on and its ALSA volume at the
+# full 496 of 496. That silence is in the hardware, so no flag reaches it.
+#
+# Named CARD=Gen and not card 4, because a USB card number moves when
+# something else is replugged and this daemon must not change ears quietly.
+# Not "default" either: that follows whatever pipewire last decided.
 #
 # plughw and not hw. mavwaked asks arecord for 16kHz mono, which is what the
-# whole pipeline is canonical in. The fifine offers 2 channels at 44100 or
-# 48000 and nothing else, so bare hw:0,0 dies on "Channels count non
-# available" before a frame is read. plughw puts ALSA's downmix and resampler
-# in front. Any replacement microphone wants the same treatment.
+# whole pipeline is canonical in. Neither microphone offers it, so bare hw
+# dies on "Channels count non available" before a frame is read. plughw puts
+# ALSA's downmix and resampler in front. Any replacement wants the same.
+#
+# The Scarlett measured RMS 0.003 against 0.14 on the onboard input, so its
+# front-panel gain is the thing to raise if she mishears. That is a knob, not
+# a control ALSA exposes. The two loud devices, the onboard ALC897 and the
+# camera, both clip at peak 1.0 and are worse candidates, not better ones.
 Environment=LD_LIBRARY_PATH=%h/.local/lib
 ExecStart=%h/.local/bin/mavwaked \
-  -device plughw:0,0 \
+  -device plughw:CARD=Gen,DEV=0 \
   -addr 127.0.0.1:9100 \
   -lang ru \
   -vad-model %h/.local/share/maven/models/silero_vad.onnx \

docs/deployment.md

@@ -166,9 +166,21 @@ the GPU. A model that will not load is logged and not fatal.
 `-barge-in` is not passed. The threshold is room-specific and this room has no
 number yet. Read the "suppressed while speaking" means out of the journal first.
 
-The device is `plughw:0,0` and not `hw:0,0`. The fifine offers 2 channels at
-44100 or 48000 and nothing else, and mavwaked asks arecord for 16kHz mono. Bare
-`hw` dies on "Channels count non available" before a frame is read.
+The device is `plughw:CARD=Gen,DEV=0`, the Scarlett Solo. It is `plughw` and
+not `hw` because mavwaked asks arecord for 16kHz mono. No microphone here
+offers that, so bare `hw` dies on "Channels count non available" before a
+frame is read. It is named `CARD=Gen` and not card 4 because a USB card number
+moves when something else is replugged.
+
+It used to be the fifine on card 0, and that cost three days. mavwaked logged
+zero completed utterances across them, before the wake word existed and after.
+The fifine returns RMS 0.00004 with its capture switch on and its ALSA volume
+at the full 496 of 496. That silence is in the hardware and no flag reaches
+it. Over the same eight seconds of speech the onboard ALC897 read 0.142 and
+the camera 0.289, both clipping at peak 1.0. The Scarlett read 0.003 clean.
+
+Check the level before blaming the gate. Stop the unit, run `arecord` against
+the device for five seconds, and measure. A live room floor reads near 0.001.
 
 The three `-wake-` flags require the keyword "Мэйвен" (V-487 stage two). Drop
 them and the loop runs open, which is what it did before. The threshold is the

go.mod

@@ -1,6 +1,6 @@
 module github.com/kami/maven
 
-go 1.25.5
+go 1.25.12
 
 require (
 	github.com/coder/websocket v1.8.12