Merge branch 'Check the digest before paying the phraser' (V-687)

cmd/mavweb/voiceproxy.go writes http.StatusMethodNotAllowed and
http.StatusServiceUnavailable now, so both ST1013 entries were left behind by
the mavweb work and make lint was failing on master before this branch. The
gate fails on a stale entry by design, so the deletion is not optional. The
accepted set is 16.

.gitignore

@@ -54,6 +54,10 @@ opencode.json
 # Test coverage output
 coverage.out
 
+# Python service/test bytecode.
+__pycache__/
+*.py[cod]
+
 # Agent worktrees and local agent state. The workflow itself is tracked: the
 # hooks, the skills and the prose dictionary are how a session behaves, so they
 # get reviewed like code. Everything else under .claude/ is scratch.

AGENTS.md

@@ -135,37 +135,41 @@ Russian recall — you may see many "clarify" responses).
 
 ## Qwen3 resident model for router + phraser
 
-The target daemon uses the locally trained Qwen3-1.7B checkpoint for both
-routing and phrasing. Training is Qwen3 Base → RU CPT → joint persona/router
-SFT → merged GGUF, and is still in flight (#122) — until it lands, the deployed
-resident model is stock **Qwen3.5-0.8B** (`Q4_K_M`), see `deploy/mavend.json`.
+The deployed resident model is stock **Qwen3-1.7B** (`UD-Q4_K_XL`), a Thinking
+variant at `n_ctx` 4096. `CLAUDE.md` carries the rule on which models qualify.
 Without a configured model, `StubPhraser` plus the classifier remain the
 deterministic floor.
 
-During training, use the runbook in
-`docs/plans/2026-07-18-qwen3-resident-training-eval.md`. After the decision gate
-and SFT pass, copy the merged GGUF into the mounted model directory and set:
+A locally trained Qwen3-1.7B checkpoint is still in flight (V-122). Training
+runs Qwen3 Base, then RU CPT, then joint persona and router SFT, then a merged
+GGUF. The
+runbook is `docs/plans/2026-07-18-qwen3-resident-training-eval.md`. After the
+decision gate and SFT pass, copy the merged GGUF into the mounted model
+directory and point `model_path` at it.
+
+**Configure in `deploy/mavend.json`.** This is the deployed `phraser` block:
 
 ```json
 "phraser": {
-  "model_path": "/opt/maven/models/llm/Qwen3-Maven-1.7B-Q8_0.gguf",
+  "model_path": "/opt/maven/models/llm/qwen3/Qwen3-1.7B-UD-Q4_K_XL.gguf",
   "bin_path": "llama-server",
   "n_gpu_layers": 99,
-  "n_ctx": 2048
+  "n_ctx": 4096,
+  "cache_ram_mib": 512,
+  "timeout": "60s"
 }
 ```
 
-**Configure in `deploy/mavend.json`** — the `phraser` block points at this
-model and the daemon spawns `llama-server` as a subprocess. The router and
-replier use the same llama-server via the shared `internal/llm` client.
+The daemon spawns `llama-server` as a subprocess. The router and replier reach
+that one server through the shared `internal/llm` client. Model files live in
+`/mnt/hdd1/llms`, bind-mounted over `models/llm/`, so a gguf sitting in the repo
+is loaded by nothing.
 
 Telegram tokens are read from `deploy/telegram.env` (gitignored), expanded
 via `${VAR}` in the JSON config.
 
-**Routing is Qwen-first** with classifier fallback. The LLM router runs
-after stage-0 (exact-match grammar) and before the classifier cascade. On any
-error or parse failure, the classifier handles the utterance — the turn never
-breaks on the model.
+The cascade order, and which stage may decline to the next, is in
+`docs/routing.md`. It is not restated here.
 
 ## Web UI conventions
 

CLAUDE.md

@@ -17,6 +17,8 @@ under `docs/`. Read that doc before changing the subsystem.
 | `docs/ecosystem.md` | touching Nexus, Praxis or Hexis |
 | `docs/rearchitecture.md`, `docs/design.md` | changing the shape of anything |
 | `docs/workflow.md` | the five stores, the doc tiers, the guards |
+| `docs/caveats/` | a known limit, its task id and its revisit trigger |
+| `docs/CLAUDE.md` | which tier a doc belongs in, and what each one holds |
 | `AGENTS.md` | local preview, screenshots, model downloads |
 
 ## What Maven is
@@ -52,8 +54,15 @@ carries `-count=1` and sets `MAVEN_ONNX_LIB`. Without that variable the four
 make build   # all 11 binaries. make build-web for one (web/waked/poll/caldav skip CGO)
 make test    # go test -race across ./internal/... ./cmd/... with CGO env set
 make t PKG=./internal/router/eval/ RUN='TestONNX' V=1   # V=1 for -v, RACE=0 to drop -race
+make analyze # staticcheck, deadcode and govulncheck. Not in `test`: all three need the network
 ```
 
+**The static gates pass against a baseline, not against zero**
+(`scripts/analyzers/*.baseline`, reasoning in `docs/workflow.md`). A fix must
+delete its baseline entry, because the gate also fails on an entry whose finding
+is gone. **`make audit` is a git-grep inventory, not analysis.** Do not cite it
+as a reachability check.
+
 ## The daemons
 
 Eleven binaries under `cmd/`, wired socket-to-socket over `internal/ipc`, not
@@ -106,13 +115,15 @@ classifier. Every stage may decline and the next one answers.
 
 - **The classifier is the floor, not dead code.** It answers when the resident
   model is off, absent, or erroring. **Any model error falls through.**
-- **`baselineGrammars` in `eval_test.go` mirrors `buildRouter`.** A grammar
-  added to one belongs in both, or the fixture scores a set nobody runs.
+- **The stage 0 set lives in `router.StageZeroGrammars`**, and both `buildRouter`
+  and the eval fixture call it. Add a grammar there, in the right place, and read
+  the comment above the line you insert after. Do not restate the list anywhere.
 - **Go's `\b` is ASCII-only** and never fires after a Cyrillic letter. A Russian
   pattern needs an explicit `(\s|[?!.]|$)`.
 - **`PraxisGrammars()` is the only path to Praxis**, not a faster one.
 - **`voice.embedder.heads_path` must never point at `model_path`.** Recall
   depends on the resident e5-small scoring what it scored. Fine-tune a copy.
+  Refused at config load since V-692, symlinks included.
 - **Routing traces are retained 14 days**, enforced on write and again on start.
 - **Bump `tokenizerRev` on any change to what `encodeWord` emits**, so a
   tokenizer fix triggers `ReembedAll` the way swapping the model file does.
@@ -129,10 +140,11 @@ it is deliberate.** It guesses, so naming `SourceWorld` drops it. **Only a stage
 0 grammar may drop it** (owner's call, V-666). `queryWalk` reads
 `Decision.SourceAnchored` for the source marked `boundary: true` and no other.
 
-Judge a routing change against the classifier (76.0% intent, 36.4% destination)
-and the resident model (80.2% intent), since those always answer. The fixture
-has grown from 77 cases to 96, so a number compares only to another number on
-the same fixture.
+Judge a routing change against the classifier and the resident model, since
+those always answer. **Their scores live in `docs/routing.md`, never here.** A
+pair copied into this file goes stale silently. The fixture has changed size
+more than once, so a number compares only to another number on the same
+fixture.
 
 ## Language: model output and Russian
 

JOURNAL.md

@@ -0,0 +1,283 @@
+# Maven completion journal
+
+This journal tracks the autonomous completion goal started on 2026-08-13. It
+is an operational index, not a substitute for living subsystem documentation,
+dated evaluations, Vikunja tasks, or focused caveat entries.
+
+## 2026-08-13 — baseline and backlog reconstruction
+
+Goal: make Maven usable end to end with every current and planned feature
+wired, tested, and polished. Completion requires clean automated gates and
+successful sessions across local, degraded-ecosystem, and integrated modes.
+
+Initial observations:
+
+- `HEAD` is `2cf8b7e`, identical to both local and remote `master`, while the
+  checked-out branch is the stale `task/704-...` branch.
+- The worktree already contained staged documentation/evaluation changes,
+  staged transcript deletions, an unstaged `deploy/mavwaked.service` change,
+  and untracked `deploy/asoundrc`. These are pre-existing work and are being
+  preserved and validated before any commit.
+- The repository has no prior goal journal. Durable subsystem facts continue
+  to belong under `docs/`; unresolved limits continue to belong under
+  `docs/caveats/` with a task and revisit trigger.
+
+Work streams started:
+
+- Vikunja project 2: inventory every open task and recover acceptance criteria.
+- Repository: compare feature plans, caveats, routing/ecosystem contracts, and
+  implementation.
+- Verification: run build, race tests, simulator, analyzer gates, and inspect
+  skipped hardware/model evaluations separately.
+- Runtime: exercise the web, IPC, voice, model, and sibling-service paths with
+  real local dependencies where available and explicit degraded-mode probes
+  otherwise.
+
+References: `docs/workflow.md`, `docs/qa.md`, `docs/ecosystem.md`,
+`docs/routing.md`, `docs/caveats/CLAUDE.md`, and Vikunja Maven project 2.
+
+### Backlog correction
+
+The first Vikunja page was accidentally read without a `done: false` filter and
+mixed closed history into the working set. Re-querying all pages strictly open
+produced 127 records: 89 implementation-open, 20 shipped-but-QA-open, 12
+external/owner gates, and 6 duplicate or stale-open records. Closed tasks are
+used only as commit provenance; they are not work to redo. V-704 was the only
+open hanging task and was closed after its measured correction landed.
+
+### Model-aware baseline
+
+The ordinary `make test` passed but does not set `MAVEN_ONNX_LIB`, so model-aware
+tests can self-skip. The explicit ONNX boundary gate exposed V-702/V-703: the
+held-out `я рассказывал тебе про байкал?` was the sole miss at 28/29. A
+three-neighbour class score fixed the semantic collision without adding a word
+pattern or copying the held-out sentence. Boundary is now 29/29 and the adjacent
+topic gate remains 43/43. Measurement:
+`docs/evals/2026-08-13-personal-boundary-neighbourhood.md`.
+
+That narrow result was not accepted as the completion gate. A second agent
+wrote a balanced 72-case RU/EN matrix across remembered speech, possession,
+narrative, proper nouns, personal preambles, and advice/current questions. It
+contains no production seeds and no Baikal paraphrase. The top-three candidate
+scores only 61/72 (84.7%); top-two reaches 62/72, one-neighbour 56/72, and a
+whole-class centroid 54/72. V-702 therefore remains open while a principled
+classifier is developed against the independent matrix. The 29/29 measurement
+describes the narrow regression set, not general boundary quality.
+
+### Live delivery incident
+
+The five-service compose stack was running, but a due reminder was being
+re-phrased and retried through ntfy every tick. The sink returned HTTP 403 each
+time. Only secret names were inspected: the configured ntfy and workstation
+token variables were absent from the deployed environment file; no secret
+values were read into this journal. The durable outbox records each failed
+attempt, but the retry path has no backoff or alternate channel and spends the
+resident model again before every failure. This is active V-651 behavior, with
+the repeated-phrasing shape related to V-687.
+
+V-715 now owns the incident acceptance criteria. In the working tree, phrases,
+collapsed-group identity, attempts, and next-attempt time are durable; definite
+failure backs off from one minute to a capped hour; retries and restarts reuse
+the exact phrase; and away delivery tries ntfy then Telegram, stopping at the
+first success. The committed deployment explicitly disables the uncredentialed
+ntfy block. Independent review added a real occurrence key for collapsed
+bundles, suppresses crash-ambiguous attempts from automatic replay, classifies
+HTTP 401/403 as permanent, blocks permanently unreachable reminders visibly,
+and commits the successful outbox result plus every collapsed original in one
+SQLite transaction. The store, delivery, IPC, loop, config, and mavweb race
+suites pass. A live rebuild and one-time delivery of the existing backlog are
+still required before V-715 is closed.
+
+### Explicit integration enablement
+
+V-691's deployment boundary was audited against every `${VAR}` reference. The
+canonical `deploy/telegram.env.example` now names Telegram, ntfy, workstation
+model, workstation STT, Home Assistant, ambient, CW2, and database-key inputs.
+Enabled Telegram, ntfy, ambient, non-loopback workstation model, and
+non-loopback workstation STT paths refuse missing credentials; each arm has an
+explicit disabled state. The live config disables the currently uncredentialed
+ntfy and workstation-model arms while retaining the separately credentialed
+STT arm. CW2 also refuses a non-loopback bind without its token.
+
+Focused Go race suites, the Python CW2 startup contract, deploy-config drift
+test, secret-expanded config validation (values not printed), and
+`docker compose config --quiet` pass. The workpc is unreachable from this host,
+so installing the updated CW2 script there remains an external deployment step;
+the affected model arm is explicitly dark rather than ambiguously half-live.
+
+### Traceable web failures
+
+V-689 gives every mavweb response a server-generated request ID and routes
+every handler failure through one sanitized problem envelope. Stable error
+codes and the request ID reach the browser; the wrapped internal error reaches
+only the server log beside the same ID. Degraded inline panels use stable public
+text rather than backend paths or tokens, and direct ecosystem reads propagate
+the web request ID as their correlation ID. An AST guard prevents new production
+handlers from bypassing the contract with `http.Error`. The full mavweb race
+suite passes, including disclosure, untrusted-ID, log-join, and propagation
+tests.
+
+### Bounded external responses
+
+Three audit defects were repaired and committed directly to `master`:
+
+- V-608 (`d7e8804`): llama completion responses are capped at 1 MiB, including
+  the LAN workstation seam.
+- V-675 (`459fe7a`): remote STT requires nonblank text and an explicit finite
+  confidence in `[0,1]`, caps JSON at 64 KiB, and falls back to mavsttd on a
+  malformed HTTP 200.
+- V-676 (`7d0250a`): Open-Meteo geocoding and forecasts are bounded, required
+  fields are nullable/validated, and coordinates/weather values are range
+  checked so `{}` cannot become plausible zero-degree weather.
+
+Each focused race suite passed and each task was closed only after the commit.
+
+### Transport shutdown
+
+V-679 (`de61b75`) adds the listener's `done` channel to TCP `Accept`. A
+concurrent-close test holds a silent peer in handshake and proves an in-flight
+accept returns `net.ErrClosed`; the race test passed twenty consecutive runs.
+
+V-688 (`80b6068`, caveat retirement `a0e6643`) bounds the browser push-to-talk
+body at ten minutes of mono PCM and configures header, idle, and read limits on
+the web server. The unused `/ws` handler was removed instead of retaining a
+second unauthenticated streaming transport with no browser caller. Focused race
+tests prove the exact-size request succeeds and an oversized request returns
+HTTP 413.
+
+### Conversation continuity
+
+V-542 (`da9114b`) repairs the five-turn monitor conversation without changing
+single-turn intent classification. Exact user utterances are now persisted
+separately from normalized intent slots and retained in chronological order.
+An anaphoric query with live transcript context reaches the chat path, while
+non-anaphoric sources are unchanged and acts stay fail-closed. An explicit
+conversation opener extends the session lifetime through later fact/query/chat
+routes without suppressing the grounded fact write.
+
+The deterministic scenario now names the monitor in all four contextual
+replies, proves that the original raw turn reached `PhraseChat` four times,
+stores the fact once, and produces zero unsolicited sends across five turns and
+one tick. Focused race tests passed for `cmd/mavend`, `internal/dialogue`,
+`internal/router`, and `internal/lexicon`. Measurement:
+`docs/evals/2026-08-13-conversation-continuity.md`.
+
+### Personal-data boundary
+
+V-702 replaces the narrow nearest-neighbour privacy gate with a frozen,
+class-balanced logistic head over multilingual-e5-small. It introduces no
+lexical exception and leaves the decision threshold at 0.5. Historical
+regressions score 29/29 and the balanced 72-case RU/EN fixture scores 72/72.
+
+The first 24-case challenge found one private-configuration miss. That result
+was treated as model-selection data rather than advertised as independent
+proof. Shrinkage LDA and an LDA/logistic ensemble repaired it but regressed the
+72-case gate, so both were rejected. Increasing the logistic L2 coefficient
+from 0.0001 to 0.0003 repairs the miss while improving four-fold corpus
+cross-validation from 97/104 to 99/104 and whole-shape holdout from 91/104 to
+92/104. A fresh 24-case challenge written only after that head was frozen scores
+24/24 at minimum signed probability margin +0.1718. The original challenge is
+also 24/24 but its +0.0001 edge remains documented as a regression, not fresh
+evidence. Full measurement:
+`docs/evals/2026-08-13-personal-boundary-linear-head.md`.
+
+During the audit, running multiple ONNX-backed tests in one `go test` process
+showed that only the first initializes; later tests self-skip because the
+runtime is process-global. All V-702 figures were therefore rerun in separate
+processes. V-716 tracks fixing that harness gap rather than hiding it in this
+feature.
+
+### Forced dialogue and repair state
+
+V-573 closes all four repair seams exposed by the dialogue contract: a
+correction wins before a parked clarify answer; a repaired decision is checked
+for required slots before acting; a request completed through clarification is
+correctable; and declined or stale repairs do not prematurely spend the repair
+pointer. Same-intent corrections are handled explicitly without redoing the
+action, so their prose cannot route fresh and overwrite the retained pointer.
+
+The independent state audit found two deeper stack losses. A handled repair
+could leave an older question silently parked with its old TTL, and a repaired
+request needing clarification could overwrite—or, on completion, delete—the
+older flow. Repairs now suspend and audibly resume live questions, repaired
+questions push onto the bounded dialogue stack, and completion/cancellation
+pops only the active top before resuming the flow underneath.
+
+`MAVEN_DIALOGUE_NO_SKIP=1 go test -race ./cmd/mavend -run
+'^TestDialogueTraces$' -count=1` passes all 22 traces. The complete forced
+`cmd/mavend` race suite passes in 208.031s. The integrated race command over
+`cmd/mavend`, `internal/dialogue`, and all `internal/router` packages also
+passes (162.310s for mavend; every package green). Focused structural
+possession, repair-pointer, nested-stack, and repaired-clarify tests pass under
+the race detector.
+
+### ONNX test/runtime lifecycle
+
+V-716 found that each embedder constructor tried to initialize ONNX Runtime,
+while `Close` destroyed only its session. In one package process the first
+model-aware test ran and later tests converted “already initialized” into a
+green skip. The router now owns the process-global environment through
+reference-counted leases held by each embedder and routing-head session; the
+last owned lease performs cleanup, and close is idempotent.
+
+The router and mavend test packages hold a lease across their model gates.
+`make eval-router` additionally requires proof that both named aggregate gates
+actually executed. In one process the classifier baseline scored 72/96 and the
+routing heads 93/96; destination was 11/33 and 25/33 respectively, and ecosystem
+reach remained 28/30. The lifecycle reacquire test, focused race suite, full
+aggregate command, and portable no-runtime packages all pass. Measurement:
+`docs/evals/2026-08-13-onnx-runtime-lifecycle.md`.
+
+### Clarification exhaustion is fail-closed
+
+V-717 closes the terminal-policy hole found during the V-573 audit. A request
+with two required gaps could spend its only question on the first, fill that
+slot, and then reach `applyAction` with the second still absent. The attempt cap
+was accidentally acting as permission to execute a partial action.
+
+The resolver now rebuilds the pending action and re-runs the canonical
+`missingFor` schema after every filled gap. One remaining gap produces exactly
+one next question only while the shared `PendingAction.CanAsk` budget permits
+it. Exhaustion visibly gives up, removes only the active stack level, and makes
+no write or action. `finishRebuilt` repeats the same invariant at the execution
+boundary. Reminder time answers remain separate from the clean payload but are
+included in the schema decision used for validation.
+
+The original `TestClarifySecondGapRespectsTheAttemptCap` now asserts the exact
+give-up and zero reminders. New tests cover direct boundary refusal and a
+two-level stack where exhausting the top appends the surviving lower question
+to the same reply. The focused V-717 race cases pass in 4.529s; every clarify
+case plus all 22 forced dialogue traces pass under the race detector in
+26.202s; `internal/dialogue` passes under race in 2.293s. Routing contract:
+`docs/routing.md` section “Required slots and attempt exhaustion”.
+
+### A suppressed nudge is identified before it is phrased
+
+V-687 closes the phrase-before-dedupe hole in the digestion worker. The dedupe
+was reported by `EnqueueDigestEntry`, which runs after `PhraseNudge` has already
+been paid, and the `else if deduped { continue }` meant to skip the cost was the
+last statement in the loop body. Every tick that kept suppressing the same rule
+spent the resident model again, against the cache claim in the comment above it.
+
+The fix gives a rule a durable semantic identity instead of hashing its prose. A
+rule eligible for the digest declares `DigestIdentity`, a function of state
+beside its predicate; `loop.DigestCandidateFingerprint` frames the rule name and
+severity around it so two rules cannot alias on a shared fact. `BreakRule`
+anchors on the last completed break rather than on `desk_active`, which is
+freshness evidence the poller refreshes without the unmet need changing. A rule
+with no declared identity does not enter the digest, because inventing a generic
+state hash would either change every tick or ignore an input the rule reads.
+
+`tick_digest.go` now looks up `LiveDigestEntry` by rule and fingerprint before
+phrasing. Migration #26 adds `candidate_fingerprint` with a partial unique index
+over live pending rows; `EnqueueDigestEntry` expires a matching stale row and
+inserts inside one transaction, so sweep order is not part of correctness and a
+second caller cannot race the pre-phrase read into a duplicate. Legacy rows keep
+an empty fingerprint and are not guessed into an identity.
+
+Six tests cover the contract: one phrase call across three suppressed ticks,
+zero after a daemon restart, and two when the meaning changes, when the entry
+expires, and when it has been drained. `./cmd/mavend/ -run TestSuppressedCareDigest`
+passes under race in 4.626s, the digest store and loop cases in 4.123s and
+1.046s, and the three full packages in 264.076s, 64.496s and 4.280s. The caveat
+`docs/caveats/workers.md#nudges` and the `SA4006` baseline entry are deleted.

Makefile

@@ -4,7 +4,7 @@
 # `test` below fail on the two packages that have no test files. deps-go builds
 # the missing tools in, so the vendored tree is self-sufficient. Keep the version
 # here in step with the `go` directive in go.mod.
-GO_VERSION := 1.25.5
+GO_VERSION := 1.25.12
 GO       := $(shell pwd)/deps/go/go/bin/go
 export GOTOOLCHAIN := local
 GOFLAGS  :=
@@ -16,7 +16,7 @@ PIPER_BIN     := $(shell pwd)/deps/piper/piper
 PIPER_MODEL   := $(shell pwd)/models/tts/ru_RU-irina-medium.onnx
 PIPER_ESPEAK  := $(shell pwd)/deps/piper/espeak-ng-data
 
-.PHONY: t audit simulate stt-fixtures test-stt-golden all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel tidy eval-router eval-reach eval-recall eval-phrasing eval-models build-gpud
+.PHONY: t audit simulate stt-fixtures test-stt-golden test-cw2-config all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel deps-vuln vuln deps-lint lint deadcode analyze tidy eval-router eval-reach eval-recall eval-phrasing eval-models build-gpud
 
 all: build
 
@@ -73,7 +73,7 @@ run-web: build-web
 # builds them on demand, but `go test -coverprofile` calls covdata through
 # base.Tool(), which only stats pkg/tool and exits. So build them in once here.
 GO_TARBALL := go$(GO_VERSION).linux-amd64.tar.gz
-GO_SHA256  := 9e9b755d63b36acf30c12a9a3fc379243714c1c6d3dd72861da637f336ebb35b
+GO_SHA256  := 234828b7a89e0e303d2556310ee549fbcf253d28de937bac3da13d6294262ac1
 deps-go: deps-sentinel
 	@mkdir -p deps/go
 	cd deps/go && curl -fLO 'https://go.dev/dl/$(GO_TARBALL)'
@@ -95,6 +95,70 @@ deps-sentinel:
 	@mkdir -p deps
 	@printf 'module github.com/kami/maven/deps\n\ngo 1.21\n' > deps/go.mod
 
+# vuln — the advisory gate the 2026-08-10 audit found missing (V-682). It reads
+# the published database over the network, so it is not part of `test`, which
+# has to pass on a box with no route out. Run it before a toolchain or
+# dependency bump lands, because that is what it grades: on 2026-08-11 the
+# pinned Go 1.25.5 and x/text 0.14.0 carried 20 reachable advisories and the
+# bumped pair carries none.
+#
+# govulncheck is a tool and not a dependency, so it is installed into deps/ like
+# the toolchain rather than added to go.mod. The version is pinned here for the
+# same reason GO_VERSION is: a gate that moves on its own is not a gate.
+GOVULNCHECK_VERSION := v1.6.0
+GOVULNCHECK := $(shell pwd)/deps/bin/govulncheck
+
+deps-vuln: deps-sentinel
+	@mkdir -p deps/bin
+	GOTOOLCHAIN=local GOBIN=$(shell pwd)/deps/bin \
+		$(GO) install golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION)
+
+# The CGO env is the same one `test` carries: govulncheck loads the packages,
+# and the four CGO daemons do not load without it.
+vuln: deps-vuln
+	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
+		PATH="$(shell pwd)/deps/go/go/bin:$$PATH" GOTOOLCHAIN=local $(GOVULNCHECK) ./...
+
+# lint and deadcode — the other two analyzers the 2026-08-10 audit asked for
+# (V-694). They are not part of `test` for the same reason `vuln` is not: they
+# install over the network, and they are slow enough that a change to one Go
+# file should not pay for them.
+#
+# Neither reports zero, so neither fails on its own output. The accepted set
+# lives in scripts/analyzers/*.baseline and scripts/analyzer-gate.sh decides.
+# What is new fails, and so does a baseline entry whose finding is gone.
+#
+# deadcode runs with -test, so a test file is a root. Without it the report is
+# 172 lines, most of internal/router/eval, and none of it is a mistake.
+STATICCHECK_VERSION := v0.7.0
+DEADCODE_VERSION    := v0.48.0
+STATICCHECK := $(shell pwd)/deps/bin/staticcheck
+DEADCODE    := $(shell pwd)/deps/bin/deadcode
+
+deps-lint: deps-sentinel
+	@mkdir -p deps/bin
+	GOTOOLCHAIN=local GOBIN=$(shell pwd)/deps/bin \
+		$(GO) install honnef.co/go/tools/cmd/staticcheck@$(STATICCHECK_VERSION)
+	GOTOOLCHAIN=local GOBIN=$(shell pwd)/deps/bin \
+		$(GO) install golang.org/x/tools/cmd/deadcode@$(DEADCODE_VERSION)
+
+# Both load the packages, so both carry the CGO env `test` carries. Without it
+# the four CGO daemons do not load and the analyzer reports a build error
+# instead of a finding -- which analyzer-gate.sh fails on rather than filters.
+ANALYZER_ENV = CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" \
+	LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
+	PATH="$(shell pwd)/deps/go/go/bin:$$PATH" GOTOOLCHAIN=local
+
+lint: deps-lint
+	@$(ANALYZER_ENV) $(STATICCHECK) ./... | scripts/analyzer-gate.sh staticcheck
+
+deadcode: deps-lint
+	@$(ANALYZER_ENV) $(DEADCODE) -test ./... | scripts/analyzer-gate.sh deadcode
+
+# Every static gate in one command. Not `check`, because it is not the thing to
+# run before a commit: vuln reads the network and all three are slow.
+analyze: lint deadcode vuln
+
 # Run the tidy the sentinel makes possible. Not part of `test`: it rewrites
 # go.mod, and a build target that edits the module file is a surprise.
 # vendor/ is committed, so a tidy that drops a requirement must be followed by
@@ -124,7 +188,10 @@ simulate:
 	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
 		$(GO) test -v -count=1 -run TestSimulator ./cmd/mavend/
 
-test: fmt-check vet
+test-cw2-config:
+	python3 -m unittest discover -s deploy/cw2 -p 'test_*.py'
+
+test: fmt-check vet test-cw2-config
 	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
 		$(GO) test -race -coverprofile=coverage.out ./internal/... ./cmd/...
 
@@ -161,11 +228,15 @@ t:
 # Verbose so the report tables land in the terminal. MAVEN_ONNX_LIB points the
 # prod-representative baseline at the vendored runtime; override it or set it
 # empty to run only the deterministic hash ratchet. This is the measurement
-# Vikunja #319 compares before #320 flips the route decider.
+# Vikunja #319 compares before #320 flips the route decider. With a non-empty
+# runtime path the package must prove that at least two model gates executed;
+# a constructor skip after the first process-global initialization is a failure.
 MAVEN_ONNX_LIB ?= $(shell pwd)/deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so
 
 eval-router:
-	MAVEN_ONNX_LIB="$(MAVEN_ONNX_LIB)" $(GO) test -v -count=1 ./internal/router/eval/
+	MAVEN_ONNX_LIB="$(MAVEN_ONNX_LIB)" \
+	MAVEN_ONNX_REQUIRED_GATES="$(if $(MAVEN_ONNX_LIB),2,0)" \
+		$(GO) test -v -count=1 ./internal/router/eval/
 
 # eval-reach — score the held-out ecosystem reach fixture (internal/router/eval,
 # ru_ecosystem_v1.json). Answers "does a real Russian utterance actually arrive

cmd/labelgen/main.go

@@ -40,34 +40,19 @@ type label struct {
 	Labeled   bool   `json:"labeled"`
 }
 
-// grammars mirrors buildRouter's order in cmd/mavend/voicewire.go. Order is
-// load-bearing there and so it is here: the agenda rules must sit after the
-// clock rules, Praxis before the capture marker, the narrative rules last.
+// grammars is the daemon's canonical ordered stage-zero set. Label generation
+// must not maintain a second copy: that drift was the defect fixed by V-693.
 func grammars() []router.Grammar {
-	var g []router.Grammar
-	g = append(g, router.SystemTimeDateGrammars()...)
-	g = append(g, router.AgendaQueryGrammars()...)
-	g = append(g, router.FeedQueryGrammar())
-	g = append(g, router.TaskListGrammar())
-	g = append(g, router.ListGrammars()...)
-	g = append(g, router.ReminderGrammar())
-	g = append(g, router.PraxisGrammars()...)
-	g = append(g, router.TaskCaptureGrammar())
-	g = append(g, router.NarrativeQueryGrammars()...)
-	return g
+	return router.StageZeroGrammars(router.DefaultActMatcher{})
 }
 
 func match(gs []router.Grammar, utterance string) label {
 	out := label{Utterance: utterance}
 	for _, g := range gs {
-		m := g.Pattern.FindStringSubmatch(utterance)
-		if m == nil {
+		d, matched, ok := g.Evaluate(utterance)
+		if !matched || !ok {
 			continue
 		}
-		d, ok := g.Build(m)
-		if !ok {
-			continue // the rule saw its shape and declined it
-		}
 		out.Intent = string(d.Intent)
 		out.Grammar = g.Name
 		out.Key = d.Slots.Key

cmd/mavend/clarify.go

@@ -342,7 +342,7 @@ func (h *reactiveHandler) resolveClarifyAnswer(ctx context.Context, text string)
 
 	switch role {
 	case roleCancel:
-		h.clarifyStore.Delete(dialogueIDOf(ctx))
+		h.completeClarifyTop(ctx)
 		return clarifyCancelled, true
 	case roleSideQuery:
 		// He asked something of his own WITHOUT leaving the flow. The question
@@ -419,19 +419,6 @@ func (h *reactiveHandler) resolveClarifyAnswer(ctx context.Context, text string)
 	if stillOpen(q.Missing, whenTextOf(q), merged) {
 		return h.reaskOrGiveUp(ctx, q, merged, text, taken), true
 	}
-	h.clarifyStore.Delete(dialogueIDOf(ctx))
-
-	// One gap filled is not the same as a complete request. askClarify parks
-	// only the first gap, because one question per turn is the rule, but a
-	// reminder wants both a subject and a time. "напомни" with neither used to
-	// ask "О чём напомнить?", accept "позвонить маме", and then hand applyAction
-	// a reminder with no time, which answered "не получилось разобрать время
-	// напоминания." — an error for a request she never finished asking about.
-	// Re-enter the loop instead, one question at a time as before.
-	if reply, asked := h.askRemainingGap(ctx, q, intent, merged); asked {
-		return reply, true
-	}
-
 	// Rebuild the decision as if it had routed cleanly, then run it down the
 	// normal path. Clarify is deliberately false and the intent is unchanged:
 	// filling in an argument never grants authority, so the completed decision
@@ -443,7 +430,44 @@ func (h *reactiveHandler) resolveClarifyAnswer(ctx context.Context, text string)
 		Intent:    intent,
 		Slots:     applyDialogueSlots(answer, merged),
 	}
-	return h.finishClarified(ctx, dec), true
+	// Time answers stay out of dec.Utterance because it is also the reminder
+	// payload. The action schema still needs that evidence, so validate a copy
+	// carrying the full time exchange while executing the clean decision.
+	schemaDec := dec
+	schemaDec.Utterance = whenTextOf(q)
+
+	// One gap filled is not the same as a complete request. askClarify parks
+	// only the first gap, because one question per turn is the rule, but a
+	// reminder wants both a subject and a time. Re-enter the schema one question
+	// at a time. If the shared attempt budget is spent, askRemainingGap visibly
+	// gives up and removes this stack level; it must never turn an incomplete
+	// decision into permission to act (V-717).
+	if reply, handled := h.askRemainingGap(ctx, q, schemaDec); handled {
+		return reply, true
+	}
+	h.completeClarifyTop(ctx)
+	return h.finishClarified(ctx, dec, schemaDec), true
+}
+
+// completeClarifyTop finishes only the active question. A nested question can
+// sit above a flow that was suspended by a side request or repair; deleting the
+// dialogue id here erased both. If one survives underneath, restart its clock
+// from the moment it is spoken again and attach its question to this turn.
+func (h *reactiveHandler) completeClarifyTop(ctx context.Context) {
+	if h.clarifyStore == nil {
+		return
+	}
+	_, resumed := h.clarifyStore.CompleteTop(dialogueIDOf(ctx), h.now())
+	if resumed == nil || len(resumed.Missing) == 0 {
+		return
+	}
+	question, ok := clarifyResumedFor(resumed.Missing[0])
+	if !ok {
+		return
+	}
+	if rt := turnRouteFrom(ctx); rt != nil {
+		rt.resume = question
+	}
 }
 
 // noteDropped records that the parked request was let go this turn, so runTurn
@@ -487,7 +511,7 @@ func (h *reactiveHandler) noteSuspended(ctx context.Context, q *dialogue.Pending
 		return
 	}
 	if !q.CanResume() {
-		h.clarifyStore.Delete(dialogueIDOf(ctx))
+		h.completeClarifyTop(ctx)
 		h.noteDropped(ctx)
 		log.Printf("voice: clarify — letting the question about %s go: %d asides in a row, %d rides in all", q.Missing[0], q.Suspends, q.Rides)
 		return
@@ -520,26 +544,27 @@ func foldAnswerIntoUtterance(utterance, subject string) string {
 	return strings.TrimSpace(utterance) + " " + subject
 }
 
-// askRemainingGap re-parks the request when the answer closed one gap and
-// wantedSlots still names another. Returns ("", false) when the request is
-// complete, when there is no question for what is left, or when she is out of
-// attempts — in all three the caller runs the decision as it stands, which for
-// the out-of-attempts case is the old behaviour and is the right one: she has
-// already asked enough.
+// askRemainingGap re-parks the request when the answer closed one gap and the
+// action schema still names another. Returns ("", false) only when the request
+// is complete. A remaining gap is always handled here: one next question while
+// budget remains, otherwise an explicit give-up with no partial action (V-717).
 //
 // The attempt budget is shared with the re-ask path on purpose. A second gap
 // costs a question exactly like a second try at the first one does, so the cap
 // still bounds how many times she can speak before acting or letting go.
-func (h *reactiveHandler) askRemainingGap(ctx context.Context, q *dialogue.PendingQuestion, intent router.Intent, merged dialogue.Slots) (string, bool) {
-	remaining := stillMissingFor(intent, whenTextOf(q), merged)
+func (h *reactiveHandler) askRemainingGap(ctx context.Context, q *dialogue.PendingQuestion, dec router.Decision) (string, bool) {
+	remaining := missingFor(dec)
 	if len(remaining) == 0 {
 		return "", false
 	}
 	// Attempts+1 is the question she is about to ask, and the budget is shared
 	// with the re-ask path, so the second gap is worded like a second try.
-	question, ok := h.questionFor(remaining[0], q.Attempts+1, whenTextOf(q), merged, "")
+	merged := toDialogueSlots(dec.Slots)
+	question, ok := h.questionFor(remaining[0], q.Attempts+1, dec.Utterance, merged, "")
 	if !ok || !q.CanAsk() {
-		return "", false
+		h.completeClarifyTop(ctx)
+		log.Printf("voice: clarify — gave up with required gap %s still open after %d question(s); no action ran", remaining[0], q.Attempts)
+		return clarifyGaveUp, true
 	}
 	// Suspends is not carried, and by this point it is already zero: the answer
 	// path resets it (V-654). Left off the literal so the zero is stated where
@@ -561,7 +586,7 @@ func (h *reactiveHandler) askRemainingGap(ctx context.Context, q *dialogue.Pendi
 		MaxAttempts: q.MaxAttempts,
 		Rides:       q.Rides,
 	})
-	log.Printf("voice: clarify — one gap filled, still missing %s for intent=%s, asking again (attempt %d)", remaining[0], intent, q.Attempts+1)
+	log.Printf("voice: clarify — one gap filled, still missing %s for intent=%s, asking again (attempt %d)", remaining[0], dec.Intent, q.Attempts+1)
 	return question, true
 }
 
@@ -576,7 +601,7 @@ func (h *reactiveHandler) reaskOrGiveUp(ctx context.Context, q *dialogue.Pending
 		question, _ = h.questionFor(q.Missing[0], q.Attempts+1, whenTextOf(q), merged, taken)
 	}
 	if question == "" || !q.CanAsk() {
-		h.clarifyStore.Delete(dialogueIDOf(ctx))
+		h.completeClarifyTop(ctx)
 		log.Printf("voice: clarify — gave up on %v after %d question(s), answer was %q", q.Missing, q.Attempts, text)
 		return clarifyGaveUp
 	}
@@ -590,15 +615,48 @@ func (h *reactiveHandler) reaskOrGiveUp(ctx context.Context, q *dialogue.Pending
 	return question
 }
 
-// finishClarified runs a completed decision through the same steps a freshly
-// routed one takes: remember the turn, act, then phrase.
-func (h *reactiveHandler) finishClarified(ctx context.Context, dec router.Decision) string {
+// finishClarified completes a decision whose parked gaps were already checked
+// by resolveClarifyAnswer. It still records the turn for a later correction;
+// the old path made anything completed through dialogue uncorrectable (V-573).
+func (h *reactiveHandler) finishClarified(ctx context.Context, dec, schemaDec router.Decision) string {
+	return h.finishRebuilt(ctx, dec, schemaDec, false)
+}
+
+// finishRepaired validates a decision rebuilt from an older utterance. Unlike
+// resolveClarifyAnswer, repair has not passed the current slot gate, so it must
+// ask about any missing argument before acting (V-573).
+func (h *reactiveHandler) finishRepaired(ctx context.Context, dec router.Decision) string {
+	return h.finishRebuilt(ctx, dec, dec, true)
+}
+
+// finishRebuilt is the execution boundary for decisions reconstructed from
+// dialogue. schemaDec is the same action with all validation evidence present;
+// a clarified reminder includes the separately-held time answers there while
+// dec keeps the clean reminder payload. No rebuilt action crosses this boundary
+// while missingFor still names a required slot.
+func (h *reactiveHandler) finishRebuilt(ctx context.Context, dec, schemaDec router.Decision, ask bool) string {
+	missing := missingFor(schemaDec)
+	if ask && (schemaDec.Clarify || len(missing) > 0) {
+		if reply := h.hexisBeforeClarify(ctx, dec); reply != "" {
+			return reply
+		}
+		if question, asked := h.askClarify(ctx, dec); asked {
+			return question
+		}
+	}
+	if len(missing) > 0 {
+		log.Printf("voice: clarify — refusing incomplete rebuilt intent=%s with required gaps %v; no action ran", dec.Intent, missing)
+		return clarifyGaveUp
+	}
 	if h.dialogueSessions != nil {
 		now := h.now()
 		prev := h.dialogueSessions.Get(dialogueIDOf(ctx), now)
 		dec = followUpMerge(prev, dec, now)
 		h.rememberTurn(ctx, prev, dec, now)
 	}
+	if !dec.Clarify {
+		h.recordTurn(dec.Utterance, dec.Intent)
+	}
 	reply := h.applyAction(ctx, dec)
 	if reply == "" {
 		reply = h.replier.Reply(ctx, dec)
@@ -622,15 +680,23 @@ const maxCarriedHistory = 3
 func (h *reactiveHandler) rememberTurn(ctx context.Context, prev *dialogue.Session, dec router.Decision, now time.Time) {
 	var history []dialogue.Turn
 	if prev != nil {
-		history = append(history, sessionAsTurn(prev))
-		maxHist := len(prev.History)
-		if maxHist > maxCarriedHistory {
-			maxHist = maxCarriedHistory
+		// History is chronological. Keep the newest tail of the older history,
+		// then append the immediate prior turn. The previous implementation put
+		// the newest turn first while the type contract said newest-last, so the
+		// model read a conversation backwards.
+		from := len(prev.History) - maxCarriedHistory
+		if from < 0 {
+			from = 0
 		}
-		history = append(history, prev.History[:maxHist]...)
+		history = append(history, prev.History[from:]...)
+		history = append(history, sessionAsTurn(prev))
+	}
+	conversational := dec.Intent == router.IntentChat || opensConversation(dec.Utterance)
+	if prev != nil && (prev.Conversational || prev.Intent == dialogue.IntentChat) {
+		conversational = true
 	}
 	ttl := time.Duration(0) // use the store default (2 min)
-	if dec.Intent == router.IntentChat {
+	if conversational {
 		ttl = 15 * time.Minute // conversational turns should last longer
 	}
 	// A system or query turn often carries no Text slot at all — a stage-0
@@ -652,10 +718,12 @@ func (h *reactiveHandler) rememberTurn(ctx context.Context, prev *dialogue.Sessi
 		slots.Text = dec.Utterance
 	}
 	h.dialogueSessions.Put(dialogueIDOf(ctx), &dialogue.Session{
-		Intent:    dialogue.Intent(dec.Intent),
-		Slots:     slots,
-		Timestamp: now,
-		TTL:       ttl,
-		History:   history,
+		Intent:         dialogue.Intent(dec.Intent),
+		Slots:          slots,
+		Utterance:      dec.Utterance,
+		Conversational: conversational,
+		Timestamp:      now,
+		TTL:            ttl,
+		History:        history,
 	})
 }

cmd/mavend/clarify_test.go

@@ -394,25 +394,86 @@ func TestClarifyAsksAboutTheSecondGapToo(t *testing.T) {
 
 // TestClarifySecondGapRespectsTheAttemptCap — the second gap spends a question
 // out of the same budget, so it cannot turn a capped exchange into an endless
-// one. With one attempt allowed she acts on what she has instead of asking.
+// one. With one attempt allowed she gives up visibly and creates nothing: the
+// cap is a bound on dialogue, never a path around the action schema (V-717).
 func TestClarifySecondGapRespectsTheAttemptCap(t *testing.T) {
 	ctx := context.Background()
-	h, _, _ := newClarifyHandler(t)
+	h, st, _ := newClarifyHandler(t)
 	h.clarifyMaxAttempts = 1
 
 	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder, router.Slots{}, "напомни")); !asked {
 		t.Fatal("expected the subject question")
 	}
 	reply, handled := h.resolveClarifyAnswer(ctx, "позвонить маме")
-	if !handled {
-		t.Fatal("the answer must be consumed")
+	if !handled || reply != clarifyGaveUp {
+		t.Fatalf("out of attempts she must give up visibly, handled=%v reply=%q", handled, reply)
 	}
-	if reply == "Когда?" {
-		t.Fatal("out of attempts she must not ask a second question")
+	if isAnyClarifyQuestion(reply) {
+		t.Fatalf("out of attempts she must not ask another question: %q", reply)
 	}
 	if h.clarifyStore.Get(voiceDialogueID, h.now()) != nil {
 		t.Fatal("no question may stay armed past the cap")
 	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 0 {
+		t.Fatalf("an incomplete exhausted request created a reminder: reminders=%+v err=%v", reminders, err)
+	}
+}
+
+// Exhausting a nested top request removes only that request and makes the
+// lower flow audible again in the same reply. This is the multi-gap exhaustion
+// shape, not the ordinary failed-answer path covered in repair_test.go.
+func TestClarifySecondGapExhaustionResumesLowerFlow(t *testing.T) {
+	ctx := context.Background()
+	h, st, _ := newClarifyHandler(t)
+	older := &dialogue.PendingQuestion{
+		Intent: dialogue.IntentReminder,
+		Slots:  dialogue.Slots{Text: "позвонить маме"}, Missing: []dialogue.Slot{dialogue.SlotTime},
+		Utterance: "напомни позвонить маме", Asked: h.now(), TTL: clarifyTTL,
+		Attempts: 1, MaxAttempts: dialogue.DefaultMaxAttempts,
+	}
+	top := &dialogue.PendingQuestion{
+		Intent: dialogue.IntentReminder, Missing: []dialogue.Slot{dialogue.SlotText},
+		Utterance: "напомни", Asked: h.now(), TTL: clarifyTTL,
+		Attempts: 1, MaxAttempts: 1,
+	}
+	h.clarifyStore.Push(voiceDialogueID, older)
+	h.clarifyStore.Push(voiceDialogueID, top)
+
+	reply := h.runTurn(ctx, "купить хлеб", sourceText)
+	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
+	want := withResumed(clarifyGaveUp, resumed)
+	if reply != want {
+		t.Fatalf("reply=%q, want visible top give-up followed by resumed lower question %q", reply, want)
+	}
+	if depth := h.clarifyStore.Depth(voiceDialogueID); depth != 1 {
+		t.Fatalf("exhausting the top request left stack depth %d, want 1", depth)
+	}
+	if got := h.clarifyStore.Get(voiceDialogueID, h.now()); got != older {
+		t.Fatalf("resumed flow=%+v, want the older question", got)
+	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 0 {
+		t.Fatalf("nested exhaustion partially created a reminder: reminders=%+v err=%v", reminders, err)
+	}
+}
+
+// The rebuilt-action boundary repeats the schema invariant even though the
+// normal resolver checked it one branch earlier. A future dialogue caller must
+// not be able to bypass required slots by calling the completion wrapper.
+func TestFinishClarifiedRefusesIncompleteAction(t *testing.T) {
+	ctx := context.Background()
+	h, st, _ := newClarifyHandler(t)
+	dec := router.Decision{
+		Utterance: "напомни позвонить маме",
+		Stage:     2,
+		Intent:    router.IntentReminder,
+		Slots:     router.Slots{Text: "позвонить маме"},
+	}
+	if reply := h.finishClarified(ctx, dec, dec); reply != clarifyGaveUp {
+		t.Fatalf("incomplete rebuilt action reply=%q, want %q", reply, clarifyGaveUp)
+	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 0 {
+		t.Fatalf("rebuilt-action guard allowed a partial reminder: reminders=%+v err=%v", reminders, err)
+	}
 }
 
 // TestClarifyProseHoldsThePersona — these lines are hand-written Russian that

cmd/mavend/conversation_context_test.go

@@ -0,0 +1,111 @@
+package main
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/router"
+)
+
+func TestRememberTurnKeepsIntentIndependentTranscriptInSpeakingOrder(t *testing.T) {
+	now := time.Date(2026, 8, 13, 1, 0, 0, 0, time.UTC)
+	h := &reactiveHandler{
+		now:              func() time.Time { return now },
+		dialogueSessions: dialogue.NewSessionStore(time.Hour),
+	}
+	ctx := context.Background()
+	turns := []router.Decision{
+		{Intent: router.IntentFact, Utterance: "я купил новый монитор", Slots: router.Slots{Key: "purchase", Value: "новый монитор", HasKey: true}},
+		{Intent: router.IntentQuery, Utterance: "а он большой?", Slots: router.Slots{Text: "normalized query"}},
+		{Intent: router.IntentChat, Utterance: "кажется, я переплатил", Slots: router.Slots{Text: "normalized chat"}},
+		{Intent: router.IntentQuery, Utterance: "стоит его вернуть?", Slots: router.Slots{Text: "normalized return query"}},
+	}
+	for i, dec := range turns {
+		prev := h.dialogueSessions.Get(voiceDialogueID, now)
+		h.rememberTurn(ctx, prev, dec, now.Add(time.Duration(i)*time.Second))
+	}
+
+	got := h.dialogueSessions.Get(voiceDialogueID, now.Add(4*time.Second))
+	if got == nil {
+		t.Fatal("no dialogue session")
+	}
+	if got.Utterance != turns[3].Utterance {
+		t.Fatalf("current utterance = %q, want %q", got.Utterance, turns[3].Utterance)
+	}
+	want := []string{turns[0].Utterance, turns[1].Utterance, turns[2].Utterance}
+	if len(got.History) != len(want) {
+		t.Fatalf("history = %+v, want %d prior turns", got.History, len(want))
+	}
+	for i := range want {
+		if got.History[i].Text != want[i] {
+			t.Errorf("history[%d] = %q, want %q", i, got.History[i].Text, want[i])
+		}
+	}
+
+	// actionChat runs after rememberTurn. It must receive only prior turns;
+	// handing over the current turn here would duplicate the model's user input.
+	history := h.chatHistory(ctx)
+	if len(history) != len(want) {
+		t.Fatalf("chat history = %+v, want exactly the prior turns", history)
+	}
+	for _, turn := range history {
+		if turn.Text == got.Utterance {
+			t.Fatalf("current utterance was duplicated into chat history: %+v", history)
+		}
+	}
+}
+
+func TestSessionAsTurnReadsLegacySlotText(t *testing.T) {
+	legacy := &dialogue.Session{
+		Intent: dialogue.IntentQuery,
+		Slots:  dialogue.Slots{Text: "старый сохранённый вопрос"},
+	}
+	if got := sessionAsTurn(legacy).Text; got != legacy.Slots.Text {
+		t.Fatalf("legacy turn text = %q, want %q", got, legacy.Slots.Text)
+	}
+}
+
+func TestExplicitConversationOpenerKeepsCrossIntentSessionAlive(t *testing.T) {
+	now := time.Date(2026, 8, 13, 1, 0, 0, 0, time.UTC)
+	h := &reactiveHandler{
+		now:              func() time.Time { return now },
+		dialogueSessions: dialogue.NewSessionStore(2 * time.Minute),
+	}
+	ctx := context.Background()
+	h.rememberTurn(ctx, nil, router.Decision{
+		Intent: router.IntentFact, Utterance: "давай поболтаем: я купил новый монитор",
+		Slots: router.Slots{Key: "purchase", Value: "новый монитор", HasKey: true},
+	}, now)
+
+	later := now.Add(10 * time.Minute)
+	prev := h.dialogueSessions.Get(voiceDialogueID, later)
+	if prev == nil {
+		t.Fatal("explicit conversation expired at the ordinary two-minute TTL")
+	}
+	if !prev.Conversational || prev.TTL != 15*time.Minute {
+		t.Fatalf("conversation state = %+v, want conversational 15m session", prev)
+	}
+	got := followUpMerge(prev, router.Decision{
+		Intent: router.IntentQuery, Utterance: "а он большой?",
+	}, later)
+	if got.Intent != router.IntentChat {
+		t.Fatalf("anaphoric follow-up intent = %s, want chat", got.Intent)
+	}
+}
+
+func TestConversationOpenerDoesNotMatchAnotherDavaiCommand(t *testing.T) {
+	if opensConversation("давай запишем новый монитор") {
+		t.Fatal("an ordinary cooperative command opened a conversation")
+	}
+	for _, text := range []string{
+		"давай поговорим: я купил монитор",
+		"давайте пообщаемся",
+		"let's talk: I bought a monitor",
+	} {
+		if !opensConversation(text) {
+			t.Errorf("%q did not open a conversation", text)
+		}
+	}
+}

cmd/mavend/decisiontrace.go

@@ -31,8 +31,8 @@ import (
 // and nothing should: a missing name costs one line of the record, while a
 // check that walks the ladder would have to run the ladder.
 var preRouteLadder = []string{
-	"confirm", "clarify-answer", "quiet-toggle", "snooze", "ack", "repair",
-	"repair-negative", "ordinal",
+	"confirm", "repair", "repair-negative", "clarify-answer", "quiet-toggle",
+	"snooze", "ack", "ordinal",
 }
 
 // notePreRoute records one rung of that ladder and passes its verdict through

cmd/mavend/dialogue_contract_test.go

@@ -651,7 +651,7 @@ func dialogueTraces() []trace {
 			end: endState{},
 		},
 
-		// ---- rows below carry the CORRECT expectation and fail today ----
+		// ---- formerly failing interleavings; kept as permanent contracts ----
 
 		// The owner's own sentence from V-577 shape 2, in his words. It needs
 		// an engine that can route it: the hash embedder marks it note with
@@ -660,7 +660,6 @@ func dialogueTraces() []trace {
 		// floor's deterministic fact parser reads.
 		{
 			name: "a note stated mid-flow is stored, not dropped",
-			skip: "the offline floor cannot route «у меня новый ноутбук» confidently; needs the resident model",
 			turns: []turn{
 				{say: "напомни позвонить врачу", question: dialogue.SlotTime, attempt: 1,
 					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "врачу"}},
@@ -747,7 +746,6 @@ func dialogueTraces() []trace {
 		// written yet and is not this task's to invent.
 		{
 			name: "cancel: a parked question, then never mind",
-			skip: "V-560: a cancel is scored as a failed answer, not as a cancel",
 			turns: []turn{
 				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
 					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1}},
@@ -761,7 +759,6 @@ func dialogueTraces() []trace {
 		// scores "нет, это была заметка" as a bad time answer and asks again.
 		{
 			name: "correction while a question is parked",
-			skip: "V-560: clarify pre-empts the repair marker, so a correction cannot be spoken mid-flow",
 			turns: []turn{
 				{say: "добавь в задачи купить молоко", contains: []string{"купить молоко"}},
 				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
@@ -771,21 +768,17 @@ func dialogueTraces() []trace {
 			},
 			end: endState{tasks: []string{"купить молоко"}},
 		},
-		// A reminder said whole, in one breath, with the hour in it — and she
-		// asks when. ReminderGrammar (stage0.go) builds its slots by hand and
-		// never runs the extractor, so a stage-0 reminder carries no time
-		// whatever the sentence says, and the clarify gate reads the gap as
-		// real. It costs a turn on the commonest reminder shape there is.
-		//
-		// Hermetic despite the date parser: stage 0 calls no parser at all, so
-		// this fails the same way with or without python dateparser installed.
+		// Stage 0 has extracted the hour since V-572. The day remains genuinely
+		// absent, and V-579 deliberately refuses to invent it even when 11:00 is
+		// still ahead on today's clock. This stale skipped row used to expect a
+		// commit and contradicted every neighbouring time-contract row.
 		{
-			name: "a reminder said whole is not asked about",
-			skip: "V-562: a stage-0 decision never meets the extractor, so its slots are never validated",
+			name: "a stage-zero reminder keeps its hour and asks for the missing day",
 			turns: []turn{
-				{say: "напомни в 11:00 позвонить маме", contains: []string{"11:00"}, noQuestion: true},
+				{say: "напомни в 11:00 позвонить маме", question: dialogue.SlotTime, attempt: 1,
+					gap: whenNoDay, parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "маме"}},
 			},
-			end: endState{reminders: []reminderWant{{payload: "позвонить маме", fireAt: "2026-07-31 11:00"}}},
+			end: endState{},
 		},
 		// The same gap on the repair path. A correction redoes the request
 		// through finishClarified, which goes straight to applyAction — it never
@@ -795,7 +788,6 @@ func dialogueTraces() []trace {
 		// with no time.
 		{
 			name: "a correction that lands short asks rather than failing",
-			skip: "V-562: finishClarified skips the clarify gate, so a repaired decision is never checked for gaps",
 			turns: []turn{
 				{say: "добавь в задачи купить молоко", contains: []string{"купить молоко"}},
 				{say: "нет, это было напоминание", contains: []string{"поняла, это напоминание"},

cmd/mavend/digest_test.go

@@ -2,13 +2,26 @@ package main
 
 import (
 	"context"
+	"path/filepath"
 	"testing"
 	"time"
 
+	"github.com/kami/maven/internal/delivery"
 	"github.com/kami/maven/internal/loop"
+	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/store"
 )
 
+type nudgeCountingPhraser struct {
+	phraser.Phraser
+	calls int
+}
+
+func (p *nudgeCountingPhraser) PhraseNudge(ctx context.Context, c loop.Candidate) (delivery.PhrasedNudge, error) {
+	p.calls++
+	return p.Phraser.PhraseNudge(ctx, c)
+}
+
 // Vikunja #281 — the fourth delivery outcome: a care candidate the restraint
 // gate suppresses (quiet hours / away / calendar-busy) is not necessarily
 // lost. If it's worth resurfacing (loop.DigestEligible), it's durably held
@@ -38,7 +51,7 @@ func TestSuppressedCareDigestsAcrossQuietHours(t *testing.T) {
 	ctx := context.Background()
 	now := refNow()
 
-	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present}
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
 	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
 
 	entries, err := st.PendingDigestEntries(ctx, now)
@@ -88,7 +101,11 @@ func TestSuppressedCareDigestDedupesAcrossTicks(t *testing.T) {
 	now := refNow()
 
 	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present}
+	quiet.Facts = breakCandidateFacts(now, 1)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
 	for i := 0; i < 3; i++ {
+		quiet.Now = now.Add(time.Duration(i) * time.Minute)
 		tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now.Add(time.Duration(i)*time.Minute))
 	}
 
@@ -99,6 +116,154 @@ func TestSuppressedCareDigestDedupesAcrossTicks(t *testing.T) {
 	if len(entries) != 1 {
 		t.Fatalf("3 suppressions of the same nudge must collapse to 1 pending entry, got %d", len(entries))
 	}
+	if counting.calls != 1 {
+		t.Fatalf("3 suppressed ticks phrased %d times, want exactly 1", counting.calls)
+	}
+}
+
+func TestSuppressedCareDigestAcrossRealTicksDoesOnePhraseCall(t *testing.T) {
+	st := newTestStore(t)
+	ctx := context.Background()
+	now := refNow()
+	markPresent(t, st, ctx, now)
+	if _, err := st.SetValue(ctx, store.KindSelf, "break", "tap:test", "done", now.Add(-2*time.Hour)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.SetValue(ctx, store.KindConfig, "quiet_hours", "promote", true, now); err != nil {
+		t.Fatal(err)
+	}
+
+	tl := newTestTickLoop(t, st, &fakeSink{}, nil)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
+	for i := 0; i < 3; i++ {
+		tl.tick(ctx, now.Add(time.Duration(i)*30*time.Second))
+	}
+
+	if counting.calls != 1 {
+		t.Fatalf("3 complete suppressed ticks phrased %d times, want exactly 1", counting.calls)
+	}
+	entries, err := st.PendingDigestEntries(ctx, now.Add(time.Minute))
+	if err != nil || len(entries) != 1 {
+		t.Fatalf("complete ticks should retain one durable entry: entries=%+v err=%v", entries, err)
+	}
+}
+
+// TestSuppressedCareDigestDedupeSurvivesRestart proves V-687 at its actual
+// boundary: a fresh tickLoop has no memory of the first call, yet durable
+// candidate identity still prevents a second PhraseNudge.
+func TestSuppressedCareDigestDedupeSurvivesRestart(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "digest-restart.db")
+	ctx := context.Background()
+	now := refNow()
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 9)}
+
+	firstStore, err := store.Open(ctx, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	first := newTestTickLoop(t, firstStore, &fakeSink{}, nil)
+	firstPhraser := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	first.phraser = firstPhraser
+	first.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
+	if firstPhraser.calls != 1 {
+		t.Fatalf("first loop phrase calls = %d, want 1", firstPhraser.calls)
+	}
+	if err := firstStore.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	secondStore, err := store.Open(ctx, path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = secondStore.Close() })
+	second := newTestTickLoop(t, secondStore, &fakeSink{}, nil)
+	secondPhraser := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	second.phraser = secondPhraser
+	quiet.Now = now.Add(time.Minute)
+	second.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, quiet.Now)
+	if secondPhraser.calls != 0 {
+		t.Fatalf("same candidate after restart phrased %d times, want 0", secondPhraser.calls)
+	}
+}
+
+func TestSuppressedCareDigestRephrasesWhenMeaningChanges(t *testing.T) {
+	st := newTestStore(t)
+	tl := newTestTickLoop(t, st, &fakeSink{}, nil)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
+	ctx := context.Background()
+	now := refNow()
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
+
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
+	quiet.Facts = breakCandidateFacts(now.Add(time.Minute), 2)
+	quiet.Now = now.Add(time.Minute)
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, quiet.Now)
+
+	if counting.calls != 2 {
+		t.Fatalf("two semantic occurrences phrased %d times, want 2", counting.calls)
+	}
+	entries, err := st.PendingDigestEntries(ctx, quiet.Now)
+	if err != nil || len(entries) != 2 {
+		t.Fatalf("changed meaning should create a second entry: entries=%+v err=%v", entries, err)
+	}
+}
+
+func TestSuppressedCareDigestRephrasesAfterExpiry(t *testing.T) {
+	st := newTestStore(t)
+	tl := newTestTickLoop(t, st, &fakeSink{}, nil)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
+	ctx := context.Background()
+	now := refNow()
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
+
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
+	// Deliberately do not run the expiry sweep. The pre-phrase lookup and
+	// enqueue path must agree that this occurrence is no longer live.
+	afterExpiry := now.Add(digestExpiry + time.Minute)
+	quiet.Now = afterExpiry
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, afterExpiry)
+
+	if counting.calls != 2 {
+		t.Fatalf("expired occurrence phrased %d times total, want 2", counting.calls)
+	}
+	entries, err := st.PendingDigestEntries(ctx, afterExpiry)
+	if err != nil || len(entries) != 1 || !entries[0].CreatedTs.Equal(afterExpiry) {
+		t.Fatalf("expired row was not replaced by one fresh row: entries=%+v err=%v", entries, err)
+	}
+}
+
+func TestSuppressedCareDigestRephrasesAfterDrain(t *testing.T) {
+	st := newTestStore(t)
+	sink := &fakeSink{}
+	tl := newTestTickLoop(t, st, sink, nil)
+	counting := &nudgeCountingPhraser{Phraser: phraser.NewStub()}
+	tl.phraser = counting
+	ctx := context.Background()
+	now := refNow()
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
+
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
+	clearAt := now.Add(time.Minute)
+	tl.maybeDrainDigest(ctx, loop.State{Now: clearAt, Presence: store.Present}, clearAt)
+	quiet.Now = clearAt.Add(time.Minute)
+	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, quiet.Now)
+
+	if counting.calls != 2 {
+		t.Fatalf("same occurrence after drain phrased %d times, want 2", counting.calls)
+	}
+}
+
+func breakCandidateFacts(now time.Time, occurrenceID int64) map[string]store.Fact {
+	return map[string]store.Fact{
+		"break": {
+			ID: occurrenceID, Ts: now.Add(-2 * time.Hour), Kind: store.KindSelf,
+			Key: "break", Value: "done", Source: "tap:test", Confidence: 1,
+		},
+	}
 }
 
 // TestSuppressedCareDigestExpiresRatherThanDeliveringLate — an entry that
@@ -111,7 +276,7 @@ func TestSuppressedCareDigestExpiresRatherThanDeliveringLate(t *testing.T) {
 	ctx := context.Background()
 	now := refNow()
 
-	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present}
+	quiet := loop.State{Now: now, QuietHours: true, Presence: store.Present, Facts: breakCandidateFacts(now, 1)}
 	tl.enqueueSuppressedDigest(ctx, breakTrace("quiet_hours"), quiet, now)
 
 	// well past digestExpiry (24h) before the suppression ever clears.

cmd/mavend/followup.go

@@ -5,6 +5,8 @@ import (
 	"time"
 
 	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/lexicon"
+	"github.com/kami/maven/internal/morph"
 	"github.com/kami/maven/internal/router"
 )
 
@@ -94,15 +96,18 @@ func applyDialogueSlots(base router.Slots, d dialogue.Slots) router.Slots {
 // anaphoraResolver is a shared instance for pronoun detection.
 var anaphoraResolver router.AnaphoraResolver
 
-// followUpMerge fills the current turn's missing slots from a prior
-// non-expired session — the multi-turn seam. It handles three cases:
+// followUpMerge carries the current conversation across a prior non-expired
+// session — the multi-turn seam. It handles four cases:
 //
 //  1. Same-intent: inherit missing slots via InheritSlots (existing behavior),
 //     except a reminder time the current sentence named and the parser missed.
-//  2. Cross-intent anaphora: if the current utterance contains a pronoun
+//  2. An anaphoric query becomes chat. A question whose subject lives in this
+//     conversation is answered from its transcript, not sent through unrelated
+//     note, web and encyclopedia sources as a context-free lookup.
+//  3. Cross-intent anaphora: if the current utterance contains a pronoun
 //     ("это" / "он" / "она" etc.) AND the prior session has a key, inherit
 //     the key for fact-lookup queries and reminder creation.
-//  3. Query after Fact: a query that references the prior fact's subject
+//  4. Query after Fact: a query that references the prior fact's subject
 //     inherits the key so the handler can do a fact-by-key lookup.
 //
 // A clarify turn resolves nothing, so it never inherits. InheritSlots only
@@ -112,6 +117,33 @@ func followUpMerge(prev *dialogue.Session, dec router.Decision, now time.Time) r
 		return dec
 	}
 
+	ref, isAnaphoric := anaphoraResolver.Resolve(dec.Utterance)
+	if dec.Intent == router.IntentQuery && isAnaphoric && ref != "mine" && sessionHasContext(prev) {
+		// The router correctly identified a question. What it cannot know from
+		// one utterance is that its subject is in the live dialogue. Chat is the
+		// only action path that receives that dialogue, so preserve the route's
+		// slots but answer it there. Clear query-only provenance: no query source
+		// was selected and an anchored destination must not survive an intent
+		// change the daemon made from state the router could not see.
+		dec.Intent = router.IntentChat
+		dec.Source = router.SourceUnknown
+		dec.SourceAnchored = false
+		// Keep a structured referent when the prior route had one. The chat
+		// phraser primarily reads the transcript, but the session must not lose
+		// the fact identity merely because one follow-up crossed an intent.
+		if !dec.Slots.HasKey && prev.Slots.HasKey {
+			dec.Slots.Key = prev.Slots.Key
+			dec.Slots.HasKey = true
+		}
+		if dec.Slots.Value == "" {
+			dec.Slots.Value = prev.Slots.Value
+		}
+		if !dec.Slots.HasTime && prev.Slots.HasTime {
+			dec.Slots.Time = prev.Slots.Time
+			dec.Slots.HasTime = true
+		}
+	}
+
 	// Case 1: same-intent inheritance (existing).
 	if prev.Intent == dialogue.Intent(dec.Intent) {
 		// A reminder that named an hour nobody could read must not borrow the
@@ -133,9 +165,8 @@ func followUpMerge(prev *dialogue.Session, dec router.Decision, now time.Time) r
 		return dec
 	}
 
-	// Cases 2 & 3: cross-intent anaphora + query-after-fact.
+	// Cases 3 & 4: cross-intent anaphora + query-after-fact.
 	// A query after a fact may reference the fact's subject by pronoun.
-	_, isAnaphoric := anaphoraResolver.Resolve(dec.Utterance)
 	if !isAnaphoric && !dec.Slots.HasKey {
 		// No anaphora and no explicit key — this is a truly new topic.
 		return dec
@@ -161,3 +192,49 @@ func followUpMerge(prev *dialogue.Session, dec router.Decision, now time.Time) r
 
 	return dec
 }
+
+// sessionHasContext distinguishes a live transcript from a session that only
+// carries timing/candidate bookkeeping. The raw utterance is the primary
+// source. The slot fallback keeps sessions persisted by older binaries useful
+// after an upgrade: those blobs have no Utterance field, but may still carry
+// the exact turn in Text or a structured fact key/value.
+func sessionHasContext(s *dialogue.Session) bool {
+	if s == nil {
+		return false
+	}
+	return s.Utterance != "" || s.Slots.Text != "" || s.Slots.HasKey || s.Slots.Value != ""
+}
+
+// opensConversation recognises an explicit cooperative opener without making
+// it a competing route. The substantive clause after the colon may still be a
+// fact worth storing; this function only chooses the session's lifetime.
+//
+// The marker is grammatical and closed (Russian давай/давайте, English let's),
+// and the action vocabulary lives in lexicon rather than a substring pattern.
+// A bare chat route needs none of this — rememberTurn marks it conversational
+// from its intent. This catches the compound shape whose fact clause otherwise
+// hides the opener from the single-intent router.
+func opensConversation(text string) bool {
+	tokens := quietTokens(text)
+	if len(tokens) < 2 {
+		return false
+	}
+	from := 1
+	switch {
+	case tokens[0] == "давай" || tokens[0] == "давайте":
+	case tokens[0] == "lets":
+	case len(tokens) >= 3 && tokens[0] == "let" && tokens[1] == "s":
+		from = 2
+	default:
+		return false
+	}
+	verbs := lexicon.ConversationVerbs()
+	for _, token := range tokens[from:] {
+		for _, verb := range verbs {
+			if token == verb || morph.SameWord(token, verb) {
+				return true
+			}
+		}
+	}
+	return false
+}

cmd/mavend/followup_test.go

@@ -138,6 +138,7 @@ func TestFollowUpMerge(t *testing.T) {
 		prior := &dialogue.Session{
 			Intent:    dialogue.IntentFact,
 			Slots:     dialogue.Slots{Key: "water", HasKey: true},
+			Utterance: "я выпил воду",
 			Timestamp: base,
 			TTL:       2 * time.Minute,
 		}
@@ -152,6 +153,72 @@ func TestFollowUpMerge(t *testing.T) {
 		if got.Slots.Key != "water" {
 			t.Errorf("query after fact: got key=%q, want water", got.Slots.Key)
 		}
+		if got.Intent != router.IntentChat {
+			t.Errorf("anaphoric query intent = %s, want chat with dialogue context", got.Intent)
+		}
+	})
+
+	t.Run("anaphoric query after unkeyed query uses raw dialogue context", func(t *testing.T) {
+		prior := &dialogue.Session{
+			Intent:    dialogue.IntentQuery,
+			Slots:     dialogue.Slots{Text: "кто изобрёл телефон?"},
+			Utterance: "кто изобрёл телефон?",
+			Timestamp: base,
+			TTL:       2 * time.Minute,
+		}
+		cur := router.Decision{
+			Intent:         router.IntentQuery,
+			Utterance:      "а когда он это сделал?",
+			Source:         router.SourceWorld,
+			SourceAnchored: true,
+		}
+		got := followUpMerge(prior, cur, base.Add(30*time.Second))
+		if got.Intent != router.IntentChat {
+			t.Fatalf("intent = %s, want chat", got.Intent)
+		}
+		if got.Source != router.SourceUnknown || got.SourceAnchored {
+			t.Errorf("query-only source survived contextual chat: source=%s anchored=%v", got.Source, got.SourceAnchored)
+		}
+	})
+
+	t.Run("anaphora without a usable prior session stays routed", func(t *testing.T) {
+		prior := &dialogue.Session{
+			Intent:    dialogue.IntentQuery,
+			Timestamp: base,
+			TTL:       2 * time.Minute,
+		}
+		cur := router.Decision{Intent: router.IntentQuery, Utterance: "что это?"}
+		got := followUpMerge(prior, cur, base.Add(30*time.Second))
+		if got.Intent != router.IntentQuery {
+			t.Errorf("empty session changed intent to %s", got.Intent)
+		}
+	})
+
+	t.Run("possessive determiner does not turn an explicit query into chat", func(t *testing.T) {
+		prior := &dialogue.Session{
+			Intent: dialogue.IntentChat, Utterance: "привет",
+			Timestamp: base, TTL: 2 * time.Minute,
+		}
+		cur := router.Decision{Intent: router.IntentQuery, Utterance: "где мой телефон?"}
+		got := followUpMerge(prior, cur, base.Add(30*time.Second))
+		if got.Intent != router.IntentQuery {
+			t.Errorf("explicit possessive query changed intent to %s", got.Intent)
+		}
+	})
+
+	t.Run("anaphoric act is never widened into chat", func(t *testing.T) {
+		prior := &dialogue.Session{
+			Intent: dialogue.IntentChat, Utterance: "сервер homesrv",
+			Timestamp: base, TTL: 2 * time.Minute,
+		}
+		cur := router.Decision{Intent: router.IntentAct, Utterance: "выключи его"}
+		got := followUpMerge(prior, cur, base.Add(30*time.Second))
+		if got.Intent != router.IntentAct {
+			t.Errorf("act intent changed to %s", got.Intent)
+		}
+		if got.Slots.HasFn {
+			t.Error("anaphora invented an executable function")
+		}
 	})
 
 	t.Run("query after fact without anaphora does not inherit", func(t *testing.T) {

cmd/mavend/main.go

@@ -559,7 +559,7 @@ func run(args []string) error {
 func personaFacts(cfg *config.Config) persona.Facts {
 	f := persona.Facts{
 		// Telegram lives outside the voice block, so it counts either way.
-		Telegram: cfg.Telegram != nil && cfg.Telegram.BotToken != "" && cfg.Telegram.ChatID != "",
+		Telegram: cfg.Telegram != nil && !cfg.Telegram.Disabled && cfg.Telegram.BotToken != "" && cfg.Telegram.ChatID != "",
 	}
 	if cfg.Voice == nil {
 		return f
@@ -678,16 +678,12 @@ func wireGatherer(st *store.Store, cfg *config.Config, rules []loop.Rule) *loop.
 // reconciled to "unknown" here, before the tick loop resumes sending, so
 // nothing auto-resends into that ambiguity.
 func wireDispatcher(st *store.Store, cfg *config.Config, voiceW *voiceWiring) (*delivery.Dispatcher, error) {
-	var ntfy delivery.Sink
-	if cfg.Ntfy != nil {
-		s, err := ntfysink.New(*cfg.Ntfy)
-		if err != nil {
-			return nil, fmt.Errorf("wire ntfy sink: %w", err)
-		}
-		ntfy = s
+	ntfy, err := wireNtfySink(cfg.Ntfy)
+	if err != nil {
+		return nil, err
 	}
 	var telegram delivery.Sink
-	if cfg.Telegram != nil {
+	if cfg.Telegram != nil && !cfg.Telegram.Disabled {
 		s, err := telegramsink.New(*cfg.Telegram)
 		if err != nil {
 			return nil, fmt.Errorf("wire telegram sink: %w", err)
@@ -712,6 +708,22 @@ func wireDispatcher(st *store.Store, cfg *config.Config, voiceW *voiceWiring) (*
 	}), nil
 }
 
+// wireNtfySink keeps an optional reach optional without ever turning a missing
+// secret into anonymous publishing. A block is live unless it says disabled;
+// therefore an expanded-empty token in a live block fails startup instead of
+// spending days in a permanent 403 retry loop. Disabled is an explicit
+// operator choice and lets another away reach take over.
+func wireNtfySink(cfg *ntfysink.Config) (delivery.Sink, error) {
+	if cfg == nil || cfg.Disabled {
+		return nil, nil
+	}
+	sink, err := ntfysink.New(*cfg)
+	if err != nil {
+		return nil, fmt.Errorf("wire ntfy sink: %w", err)
+	}
+	return sink, nil
+}
+
 // wireTickLoop reads the loop's three intervals and its schedules out of the
 // config, so the two boot paths cannot disagree about them.
 func wireTickLoop(st *store.Store, gatherer *loop.Gatherer, dispatcher *delivery.Dispatcher, phr phraser.Phraser, rules []loop.Rule, cfg *config.Config) *tickLoop {

cmd/mavend/ntfy_wiring_test.go

@@ -0,0 +1,35 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/kami/maven/internal/delivery/ntfysink"
+)
+
+func TestWireNtfySinkRejectsMissingCredentialWhenEnabled(t *testing.T) {
+	_, err := wireNtfySink(&ntfysink.Config{
+		BaseURL: "https://ntfy.example", Topic: "maven",
+	})
+	if err == nil {
+		t.Fatal("expanded-empty credential did not fail an enabled reach")
+	}
+}
+
+func TestWireNtfySinkLeavesExplicitlyDisabledReachDark(t *testing.T) {
+	sink, err := wireNtfySink(&ntfysink.Config{
+		Disabled: true, BaseURL: "https://ntfy.example", Topic: "maven",
+	})
+	if err != nil {
+		t.Fatalf("wireNtfySink: %v", err)
+	}
+	if sink != nil {
+		t.Fatal("disabled reach built a live sink")
+	}
+}
+
+func TestWireNtfySinkRejectsMalformedEnabledConfig(t *testing.T) {
+	_, err := wireNtfySink(&ntfysink.Config{Token: "token", Topic: "maven"})
+	if err == nil {
+		t.Fatal("malformed enabled config did not fail wiring")
+	}
+}

cmd/mavend/onnx_testmain_test.go

@@ -0,0 +1,36 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/kami/maven/internal/router"
+)
+
+// TestMain holds one ONNX Runtime lease across the model-aware topic and
+// personal-boundary gates. Each test still owns and closes its model session;
+// the process-global environment is released only after the final test.
+func TestMain(m *testing.M) {
+	var lease *router.ONNXRuntimeLease
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib != "" {
+		if _, err := os.Stat(lib); err == nil {
+			var acquireErr error
+			lease, acquireErr = router.AcquireONNXRuntime(lib)
+			if acquireErr != nil {
+				fmt.Fprintf(os.Stderr, "initialize shared ONNX test runtime: %v\n", acquireErr)
+				os.Exit(2)
+			}
+		}
+	}
+
+	code := m.Run()
+	if lease != nil {
+		if err := lease.Close(); err != nil {
+			fmt.Fprintf(os.Stderr, "ONNX test runtime cleanup: %v\n", err)
+			code = 1
+		}
+	}
+	os.Exit(code)
+}

cmd/mavend/personalboundary.go

@@ -2,6 +2,8 @@ package main
 
 import (
 	"context"
+	"encoding/base64"
+	"encoding/binary"
 	"log"
 	"math"
 	"sync"
@@ -23,31 +25,40 @@ import (
 // every utterance the list misses is one that reaches the world. It also drifts
 // silently — a missing verb looks exactly like no bug.
 //
-// So the boundary asks the embedder instead. Two frozen seed sets — questions
-// about him, questions about the world — are embedded once, and the turn's own
-// query vector, already computed by queryEmbed upstream, is scored against
-// both. Nearest side wins. Word order, verb form and unseen phrasing stop
-// mattering, which is exactly what a lexicon could not do.
+// So the boundary asks the embedder instead. A frozen bilingual corpus is
+// embedded at model-fit time, then a class-balanced logistic head is fitted
+// over those vectors. The head learns a direction in semantic space instead
+// of choosing whichever single example happens to share the most words. That
+// matters for a public noun inside a private question and for advice about an
+// owned object: nearest-neighbour scoring confuses both, while a trained head
+// combines the evidence across the whole sentence.
 //
-// Measured 03-08-2026 against multilingual-e5-small on 19 held-out utterances,
-// none of them a seed: 19 right (TestONNXPersonalBoundary). A 20th, "as i said,
-// what is the population of india", missed by +0.008 during the first pass and
-// is a world seed now, which is why it is not in the held-out set. True
-// positives clear the world side by +0.014 to +0.089 and the nearest true
-// negative sits at -0.005, so the gate is the sign of the difference and
-// nothing tighter: the margins are too thin to justify a threshold, and the
-// asymmetry favours claiming anyway. A false claim costs one honest "не знаю";
-// a false pass sends his life to an upstream engine.
+// The corpus covers six sentence shapes on both sides: remembered speech,
+// possession, narrative, first-person preambles, current advice/information,
+// and public proper nouns. Training weights each class equally, so the larger
+// world corpus cannot move the prior merely by containing more examples. A
+// small L2 term makes the solution stable; its value and the fixed optimiser
+// are measured by model-backed cross-validation, not adjusted at runtime.
 //
-// The embedder is the one model CLAUDE.md pins to homesrv permanently, and it
-// is what makes this affordable: no llama-server call, no network, one cosine
-// per seed against a vector the turn already has.
+// This linear head measures 29/29 on the historical regression suite and
+// 72/72 on the separate stratified fixture (V-702, 13-08-2026). The gate is
+// still probability 0.5: a false claim costs one honest "не знаю", while a
+// false pass can send his life to an upstream engine.
+//
+// The embedder is the one model CLAUDE.md pins to homesrv permanently. Its head
+// is fitted and verified by the model-backed gate, then frozen into the binary;
+// inference is one dot product against a vector the turn already has. Unknown
+// embedding spaces fit their own head once per process instead of applying
+// foreign weights. Neither path calls llama-server or the network.
 
-// personalSeeds — questions about him. Frozen: they are scoring data, so
-// editing one moves the boundary and must be re-measured, not eyeballed. Cover
-// both classes the boundary owns, possession and first-person speech, in both
-// languages.
+// personalSeeds and worldSeeds are the frozen training corpus for the linear
+// boundary head. Editing either changes a model, not a phrase list: every edit
+// therefore needs the model-backed regression, stratified evaluation and
+// training-corpus cross-validation. The examples describe where an answer can
+// come from, in both languages. None is a special case copied from an eval.
 var personalSeeds = []string{
+	// The original compact corpus. It remains here both as training signal and
+	// as provenance for the regressions that introduced the semantic boundary.
 	"что я говорил про это",
 	"я тебе рассказывал об этом?",
 	"что я записал про врача",
@@ -56,21 +67,79 @@ var personalSeeds = []string{
 	"когда моя встреча",
 	"what did i say about this",
 	"did i mention this to you",
+
+	// Remembered speech.
+	"какой адрес я тебе сообщал?",
+	"что я говорил о своём самочувствии?",
+	"какое решение по ремонту я озвучил?",
+	"что я обещал сделать после отпуска?",
+	"what reason did I give for declining the offer?",
+	"did I tell you where I grew up?",
+	"which restaurant did I say I wanted to visit?",
+	"what explanation did I give for missing the meeting?",
+
+	// Stored attributes of his possessions and records.
+	"где лежит мой договор аренды?",
+	"когда заканчивается моя подписка на спортзал?",
+	"какой размер у моей запасной куртки?",
+	"до какой даты действует мой пропуск?",
+	"какой размер у моего велосипедного шлема?",
+	"where is my vehicle registration document?",
+	"when is my museum membership renewal?",
+	"what number is on my travel insurance policy?",
+	"which shelf did I put my tax folder on?",
+	"what size is my waterproof coat?",
+
+	// Narratives that only his memories or records can supply.
+	"собери по моим записям рассказ о поездке в Самару",
+	"напомни, как прошёл мой первый урок вождения",
+	"восстанови из дневника, как я искал первую квартиру",
+	"перескажи по моим словам, как прошла встреча выпускников",
+	"summarize my account of moving into this apartment",
+	"tell me what happened during my first week at the new job",
+	"recreate the story of my graduation from my journal",
+	"piece together my account of adopting the dog",
+
+	// First-person framing around a private answer.
+	"возвращаясь к нашей беседе, какой банк я выбрал?",
+	"кажется, я уже говорил: на какую дату записался к врачу?",
+	"если мы это обсуждали, какую школу вождения я предпочёл?",
+	"напомню наш разговор: когда я решил менять работу?",
+	"as I mentioned before, which contractor did I hire?",
+	"coming back to our chat, what date did I book the inspection for?",
+	"if we covered this already, which course did I enroll in?",
+	"back to what I told you: where did I plan to stay in Oslo?",
+
+	// Current information that lives only in his records.
+	"какой счёт мне нужно оплатить на этой неделе?",
+	"сколько часов я работал в прошлом месяце?",
+	"какую процедуру мастер советовал выполнить утром?",
+	"какая из моих заявок всё ещё не закрыта?",
+	"which appointment do I have tomorrow morning?",
+	"how many kilometres did I run last week?",
+	"what maintenance did the mechanic tell me to schedule?",
+	"which item on my project list is overdue?",
+
+	// Public names inside questions that still require his records.
+	"какую цитату из Набокова я сохранил?",
+	"когда у меня созвон с Ириной Петровой?",
+	"что я думал о романе Умберто Эко?",
+	"какую оценку я дал выставке Айвазовского?",
+	"какую фотографию Эрмитажа я отметил для печати?",
+	"what did I note down after Margaret Hamilton's lecture?",
+	"when is my booking at the Royal Albert Hall?",
+	"which Nina Simone song did I call my favourite?",
+	"what opinion did I share about Zadie Smith's new novel?",
+	"what reminder did I attach to the Jira migration?",
 }
 
-// worldSeeds — questions the world can answer, including the two shapes that
-// look personal and are not: a first-person preamble on a world question ("как
-// я говорил, ..."), and first person without possession ("что я могу
-// посмотреть вечером"). Refusing those is the opposite mistake and the older
-// comment on personalMarkers already named it.
 var worldSeeds = []string{
+	// The original compact corpus, retained as above.
 	"почему небо синее",
 	"какая столица франции",
 	"как сварить борщ",
 	"кто написал эту книгу",
 	"what is the capital of france",
-	"how do i boil an egg",
-	"как я говорил, почему небо синее",
 	"as i said, why is the sky blue",
 	"as i said, what is the population of india",
 	"что я могу посмотреть вечером",
@@ -103,21 +172,89 @@ var worldSeeds = []string{
 	"расскажи про древний рим",
 	"объясни как работает двигатель",
 	"tell me about the roman empire",
+
+	// Speech and reports by somebody other than the owner.
+	"что Александр Пушкин писал о Москве?",
+	"как учёные объясняли исчезновение динозавров?",
+	"что Менделеев говорил о будущем химии?",
+	"какие выводы сделал Амундсен после экспедиции?",
+	"what did Virginia Woolf write about fiction?",
+	"how did researchers describe the Tunguska event?",
+	"what did witnesses report after the Lisbon earthquake?",
+	"which ideas did Ada Lovelace describe in her notes?",
+
+	// General advice about an owned object. Ownership supplies context, but an
+	// outside source can still supply the answer.
+	"как починить мой скрипящий стул?",
+	"почему мой роутер теряет соединение?",
+	"чем очистить мой велосипед от ржавчины?",
+	"какой бензин подходит для моего генератора?",
+	"какой чехол подобрать для моего планшета?",
+	"как защитить мой деревянный стол от влаги?",
+	"how do I remove a stain from my jacket?",
+	"why is my freezer building up ice?",
+	"which oil should I use in my lawn mower?",
+	"what detergent is safe for my washing machine?",
+	"which replacement blade should I buy for my circular saw?",
+	"how can I keep my garden tools from rusting?",
+
+	// Public narratives.
+	"расскажи историю строительства Транссибирской магистрали",
+	"опиши, как развивалась письменность",
+	"объясни, как появился периодический закон",
+	"опиши первую успешную зимовку в Антарктиде",
+	"tell the story of the discovery of penicillin",
+	"describe how the first transatlantic cable was laid",
+	"explain how the Olympic Games were revived",
+	"describe the expedition that first reached the South Pole",
+
+	// First-person framing around a public answer.
+	"как я уже спрашивал, почему звёзды мерцают?",
+	"повторю свой вопрос: как образуются коралловые рифы?",
+	"возможно, я повторяюсь: когда возвели собор Святого Петра?",
+	"я мог уже спрашивать: из чего делают фарфор?",
+	"as I asked earlier, why do leaves change colour?",
+	"to repeat my question, how are fjords formed?",
+	"I might be asking twice, when was Angkor Wat constructed?",
+	"I may have asked before, what causes bioluminescence?",
+
+	// Public current information and generally applicable advice.
+	"какие поезда сегодня идут из Москвы в Тверь?",
+	"как правильно хранить чугунную сковороду?",
+	"какие выставки проходят в Петербурге в этом месяце?",
+	"какой сейчас уровень воды в Волге?",
+	"what is the latest supported version of Ubuntu?",
+	"how should I prepare a wooden deck for winter?",
+	"which film festivals are taking place this season?",
+	"what is the current exchange rate for the Norwegian krone?",
+
+	// Public facts about named people, places and organisations.
+	"кто такая Софья Ковалевская?",
+	"когда была основана компания Nintendo?",
+	"чем прославился архитектор Фрэнк Ллойд Райт?",
+	"где находится музей Прадо?",
+	"who was James Baldwin?",
+	"what is the city of Petra known for?",
+	"when was the composer Philip Glass born?",
+	"where is the Uffizi Gallery located?",
 }
 
-// personalBoundary holds the embedded seeds. Zero value is usable and means
-// "not loaded yet"; a handler built without an embedder never loads and the
-// boundary falls back to personalMarkers.
+// personalBoundary holds the frozen or locally fitted head and, when fitting
+// was necessary, its embedded corpus. Zero value is usable and means "not
+// loaded yet"; a handler built without an embedder never loads and the boundary
+// falls back to personalMarkers.
 type personalBoundary struct {
 	once     sync.Once
 	personal [][]float32
 	world    [][]float32
+	head     personalBoundaryLinearHead
 	loaded   bool
 }
 
-// load embeds both seed sets, once per process. Seeds are embedded on the QUERY
-// side, like the utterance they are compared with — a question against a
-// question. Mixing sides would measure the e5 prefix, not the meaning.
+// load selects the pinned frozen head or embeds and fits the seed sets once per
+// process for another embedding space. Seeds are embedded on the QUERY side,
+// like the utterance they classify. Mixing sides would measure the e5 prefix,
+// not the meaning.
 func (b *personalBoundary) load(ctx context.Context, emb router.Embedder) {
 	b.once.Do(func() {
 		if emb == nil {
@@ -135,30 +272,149 @@ func (b *personalBoundary) load(ctx context.Context, emb router.Embedder) {
 			}
 			return out
 		}
+		// The deployed e5-small head is fitted offline from the corpus below and
+		// checked back against it by TestONNXPersonalBoundaryFrozenHead. Loading
+		// it directly keeps the first personal query from embedding 132 examples.
+		if router.EmbedderID(emb) == personalBoundaryHeadModelID {
+			head, ok := frozenPersonalBoundaryHead()
+			if ok && len(head.weights) == emb.Dim() {
+				b.head, b.loaded = head, true
+				return
+			}
+			log.Printf("voice: frozen personal boundary head is corrupt; rebuilding from its corpus")
+		}
+
 		p, w := embedAll(personalSeeds), embedAll(worldSeeds)
 		if p == nil || w == nil {
 			return
 		}
-		b.personal, b.world, b.loaded = p, w, true
+		epochs := personalBoundaryTrainingEpochs
+		if router.EmbedderID(emb) == personalBoundaryHashModelID {
+			epochs = personalBoundaryHashTrainingEpochs
+		}
+		head, ok := trainPersonalBoundaryLinearHeadEpochs(p, w, epochs)
+		if !ok {
+			log.Printf("voice: personal boundary training examples have inconsistent dimensions; falling back to possession markers")
+			return
+		}
+		b.personal, b.world, b.head, b.loaded = p, w, head, true
 	})
 }
 
-// score returns the best similarity to each side. ok is false when the seeds
-// are not loaded, which is the caller's signal to use the markers instead.
-func (b *personalBoundary) score(vec []float32) (personal, world float64, ok bool) {
-	if !b.loaded || len(vec) == 0 {
-		return 0, 0, false
+const (
+	personalBoundaryTrainingEpochs = 5000
+	personalBoundaryLearningRate   = 10.0
+	personalBoundaryL2             = 0.0003
+)
+
+const personalBoundaryHeadModelID = "model_quantized@384/tok2"
+
+const personalBoundaryHashModelID = "hash@1024"
+
+const personalBoundaryHeadWeights = "a3q5vmod2L7msrs+1RE8Pp5HDEBlv609AC9cvzm4D0CL7Fc/FU9cvxLmAMA638c/BgDBP6Is1r7PzBO/6MVAPsmEWT6XowjAouT0v8jMN79d2Sk+7XLlPX2akD+lmKi/q922vvLSFcBb0ma/cN3QP27zBMDl45i/iuE0P4KIJb+7dua+gTePP5unVz9H3q29Sxsev7YJe7+SvoQ+r6jyPxW2DL8sMQc/+iExQM5y8D/qJSZAtFyKP3PbyD8OK0dAHD+0v056qj4AbOS+AFHzP1KPeT9+cqu/aMIQv9wCqL8WbYe/xED1vu7pHMCPlxe/ZUGLPqFoDb8GPQ6/XE6cvqPVi7xKdr0/CE1PP4dPrj6TxoK+KokGP7xxu73h6DW/Lw8APsjd1D43aci/ZBMoQPyy8D8G6w/AMT1tPSEUU7/Sp+c+sjpRvyfl2L4KDs8/q/Ibv3urHj/+7ls/yxjaP8WS8jy8cd6+BO+4P/IcJkBTEPo/q2VGvqvsUD9anuk8UiO/PSw707+5+oY+zBpHP6e+UT4qaEe/zqjGvypN1j45TFY+nZ36v9rP8L9bmyE/Rn8UwONI0D5Yhs6/InCYv4kGgz/LNXO/rhK+Pu2Qdz/W8ijAdi3hv5qT5D9383k8Ir2wP0MRD0AxCCQ/0CUDP5kWoz+TQjdAOxI0vSbxDb/xj54/N/G6v86Ixr932Lk/jQ2jvqn2nr9y3JC96jDDPsyPlj9q/OQ/cOcCQJ+15z9747s/8Zh8PoS4oL0GKma/lfuPv/Clgb9GPKW+2OR3vimzAUBVYxXARcw0vynpsr/IUqe/bsUhv5kwWcCZtnE/fr87vjvfdr4mHis/xMpzvn20HL4SHFu/1DFXvVgOg76GXEq/pB2QP2u6e71q7w0+7F3APlte1j9YKXK/1cljPkFx0L/CndS9b4CeP4BIvj/fP5Q99jbZvL1h778WhC0/pNhov4+x1r+lYeE/9Y6gP9gtqr75dIe/wGiKv4q56D10ckY+UuvDvoIUnz/3TVM/moHcP6FkUz6//pY+FYhcwFEkD8B2a2c9mC+UP/ZeTb5FgIq+rgEOvylj8D9dvx8/OngmPyiplT9oiLy/AJwswKOJdL+i8/m9GPNfvyyWk77jVPC/0u+IPpx/Fz/QdvG/Ag9gP41l2rxmXUo/hdL0vx1XX0BUp+w9hmYyPk21dT6UJmK/zajGP7gBSD0FqoXAkis4P7kehz94wNa//nfZvxA0Fz8b9ze/IETPv3xEb76BG8k/SpyVP9xkEUC2/jlAcv8/wKKxU75E0xM+9BItPzlQKr6S0wdAMa39v0GKA8AMB3G/IeKvvyTZkz+es62/UEYTP3j+lj4SRM+/Dbfgvupdsj/wcUbAbjqRv/WV/r5WRaO/iB67P3/UyD8AK5Q+LzvJPsjPPL/fwkS/atd9P56MHz9CIJu9ugjgvp7J2D8otQC/YYoowKGEFD4eMVC/xy3UP2UEND9nU0i/ol4GQJuwfb+xeaa/B3IjwDK6Gz8dVv8/2wbLPlUo6j+FDCk/4Q/VP/J8JkCYVd0/gMS/P9Bwhj9R94a9M0Mjv/hKdL8cl6Y/lD73vwgior9+56Q/YI+1v9Wd0j8ltAjAmD5dP56Hnb+rdrA+gn2jP0bFA7/lkZU/tK6VP63ItT5Oi7O+YjfUv5iUzT+n5H8/zXMpvjefvj67z66/GA71Pj2h2T5bXxW/EyfLP1LZxr/B758/iCd2v0jnoT8twoG/oAO9vjpYDr61q6I+AEVFv1OP2b1VQpO/5FYdP5vgaz/4Lbm9CMCjvhbWlL9pYQk/1l5hPjCTYj8dtiJATXjavb6SlL7rp0E/cMBgP9UIXLwVYXC+rFS2v9yeFUD88JBAbwWcvt7s1D/bsuU/BCv0PzSdQEA7l36/FULEvmxlo79jjzc+gFvav1vptb/YjkS/Zo76vqK+3j+qvqi/qyfpPj1BLj+ehSzA4Z8nPyS/1b8kz5a9NIuZv31beL/k0oXAXFO/P8cCh8BSPzS+N7agvhjPUD6/G24/GIP0PYlNOsAFe6q+"
+
+// HashEmbedder is a deterministic offline floor. Its 1024-dimensional head is
+// trained on first use instead of embedded here because the binary form is
+// still tiny but not meaningful as a production quality claim. The floor's
+// optimizer uses fewer steps: the hash vectors are sparse and converge long
+// before the semantic head, keeping an unconfigured box responsive.
+const personalBoundaryHashTrainingEpochs = 400
+
+type personalBoundaryLinearHead struct {
+	weights []float64
+	bias    float64
+}
+
+func frozenPersonalBoundaryHead() (personalBoundaryLinearHead, bool) {
+	raw, err := base64.StdEncoding.DecodeString(personalBoundaryHeadWeights)
+	if err != nil || len(raw)%4 != 0 {
+		return personalBoundaryLinearHead{}, false
 	}
-	best := func(seeds [][]float32) float64 {
-		m := -1.0
-		for _, s := range seeds {
-			if c := cosine(vec, s); c > m {
-				m = c
+	weights := make([]float64, len(raw)/4)
+	for i := range weights {
+		weights[i] = float64(math.Float32frombits(binary.LittleEndian.Uint32(raw[4*i:])))
+	}
+	return personalBoundaryLinearHead{weights: weights, bias: -3.122734201373742}, true
+}
+
+// trainPersonalBoundaryLinearHead fits binary logistic regression with full
+// batch gradient descent. Each side contributes total weight 0.5 regardless
+// of its number of examples. The optimiser is intentionally tiny and local:
+// the embedder supplies all learned language knowledge; this only learns one
+// separating hyperplane over its 384-dimensional vectors.
+func trainPersonalBoundaryLinearHead(personal, world [][]float32) (personalBoundaryLinearHead, bool) {
+	return trainPersonalBoundaryLinearHeadEpochs(personal, world, personalBoundaryTrainingEpochs)
+}
+
+func trainPersonalBoundaryLinearHeadEpochs(personal, world [][]float32, epochs int) (personalBoundaryLinearHead, bool) {
+	if len(personal) == 0 || len(world) == 0 || len(personal[0]) == 0 {
+		return personalBoundaryLinearHead{}, false
+	}
+	dim := len(personal[0])
+	for _, vectors := range [][][]float32{personal, world} {
+		for _, vector := range vectors {
+			if len(vector) != dim {
+				return personalBoundaryLinearHead{}, false
 			}
 		}
-		return m
 	}
-	return best(b.personal), best(b.world), true
+
+	head := personalBoundaryLinearHead{weights: make([]float64, dim)}
+	personalWeight := 0.5 / float64(len(personal))
+	worldWeight := 0.5 / float64(len(world))
+	for epoch := 0; epoch < epochs; epoch++ {
+		gradient := make([]float64, dim)
+		biasGradient := 0.0
+		accumulate := func(vectors [][]float32, target, sampleWeight float64) {
+			for _, vector := range vectors {
+				probability := logistic(head.logit(vector))
+				error := (probability - target) * sampleWeight
+				biasGradient += error
+				for i, value := range vector {
+					gradient[i] += error * float64(value)
+				}
+			}
+		}
+		accumulate(personal, 1, personalWeight)
+		accumulate(world, 0, worldWeight)
+
+		step := personalBoundaryLearningRate / (1 + float64(epoch)/1000)
+		for i := range head.weights {
+			head.weights[i] -= step * (gradient[i] + personalBoundaryL2*head.weights[i])
+		}
+		head.bias -= step * biasGradient
+	}
+	return head, true
+}
+
+func (h personalBoundaryLinearHead) logit(vec []float32) float64 {
+	if len(vec) != len(h.weights) {
+		return 0
+	}
+	score := h.bias
+	for i, value := range vec {
+		score += h.weights[i] * float64(value)
+	}
+	return score
+}
+
+func logistic(value float64) float64 {
+	if value >= 0 {
+		return 1 / (1 + math.Exp(-value))
+	}
+	exp := math.Exp(value)
+	return exp / (1 + exp)
+}
+
+// score returns complementary class probabilities. ok is false when the
+// corpus is not loaded or the query vector belongs to another embedding
+// space, which is the caller's signal to use the offline marker floor.
+func (b *personalBoundary) score(vec []float32) (personal, world float64, ok bool) {
+	if !b.loaded || len(vec) != len(b.head.weights) {
+		return 0, 0, false
+	}
+	personal = logistic(b.head.logit(vec))
+	return personal, 1 - personal, true
 }
 
 // cosine — same math as internal/router and internal/memory, small enough that

cmd/mavend/personalboundary_eval_test.go

@@ -0,0 +1,405 @@
+package main
+
+import (
+	"context"
+	_ "embed"
+	"encoding/json"
+	"math"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+	"unicode"
+
+	"github.com/kami/maven/internal/router"
+)
+
+// This fixture is intentionally separate from personalboundary_test.go. The
+// small regression table there explains individual fixes; this matrix measures
+// the boundary as a classifier and prevents a repaired sentence shape from
+// standing in for language and subject coverage.
+//
+//go:embed testdata/personal_boundary_v1.json
+var personalBoundaryFixtureJSON []byte
+
+type personalBoundaryEvalCase struct {
+	ID        string `json:"id"`
+	Utterance string `json:"utterance"`
+	Lang      string `json:"lang"`
+	Want      string `json:"want"`
+	Stratum   string `json:"stratum"`
+}
+
+type personalBoundaryEvalFixture struct {
+	SchemaVersion int                        `json:"schema_version"`
+	Name          string                     `json:"name"`
+	Notes         []string                   `json:"notes"`
+	Cases         []personalBoundaryEvalCase `json:"cases"`
+}
+
+var personalBoundaryEvalStrata = []string{
+	"remembered_speech",
+	"possession",
+	"narrative",
+	"first_person_preamble",
+	"advice_current_info",
+	"public_proper_nouns",
+}
+
+func loadPersonalBoundaryEvalFixture(t *testing.T) personalBoundaryEvalFixture {
+	t.Helper()
+	var fixture personalBoundaryEvalFixture
+	if err := json.Unmarshal(personalBoundaryFixtureJSON, &fixture); err != nil {
+		t.Fatalf("parse personal boundary fixture: %v", err)
+	}
+	if fixture.SchemaVersion != 1 {
+		t.Fatalf("personal boundary fixture schema_version = %d, want 1", fixture.SchemaVersion)
+	}
+	if fixture.Name != "personal_boundary_v1" {
+		t.Fatalf("personal boundary fixture name = %q, want personal_boundary_v1", fixture.Name)
+	}
+	return fixture
+}
+
+// TestPersonalBoundaryEvalFixture enforces the sampling contract separately
+// from the model measurement. It runs in ordinary CI even when ONNX Runtime is
+// absent, so a fixture edit cannot silently unbalance a language, side or
+// sentence shape, or turn a production seed into a held-out case.
+func TestPersonalBoundaryEvalFixture(t *testing.T) {
+	fixture := loadPersonalBoundaryEvalFixture(t)
+	const wantPerCell = 3
+	const wantTotal = 6 * 2 * 2 * wantPerCell
+	if len(fixture.Cases) != wantTotal {
+		t.Errorf("fixture has %d cases, want %d", len(fixture.Cases), wantTotal)
+	}
+
+	validStrata := make(map[string]bool, len(personalBoundaryEvalStrata))
+	for _, stratum := range personalBoundaryEvalStrata {
+		validStrata[stratum] = true
+	}
+	seedSource := make(map[string]string, len(personalSeeds)+len(worldSeeds))
+	for _, seed := range personalSeeds {
+		seedSource[normalizePersonalBoundaryEval(seed)] = "personalSeeds"
+	}
+	for _, seed := range worldSeeds {
+		seedSource[normalizePersonalBoundaryEval(seed)] = "worldSeeds"
+	}
+
+	seenID := make(map[string]bool, len(fixture.Cases))
+	seenUtterance := make(map[string]string, len(fixture.Cases))
+	cells := make(map[string]int)
+	for _, c := range fixture.Cases {
+		if strings.TrimSpace(c.ID) == "" || seenID[c.ID] {
+			t.Errorf("case %q: empty or duplicate id", c.ID)
+		}
+		seenID[c.ID] = true
+		if c.Lang != "ru" && c.Lang != "en" {
+			t.Errorf("%s: lang = %q, want ru|en", c.ID, c.Lang)
+		}
+		if c.Want != "personal" && c.Want != "world" {
+			t.Errorf("%s: want = %q, want personal|world", c.ID, c.Want)
+		}
+		if !validStrata[c.Stratum] {
+			t.Errorf("%s: stratum = %q, not one of the six declared strata", c.ID, c.Stratum)
+		}
+
+		normalized := normalizePersonalBoundaryEval(c.Utterance)
+		if normalized == "" {
+			t.Errorf("%s: empty utterance", c.ID)
+		}
+		if previous, ok := seenUtterance[normalized]; ok {
+			t.Errorf("%s: utterance duplicates %s after normalization", c.ID, previous)
+		}
+		seenUtterance[normalized] = c.ID
+		if source, ok := seedSource[normalized]; ok {
+			t.Errorf("%s: %q is verbatim in %s, so it is not held out", c.ID, c.Utterance, source)
+		}
+		// The original failure names Baikal. Replacing that sentence's verb or
+		// punctuation would measure an exception, not the boundary. This corpus
+		// instead varies people, places, products and events.
+		if strings.Contains(normalized, "байкал") || strings.Contains(normalized, "baikal") {
+			t.Errorf("%s: the stratified fixture must not copy the Baikal regression", c.ID)
+		}
+		cells[c.Stratum+"/"+c.Lang+"/"+c.Want]++
+	}
+
+	for _, stratum := range personalBoundaryEvalStrata {
+		for _, lang := range []string{"ru", "en"} {
+			for _, want := range []string{"personal", "world"} {
+				cell := stratum + "/" + lang + "/" + want
+				if got := cells[cell]; got != wantPerCell {
+					t.Errorf("fixture cell %s has %d cases, want %d", cell, got, wantPerCell)
+				}
+			}
+		}
+	}
+}
+
+// normalizePersonalBoundaryEval compares content rather than typography:
+// case, punctuation and repeated whitespace cannot disguise a copied seed or
+// duplicate case. This is fixture hygiene only; it does not participate in the
+// production boundary.
+func normalizePersonalBoundaryEval(s string) string {
+	var b strings.Builder
+	space := true
+	for _, r := range strings.ToLower(s) {
+		if unicode.IsLetter(r) || unicode.IsNumber(r) {
+			b.WriteRune(r)
+			space = false
+			continue
+		}
+		if !space {
+			b.WriteByte(' ')
+			space = true
+		}
+	}
+	return strings.TrimSpace(b.String())
+}
+
+type personalBoundaryEvalStat struct {
+	Correct int
+	Total   int
+}
+
+type personalBoundaryEvalReport struct {
+	Name            string
+	Correct         int
+	Total           int
+	MinimumMargin   float64
+	ByStratum       map[string]personalBoundaryEvalStat
+	ByLanguage      map[string]personalBoundaryEvalStat
+	ByExpectedClass map[string]personalBoundaryEvalStat
+	ByCell          map[string]personalBoundaryEvalStat
+}
+
+func newPersonalBoundaryEvalReport(name string) *personalBoundaryEvalReport {
+	return &personalBoundaryEvalReport{
+		Name:            name,
+		MinimumMargin:   math.Inf(1),
+		ByStratum:       make(map[string]personalBoundaryEvalStat),
+		ByLanguage:      make(map[string]personalBoundaryEvalStat),
+		ByExpectedClass: make(map[string]personalBoundaryEvalStat),
+		ByCell:          make(map[string]personalBoundaryEvalStat),
+	}
+}
+
+func (r *personalBoundaryEvalReport) add(c personalBoundaryEvalCase, gotPersonal bool, personal, world float64) {
+	wantPersonal := c.Want == "personal"
+	correct := gotPersonal == wantPersonal
+	r.Total++
+	if correct {
+		r.Correct++
+	}
+	signedMargin := personal - world
+	if !wantPersonal {
+		signedMargin = -signedMargin
+	}
+	if signedMargin < r.MinimumMargin {
+		r.MinimumMargin = signedMargin
+	}
+	add := func(stats map[string]personalBoundaryEvalStat, key string) {
+		stat := stats[key]
+		stat.Total++
+		if correct {
+			stat.Correct++
+		}
+		stats[key] = stat
+	}
+	add(r.ByStratum, c.Stratum)
+	add(r.ByLanguage, c.Lang)
+	add(r.ByExpectedClass, c.Want)
+	add(r.ByCell, c.Stratum+"/"+c.Lang+"/"+c.Want)
+}
+
+// TestONNXPersonalBoundaryStratified scores the model homesrv actually runs.
+// Production is read from personalBoundary.score; top1, top2, top3 and a
+// whole-class centroid are diagnostics over the same embedded seeds. Today
+// production and top3 coincide, but keeping them separate means a later scoring
+// experiment can be compared without rewriting this evaluation or putting its
+// candidate math in runtime code. The privacy boundary is a hard contract, so
+// every production miss is a test failure rather than an accuracy target to
+// average away.
+func TestONNXPersonalBoundaryStratified(t *testing.T) {
+	if os.Getenv("MAVEN_EVAL_PERSONAL_BOUNDARY") == "" {
+		t.Skip("set MAVEN_EVAL_PERSONAL_BOUNDARY=1 to run the deliberately strict V-702 matrix")
+	}
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	modelDir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	model := filepath.Join(modelDir, "model_quantized.onnx")
+	tokenizer := filepath.Join(modelDir, "tokenizer.json")
+	for _, path := range []string{lib, model, tokenizer} {
+		if _, err := os.Stat(path); err != nil {
+			t.Skipf("personal boundary eval dependency %s unavailable: %v", path, err)
+		}
+	}
+
+	embedder, err := router.NewONNXEmbedder(model, tokenizer, lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer embedder.Close()
+
+	ctx := context.Background()
+	boundary := &personalBoundary{}
+	boundary.load(ctx, embedder)
+	if !boundary.loaded {
+		t.Fatal("personal boundary seeds did not load with a working embedder")
+	}
+	// Production loads its model-ID-pinned frozen head and deliberately skips
+	// the 132 corpus embeddings on a user's first query. This test still needs
+	// those vectors for the historical top-k/centroid diagnostics, so build
+	// them here without putting that latency back in runtime code.
+	embedCorpus := func(values []string) [][]float32 {
+		vectors := make([][]float32, len(values))
+		for i, value := range values {
+			vector, err := router.EmbedQuery(ctx, embedder, value)
+			if err != nil {
+				t.Fatalf("embed diagnostic corpus %q: %v", value, err)
+			}
+			vectors[i] = vector
+		}
+		return vectors
+	}
+	boundary.personal = embedCorpus(personalSeeds)
+	boundary.world = embedCorpus(worldSeeds)
+	personalCentroid := personalBoundaryEvalCentroid(boundary.personal)
+	worldCentroid := personalBoundaryEvalCentroid(boundary.world)
+	if len(personalCentroid) == 0 || len(worldCentroid) == 0 {
+		t.Fatal("personal boundary seed vectors do not share a dimension")
+	}
+
+	type candidate struct {
+		name  string
+		score func([]float32) (float64, float64)
+	}
+	candidates := []candidate{
+		{name: "production", score: func(vec []float32) (float64, float64) {
+			personal, world, ok := boundary.score(vec)
+			if !ok {
+				t.Fatal("loaded personal boundary declined to score")
+			}
+			return personal, world
+		}},
+		{name: "top1", score: func(vec []float32) (float64, float64) {
+			return meanNearest(vec, boundary.personal, 1), meanNearest(vec, boundary.world, 1)
+		}},
+		{name: "top2", score: func(vec []float32) (float64, float64) {
+			return meanNearest(vec, boundary.personal, 2), meanNearest(vec, boundary.world, 2)
+		}},
+		{name: "top3", score: func(vec []float32) (float64, float64) {
+			return meanNearest(vec, boundary.personal, 3), meanNearest(vec, boundary.world, 3)
+		}},
+		{name: "centroid", score: func(vec []float32) (float64, float64) {
+			return cosine(vec, personalCentroid), cosine(vec, worldCentroid)
+		}},
+	}
+	reports := make(map[string]*personalBoundaryEvalReport, len(candidates))
+	for _, candidate := range candidates {
+		reports[candidate.name] = newPersonalBoundaryEvalReport(candidate.name)
+	}
+
+	fixture := loadPersonalBoundaryEvalFixture(t)
+	for _, c := range fixture.Cases {
+		vec, err := router.EmbedQuery(ctx, embedder, c.Utterance)
+		if err != nil {
+			t.Fatalf("%s: embed %q: %v", c.ID, c.Utterance, err)
+		}
+		for _, candidate := range candidates {
+			personal, world := candidate.score(vec)
+			gotPersonal := personal > world
+			reports[candidate.name].add(c, gotPersonal, personal, world)
+			if candidate.name == "production" && gotPersonal != (c.Want == "personal") {
+				t.Errorf("%s [%s/%s]: got %s, want %s (personal %.4f world %.4f delta %+.4f): %q",
+					c.ID, c.Lang, c.Stratum, boundaryEvalSide(gotPersonal), c.Want,
+					personal, world, personal-world, c.Utterance)
+			}
+		}
+	}
+
+	for _, candidate := range candidates {
+		report := reports[candidate.name]
+		t.Logf("candidate %-15s %2d/%d (%.1f%%), minimum signed margin %+.4f",
+			report.Name, report.Correct, report.Total,
+			100*float64(report.Correct)/float64(report.Total), report.MinimumMargin)
+	}
+	production := reports["production"]
+	for _, lang := range []string{"ru", "en"} {
+		stat := production.ByLanguage[lang]
+		t.Logf("production language %-2s %2d/%d", lang, stat.Correct, stat.Total)
+	}
+	for _, side := range []string{"personal", "world"} {
+		stat := production.ByExpectedClass[side]
+		t.Logf("production expected %-8s %2d/%d", side, stat.Correct, stat.Total)
+	}
+	strata := append([]string(nil), personalBoundaryEvalStrata...)
+	sort.Strings(strata)
+	for _, stratum := range strata {
+		stat := production.ByStratum[stratum]
+		ruPersonal := production.ByCell[stratum+"/ru/personal"]
+		ruWorld := production.ByCell[stratum+"/ru/world"]
+		enPersonal := production.ByCell[stratum+"/en/personal"]
+		enWorld := production.ByCell[stratum+"/en/world"]
+		t.Logf("production stratum %-21s %2d/%d | ru personal %d/%d world %d/%d | en personal %d/%d world %d/%d",
+			stratum, stat.Correct, stat.Total,
+			ruPersonal.Correct, ruPersonal.Total, ruWorld.Correct, ruWorld.Total,
+			enPersonal.Correct, enPersonal.Total, enWorld.Correct, enWorld.Total)
+	}
+}
+
+func personalBoundaryEvalCentroid(vectors [][]float32) []float32 {
+	if len(vectors) == 0 {
+		return nil
+	}
+	centroid := make([]float32, len(vectors[0]))
+	for _, vector := range vectors {
+		if len(vector) != len(centroid) {
+			return nil
+		}
+		for i, value := range vector {
+			centroid[i] += value
+		}
+	}
+	for i := range centroid {
+		centroid[i] /= float32(len(vectors))
+	}
+	return centroid
+}
+
+func boundaryEvalSide(personal bool) string {
+	if personal {
+		return "personal"
+	}
+	return "world"
+}
+
+// meanNearest is an evaluation baseline retained beside the strict fixture;
+// production uses the linear head in personalboundary.go.
+func meanNearest(vec []float32, seeds [][]float32, k int) float64 {
+	if len(seeds) == 0 || k <= 0 {
+		return -1
+	}
+	if k > len(seeds) {
+		k = len(seeds)
+	}
+	top := make([]float64, k)
+	for i := range top {
+		top[i] = -1
+	}
+	for _, seed := range seeds {
+		candidate := cosine(vec, seed)
+		for i := range top {
+			if candidate > top[i] {
+				candidate, top[i] = top[i], candidate
+			}
+		}
+	}
+	var sum float64
+	for _, similarity := range top {
+		sum += similarity
+	}
+	return sum / float64(k)
+}

cmd/mavend/personalboundary_test.go

@@ -2,13 +2,213 @@ package main
 
 import (
 	"context"
+	"math"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
+	"time"
 
 	"github.com/kami/maven/internal/router"
 )
 
+func TestPersonalBoundaryLinearHeadSeparatesSemanticDirections(t *testing.T) {
+	personal := [][]float32{{1, 0}, {0.9, 0.1}, {0.8, -0.1}}
+	world := [][]float32{{-1, 0}, {-0.9, 0.1}, {-0.8, -0.1}}
+	head, ok := trainPersonalBoundaryLinearHead(personal, world)
+	if !ok {
+		t.Fatal("valid training vectors were rejected")
+	}
+	b := personalBoundary{personal: personal, world: world, head: head, loaded: true}
+	for _, tc := range []struct {
+		vector   []float32
+		personal bool
+	}{
+		{vector: []float32{0.75, 0.2}, personal: true},
+		{vector: []float32{-0.75, 0.2}, personal: false},
+	} {
+		personalScore, worldScore, ok := b.score(tc.vector)
+		if !ok {
+			t.Fatal("loaded boundary did not score")
+		}
+		if got := personalScore > worldScore; got != tc.personal {
+			t.Fatalf("vector %v classified personal=%v (scores %.4f/%.4f), want %v",
+				tc.vector, got, personalScore, worldScore, tc.personal)
+		}
+		if math.Abs(personalScore+worldScore-1) > 1e-12 {
+			t.Fatalf("scores %.8f and %.8f are not complementary probabilities", personalScore, worldScore)
+		}
+	}
+}
+
+func TestPersonalBoundaryTrainingBalancesClasses(t *testing.T) {
+	personal := [][]float32{{1, 0}, {0.8, 0.2}}
+	world := [][]float32{{-1, 0}}
+	oneWorld, ok := trainPersonalBoundaryLinearHead(personal, world)
+	if !ok {
+		t.Fatal("valid training vectors were rejected")
+	}
+	repeatedWorld := make([][]float32, 12)
+	for i := range repeatedWorld {
+		repeatedWorld[i] = world[0]
+	}
+	twelveWorld, ok := trainPersonalBoundaryLinearHead(personal, repeatedWorld)
+	if !ok {
+		t.Fatal("valid repeated training vectors were rejected")
+	}
+	if math.Abs(oneWorld.bias-twelveWorld.bias) > 1e-10 {
+		t.Fatalf("duplicating one class moved bias from %.12f to %.12f", oneWorld.bias, twelveWorld.bias)
+	}
+	for i := range oneWorld.weights {
+		if math.Abs(oneWorld.weights[i]-twelveWorld.weights[i]) > 1e-10 {
+			t.Fatalf("duplicating one class moved weight %d from %.12f to %.12f",
+				i, oneWorld.weights[i], twelveWorld.weights[i])
+		}
+	}
+}
+
+func TestPersonalBoundaryTrainingRejectsMixedDimensions(t *testing.T) {
+	if _, ok := trainPersonalBoundaryLinearHead(
+		[][]float32{{1, 0}},
+		[][]float32{{-1, 0, 0}},
+	); ok {
+		t.Fatal("mixed embedding dimensions were accepted")
+	}
+}
+
+// The corpus is grouped by sentence shape in personalboundary.go. This test
+// leaves one entire shape out of training at a time, then requires the linear
+// head to classify the omitted examples from the semantics learned from the
+// other shapes. It is ordinary deterministic CI: the small axis vectors stand
+// in for frozen embedding directions, so the test proves the training code
+// generalises across groups rather than memorising one row at a time.
+func TestPersonalBoundaryLinearHeadLeaveOneShapeOut(t *testing.T) {
+	type example struct {
+		vector []float32
+		shape  int
+		want   bool
+	}
+	const shapeCount = 6
+	examples := make([]example, 0, shapeCount*4)
+	for shape := 0; shape < shapeCount; shape++ {
+		for variant := 0; variant < 2; variant++ {
+			personal := make([]float32, shapeCount+1)
+			world := make([]float32, shapeCount+1)
+			personal[0], world[0] = 1, -1
+			personal[shape+1] = float32(0.1 * float64(variant+1))
+			world[shape+1] = float32(-0.1 * float64(variant+1))
+			examples = append(examples,
+				example{vector: personal, shape: shape, want: true},
+				example{vector: world, shape: shape, want: false},
+			)
+		}
+	}
+
+	for omitted := 0; omitted < shapeCount; omitted++ {
+		var personal, world [][]float32
+		for _, example := range examples {
+			if example.shape == omitted {
+				continue
+			}
+			if example.want {
+				personal = append(personal, example.vector)
+			} else {
+				world = append(world, example.vector)
+			}
+		}
+		head, ok := trainPersonalBoundaryLinearHead(personal, world)
+		if !ok {
+			t.Fatalf("fold %d rejected valid vectors", omitted)
+		}
+		for _, example := range examples {
+			if example.shape != omitted {
+				continue
+			}
+			if got := head.logit(example.vector) > 0; got != example.want {
+				t.Errorf("fold %d classified %v as personal=%v, want %v", omitted, example.vector, got, example.want)
+			}
+		}
+	}
+}
+
+func TestPersonalBoundaryTrainingCorpusIsIndependent(t *testing.T) {
+	// The strict stratified fixture already enforces this for its 72 rows. The
+	// historical regression table lives here, so protect it here too: a future
+	// seed addition must not copy a regression sentence into training.
+	training := make(map[string]bool, len(personalSeeds)+len(worldSeeds))
+	for _, seed := range append(append([]string(nil), personalSeeds...), worldSeeds...) {
+		training[normalizePersonalBoundaryTraining(seed)] = true
+	}
+	for _, regression := range []string{
+		"что я говорил про бэкапы?",
+		"что я сказал вчера про отпуск",
+		"я писал что-нибудь про сервер",
+		"я упоминал про конференцию?",
+		"что я отмечал по поводу переезда",
+		"я рассказывал тебе про новую работу?",
+		"во сколько у меня встреча",
+		"когда мой следующий отпуск",
+		"what did i say about backups",
+		"did i tell you about the doctor",
+		"как я говорил, почему небо синее",
+		"как уже я говорил, какая столица франции",
+		"почему трава зелёная",
+		"столица франции",
+		"как мне сварить борщ",
+		"что мне посмотреть вечером",
+		"я хочу узнать про рим",
+		"кто такой гагарин",
+		"how do i boil an egg",
+		"во сколько закат сегодня",
+		"когда сегодня заканчивается концерт",
+		"во сколько завтра открывается аптека",
+		"какой сегодня праздник",
+		"что интересного произошло сегодня в мире",
+		"кто выиграл вчера матч",
+		"расскажи про эверест",
+		"расскажи про войну 1812 года",
+		"объясни что такое инфляция",
+		"я рассказывал тебе про байкал?",
+	} {
+		if training[normalizePersonalBoundaryTraining(regression)] {
+			t.Errorf("regression utterance leaked into training: %q", regression)
+		}
+	}
+}
+
+func TestPersonalBoundaryFrozenHeadDecodes(t *testing.T) {
+	head, ok := frozenPersonalBoundaryHead()
+	if !ok {
+		t.Fatal("frozen head did not decode")
+	}
+	if len(head.weights) != 384 {
+		t.Fatalf("frozen head has %d weights, want 384", len(head.weights))
+	}
+}
+
+func TestPersonalBoundaryHashFloorLatency(t *testing.T) {
+	b := &personalBoundary{}
+	embedder := router.NewHashEmbedder(1024)
+	query, err := router.EmbedQuery(context.Background(), embedder, "когда моя встреча")
+	if err != nil {
+		t.Fatal(err)
+	}
+	started := time.Now()
+	b.load(context.Background(), embedder)
+	if _, _, ok := b.score(query); !ok {
+		t.Fatal("hash-floor boundary declined to score")
+	}
+	elapsed := time.Since(started)
+	t.Logf("hash-floor corpus fit+score: %s", elapsed)
+	if elapsed > 2*time.Second {
+		t.Errorf("hash-floor boundary took %s, exceeds 2s local floor ceiling", elapsed)
+	}
+}
+
+func normalizePersonalBoundaryTraining(value string) string {
+	return strings.Join(strings.Fields(strings.ToLower(value)), " ")
+}
+
 // A handler with no embedder never loads the seeds, so the boundary falls back
 // to the possession markers. That is the offline floor and it must keep working
 // — an embedder that fails to load must not open the boundary.
@@ -113,3 +313,419 @@ func TestONNXPersonalBoundary(t *testing.T) {
 	}
 	t.Logf("personal boundary: %d/%d held-out utterances correct", len(cases)-wrong, len(cases))
 }
+
+func TestONNXPersonalBoundaryFourFold(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+	ctx := context.Background()
+	embedAll := func(values []string) [][]float32 {
+		vectors := make([][]float32, len(values))
+		for i, value := range values {
+			vector, err := router.EmbedQuery(ctx, emb, value)
+			if err != nil {
+				t.Fatalf("embed %q: %v", value, err)
+			}
+			vectors[i] = vector
+		}
+		return vectors
+	}
+	personalVectors := embedAll(personalSeeds)
+	worldVectors := embedAll(worldSeeds)
+
+	type group struct {
+		name                         string
+		personalStart, personalCount int
+		worldStart, worldCount       int
+	}
+	groups := []group{
+		{name: "remembered_speech", personalStart: 8, personalCount: 8, worldStart: 20, worldCount: 8},
+		{name: "possession", personalStart: 16, personalCount: 10, worldStart: 28, worldCount: 12},
+		{name: "narrative", personalStart: 26, personalCount: 8, worldStart: 40, worldCount: 8},
+		{name: "first_person_preamble", personalStart: 34, personalCount: 8, worldStart: 48, worldCount: 8},
+		{name: "advice_current_info", personalStart: 42, personalCount: 8, worldStart: 56, worldCount: 8},
+		{name: "public_proper_nouns", personalStart: 50, personalCount: 10, worldStart: 64, worldCount: 8},
+	}
+
+	const foldCount = 4
+	aggregateCorrect, aggregateTotal := 0, 0
+	for omittedFold := 0; omittedFold < foldCount; omittedFold++ {
+		trainingPersonal := append([][]float32(nil), personalVectors[:8]...)
+		trainingWorld := append([][]float32(nil), worldVectors[:20]...)
+		var heldPersonal, heldWorld [][]float32
+		partition := func(vectors [][]float32, start, count int, training, held *[][]float32) {
+			for relative, vector := range vectors[start : start+count] {
+				if relative%foldCount == omittedFold {
+					*held = append(*held, vector)
+				} else {
+					*training = append(*training, vector)
+				}
+			}
+		}
+		for _, group := range groups {
+			partition(personalVectors, group.personalStart, group.personalCount, &trainingPersonal, &heldPersonal)
+			partition(worldVectors, group.worldStart, group.worldCount, &trainingWorld, &heldWorld)
+		}
+		head, ok := trainPersonalBoundaryLinearHead(
+			trainingPersonal,
+			trainingWorld,
+		)
+		if !ok {
+			t.Fatalf("fold %d: valid training fold rejected", omittedFold)
+		}
+		correct, total := 0, 0
+		for _, vector := range heldPersonal {
+			total++
+			if head.logit(vector) > 0 {
+				correct++
+			}
+		}
+		for _, vector := range heldWorld {
+			total++
+			if head.logit(vector) <= 0 {
+				correct++
+			}
+		}
+		t.Logf("fold %d: %d/%d held-out training examples", omittedFold+1, correct, total)
+		aggregateCorrect += correct
+		aggregateTotal += total
+	}
+	t.Logf("four-fold aggregate: %d/%d", aggregateCorrect, aggregateTotal)
+	if aggregateCorrect < 99 {
+		t.Errorf("four-fold aggregate %d/%d, want at least 99/104", aggregateCorrect, aggregateTotal)
+	}
+}
+
+func TestONNXPersonalBoundarySemanticGroupHoldout(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+	ctx := context.Background()
+	embedAll := func(values []string) [][]float32 {
+		vectors := make([][]float32, len(values))
+		for i, value := range values {
+			vector, err := router.EmbedQuery(ctx, emb, value)
+			if err != nil {
+				t.Fatalf("embed %q: %v", value, err)
+			}
+			vectors[i] = vector
+		}
+		return vectors
+	}
+	personalVectors := embedAll(personalSeeds)
+	worldVectors := embedAll(worldSeeds)
+
+	type group struct {
+		name                         string
+		personalStart, personalCount int
+		worldStart, worldCount       int
+	}
+	groups := []group{
+		{name: "remembered_speech", personalStart: 8, personalCount: 8, worldStart: 20, worldCount: 8},
+		{name: "possession", personalStart: 16, personalCount: 10, worldStart: 28, worldCount: 12},
+		{name: "narrative", personalStart: 26, personalCount: 8, worldStart: 40, worldCount: 8},
+		{name: "first_person_preamble", personalStart: 34, personalCount: 8, worldStart: 48, worldCount: 8},
+		{name: "advice_current_info", personalStart: 42, personalCount: 8, worldStart: 56, worldCount: 8},
+		{name: "public_proper_nouns", personalStart: 50, personalCount: 10, worldStart: 64, worldCount: 8},
+	}
+
+	aggregateCorrect, aggregateTotal := 0, 0
+	for _, omitted := range groups {
+		excluding := func(vectors [][]float32, start, count int) [][]float32 {
+			result := make([][]float32, 0, len(vectors)-count)
+			result = append(result, vectors[:start]...)
+			return append(result, vectors[start+count:]...)
+		}
+		head, ok := trainPersonalBoundaryLinearHead(
+			excluding(personalVectors, omitted.personalStart, omitted.personalCount),
+			excluding(worldVectors, omitted.worldStart, omitted.worldCount),
+		)
+		if !ok {
+			t.Fatalf("%s: valid training fold rejected", omitted.name)
+		}
+		correct, total := 0, 0
+		for _, vector := range personalVectors[omitted.personalStart : omitted.personalStart+omitted.personalCount] {
+			total++
+			if head.logit(vector) > 0 {
+				correct++
+			}
+		}
+		for _, vector := range worldVectors[omitted.worldStart : omitted.worldStart+omitted.worldCount] {
+			total++
+			if head.logit(vector) <= 0 {
+				correct++
+			}
+		}
+		t.Logf("leave %-21s out: %d/%d", omitted.name, correct, total)
+		aggregateCorrect += correct
+		aggregateTotal += total
+		// Whole-shape holdout is an honest diagnostic, not a 100% release gate:
+		// some shapes (notably private-vs-general possession) define a distinct
+		// semantic ambiguity. The separately authored challenge set remains the
+		// strict generalisation gate.
+	}
+	if aggregateCorrect < 92 {
+		t.Errorf("whole-shape aggregate %d/%d, want at least 92/104", aggregateCorrect, aggregateTotal)
+	}
+}
+
+// This challenge set was originally authored after the six-shape training
+// corpus and the 72-case matrix were frozen. Its sole miss then informed the
+// regularisation comparison, so it is now a strict regression gate rather than
+// independent evidence. It remains outside the production corpus.
+func TestONNXPersonalBoundaryChallenge(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+
+	cases := []struct {
+		utterance string
+		personal  bool
+	}{
+		{"какой пароль приложения я задал для почтового клиента?", true},
+		{"на каком порту я решил поднять тестовый сервис?", true},
+		{"какую причину я указал, когда отменил бронь?", true},
+		{"где в гараже я сложил зимние шины?", true},
+		{"какой сериал я бросил после второго сезона?", true},
+		{"о чём мы договорились с Олегом на прошлой неделе?", true},
+		{"почему мой монитор мерцает при частоте 144 герца?", false},
+		{"подойдёт ли кабель Thunderbolt 3 к разъёму USB4?", false},
+		{"как вывести запах дыма из моей куртки?", false},
+		{"что означают кольца на флаге Олимпиады?", false},
+		{"почему после дождя на асфальте видна радуга?", false},
+		{"какой формат файлов поддерживает Kindle Paperwhite?", false},
+		{"which SSH key did I install on the build server?", true},
+		{"what spending limit did I set for the travel card?", true},
+		{"where did I store the spare apartment fob?", true},
+		{"which objection did I raise during the design review?", true},
+		{"what route did I plan for the Sunday hike?", true},
+		{"when did I promise Maya I would send the draft?", true},
+		{"why does my mechanical keyboard sometimes chatter?", false},
+		{"can my USB-C charger safely power a Steam Deck?", false},
+		{"how do I stop condensation inside my camera lens?", false},
+		{"what caused the Tacoma Narrows Bridge to collapse?", false},
+		{"why are some auroras red instead of green?", false},
+		{"which codecs does the current Firefox release support?", false},
+	}
+
+	b := &personalBoundary{}
+	b.load(context.Background(), emb)
+	correct := 0
+	minimumMargin := math.Inf(1)
+	for _, testCase := range cases {
+		vector, err := router.EmbedQuery(context.Background(), emb, testCase.utterance)
+		if err != nil {
+			t.Fatalf("embed %q: %v", testCase.utterance, err)
+		}
+		personal, world, ok := b.score(vector)
+		if !ok {
+			t.Fatal("loaded boundary declined to score")
+		}
+		got := personal > world
+		signedMargin := personal - world
+		if !testCase.personal {
+			signedMargin = -signedMargin
+		}
+		if signedMargin < minimumMargin {
+			minimumMargin = signedMargin
+		}
+		if got == testCase.personal {
+			correct++
+		} else {
+			t.Logf("miss %q: personal=%v want %v (%.4f/%.4f)", testCase.utterance, got, testCase.personal, personal, world)
+		}
+	}
+	t.Logf("regularisation challenge: %d/%d, minimum signed margin %+.4f", correct, len(cases), minimumMargin)
+	if correct != len(cases) {
+		t.Errorf("regularisation challenge %d/%d, want every case correct", correct, len(cases))
+	}
+}
+
+// TestONNXPersonalBoundaryPostRetuneChallenge was authored only after the L2
+// coefficient and frozen head had been selected using corpus cross-validation.
+// It deliberately returns to private configuration, commitments and stored
+// choices with new objects, and contrasts them with public technical facts,
+// compatibility and maintenance. No result from this table may be used to
+// tune the current head; a miss is evidence for the next independently
+// evaluated model revision.
+func TestONNXPersonalBoundaryPostRetuneChallenge(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+
+	cases := []struct {
+		utterance string
+		personal  bool
+	}{
+		{"какое имя я выбрал для гостевой сети Wi-Fi?", true},
+		{"на какой день я перенёс техосмотр машины?", true},
+		{"какую сумму мы с Мариной согласовали за ремонт кухни?", true},
+		{"где я сохранил резервные коды от GitHub?", true},
+		{"какой из макетов визитки я одобрил?", true},
+		{"что я решил делать со страховкой перед поездкой?", true},
+		{"какой диапазон частот использует Wi-Fi 6E?", false},
+		{"почему OLED-экраны со временем выгорают?", false},
+		{"можно ли подключить монитор DisplayPort к Thunderbolt 4?", false},
+		{"чем безопасно чистить замшевые ботинки?", false},
+		{"когда появился протокол WebSocket?", false},
+		{"почему соль ускоряет таяние льда?", false},
+		{"which hostname did I assign to the home NAS?", true},
+		{"what date did I move the annual checkup to?", true},
+		{"where did I save the recovery phrase for the hardware wallet?", true},
+		{"which catering quote did we accept for the party?", true},
+		{"what did I decide about renewing the domain?", true},
+		{"which paint sample did I approve for the hallway?", true},
+		{"does Wi-Fi 7 work with older wireless clients?", false},
+		{"why can an SSD slow down when it is nearly full?", false},
+		{"how should suede shoes be cleaned?", false},
+		{"when was the WebSocket protocol standardized?", false},
+		{"what does a hardware-wallet recovery phrase do?", false},
+		{"why does road salt damage concrete?", false},
+	}
+
+	b := &personalBoundary{}
+	b.load(context.Background(), emb)
+	correct := 0
+	minimumMargin := math.Inf(1)
+	for _, testCase := range cases {
+		vector, err := router.EmbedQuery(context.Background(), emb, testCase.utterance)
+		if err != nil {
+			t.Fatalf("embed %q: %v", testCase.utterance, err)
+		}
+		personal, world, ok := b.score(vector)
+		if !ok {
+			t.Fatal("loaded boundary declined to score")
+		}
+		got := personal > world
+		signedMargin := personal - world
+		if !testCase.personal {
+			signedMargin = -signedMargin
+		}
+		if signedMargin < minimumMargin {
+			minimumMargin = signedMargin
+		}
+		if got == testCase.personal {
+			correct++
+		} else {
+			t.Logf("miss %q: personal=%v want %v (%.4f/%.4f)", testCase.utterance, got, testCase.personal, personal, world)
+		}
+	}
+	t.Logf("post-retune challenge: %d/%d, minimum signed margin %+.4f", correct, len(cases), minimumMargin)
+	if correct != len(cases) {
+		t.Errorf("post-retune challenge %d/%d, want every case correct", correct, len(cases))
+	}
+}
+
+func TestONNXPersonalBoundaryLatency(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+	ctx := context.Background()
+	query, err := router.EmbedQuery(ctx, emb, "что я решил насчёт переезда?")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	b := &personalBoundary{}
+	coldStart := time.Now()
+	b.load(ctx, emb)
+	if _, _, ok := b.score(query); !ok {
+		t.Fatal("loaded boundary declined to score")
+	}
+	cold := time.Since(coldStart)
+
+	const iterations = 100000
+	steadyStart := time.Now()
+	for i := 0; i < iterations; i++ {
+		if _, _, ok := b.score(query); !ok {
+			t.Fatal("loaded boundary declined to score")
+		}
+	}
+	steady := time.Since(steadyStart) / iterations
+	t.Logf("boundary cold load+train+score: %s; steady score: %s/op", cold, steady)
+	// This is a user-visible first-turn path. Keep a generous ceiling to avoid
+	// noisy CI while making an accidental per-turn training/load regression
+	// unmistakable.
+	if cold > 5*time.Second {
+		t.Errorf("cold boundary load %s exceeds 5s local usability ceiling", cold)
+	}
+	if steady > 100*time.Microsecond {
+		t.Errorf("steady boundary score %s exceeds 100µs ceiling", steady)
+	}
+}
+
+func TestONNXPersonalBoundaryFrozenHeadMatchesCorpusFit(t *testing.T) {
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset — see AGENTS.md § Embedder model for intent routing")
+	}
+	dir := filepath.Join("../..", "models/embedder/multilingual-e5-small")
+	emb, err := router.NewONNXEmbedder(filepath.Join(dir, "model_quantized.onnx"), filepath.Join(dir, "tokenizer.json"), lib)
+	if err != nil {
+		t.Skipf("onnx embedder unavailable: %v", err)
+	}
+	defer emb.Close()
+	ctx := context.Background()
+	embedAll := func(values []string) [][]float32 {
+		vectors := make([][]float32, len(values))
+		for i, value := range values {
+			vector, err := router.EmbedQuery(ctx, emb, value)
+			if err != nil {
+				t.Fatalf("embed %q: %v", value, err)
+			}
+			vectors[i] = vector
+		}
+		return vectors
+	}
+	fitted, ok := trainPersonalBoundaryLinearHead(embedAll(personalSeeds), embedAll(worldSeeds))
+	if !ok {
+		t.Fatal("corpus fit failed")
+	}
+	frozen, ok := frozenPersonalBoundaryHead()
+	if !ok {
+		t.Fatal("frozen head did not decode")
+	}
+	if math.Abs(fitted.bias-frozen.bias) > 1e-9 {
+		t.Fatalf("frozen bias %.12f != fitted %.12f", frozen.bias, fitted.bias)
+	}
+	for i := range fitted.weights {
+		if math.Abs(fitted.weights[i]-frozen.weights[i]) > 5e-7 {
+			t.Fatalf("frozen weight %d %.12f != fitted %.12f", i, frozen.weights[i], fitted.weights[i])
+		}
+	}
+}

cmd/mavend/repair.go

@@ -172,14 +172,57 @@ func (h *reactiveHandler) stampLastTurn(utterance string, traceID int64) {
 	h.lastRouted.traceID = traceID
 }
 
-func (h *reactiveHandler) takeLastTurn() *routedTurn {
+// takeLastTurnIf atomically claims the previous acted turn only when the
+// caller can actually handle it. A declined repair must not spend the pointer:
+// "нет, это заметка" may name the intent Maven already chose and be followed
+// immediately by the real correction. The older read-then-clear helper lost
+// the original before checking either that case or the repair window (V-573).
+func (h *reactiveHandler) takeLastTurnIf(accept func(*routedTurn) bool) *routedTurn {
 	h.mu.Lock()
 	defer h.mu.Unlock()
-	last := h.lastRouted
-	// Taken, not read: one utterance is corrected once. Saying "нет, не так"
-	// twice would otherwise redo the same request twice.
+	if h.lastRouted == nil || !accept(h.lastRouted) {
+		return nil
+	}
+	last := *h.lastRouted
+	// A handled correction is still spent once. Returning a copy prevents a
+	// later trace stamp from mutating the evidence after this resolver owns it.
 	h.lastRouted = nil
-	return last
+	return &last
+}
+
+// takeTargetedRepair atomically distinguishes the three outcomes a targeted
+// correction needs. A recent, differently-routed turn is claimed and spent; a
+// recent turn already carrying that intent is retained and reported as
+// already-correct; everything else declines. Treating the second case as a
+// generic decline lets runTurn route the correction words as a fresh turn and
+// record them over the very pointer this helper was meant to preserve.
+func (h *reactiveHandler) takeTargetedRepair(now time.Time, corrected router.Intent) (last *routedTurn, already bool) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.lastRouted == nil || now.Sub(h.lastRouted.at) > repairWindow {
+		return nil, false
+	}
+	if h.lastRouted.intent == corrected {
+		return nil, true
+	}
+	copy := *h.lastRouted
+	h.lastRouted = nil
+	return &copy, false
+}
+
+// suspendClarifyForRepair makes a correction an aside to any question already
+// parked in this dialogue. It is called only after a repair has actually found
+// a target, so an ordinary utterance that merely resembles one changes no
+// dialogue state. If the redo itself needs a question, askClarify sees the
+// suspended flag and pushes that question instead of overwriting the older
+// request.
+func (h *reactiveHandler) suspendClarifyForRepair(ctx context.Context) {
+	if h.clarifyStore == nil {
+		return
+	}
+	if q := h.clarifyStore.Get(dialogueIDOf(ctx), h.now()); q != nil {
+		h.noteSuspended(ctx, q)
+	}
 }
 
 // resolveUntargetedRepair handles the cheap half of a spoken correction: he says
@@ -199,15 +242,16 @@ func (h *reactiveHandler) resolveUntargetedRepair(ctx context.Context, text stri
 	if !isRepairNegative(text) {
 		return "", false
 	}
-	last := h.takeLastTurn()
-	if last == nil || h.now().Sub(last.at) > repairWindow {
-		return "", false
-	}
-	if last.traceID == 0 {
+	now := h.now()
+	last := h.takeLastTurnIf(func(last *routedTurn) bool {
+		return now.Sub(last.at) <= repairWindow && last.traceID != 0
+	})
+	if last == nil {
 		// No row to point at, so there is no label to write and nothing this
 		// resolver can do. Routing the words normally is the honest outcome.
 		return "", false
 	}
+	h.suspendClarifyForRepair(ctx)
 	h.labelCorrection(ctx, last, "")
 	log.Printf("voice: repair — %q marked wrong, no target given", last.utterance)
 	return phraser.A(phraser.RepairNoted, nil), true
@@ -239,16 +283,20 @@ func (h *reactiveHandler) resolveRepair(ctx context.Context, text string) (strin
 	if !ok || h.router == nil {
 		return "", false
 	}
-	last := h.takeLastTurn()
-	if last == nil || h.now().Sub(last.at) > repairWindow {
-		return "", false
-	}
-	if last.intent == corrected {
-		// She already did what he is asking for. Correcting the classifier
-		// here would teach it the label it produced, and redoing the request
-		// would file it twice.
+	last, already := h.takeTargetedRepair(h.now(), corrected)
+	if already {
+		// This is still a correction turn, not slot material and not a fresh note.
+		// Say why nothing ran, retain the original pointer, and keep any parked
+		// question audible for the next breath.
+		h.suspendClarifyForRepair(ctx)
+		return "это уже " + say + " — ничего не переделываю.", true
+	}
+	if last == nil {
+		// Nothing recent to correct. Routing the words normally is the honest
+		// outcome; an expired pointer cannot become usable again.
 		return "", false
 	}
+	h.suspendClarifyForRepair(ctx)
 	learned := true
 	if err := h.router.CorrectMisroute(ctx, last.utterance, corrected); err != nil {
 		// The redo is still worth doing: he asked for something and it did not
@@ -271,7 +319,7 @@ func (h *reactiveHandler) resolveRepair(ctx context.Context, text string) (strin
 	if dec.Slots.Text == "" && corrected != router.IntentReminder {
 		dec.Slots.Text = last.utterance
 	}
-	return repairLine(say, learned) + " " + h.finishClarified(ctx, dec), true
+	return repairLine(say, learned) + " " + h.finishRepaired(ctx, dec), true
 }
 
 // repairLine — what she says before redoing it, so the correction is visible

cmd/mavend/repair_test.go

@@ -6,6 +6,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/kami/maven/internal/dialogue"
 	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/store"
 )
@@ -93,7 +94,7 @@ func TestRepairNeedsARecentTurnToPointAt(t *testing.T) {
 }
 
 func TestRepairIsSpentOnce(t *testing.T) {
-	h, _, _ := newClarifyHandler(t)
+	h, st, _ := newClarifyHandler(t)
 	emb := router.NewHashEmbedder(256)
 	h.recall.embedder = emb
 	h.router = router.New(router.Config{Classifier: router.NewClassifier(emb), Extractor: h.extractor})
@@ -103,8 +104,17 @@ func TestRepairIsSpentOnce(t *testing.T) {
 	if _, handled := h.resolveRepair(ctx, "нет, это заметка"); !handled {
 		t.Fatal("the first correction was not handled")
 	}
-	if _, handled := h.resolveRepair(ctx, "нет, это заметка"); handled {
-		t.Error("the same turn was corrected twice")
+	before, err := st.RecentNotes(ctx, 10)
+	if err != nil || len(before) != 1 {
+		t.Fatalf("first repair notes=%+v err=%v", before, err)
+	}
+	reply, handled := h.resolveRepair(ctx, "нет, это заметка")
+	if !handled || !strings.Contains(reply, "уже") {
+		t.Fatalf("the repeated correction was not acknowledged as already applied: handled=%v reply=%q", handled, reply)
+	}
+	after, err := st.RecentNotes(ctx, 10)
+	if err != nil || len(after) != 1 {
+		t.Fatalf("the same turn was redone twice: notes=%+v err=%v", after, err)
 	}
 }
 
@@ -114,8 +124,119 @@ func TestRepairPassesWhenSheAlreadyDidThat(t *testing.T) {
 	h, _, _ := newClarifyHandler(t)
 	h.router = router.New(router.Config{Classifier: router.NewClassifier(router.NewHashEmbedder(256))})
 	h.recordTurn("купить хлеб", router.IntentNote)
+	reply, handled := h.resolveRepair(context.Background(), "нет, это заметка")
+	if !handled || !strings.Contains(reply, "уже") {
+		t.Fatalf("a redundant correction must be acknowledged without redoing it: handled=%v reply=%q", handled, reply)
+	}
+	// Acknowledging the redundant target must not spend the original. If this
+	// resolver declines instead, runTurn routes the correction as a fresh turn
+	// and recordTurn overwrites the pointer even though takeLastTurn retained it.
+	if _, handled := h.resolveRepair(context.Background(), "нет, это факт"); !handled {
+		t.Error("a redundant same-intent repair spent the original turn")
+	}
+}
+
+func TestRepairResumesQuestionParkedAfterTheCorrectedTurn(t *testing.T) {
+	h, _, _ := newClarifyHandler(t)
+	emb := router.NewHashEmbedder(256)
+	h.recall.embedder = emb
+	h.router = router.New(router.Config{Classifier: router.NewClassifier(emb), Extractor: h.extractor})
+	ctx := context.Background()
+
+	h.recordTurn("купить хлеб", router.IntentFact)
+	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder,
+		router.Slots{Text: "позвонить маме"}, "напомни позвонить маме")); !asked {
+		t.Fatal("expected a parked reminder question")
+	}
+
+	reply := h.runTurn(ctx, "нет, это был вопрос", sourceText)
+	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
+	if !strings.HasSuffix(reply, resumed) {
+		t.Fatalf("the correction hid the still-live question: reply=%q want suffix=%q", reply, resumed)
+	}
+	q := h.clarifyStore.Get(voiceDialogueID, h.now())
+	if q == nil {
+		t.Fatal("the correction dropped the parked question")
+	}
+	if q.Attempts != 1 || q.Suspends != 1 {
+		t.Fatalf("the correction spent a retry instead of suspending the question: %+v", q)
+	}
+}
+
+func TestRepairedClarifyCompletesWithoutDroppingTheOlderQuestion(t *testing.T) {
+	h, st, _ := newClarifyHandler(t)
+	emb := router.NewHashEmbedder(256)
+	h.recall.embedder = emb
+	h.router = router.New(router.Config{Classifier: router.NewClassifier(emb), Extractor: h.extractor})
+	ctx := context.Background()
+
+	h.recordTurn("купить хлеб", router.IntentFact)
+	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder,
+		router.Slots{Text: "позвонить маме"}, "напомни позвонить маме")); !asked {
+		t.Fatal("expected the older reminder question")
+	}
+
+	if reply := h.runTurn(ctx, "нет, это было напоминание", sourceText); !strings.Contains(reply, "Когда") {
+		t.Fatalf("the repaired reminder did not ask for its missing time: %q", reply)
+	}
+	if depth := h.clarifyStore.Depth(voiceDialogueID); depth != 2 {
+		t.Fatalf("the repaired question overwrote the older one: depth=%d want=2", depth)
+	}
+
+	reply := h.runTurn(ctx, "сегодня в 15:00", sourceText)
+	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
+	if !strings.HasSuffix(reply, resumed) {
+		t.Fatalf("completing the repaired request did not resume the older one: reply=%q", reply)
+	}
+	q := h.clarifyStore.Get(voiceDialogueID, h.now())
+	if q == nil || !strings.Contains(q.Utterance, "маме") {
+		t.Fatalf("the older question was lost after the top one completed: %+v", q)
+	}
+	reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour))
+	if err != nil || len(reminders) != 1 || !strings.Contains(reminders[0].Payload, "хлеб") {
+		t.Fatalf("the repaired reminder did not land exactly once: reminders=%+v err=%v", reminders, err)
+	}
+}
+
+func TestRepairedClarifyGiveUpKeepsTheOlderQuestion(t *testing.T) {
+	h, _, _ := newClarifyHandler(t)
+	ctx := context.Background()
+	older := &dialogue.PendingQuestion{
+		Intent: dialogue.IntentReminder, Missing: []dialogue.Slot{dialogue.SlotTime},
+		Utterance: "напомни позвонить маме", Asked: h.now(), TTL: clarifyTTL,
+	}
+	top := &dialogue.PendingQuestion{
+		Intent: dialogue.IntentReminder, Missing: []dialogue.Slot{dialogue.SlotTime},
+		Utterance: "напомни купить хлеб", Asked: h.now(), TTL: clarifyTTL,
+		Attempts: dialogue.DefaultMaxAttempts, MaxAttempts: dialogue.DefaultMaxAttempts,
+	}
+	h.clarifyStore.Push(voiceDialogueID, older)
+	h.clarifyStore.Push(voiceDialogueID, top)
+
+	if reply := h.reaskOrGiveUp(ctx, top, top.Slots, "не знаю", ""); reply != clarifyGaveUp {
+		t.Fatalf("reply=%q, want the explicit give-up line", reply)
+	}
+	if depth := h.clarifyStore.Depth(voiceDialogueID); depth != 1 {
+		t.Fatalf("giving up on the top request erased the older flow: depth=%d", depth)
+	}
+	q := h.clarifyStore.Get(voiceDialogueID, h.now())
+	if q != older {
+		t.Fatalf("survivor=%+v, want the older parked question", q)
+	}
+}
+
+func TestStaleRepairDoesNotSpendTheOriginal(t *testing.T) {
+	h, _, now := newClarifyHandler(t)
+	h.router = router.New(router.Config{Classifier: router.NewClassifier(router.NewHashEmbedder(256))})
+	h.recordTurn("купить хлеб", router.IntentFact)
+	*now = now.Add(repairWindow + time.Minute)
 	if _, handled := h.resolveRepair(context.Background(), "нет, это заметка"); handled {
-		t.Error("a correction to the intent she already used was handled")
+		t.Fatal("a stale correction was handled")
+	}
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.lastRouted == nil || h.lastRouted.utterance != "купить хлеб" {
+		t.Fatal("a stale declined correction spent the original turn")
 	}
 }
 

cmd/mavend/simulator_test.go

@@ -127,10 +127,14 @@ type toolRow struct {
 // Route and Reply are separate because the same model serves both contracts
 // (CLAUDE.md, "LLM output contract"): a grammar-constrained call is a routing
 // call and gets Route, an unconstrained one is a phrasing call and gets Reply.
+// HistoryContains makes a chat reply conditional on the transcript the daemon
+// supplied. It prevents a canned answer from making a continuity scenario pass
+// while the referent is still absent from the model input.
 type scriptEntry struct {
-	Match string `json:"match"`
-	Route string `json:"route,omitempty"`
-	Reply string `json:"reply,omitempty"`
+	Match           string   `json:"match"`
+	Route           string   `json:"route,omitempty"`
+	Reply           string   `json:"reply,omitempty"`
+	HistoryContains []string `json:"history_contains,omitempty"`
 }
 
 // step — one scripted moment. At is "HH:MM" or "HH:MM:SS", interpreted in the
@@ -369,7 +373,7 @@ type scriptedPhraser struct {
 // matches scriptedLLM: actionChat logs it and falls back to ChatFallback(), so a
 // scenario that never meant to assert on a chat reply behaves exactly as it did
 // before, and one that DID means to is told its script has a hole.
-func (p *scriptedPhraser) PhraseChat(_ context.Context, utterance string, _ []dialogue.Turn) (string, error) {
+func (p *scriptedPhraser) PhraseChat(_ context.Context, utterance string, history []dialogue.Turn) (string, error) {
 	for _, e := range p.entries {
 		if e.Reply == "" {
 			continue
@@ -377,6 +381,19 @@ func (p *scriptedPhraser) PhraseChat(_ context.Context, utterance string, _ []di
 		if e.Match != "" && !strings.Contains(strings.ToLower(utterance), strings.ToLower(e.Match)) {
 			continue
 		}
+		for _, want := range e.HistoryContains {
+			found := false
+			for _, turn := range history {
+				if containsFold(turn.Text, want) {
+					found = true
+					break
+				}
+			}
+			if !found {
+				return "", fmt.Errorf("simulator: chat history for %q does not contain %q: %+v",
+					truncateRunes(utterance, 60), want, history)
+			}
+		}
 		return chatReplyText(e.Reply), nil
 	}
 	return "", fmt.Errorf("simulator: no scripted chat reply for %q", truncateRunes(utterance, 60))

cmd/mavend/telegramintake.go

@@ -25,7 +25,7 @@ import (
 // already failed the boot in wireDispatcher for the same config, so a second
 // hard failure would only lose that message.
 func wireTelegramIntake(ctx context.Context, wg *sync.WaitGroup, api ipc.CoreAPI, cfg *config.Config) {
-	if cfg == nil || cfg.Telegram == nil || !cfg.Telegram.Intake || api == nil {
+	if cfg == nil || cfg.Telegram == nil || cfg.Telegram.Disabled || !cfg.Telegram.Intake || api == nil {
 		return
 	}
 	sink, err := telegramsink.New(*cfg.Telegram)

cmd/mavend/testdata/personal_boundary_v1.json

@@ -0,0 +1,521 @@
+{
+  "schema_version": 1,
+  "name": "personal_boundary_v1",
+  "notes": [
+    "Held-out personal-boundary fixture for V-702. Cases are not production seeds and the fixture test enforces that after case folding and punctuation removal.",
+    "The matrix is balanced: three cases for every stratum × language × expected side cell (6 × 2 × 2 × 3 = 72).",
+    "Personal means that only the owner's local data can answer. World means that an outside knowledge source can answer even when the wording uses first person or possession.",
+    "Public subjects are deliberately varied. No case repeats the Baikal regression or changes only its place name."
+  ],
+  "cases": [
+    {
+      "id": "pb-ru-remembered-personal-01",
+      "utterance": "что я раньше говорил насчёт бессонницы?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-personal-02",
+      "utterance": "помнишь, какие причины увольнения я называл?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-personal-03",
+      "utterance": "упоминал ли я, куда хочу переехать?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-world-01",
+      "utterance": "что Чехов говорил о краткости?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-world-02",
+      "utterance": "какие причины кризиса называли экономисты?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-ru-remembered-world-03",
+      "utterance": "что свидетели рассказывали об извержении Кракатау?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-personal-01",
+      "utterance": "what was it I told you about changing careers?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-personal-02",
+      "utterance": "have I ever mentioned where I studied?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-personal-03",
+      "utterance": "do you remember which camera I said I preferred?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-world-01",
+      "utterance": "what did Marie Curie write about radium?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-world-02",
+      "utterance": "which causes of inflation do economists usually mention?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+    {
+      "id": "pb-en-remembered-world-03",
+      "utterance": "what did the Apollo astronauts report about lunar dust?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "remembered_speech"
+    },
+
+    {
+      "id": "pb-ru-possession-personal-01",
+      "utterance": "какой номер у моего страхового полиса?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-personal-02",
+      "utterance": "где я оставил свои запасные ключи?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-personal-03",
+      "utterance": "до какого числа действует мой абонемент?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-world-01",
+      "utterance": "как убрать царапину с моего стола?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-world-02",
+      "utterance": "почему у меня запотевают окна зимой?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-ru-possession-world-03",
+      "utterance": "чем зарядить мой телефон в поездке?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-personal-01",
+      "utterance": "when does my library card expire?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-personal-02",
+      "utterance": "where did I put my passport copy?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-personal-03",
+      "utterance": "what size are my hiking boots?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-world-01",
+      "utterance": "how can I descale my kettle safely?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-world-02",
+      "utterance": "why does my laptop fan get loud under load?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "possession"
+    },
+    {
+      "id": "pb-en-possession-world-03",
+      "utterance": "which adapter should I use for my phone abroad?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "possession"
+    },
+
+    {
+      "id": "pb-ru-narrative-personal-01",
+      "utterance": "напомни историю о том, как я познакомился с Антоном",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-personal-02",
+      "utterance": "расскажи, что со мной случилось в первый день на новой работе",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-personal-03",
+      "utterance": "восстанови по моим заметкам историю поездки в Казань",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-world-01",
+      "utterance": "опиши восхождение на Эверест",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-world-02",
+      "utterance": "расскажи историю создания языка Rust",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-ru-narrative-world-03",
+      "utterance": "объясни, как возникли кольца Сатурна",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-personal-01",
+      "utterance": "retell the story of how I met Lena from what I told you",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-personal-02",
+      "utterance": "walk me through what happened on my first day at university",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-personal-03",
+      "utterance": "reconstruct my Prague trip from my notes",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-world-01",
+      "utterance": "tell me the story of the first Moon landing",
+      "lang": "en",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-world-02",
+      "utterance": "describe how the printing press spread through Europe",
+      "lang": "en",
+      "want": "world",
+      "stratum": "narrative"
+    },
+    {
+      "id": "pb-en-narrative-world-03",
+      "utterance": "explain how the Panama Canal was built",
+      "lang": "en",
+      "want": "world",
+      "stratum": "narrative"
+    },
+
+    {
+      "id": "pb-ru-preamble-personal-01",
+      "utterance": "если помнишь наш разговор, что я решил насчёт переезда?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-personal-02",
+      "utterance": "как я уже упоминал, когда мне продлевать страховку?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-personal-03",
+      "utterance": "возвращаясь к тому, что я рассказывал, какую модель велосипеда я выбрал?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-world-01",
+      "utterance": "как я уже говорил, почему самолёты оставляют белый след?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-world-02",
+      "utterance": "возвращаясь к моему вопросу, из чего состоит базальт?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-ru-preamble-world-03",
+      "utterance": "я, возможно, повторяюсь, но когда построили Колизей?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-personal-01",
+      "utterance": "as I mentioned earlier, which dentist did I choose?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-personal-02",
+      "utterance": "coming back to what I told you, when am I taking leave?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-personal-03",
+      "utterance": "I may have said this already, which Linux distro did I settle on?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-world-01",
+      "utterance": "as I was saying, why do tides happen?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-world-02",
+      "utterance": "coming back to my question, how are auroras formed?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+    {
+      "id": "pb-en-preamble-world-03",
+      "utterance": "I may be repeating myself, when was Machu Picchu built?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "first_person_preamble"
+    },
+
+    {
+      "id": "pb-ru-advice-personal-01",
+      "utterance": "что из моих дел нужно закончить до пятницы?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-personal-02",
+      "utterance": "какое лекарство врач велел мне принимать утром?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-personal-03",
+      "utterance": "сколько денег я потратил на продукты в этом месяце?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-world-01",
+      "utterance": "как безопасно заменить розетку?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-world-02",
+      "utterance": "какая сейчас версия Debian stable?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-ru-advice-world-03",
+      "utterance": "что сегодня происходит на мировых рынках?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-personal-01",
+      "utterance": "which of my tasks is due before Friday?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-personal-02",
+      "utterance": "what dosage did my doctor tell me to take at breakfast?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-personal-03",
+      "utterance": "how much did I spend on groceries this month?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-world-01",
+      "utterance": "how should I clean a cast-iron pan?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-world-02",
+      "utterance": "what is the current stable release of PostgreSQL?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+    {
+      "id": "pb-en-advice-world-03",
+      "utterance": "which major elections are happening this month?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "advice_current_info"
+    },
+
+    {
+      "id": "pb-ru-proper-personal-01",
+      "utterance": "что я записал после доклада Линуса Торвальдса?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-personal-02",
+      "utterance": "какое мнение я высказал о фильмах Куросавы?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-personal-03",
+      "utterance": "когда у меня билеты на концерт Земфиры?",
+      "lang": "ru",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-world-01",
+      "utterance": "кто такой Алан Тьюринг?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-world-02",
+      "utterance": "чем известна Фрида Кало?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-ru-proper-world-03",
+      "utterance": "когда родился Юрий Гагарин?",
+      "lang": "ru",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-personal-01",
+      "utterance": "what notes did I make after Grace Hopper's talk?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-personal-02",
+      "utterance": "which David Bowie album did I say I liked most?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-personal-03",
+      "utterance": "when are my tickets for the Radiohead show?",
+      "lang": "en",
+      "want": "personal",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-world-01",
+      "utterance": "who was Katherine Johnson?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-world-02",
+      "utterance": "what is Antoni Gaudí famous for?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    },
+    {
+      "id": "pb-en-proper-world-03",
+      "utterance": "when was Nelson Mandela born?",
+      "lang": "en",
+      "want": "world",
+      "stratum": "public_proper_nouns"
+    }
+  ]
+}

cmd/mavend/testdata/scenarios/conversation_anaphora.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "name": "conversation_anaphora",
-  "description": "Five consecutive Russian turns about one object, replayed from the run that found V-542 on the box on 05-08-2026. He names a monitor, then asks four questions that all say \"он\" and never name it again.\n\nThis scenario exists because the shape had nowhere to fail. The routing fixture scores one utterance at a time, so a conversation that breaks on its second turn cannot lose a point there, and V-44 step 2 could only be verified by hand. That is item 3 of V-542.\n\nFour of the five replies below are WRONG, and the assertions pin them anyway. Read them as the recorded defect rather than the contract: she has the last four turns in front of her and never once names the thing he is asking about. Every wrong assertion is marked in its step note with what it must become. When V-542 lands, those flip and the ones marked correct do not move.\n\nWhat the four assert is that the reply LACKS \"монитор\". Absence is the defect itself: she is answering a question about a thing she wrote down two minutes ago and cannot name it. It also survives the fallback picker, which matters on the three query turns — they refuse from internal/phraser/fallbacks_ru_v1.json, four variants deep, and the same scenario returned \"тут я пас.\" one run and \"не знаю, честно.\" the next, so a string assertion there would pin the picker rather than the daemon.\n\nTurn 4 asserts its text as well, because that turn goes through the chat path and the chat path is now scriptable. scriptedPhraser in simulator_test.go answers PhraseChat from the same script entries the router reads (V-542 item 4); before it, the simulator wired phraser.NewStub() and no scenario could say what she SAYS on a chat turn at all.\n\nThe routes are scripted exactly as the box produced them, because the failure is not the model's. Turn 1 went to fact despite \"давай поболтаем\", every question after it went to query, and turn 4 went to chat. A scripted route is what lets this scenario pin the daemon's half without a llama-server in the loop.",
+  "description": "Five consecutive Russian turns about one object, replayed from the run that found V-542 on the box on 05-08-2026. He names a monitor once, then refers to it by pronoun or ellipsis for four turns.\n\nThe router decisions stay exactly as the box produced them: fact, query, query, chat, query. That is intentional. Routing sees one utterance; dialogue continuity owns what earlier turns make it mean. A grounded fact inside an explicit conversational opener is still stored, while its exact utterance also enters the transcript. Anaphoric queries are answered through chat with that transcript instead of walking note and world sources without their referent.\n\nEvery scripted chat answer below is conditional on history containing the original monitor turn. A canned reply therefore cannot make this scenario pass if session capture, cross-intent merge, history ordering or PhraseChat wiring loses the referent. The visible assertions require the answer to name the monitor, and the final tick remains the not-a-nag control.",
   "start": "2026-08-05T14:00:00+03:00",
   "script": [
     {
@@ -11,20 +11,27 @@
     },
     {
       "match": "он большой",
-      "route": "[{\"intent\":\"query\",\"text\":\"а он большой?\"}]"
+      "route": "[{\"intent\":\"query\",\"text\":\"а он большой?\"}]",
+      "reply": "{\"response\":\"Ты про новый монитор; диагональ ты пока не называл.\",\"mood\":\"neutral\"}",
+      "history_contains": ["купил новый монитор"]
     },
     {
       "match": "сколько он примерно стоит",
-      "route": "[{\"intent\":\"query\",\"text\":\"сколько он примерно стоит по-твоему?\"}]"
+      "route": "[{\"intent\":\"query\",\"text\":\"сколько он примерно стоит по-твоему?\"}]",
+      "reply": "{\"response\":\"Новый монитор без модели и диагонали я честно не оценю.\",\"mood\":\"thinking\"}",
+      "history_contains": ["купил новый монитор"]
     },
     {
       "match": "переплатил",
       "route": "[{\"intent\":\"chat\",\"text\":\"мне кажется я переплатил\"}]",
-      "reply": "{\"response\":\"я не знаю, о каком именно устройстве ты говоришь.\",\"mood\":\"neutral\"}"
+      "reply": "{\"response\":\"Про новый монитор поняла; цену лучше сравнить по точной модели.\",\"mood\":\"thinking\"}",
+      "history_contains": ["купил новый монитор"]
     },
     {
       "match": "стоит его вернуть",
-      "route": "[{\"intent\":\"query\",\"text\":\"стоит его вернуть?\"}]"
+      "route": "[{\"intent\":\"query\",\"text\":\"стоит его вернуть?\"}]",
+      "reply": "{\"response\":\"Новый монитор стоит вернуть, если сравнение подтвердит переплату или он тебе не подходит.\",\"mood\":\"neutral\"}",
+      "history_contains": ["купил новый монитор"]
     },
     {
       "match": "",
@@ -35,43 +42,42 @@
   "steps": [
     {
       "at": "14:00",
-      "note": "CORRECT, and it is the first half of the defect. \"давай поболтаем\" is an explicit request to converse and the turn is filed as a fact anyway. Storing what he said is not wrong on its own — he did buy a monitor — but the object then lives in the fact store and never enters the transcript PhraseChat reads. That is V-542 decision 2: either the marker claims the turn at stage 0, or it means nothing and comes out of the fixture.",
+      "note": "A substantive statement inside an explicit conversational opener remains a grounded fact, and the exact same utterance becomes dialogue context. Conversation is session state, not a competing storage intent.",
       "say": "давай поболтаем: я вчера купил новый монитор",
       "expect_events": ["purchase"],
       "expect_no_send": true
     },
     {
       "at": "14:01",
-      "note": "WRONG. \"он\" is the monitor from one turn ago, and she says she has no record of it. followUpMerge inherits prev.Slots.Key, and a query turn asking about a pronoun has no key to merge, so the question reaches the query sources naked and the notes source answers the only way it can. Must become: an answer about the monitor, or a route to chat where the transcript is.",
+      "note": "The query route cannot see earlier turns. The dialogue merge sees the anaphora and answers through chat with the transcript, which names the monitor.",
       "say": "а он большой?",
-      "expect_reply_lacks": ["монитор"],
+      "expect_reply_contains": ["монитор"],
       "expect_no_send": true
     },
     {
       "at": "14:02",
-      "note": "WRONG, and it rules out one explanation. This is not the previous turn failing to stick — it is the same wall a second time, two turns from where the monitor was named. Nothing accumulates across query turns.",
+      "note": "The referent survives a second routed-query boundary; the previous contextual turn did not replace the transcript anchor.",
       "say": "сколько он примерно стоит по-твоему?",
-      "expect_reply_lacks": ["монитор"],
+      "expect_reply_contains": ["монитор"],
       "expect_no_send": true
     },
     {
       "at": "14:03",
-      "note": "WRONG, and it is the same wall from the other side. This turn routed chat, so it HAD the history that Session.History holds, and it asks which device he means anyway — because turn 1's object went to the fact store rather than the transcript. So a source reading the conversation is not sufficient on its own; decision 1 has to say which store the referent comes from. This is the one step whose text is pinned: the reply is scripted and reaches PhraseChat, so it is the box's own words rather than a fallback pick. Must become: a reply that names the monitor.",
+      "note": "A native chat route reads the same cross-intent transcript, in chronological order, without receiving the current utterance twice.",
       "say": "мне кажется я переплатил",
-      "expect_reply_contains": ["о каком именно устройстве"],
-      "expect_reply_lacks": ["монитор"],
+      "expect_reply_contains": ["монитор"],
       "expect_no_send": true
     },
     {
       "at": "14:04",
-      "note": "WRONG. The fifth turn is the one that shows the cost. A returns question about a purchase two minutes old is answered with \"не нашла у тебя такой записи\", which is wrong in kind rather than merely unhelpful: the record exists, she wrote it herself at 14:00 under the key purchase.",
+      "note": "The fifth turn proves the oldest retained turn still supplies the referent after fact, query and chat crossings.",
       "say": "стоит его вернуть?",
-      "expect_reply_lacks": ["монитор"],
+      "expect_reply_contains": ["монитор"],
       "expect_no_send": true
     },
     {
       "at": "14:05",
-      "note": "CORRECT, and it is the control. Nothing in five conversational turns was sent at him unprompted, and a tick with him mid-conversation stays silent. Whatever V-542 changes must not change this.",
+      "note": "Control: session continuity is reactive state only. A tick during the conversation sends nothing unprompted.",
       "tick": true,
       "expect_no_send": true
     }

cmd/mavend/tick.go

@@ -10,11 +10,13 @@ package main
 
 import (
 	"context"
+	"crypto/sha256"
 	"errors"
 	"fmt"
 	"log"
 	"os"
 	"path/filepath"
+	"sort"
 	"sync"
 	"time"
 
@@ -226,18 +228,11 @@ func (t *tickLoop) tick(ctx context.Context, now time.Time) {
 	// detectPatterns below for how idempotence and dismissal are respected.
 	t.detectPatterns(ctx, now, state)
 
-	// reminders: gate-bypassing class. fired once, marked after a successful
-	// delivery.  a failed send leaves the reminder pending — the next tick
-	// re-gathers and re-attempts.
+	// reminders: gate-bypassing class. The presentation and retry clock live on
+	// the reminder occurrence, so a transport outage neither spends the model
+	// every tick nor changes what the reminder says after a restart.
 	for _, d := range loop.RemindDecisions(state, due) {
-		pr, err := t.phraser.PhraseReminder(ctx, d)
-		if err != nil {
-			log.Printf("tick: phrase reminder %d: %v", d.Reminder.ID, err)
-			continue
-		}
-		if _, err := t.dispatcher.DispatchReminder(ctx, pr, now); err != nil {
-			log.Printf("tick: dispatch reminder %d: %v", d.Reminder.ID, err)
-		}
+		t.deliverReminder(ctx, d, now)
 	}
 
 	// sev4-away repeats: re-send un-acked telegram nudges per repeatInterval.
@@ -263,6 +258,125 @@ func (t *tickLoop) tick(ctx context.Context, now time.Time) {
 	}
 }
 
+// deliverReminder advances one due reminder (or collapsed bundle) through the
+// durable delivery state. A phrase is cached before the first external send;
+// every definite failure advances the persisted bounded backoff.
+func (t *tickLoop) deliverReminder(ctx context.Context, d loop.ReminderDecision, now time.Time) {
+	originals := reminderOriginals(d.Reminder)
+	pr, cached := cachedReminderPhrase(d, originals)
+	if !cached {
+		var err error
+		pr, err = t.phraser.PhraseReminder(ctx, d)
+		if err == nil && pr.Body == "" {
+			err = errors.New("phraser returned an empty reminder body")
+		}
+		if err != nil {
+			log.Printf("tick: phrase reminder %d: %v", d.Reminder.ID, err)
+			t.scheduleReminderRetry(ctx, originals, now)
+			return
+		}
+		if pr.Mood == "" {
+			pr.Mood = "neutral"
+		}
+		group := reminderDeliveryGroup(originals)
+		if err := t.store.CacheReminderPhrase(
+			ctx, originals, group, pr.Body, pr.Summary, pr.Mood,
+		); err != nil {
+			// A cancellation or another completion can win while phrasing. Do
+			// not send a presentation that no longer owns every original.
+			log.Printf("tick: cache reminder %d phrase: %v", d.Reminder.ID, err)
+			return
+		}
+		// The store now owns the phrase, but this tick's value predates that
+		// write. Stamp the exact persisted occurrence identity onto the value
+		// handed to the dispatcher so its outbox row can suppress an ambiguous
+		// crash for both a real reminder and a synthetic collapsed bundle.
+		for i := range originals {
+			originals[i].DeliveryGroup = group
+			originals[i].PhraseBody = pr.Body
+			originals[i].PhraseSummary = pr.Summary
+			originals[i].PhraseMood = pr.Mood
+		}
+		if d.Reminder.ID == 0 {
+			d.Reminder.Collapsed = originals
+		} else {
+			d.Reminder = originals[0]
+		}
+	}
+	// A phraser is not allowed to substitute the reminder decision. In
+	// particular, the durable group stamped above must reach the outbox.
+	pr.Decision = d
+
+	if _, err := t.dispatcher.DispatchReminder(ctx, pr, now); err != nil {
+		log.Printf("tick: dispatch reminder %d: %v", d.Reminder.ID, err)
+		t.scheduleReminderRetry(ctx, originals, now)
+	}
+}
+
+func (t *tickLoop) scheduleReminderRetry(ctx context.Context, originals []store.Reminder, now time.Time) {
+	if err := t.store.ScheduleReminderRetry(ctx, originals, now); err != nil {
+		log.Printf("tick: schedule reminder retry: %v", err)
+	}
+}
+
+// reminderOriginals converts the synthetic ID=0 bundle back to real store
+// rows. Keeping this in one helper makes it impossible to accidentally persist
+// retry state against reminder zero.
+func reminderOriginals(r store.Reminder) []store.Reminder {
+	if r.ID == 0 {
+		return append([]store.Reminder(nil), r.Collapsed...)
+	}
+	return []store.Reminder{r}
+}
+
+// cachedReminderPhrase reconstructs a PhrasedReminder only when every original
+// agrees on one persisted group and presentation. That agreement is what lets
+// a collapsed bundle survive a restart without being re-phrased.
+func cachedReminderPhrase(d loop.ReminderDecision, originals []store.Reminder) (delivery.PhrasedReminder, bool) {
+	if len(originals) == 0 || !originals[0].HasDeliveryPhrase() {
+		return delivery.PhrasedReminder{}, false
+	}
+	first := originals[0]
+	for _, r := range originals[1:] {
+		if !r.HasDeliveryPhrase() ||
+			r.DeliveryGroup != first.DeliveryGroup ||
+			r.PhraseBody != first.PhraseBody ||
+			r.PhraseSummary != first.PhraseSummary ||
+			r.PhraseMood != first.PhraseMood {
+			return delivery.PhrasedReminder{}, false
+		}
+	}
+	mood := first.PhraseMood
+	if mood == "" {
+		mood = "neutral"
+	}
+	return delivery.PhrasedReminder{
+		Decision: d,
+		Body:     first.PhraseBody,
+		Summary:  first.PhraseSummary,
+		Mood:     mood,
+	}, true
+}
+
+// reminderDeliveryGroup deterministically names one occurrence or collapsed
+// set. The next-fire instant is part of the identity so a recurring reminder's
+// later occurrence can never inherit the previous occurrence's phrase.
+func reminderDeliveryGroup(originals []store.Reminder) string {
+	ordered := append([]store.Reminder(nil), originals...)
+	sort.Slice(ordered, func(i, j int) bool {
+		if ordered[i].ID == ordered[j].ID {
+			return ordered[i].NextFireTs.Before(ordered[j].NextFireTs)
+		}
+		return ordered[i].ID < ordered[j].ID
+	})
+	h := sha256.New()
+	for _, r := range ordered {
+		_, _ = fmt.Fprintf(h, "%d:%d;", r.ID, r.NextFireTs.UnixMilli())
+	}
+	sum := h.Sum(nil)
+	return fmt.Sprintf("reminder:%x", sum[:12])
+}
+
 // savePresence writes back the bucket GatherState just resolved.
 //
 // It lives here and not in GatherState because that method holds a read-only

cmd/mavend/tick_digest.go

@@ -125,12 +125,10 @@ const maxDigestSpokenItems = 3
 
 // enqueueSuppressedDigest scans this tick's trace for care candidates the
 // gate blocked for a genuine restraint reason and durably records the
-// digest-eligible ones (loop.DigestEligible). Phrasing happens once, here,
-// at enqueue time — not re-derived at drain time — the same way queueNudge
-// phrases once and caches, so a rule suppressed for hours isn't re-prompting
-// the LLM every tick it stays blocked (EnqueueDigestEntry's rule+body dedupe
-// makes repeat calls here harmless, but skipping the phrase call entirely
-// when a pending entry already exists avoids the LLM round-trip too).
+// digest-eligible ones (loop.DigestEligible). Before phrasing, the candidate's
+// rule-owned semantic fingerprint is checked against the durable queue. This
+// is intentionally not a prose hash or an in-memory cache: phrasing may vary,
+// and the first tick after a restart owes the same zero-model-work behavior.
 func (t *tickLoop) enqueueSuppressedDigest(ctx context.Context, trace *loop.TickTrace, state loop.State, now time.Time) {
 	if trace == nil {
 		return
@@ -142,7 +140,24 @@ func (t *tickLoop) enqueueSuppressedDigest(ctx context.Context, trace *loop.Tick
 		if !loop.DigestEligible(tr.Severity, tr.GateBlockedBy) {
 			continue
 		}
-		rule := loop.Rule{Name: tr.RuleName, Severity: tr.Severity}
+		rule, ok := t.ruleNamed(tr.RuleName)
+		if !ok {
+			log.Printf("tick: digest candidate %s has no configured rule", tr.RuleName)
+			continue
+		}
+		fingerprint, ok := loop.DigestCandidateFingerprint(rule, state)
+		if !ok {
+			log.Printf("tick: digest candidate %s has no semantic identity", tr.RuleName)
+			continue
+		}
+		if _, live, err := t.store.LiveDigestEntry(ctx, tr.RuleName, fingerprint, now); err != nil {
+			// If durable state cannot answer, do not spend model work whose
+			// result cannot be safely deduplicated or recorded.
+			log.Printf("tick: check digest candidate %s: %v", tr.RuleName, err)
+			continue
+		} else if live {
+			continue
+		}
 		cand := loop.Candidate{Rule: rule, Severity: tr.Severity, State: state}
 		pn, err := t.phraser.PhraseNudge(ctx, cand)
 		if err != nil {
@@ -150,15 +165,21 @@ func (t *tickLoop) enqueueSuppressedDigest(ctx context.Context, trace *loop.Tick
 			continue
 		}
 		expires := now.Add(digestExpiry)
-		if _, deduped, err := t.store.EnqueueDigestEntry(ctx, tr.RuleName, int(tr.Severity), pn.Body, now, expires); err != nil {
+		if _, _, err := t.store.EnqueueDigestEntry(ctx, tr.RuleName, fingerprint, int(tr.Severity), pn.Body, now, expires); err != nil {
 			log.Printf("tick: enqueue digest entry %s: %v", tr.RuleName, err)
-		} else if deduped {
-			// same suppressed nudge already pending — nothing new to say.
-			continue
 		}
 	}
 }
 
+func (t *tickLoop) ruleNamed(name string) (loop.Rule, bool) {
+	for _, rule := range t.rules {
+		if rule.Name == name {
+			return rule, true
+		}
+	}
+	return loop.Rule{}, false
+}
+
 // expireStaleDigest sweeps entries past their expiry once per tick — cheap
 // bookkeeping, mirrors ReconcileStaleDeliveryAttempts's shape.
 func (t *tickLoop) expireStaleDigest(ctx context.Context, now time.Time) {

cmd/mavend/tick_reminder_delivery_test.go

@@ -0,0 +1,170 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/delivery"
+	"github.com/kami/maven/internal/loop"
+	"github.com/kami/maven/internal/phraser"
+	"github.com/kami/maven/internal/store"
+)
+
+type reminderCountingPhraser struct {
+	phraser.Phraser
+	calls   int
+	body    string
+	summary string
+	mood    string
+}
+
+func (p *reminderCountingPhraser) PhraseReminder(_ context.Context, d loop.ReminderDecision) (delivery.PhrasedReminder, error) {
+	p.calls++
+	return delivery.PhrasedReminder{
+		Decision: d,
+		Body:     p.body,
+		Summary:  p.summary,
+		Mood:     p.mood,
+	}, nil
+}
+
+type reminderFailSink struct {
+	sends int
+}
+
+func (s *reminderFailSink) Send(_ context.Context, _ delivery.Sendable) error {
+	s.sends++
+	return errors.New("transport unavailable")
+}
+
+func newReminderDeliveryLoop(t *testing.T, st *store.Store, sink delivery.Sink, p phraser.Phraser) *tickLoop {
+	t.Helper()
+	rules := loop.DefaultRules()
+	return newTickLoop(
+		st,
+		loop.NewGatherer(st, rules),
+		delivery.NewDispatcher(delivery.Config{
+			Voice: sink, Ntfy: sink, Telegram: sink,
+			Nudges: st, Reminders: st, Outbox: st,
+		}),
+		p,
+		rules,
+		time.Second,
+		5*time.Minute,
+		0,
+		nil, nil, nil, nil,
+	)
+}
+
+func TestTickReminderRetryUsesPersistedPhraseAfterRestart(t *testing.T) {
+	st := newTestStore(t)
+	ctx := context.Background()
+	now := refNow()
+	if _, err := st.CreateReminder(ctx, now.Add(-time.Minute), `{"text":"позвонить маме"}`, ""); err != nil {
+		t.Fatal(err)
+	}
+
+	fail := &reminderFailSink{}
+	firstPhraser := &reminderCountingPhraser{
+		Phraser: phraser.NewStub(), body: "Не забудь позвонить маме.",
+		summary: "Позвонить маме", mood: "warm",
+	}
+	tl := newReminderDeliveryLoop(t, st, fail, firstPhraser)
+	tl.tick(ctx, now)
+	if firstPhraser.calls != 1 {
+		t.Fatalf("first tick phrased %d times, want 1", firstPhraser.calls)
+	}
+	rows, err := st.ListReminders(ctx, 1)
+	if err != nil || len(rows) != 1 {
+		t.Fatalf("list = %d, err=%v", len(rows), err)
+	}
+	if !rows[0].HasDeliveryPhrase() || rows[0].DeliveryAttempts != 1 {
+		t.Fatalf("failed delivery state was not persisted: %+v", rows[0])
+	}
+	if want := now.Add(store.ReminderRetryBase); !rows[0].NextAttemptTs.Equal(want) {
+		t.Fatalf("next attempt = %s, want %s", rows[0].NextAttemptTs, want)
+	}
+
+	// A normal tick inside the wait does no transport work and no model work.
+	sendsAfterFirst := fail.sends
+	tl.tick(ctx, now.Add(30*time.Second))
+	if firstPhraser.calls != 1 || fail.sends != sendsAfterFirst {
+		t.Fatalf("retry wait did work: phrase calls=%d, sends=%d (was %d)", firstPhraser.calls, fail.sends, sendsAfterFirst)
+	}
+
+	// Constructing a new loop is the daemon-restart boundary. Its phraser would
+	// say something different if called; the stored phrase must win instead.
+	success := &fakeSink{}
+	afterRestart := &reminderCountingPhraser{
+		Phraser: phraser.NewStub(), body: "WRONG NEW PHRASE", summary: "WRONG", mood: "neutral",
+	}
+	restarted := newReminderDeliveryLoop(t, st, success, afterRestart)
+	restarted.tick(ctx, now.Add(store.ReminderRetryBase))
+	if afterRestart.calls != 0 {
+		t.Fatalf("restart re-phrased the reminder %d times", afterRestart.calls)
+	}
+	if len(success.sends) != 1 {
+		t.Fatalf("retry sends = %d, want 1", len(success.sends))
+	}
+	if got := success.sends[0].Body; got != "Позвонить маме" {
+		t.Fatalf("away retry body = %q, want persisted summary", got)
+	}
+	rows, err = st.ListReminders(ctx, 1)
+	if err != nil || rows[0].Status != store.ReminderFired {
+		t.Fatalf("successful retry did not fire reminder: rows=%+v err=%v", rows, err)
+	}
+}
+
+func TestTickCollapsedReminderRetriesOnePhraseAndCompletesOriginals(t *testing.T) {
+	st := newTestStore(t)
+	ctx := context.Background()
+	now := refNow()
+	for _, text := range []string{"полить цветы", "записаться к врачу"} {
+		if _, err := st.CreateReminder(ctx, now.Add(-time.Minute), text, ""); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	fail := &reminderFailSink{}
+	firstPhraser := &reminderCountingPhraser{
+		Phraser: phraser.NewStub(), body: "У тебя два напоминания.",
+		summary: "Два напоминания", mood: "neutral",
+	}
+	newReminderDeliveryLoop(t, st, fail, firstPhraser).tick(ctx, now)
+	if firstPhraser.calls != 1 {
+		t.Fatalf("collapsed bundle phrased %d times, want 1", firstPhraser.calls)
+	}
+	rows, err := st.ListReminders(ctx, 10)
+	if err != nil || len(rows) != 2 {
+		t.Fatalf("list = %d, err=%v", len(rows), err)
+	}
+	for _, r := range rows {
+		if r.DeliveryGroup == "" || r.DeliveryGroup != rows[0].DeliveryGroup ||
+			r.PhraseBody != "У тебя два напоминания." || r.DeliveryAttempts != 1 {
+			t.Fatalf("collapsed original lost shared state: %+v", r)
+		}
+	}
+
+	success := &fakeSink{}
+	afterRestart := &reminderCountingPhraser{
+		Phraser: phraser.NewStub(), body: "WRONG", summary: "WRONG", mood: "neutral",
+	}
+	newReminderDeliveryLoop(t, st, success, afterRestart).tick(ctx, now.Add(store.ReminderRetryBase))
+	if afterRestart.calls != 0 {
+		t.Fatalf("collapsed retry re-phrased %d times", afterRestart.calls)
+	}
+	if len(success.sends) != 1 || success.sends[0].ReminderID != 0 {
+		t.Fatalf("collapsed retry sends = %+v, want one synthetic delivery", success.sends)
+	}
+	rows, err = st.ListReminders(ctx, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range rows {
+		if r.Status != store.ReminderFired {
+			t.Fatalf("collapsed original %d status = %q, want fired", r.ID, r.Status)
+		}
+	}
+}

cmd/mavend/voice.go

@@ -260,8 +260,9 @@ const (
 )
 
 // runTurn — the reactive turn pipeline shared by the voice and text entry
-// points: expired-clarify notice → confirm answer → clarify answer → quiet
-// toggle → route → dialogue merge → clarify question → action → replier.
+// points: expired-clarify notice → confirm answer → explicit correction →
+// clarify answer → quiet toggle → route → dialogue merge → clarify question →
+// action → replier.
 // Takes the already-transcribed utterance, returns the reply text; the voice
 // path wraps it in stt/tts, the text path returns it as-is.
 //
@@ -290,6 +291,14 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	now := h.now()
 	rt := h.newTurnRoute(text, now)
 	ctx = withTurnRoute(ctx, rt)
+	// A resolver may suspend an older clarify flow even when it handles this
+	// turn itself. Finalise that state at one choke point so early returns from
+	// confirm/repair/clarify cannot leave a live question parked without saying
+	// it again, or silently drop one when the suspension bound is reached.
+	defer func() {
+		reply = withNotice(rt.dropped, reply)
+		reply = withResumed(reply, rt.resume)
+	}()
 
 	// 1. expired clarify — a question was parked but its TTL ran out, so the
 	// request behind it is gone. Say that out loud (see clarify.go) and carry
@@ -310,7 +319,23 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 3. clarify answer — if she asked a live question last turn, this
+	// 3. spoken correction — an explicit "нет, это был вопрос" names both the
+	// prior mistake and its replacement. It is narrower evidence than a parked
+	// question merely being present, so it gets first refusal. Otherwise the
+	// clarify resolver treats the correction as a bad slot value and spends a
+	// retry on a turn that was never an answer (V-573).
+	if reply, handled := h.resolveRepair(ctx, text); notePreRoute(ctx, "repair", handled) {
+		return withNotice(expiredNotice, reply)
+	}
+
+	// 3b. The same correction without a target — "нет, не так". It cannot redo
+	// the turn, but it can durably label the previous decision as wrong. Like a
+	// targeted repair, it is not an answer to a parked slot question.
+	if reply, handled := h.resolveUntargetedRepair(ctx, text); notePreRoute(ctx, "repair-negative", handled) {
+		return withNotice(expiredNotice, reply)
+	}
+
+	// 4. clarify answer — if she asked a live question last turn, this
 	// utterance is its answer, not a fresh command. After the confirm check: a
 	// y/n gate is armed by her own prompt and is the narrower claim on the
 	// utterance.
@@ -321,20 +346,10 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	if reply, handled := h.resolveClarifyAnswer(ctx, text); notePreRoute(ctx, "clarify-answer", handled) {
 		return withNotice(expiredNotice, reply)
 	}
-	// It did not claim the turn. If it let a parked request go to get out of the
-	// way, that has to be said in front of whatever these words are answered
-	// with — carried on the same notice, so every exit below keeps it.
-	expiredNotice = withNotice(expiredNotice, rt.dropped)
+	// It did not claim the turn. Any drop notice or resumed question recorded on
+	// rt is attached by the turn finaliser above, including on an early return.
 
-	// 3b. and if it SUSPENDED a request instead of letting it go, the question
-	// comes back on the end of whatever these words are answered with (Vikunja
-	// #561). A deferred append rather than a call at each exit: there are eight
-	// returns between here and the replier, and the flow has to survive all of
-	// them — one that forgot would be a request parked for ever, waiting for an
-	// answer to a question he never heard asked.
-	defer func() { reply = withResumed(reply, rt.resume) }()
-
-	// 4. quiet-hours toggle — keyword match, not classifier-dependent.
+	// 5. quiet-hours toggle — keyword match, not classifier-dependent.
 	// "тихий режим" / "quiet on" would route through the classifier
 	// unreliably (it's a command, not a free-form query), so we match it
 	// before routing. Same pattern as the confirm turn above.
@@ -342,7 +357,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 4b. spoken snooze — "не сейчас" / "потом" answers the nudge she just
+	// 5b. spoken snooze — "не сейчас" / "потом" answers the nudge she just
 	// sent. Only handled when a pending nudge is actually inside the window
 	// (snooze.go); otherwise the words route normally, because "потом" is an
 	// ordinary word and eating every one of them would break real sentences.
@@ -350,30 +365,14 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 4c. spoken ack — "готово" closes that same nudge as `acted`. Only the
+	// 5c. spoken ack — "готово" closes that same nudge as `acted`. Only the
 	// contentless form is intercepted here; "выпил воды" keeps routing and
 	// closes the nudge after its fact lands (ackFromFact, step 8b).
 	if reply, handled := h.resolveAck(ctx, text, src); notePreRoute(ctx, "ack", handled) {
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 4d. spoken correction — "нет, это была заметка" points at the previous
-	// turn and names what it should have been (repair.go). Before routing,
-	// like the confirm and clarify turns: routing the correction as a fresh
-	// utterance files the correction itself instead of fixing anything.
-	if reply, handled := h.resolveRepair(ctx, text); notePreRoute(ctx, "repair", handled) {
-		return withNotice(expiredNotice, reply)
-	}
-
-	// 4d-ii. and the same correction without a target — "нет, не так" (V-636).
-	// After the targeted one, which is the narrower claim: an utterance that
-	// names an intent is answered by redoing the request, and this rung only
-	// gets the ones that name nothing.
-	if reply, handled := h.resolveUntargetedRepair(ctx, text); notePreRoute(ctx, "repair-negative", handled) {
-		return withNotice(expiredNotice, reply)
-	}
-
-	// 4e. ordinal selection — "второй", "первую сделал" pick from the list she
+	// 5d. ordinal selection — "второй", "первую сделал" pick from the list she
 	// just read (ordinal.go). Before routing, and only when a list is actually
 	// bound to the session: with nothing offered, "второй" is an ordinary word
 	// and keeps routing.
@@ -381,7 +380,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, reply)
 	}
 
-	// 5. route. An elliptical follow-up — "а завтра?" — is answered from the
+	// 6. route. An elliptical follow-up — "а завтра?" — is answered from the
 	// previous turn instead (continuation.go): the intent is the part it is
 	// missing, so no amount of routing recovers it, and the model's guess
 	// costs seconds to obtain and is close to a coin flip. Everything else
@@ -398,7 +397,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	}
 	log.Printf("voice: route result: intent=%s slots=%+v", dec.Intent, dec.Slots)
 
-	// 6. dialogue — fill this turn's missing slots from a prior same-intent
+	// 7. dialogue — fill this turn's missing slots from a prior same-intent
 	// turn (follow-ups like «напомни завтра» → «…позвонить маме»), then remember
 	// this turn for the next follow-up. Only same-intent, non-expired, non-
 	// clarify turns carry (see followUpMerge). Best-effort: nil store ⇒ skipped.
@@ -416,7 +415,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		}
 	}
 
-	// 7. clarify — something she needs is missing. If one named thing is missing,
+	// 8. clarify — something she needs is missing. If one named thing is missing,
 	// ask about it and park the request (clarify.go); otherwise the replier's
 	// canned reply stands.
 	//
@@ -443,7 +442,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		h.recordTurn(text, dec.Intent)
 	}
 
-	// 8. action — execute the decision's intent. errors here surface as
+	// 9. action — execute the decision's intent. errors here surface as
 	// short reply text (the user wants to know the action didn't land);
 	// the round-trip stays alive.
 	replyText := h.applyAction(ctx, dec)
@@ -452,11 +451,11 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	// intent has no chain and no scoreboard, so the handler is the winner.
 	noteTerminal(ctx, "action-handler", dec.Intent, "")
 
-	// 8b. a fact that answers a live nudge closes it as `acted` (ack.go).
+	// 9b. a fact that answers a live nudge closes it as `acted` (ack.go).
 	// Silent: the fact reply stands, she does not congratulate him for it.
 	h.ackFromFact(ctx, dec)
 
-	// 9. replier — phrase the reply across the router decision.
+	// 10. replier — phrase the reply across the router decision.
 	if replyText == "" {
 		replyText = h.replier.Reply(ctx, dec)
 	}
@@ -555,10 +554,17 @@ func (h *reactiveHandler) replySystem(ctx context.Context, dec router.Decision)
 // history lists. Shared by chatHistory and rememberTurn (clarify.go) so the
 // same session is described the same way in both places.
 func sessionAsTurn(s *dialogue.Session) dialogue.Turn {
+	text := s.Utterance
+	if text == "" {
+		// Compatibility with a session blob written before Utterance became a
+		// first-class field. Slots.Text was the old transcript by convention
+		// for query/chat/system turns, and is still better than dropping it.
+		text = s.Slots.Text
+	}
 	return dialogue.Turn{
 		Intent: s.Intent,
 		Slots:  s.Slots,
-		Text:   s.Slots.Text,
+		Text:   text,
 	}
 }
 
@@ -574,11 +580,12 @@ func (h *reactiveHandler) chatHistory(ctx context.Context) []dialogue.Turn {
 	if prev == nil {
 		return nil
 	}
-	// History already includes the immediate prior turn (set by the dialogue
-	// merge in runTurn's step 6, above), plus up to 3 more from deeper history.
-	out := make([]dialogue.Turn, 0, 1+len(prev.History))
-	out = append(out, sessionAsTurn(prev))
-	out = append(out, prev.History...)
+	// rememberTurn runs before the action so query handlers can bind candidate
+	// lists to the current session. Therefore prev is the CURRENT turn here;
+	// its History is precisely the prior transcript. Adding sessionAsTurn(prev)
+	// would hand the model the current utterance twice.
+	out := make([]dialogue.Turn, len(prev.History))
+	copy(out, prev.History)
 	return out
 }
 

cmd/mavend/voicewire.go

@@ -377,17 +377,22 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 // degraded mode, so the seam is nil and the cascade routes with the classifier.
 func modelSeam(cfg *config.Config, resident *llm.Client) (router.Completer, *llm.Pair) {
 	if resident == nil {
-		if cfg.Workstation != nil {
+		if cfg.Workstation != nil && !cfg.Workstation.ModelDisabled {
 			log.Printf("voice: a workstation is configured but there is no resident model to floor it with — ignoring the block")
 		}
 		return nil, nil
 	}
-	if cfg.Workstation == nil {
+	if cfg.Workstation == nil || cfg.Workstation.ModelDisabled {
 		return resident, nil
 	}
 	ws := cfg.Workstation
+	remote := llm.New(ws.URL, time.Duration(ws.Timeout))
+	remote.SetToken(ws.Token)
+	if ws.Token == "" {
+		log.Printf("voice: unauthenticated workstation model endpoint is loopback-only")
+	}
 	pair := llm.NewPair(
-		llm.New(ws.URL, time.Duration(ws.Timeout)),
+		remote,
 		resident,
 		ws.Health,
 		time.Duration(ws.Probe),
@@ -429,7 +434,7 @@ func sttSeam(cfg *config.Config, floor stt.Transcriber) (stt.Transcriber, *stt.P
 	)
 	pair.Start(context.Background())
 	if s.Token == "" {
-		log.Print("voice: the workstation transcriber has no token, so anything on the LAN can post audio to it")
+		log.Print("voice: unauthenticated workstation transcriber endpoint is loopback-only")
 	}
 	log.Printf("voice: workstation transcriber at %s, probed every %s, mavsttd as the floor",
 		s.URL, time.Duration(s.Probe))
@@ -464,45 +469,9 @@ func buildRouter(emb router.Embedder, acts router.ActMatcher, threshold float64,
 	llmR *router.LLMRouter, heads *router.RouterHeads) *router.Router {
 	cls := router.NewClassifier(emb)
 	seedClassifier(cls)
-	grammars := router.DefaultGrammars(acts)
-	grammars = append(grammars, router.SystemTimeDateGrammars()...)
-	// After the time/date rules on purpose: "какой сегодня день" is a clock
-	// question and must keep reaching replySystem, while "что у меня сегодня"
-	// is an agenda question and must not.
-	grammars = append(grammars, router.AgendaQueryGrammars()...)
-	// Same reason as the agenda rules, for the feeds: "что нового в лентах?"
-	// routed system and answered "пока не умею" (Vikunja #474).
-	// After the agenda rules, which are the narrower claim, and BEFORE the feed
-	// and list rules, which are not: "что такое лента" is a definition question
-	// and the feed rule would take it on the noun alone (V-655).
-	grammars = append(grammars, router.WorldQueryGrammars()...)
-	grammars = append(grammars, router.FeedQueryGrammar())
-	// The list side of the same exposure: a phrasing with no possessive in it
-	// ("список дел") routed system and never reached queryTasks (Vikunja #467).
-	grammars = append(grammars, router.TaskListGrammar())
-	grammars = append(grammars, router.ListGrammars()...)
-	grammars = append(grammars, router.ReminderGrammar())
-	// Before the capture marker, because "отметь" is a capture verb and "отметь
-	// второй пункт" is not a note. The Praxis rules are the narrower claim — a
-	// lifecycle verb AND an item named — so they get first refusal (Vikunja #516).
-	grammars = append(grammars, router.PraxisGrammars()...)
-	// Last, and it matches any utterance shape — its Build is the filter. An
-	// explicit capture marker beats the model, which called it an act and
-	// rewrote the task text (Vikunja #467). After the rules above because a
-	// marker never collides with a clock or agenda question.
-	// After Praxis, whose bare "закрой" claim this rule cannot reach (it needs the
-	// board noun), and before the capture marker, which would otherwise read
-	// "убери из задач купить молоко" as a new task (Vikunja #512).
-	grammars = append(grammars, router.TaskStatusGrammar())
-	// Before the capture markers, which all need an object. A capture verb
-	// alone is a fact with no key, and the clarify path asks for it rather than
-	// letting the model invent an answer (Vikunja #557).
-	grammars = append(grammars, router.BareCaptureGrammar()...)
-	grammars = append(grammars, router.TaskCaptureGrammar())
-	// After the capture marker, so "запиши" still wins over "расскажи", and
-	// last overall because it matches on the first word alone: "расскажи про
-	// X" is a world question the model called a fact (Vikunja #498).
-	grammars = append(grammars, router.NarrativeQueryGrammars()...)
+	// The stage 0 set, in the router package, so the eval fixture runs the rules
+	// the daemon runs (V-693). Order and reasoning live with the list.
+	grammars := router.StageZeroGrammars(acts)
 	return router.New(router.Config{
 		Grammars:   grammars,
 		Classifier: cls,

cmd/mavgpud/auth.go

@@ -0,0 +1,145 @@
+package main
+
+import (
+	"crypto/sha256"
+	"crypto/subtle"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+)
+
+// The boundary in front of the card.
+//
+// mavgpud has to listen on the LAN, because homesrv is the client and a
+// loopback default takes the model arm down. That makes this the one hop on the
+// workstation anything on the network could reach, and until 2026-08-11 it
+// reverse-proxied every path to llama-server unauthenticated: any client could
+// spend the card, hold the model resident by touching the idle clock, and read
+// /slots, which carries the prompts of whoever else was using it.
+//
+// So: a bearer token every request must carry, read from a file, and a path
+// allowlist so a token that leaks buys the model API and not the admin one. The
+// CW2 transcriber beside this daemon has worked this way since it shipped; this
+// is the same arrangement, not a new one.
+
+// readToken loads the bearer token. The file holds the token and nothing else,
+// trailing newline allowed. A path that is set and unreadable is fatal to the
+// caller: a supervisor that silently ran without its boundary is the failure
+// this exists to prevent.
+func readToken(path string) (string, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("token_file: %w", err)
+	}
+	tok := strings.TrimSpace(string(b))
+	if tok == "" {
+		return "", fmt.Errorf("token_file %s is empty", path)
+	}
+	return tok, nil
+}
+
+// loopbackListen reports whether addr can only be reached from this machine.
+// An empty or wildcard host is not loopback, which is the case that matters:
+// ":8080" is the shipped default and it answers the whole LAN.
+func loopbackListen(addr string) bool {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		host = addr
+	}
+	host = strings.Trim(host, "[]")
+	if host == "" {
+		return false
+	}
+	if host == "localhost" {
+		return true
+	}
+	ip := net.ParseIP(host)
+	return ip != nil && ip.IsLoopback()
+}
+
+// allowed is what a token buys. Everything llama-server exposes beyond this is
+// refused, because the endpoints Maven does not call are the expensive ones to
+// hand out: /slots returns other callers' prompts, and its save/restore actions
+// write files chosen by the request.
+//
+// Adding a caller means adding its path here. That is deliberate — the list is
+// short because Maven's use of the workstation is.
+var allowed = map[string]string{
+	"/v1/chat/completions": http.MethodPost,
+	"/v1/completions":      http.MethodPost,
+	"/v1/embeddings":       http.MethodPost,
+	"/v1/models":           http.MethodGet,
+	"/props":               http.MethodGet,
+}
+
+// requireToken authenticates, then bounds. Order matters: an unauthenticated
+// client must not be able to make this daemon allocate a body buffer.
+//
+// /health is not exempt. It reports whether the card is loaded and free, which
+// is exactly what someone deciding whether to take it from him would ask.
+func requireToken(token string, maxBody int64, next http.Handler) http.Handler {
+	want := sha256.Sum256([]byte(token))
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		got := sha256.Sum256([]byte(bearer(r)))
+		if subtle.ConstantTimeCompare(got[:], want[:]) != 1 {
+			w.Header().Set("WWW-Authenticate", "Bearer")
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		r.Body = http.MaxBytesReader(w, r.Body, maxBody)
+		next.ServeHTTP(w, r)
+	})
+}
+
+// bearer pulls the credential out of the header. A malformed header yields the
+// empty string, which fails the comparison like any other wrong token — there
+// is no separate error for it, because telling a caller *how* it was wrong is
+// the only thing a probe learns from a 401.
+func bearer(r *http.Request) string {
+	h := r.Header.Get("Authorization")
+	const prefix = "Bearer "
+	if len(h) <= len(prefix) || !strings.EqualFold(h[:len(prefix)], prefix) {
+		return ""
+	}
+	return strings.TrimSpace(h[len(prefix):])
+}
+
+// allowlist refuses a path the model arm does not use. It answers 404 rather
+// than 403 so a scan cannot map llama-server's surface through this hop.
+func allowlist(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		method, ok := allowed[r.URL.Path]
+		if !ok {
+			http.NotFound(w, r)
+			return
+		}
+		if r.Method != method {
+			w.Header().Set("Allow", method)
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// limitInflight caps concurrent proxied requests. A waiter leaves when its own
+// context ends, so a client that gave up does not keep a slot: llama-server
+// runs with -np 1 and queueing here is cheaper than queueing inside the child
+// with a body held in memory on both sides.
+func limitInflight(n int, next http.Handler) http.Handler {
+	if n <= 0 {
+		return next
+	}
+	slots := make(chan struct{}, n)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		select {
+		case slots <- struct{}{}:
+			defer func() { <-slots }()
+			next.ServeHTTP(w, r)
+		case <-r.Context().Done():
+			http.Error(w, "client went away", http.StatusServiceUnavailable)
+		}
+	})
+}

cmd/mavgpud/auth_test.go

@@ -0,0 +1,180 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// ok is what the boundary is protecting: anything that reaches it has spent
+// the card.
+func ok(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusTeapot) }
+
+func TestRequireTokenRefusesEveryWrongCredential(t *testing.T) {
+	h := requireToken("s3cret", 1<<20, http.HandlerFunc(ok))
+	cases := []struct {
+		name string
+		auth string
+		want int
+	}{
+		{"no header", "", http.StatusUnauthorized},
+		{"wrong token", "Bearer wrong", http.StatusUnauthorized},
+		{"prefix of the token", "Bearer s3cre", http.StatusUnauthorized},
+		{"token with no scheme", "s3cret", http.StatusUnauthorized},
+		{"basic auth", "Basic czNjcmV0", http.StatusUnauthorized},
+		{"right token", "Bearer s3cret", http.StatusTeapot},
+		{"scheme is case-insensitive", "bearer s3cret", http.StatusTeapot},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/health", nil)
+			if tc.auth != "" {
+				r.Header.Set("Authorization", tc.auth)
+			}
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, r)
+			if w.Code != tc.want {
+				t.Errorf("status %d, want %d", w.Code, tc.want)
+			}
+		})
+	}
+}
+
+// The 401 must not say which part was wrong. A probe that can tell a malformed
+// header from a wrong token learns the header shape for free.
+func TestUnauthorizedSaysNothingUseful(t *testing.T) {
+	h := requireToken("s3cret", 1<<20, http.HandlerFunc(ok))
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/health", nil))
+	if got := strings.TrimSpace(w.Body.String()); got != "unauthorized" {
+		t.Errorf("body %q, want %q", got, "unauthorized")
+	}
+	if got := w.Header().Get("WWW-Authenticate"); got != "Bearer" {
+		t.Errorf("WWW-Authenticate %q, want Bearer", got)
+	}
+}
+
+// The body cap applies to an authenticated request. An unauthenticated one
+// never gets far enough to allocate anything.
+func TestRequireTokenCapsTheBody(t *testing.T) {
+	var read error
+	h := requireToken("t", 8, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		buf := make([]byte, 64)
+		for read == nil {
+			if _, read = r.Body.Read(buf); read != nil {
+				break
+			}
+		}
+	}))
+	r := httptest.NewRequest(http.MethodPost, "/v1/chat/completions", strings.NewReader(strings.Repeat("x", 4096)))
+	r.Header.Set("Authorization", "Bearer t")
+	h.ServeHTTP(httptest.NewRecorder(), r)
+	if read == nil || !strings.Contains(read.Error(), "too large") {
+		t.Errorf("read error %v, want the body cap", read)
+	}
+}
+
+func TestAllowlistRefusesWhatMavenDoesNotCall(t *testing.T) {
+	h := allowlist(http.HandlerFunc(ok))
+	cases := []struct {
+		method, path string
+		want         int
+	}{
+		{http.MethodPost, "/v1/chat/completions", http.StatusTeapot},
+		{http.MethodGet, "/v1/models", http.StatusTeapot},
+		// /slots returns the prompts of whoever else is using the card, and
+		// its actions write files the request names.
+		{http.MethodGet, "/slots", http.StatusNotFound},
+		{http.MethodPost, "/slots/0?action=save", http.StatusNotFound},
+		{http.MethodGet, "/", http.StatusNotFound},
+		{http.MethodGet, "/v1/chat/completions", http.StatusMethodNotAllowed},
+	}
+	for _, tc := range cases {
+		t.Run(tc.method+" "+tc.path, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, httptest.NewRequest(tc.method, tc.path, nil))
+			if w.Code != tc.want {
+				t.Errorf("status %d, want %d", w.Code, tc.want)
+			}
+		})
+	}
+}
+
+func TestLimitInflightCapsConcurrency(t *testing.T) {
+	const cap = 2
+	var mu sync.Mutex
+	now, peak := 0, 0
+	release := make(chan struct{})
+	h := limitInflight(cap, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		mu.Lock()
+		now++
+		if now > peak {
+			peak = now
+		}
+		mu.Unlock()
+		<-release
+		mu.Lock()
+		now--
+		mu.Unlock()
+	}))
+
+	var wg sync.WaitGroup
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			h.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodPost, "/v1/chat/completions", nil))
+		}()
+	}
+	// Let the first wave arrive, then drain. The assertion is the peak, and a
+	// peak that never reached the cap still cannot exceed it.
+	close(release)
+	wg.Wait()
+	if peak > cap {
+		t.Errorf("%d requests in flight at once, cap is %d", peak, cap)
+	}
+}
+
+func TestLoopbackListen(t *testing.T) {
+	cases := map[string]bool{
+		":8080":              false, // the shipped default, and the whole LAN
+		"0.0.0.0:8080":       false,
+		"[::]:8080":          false,
+		"192.168.1.105:8080": false,
+		"127.0.0.1:8080":     true,
+		"[::1]:8080":         true,
+		"localhost:8080":     true,
+	}
+	for addr, want := range cases {
+		if got := loopbackListen(addr); got != want {
+			t.Errorf("loopbackListen(%q) = %v, want %v", addr, got, want)
+		}
+	}
+}
+
+func TestReadToken(t *testing.T) {
+	dir := t.TempDir()
+	good := filepath.Join(dir, "tok")
+	if err := os.WriteFile(good, []byte("  abc123\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	got, err := readToken(good)
+	if err != nil || got != "abc123" {
+		t.Errorf("readToken = %q, %v; want abc123", got, err)
+	}
+
+	blank := filepath.Join(dir, "blank")
+	if err := os.WriteFile(blank, []byte("\n\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readToken(blank); err == nil {
+		t.Error("an empty token file is not a token")
+	}
+	if _, err := readToken(filepath.Join(dir, "absent")); err == nil {
+		t.Error("a missing token file is not a token")
+	}
+}

cmd/mavgpud/gpu_test.go

@@ -104,9 +104,11 @@ func TestHealthAndProxyRefuseWhenNotReady(t *testing.T) {
 	s := &supervisor{run: newRunner("fake", "/bin/true", nil, "")}
 	h := s.handler(mustURL(t, "http://127.0.0.1:1"))
 
-	for _, path := range []string{"/health", "/v1/chat/completions"} {
+	// The completion is a POST because the allowlist is in front of the
+	// readiness check now, and it answers 405 to a method it never serves.
+	for path, method := range map[string]string{"/health": http.MethodGet, "/v1/chat/completions": http.MethodPost} {
 		w := httptest.NewRecorder()
-		h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, path, nil))
+		h.ServeHTTP(w, httptest.NewRequest(method, path, nil))
 		if w.Code != http.StatusServiceUnavailable {
 			t.Errorf("%s with no model: got %d, want 503", path, w.Code)
 		}

cmd/mavgpud/main.go

@@ -36,6 +36,21 @@ type config struct {
 	Listen    string `json:"listen"`     // what Maven talks to
 	LlamaAddr string `json:"llama_addr"` // where llama-server binds
 	LlamaBin  string `json:"llama_bin"`
+
+	// TokenFile holds the bearer token every request must carry. It is a path
+	// and never the token itself, the rule mavpoll, mavmaild and the CW2
+	// transcriber already follow: a secret in a committed config is a secret
+	// in the history. Empty is allowed only on a loopback Listen, and
+	// requireToken is where that is decided.
+	TokenFile string `json:"token_file,omitempty"`
+
+	// MaxBody bounds a proxied request body. A completion is a prompt, and a
+	// prompt that does not fit here would not fit the context window either.
+	MaxBody int64 `json:"max_body_bytes,omitempty"`
+	// MaxInflight bounds how many proxied requests reach llama-server at once.
+	// It runs with -np 1, so anything above a handful only queues inside the
+	// child while holding a connection and a body in memory here.
+	MaxInflight int `json:"max_inflight,omitempty"`
 	// LlamaArgs must include the flags that bind LlamaAddr. They are passed
 	// through untouched so the model, context size and layer count stay the
 	// owner's business and not this daemon's schema.
@@ -88,6 +103,8 @@ func defaults() config {
 		MinFreeVRAM: 15 << 30,
 		EvictAfter:  2,
 		StartAfter:  5,
+		MaxBody:     8 << 20,
+		MaxInflight: 4,
 	}
 }
 
@@ -123,6 +140,20 @@ func main() {
 		log.Fatal("mavgpud: llama_bin is required")
 	}
 
+	// A LAN listener with no token is refused rather than downgraded to
+	// loopback. Downgrading would look like a safe default and would take the
+	// model arm down instead: homesrv is the client and it is on the LAN.
+	var token string
+	if cfg.TokenFile != "" {
+		var err error
+		if token, err = readToken(cfg.TokenFile); err != nil {
+			log.Fatalf("mavgpud: %v", err)
+		}
+	} else if !loopbackListen(cfg.Listen) {
+		log.Fatalf("mavgpud: listen %s is reachable from the network and token_file is unset — "+
+			"set token_file, or listen on 127.0.0.1 and accept that Maven cannot reach it", cfg.Listen)
+	}
+
 	base := "http://" + cfg.LlamaAddr
 	run := newRunner("llama-server", cfg.LlamaBin, cfg.LlamaArgs, base+"/health")
 	sup := &supervisor{
@@ -145,7 +176,20 @@ func main() {
 	if err != nil {
 		log.Fatalf("mavgpud: llama_addr: %v", err)
 	}
-	srv := &http.Server{Addr: cfg.Listen, Handler: sup.handler(target)}
+	var h http.Handler = sup.handler(target)
+	if token != "" {
+		h = requireToken(token, cfg.MaxBody, h)
+	}
+	srv := &http.Server{
+		Addr:    cfg.Listen,
+		Handler: h,
+		// A slow-loris client holds a connection and a header buffer for free
+		// otherwise. No ReadTimeout or WriteTimeout: a completion legitimately
+		// takes minutes on this card, and either one would cut it off.
+		ReadHeaderTimeout: 10 * time.Second,
+		IdleTimeout:       60 * time.Second,
+		MaxHeaderBytes:    1 << 16,
+	}
 	go func() {
 		log.Printf("mavgpud: listening on %s, model %s", cfg.Listen, cfg.LlamaBin)
 		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
@@ -203,14 +247,14 @@ func (s *supervisor) handler(target *url.URL) http.Handler {
 		w.Header().Set("Content-Type", "application/json")
 		_, _ = w.Write([]byte(`{"status":"ok"}`))
 	})
-	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+	mux.Handle("/", allowlist(limitInflight(s.cfg.MaxInflight, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if !s.run.isReady() {
 			http.Error(w, "model not loaded", http.StatusServiceUnavailable)
 			return
 		}
 		s.touch()
 		proxy.ServeHTTP(w, r)
-	})
+	}))))
 	return mux
 }
 

cmd/mavweb/ambient.go

@@ -4,6 +4,7 @@ import (
 	"crypto/subtle"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
 	"log"
 	"net/http"
@@ -51,34 +52,41 @@ type ambientResp struct {
 // never registered, so it is treated as a hard failure here too.
 func handleAmbient(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, token string) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
 	if token == "" {
-		http.Error(w, "ambient ingest disabled (no -ambient-token)", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemIntegrationOff,
+			"ambient ingest disabled (no -ambient-token)", nil)
 		return
 	}
 	if !ambientAuthorized(r, token) {
-		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		writeProblem(w, r, http.StatusUnauthorized, problemUnauthorized,
+			"unauthorized", nil)
 		return
 	}
 	if core == nil {
-		http.Error(w, "ambient ingest disabled (no -core)", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemCoreUnavailable,
+			"ambient ingest disabled (no -core)", nil)
 		return
 	}
 
 	var n calendar.Notification
 	body, err := io.ReadAll(io.LimitReader(r.Body, ambientMaxBody))
 	if err != nil {
-		http.Error(w, "read failed", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"read failed", fmt.Errorf("read ambient request: %w", err))
 		return
 	}
 	if err := json.Unmarshal(body, &n); err != nil {
-		http.Error(w, "bad json", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"bad json", fmt.Errorf("decode ambient request: %w", err))
 		return
 	}
 	if n.Posted.IsZero() {
-		writeAmbient(w, http.StatusBadRequest, ambientResp{Reason: "posted_at is required"})
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"posted_at is required", nil)
 		return
 	}
 
@@ -99,8 +107,8 @@ func handleAmbient(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, tok
 		writeAmbient(w, http.StatusOK, ambientResp{Stored: false, Key: key, Reason: "unchanged"})
 		return
 	} else if err != nil && !errors.Is(err, ipc.ErrNoFact) {
-		log.Printf("ambient: read %s: %v", key, err)
-		http.Error(w, "read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"read failed", fmt.Errorf("read ambient fact %q: %w", key, err))
 		return
 	}
 
@@ -116,8 +124,8 @@ func handleAmbient(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, tok
 		Source:     calendar.SourceAmbient,
 		Confidence: calendar.AmbientConfidence,
 	}); err != nil {
-		log.Printf("ambient: write %s: %v", key, err)
-		http.Error(w, "write failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreWriteFailed,
+			"write failed", fmt.Errorf("write ambient fact %q: %w", key, err))
 		return
 	}
 	log.Printf("ambient: %s=%s (%s, pkg=%s)", key, val, calendar.SourceAmbient, n.Package)

cmd/mavweb/ambient_test.go

@@ -16,6 +16,18 @@ import (
 
 const ambientTestToken = "s3cret"
 
+func TestValidateAmbientConfig(t *testing.T) {
+	if err := validateAmbientConfig(false, ""); err != nil {
+		t.Fatalf("explicitly disabled ambient config: %v", err)
+	}
+	if err := validateAmbientConfig(true, ""); err == nil {
+		t.Fatal("enabled ambient ingest accepted an empty token")
+	}
+	if err := validateAmbientConfig(true, ambientTestToken); err != nil {
+		t.Fatalf("enabled authenticated ambient config: %v", err)
+	}
+}
+
 // ambientCore adds provenance-scoped reads to fakeCore, which the dedupe path
 // needs.
 type ambientCore struct {

cmd/mavweb/chat.go

@@ -3,7 +3,7 @@ package main
 import (
 	_ "embed"
 	"errors"
-	"log"
+	"fmt"
 	"net/http"
 	"net/url"
 	"strconv"
@@ -47,7 +47,7 @@ var correctionTargets = []router.Intent{
 
 // handleChatPage renders the chat conversation page.
 func handleChatPage(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "chat") {
+	if !requireCore(w, r, core, "chat") {
 		return
 	}
 	msgs := []chatMsg{}
@@ -83,13 +83,14 @@ func handleChatPage(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 // denies, which is the point of that flag.
 func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !requireCore(w, core, "chat") {
+	if !requireCore(w, r, core, "chat") {
 		return
 	}
-	if !stepUpGate(w, session, requireStepUp) {
+	if !stepUpGate(w, r, session, requireStepUp) {
 		return
 	}
 	text := strings.TrimSpace(r.FormValue("text"))
@@ -105,8 +106,8 @@ func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, ses
 	// which is right for a single-owner box.
 	reply, err := core.Chat(r.Context(), "web", text)
 	if err != nil {
-		log.Printf("chat api: %v", err)
-		http.Redirect(w, r, "/chat", http.StatusSeeOther)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreChangeFailed,
+			"chat failed", fmt.Errorf("run web chat turn: %w", err))
 		return
 	}
 	// The claiming query source rides back on the redirect so the page can show
@@ -138,36 +139,40 @@ func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, ses
 // id could otherwise mislabel turns he never corrected.
 func handleCorrectAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !requireCore(w, core, "correct") {
+	if !requireCore(w, r, core, "correct") {
 		return
 	}
-	if !stepUpGate(w, session, requireStepUp) {
+	if !stepUpGate(w, r, session, requireStepUp) {
 		return
 	}
 	id, err := strconv.ParseInt(strings.TrimSpace(r.FormValue("trace_id")), 10, 64)
 	if err != nil || id <= 0 {
-		http.Error(w, "trace_id required", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"trace_id required", err)
 		return
 	}
 	shouldBe := strings.TrimSpace(r.FormValue("should_be"))
 	// Only one of the seven, or nothing. Free text here would put an unroutable
 	// label in the one table V-632 fits prototypes from.
 	if shouldBe != "" && !isCorrectionTarget(shouldBe) {
-		http.Error(w, "should_be must be one of the seven intents", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"should_be must be one of the seven intents", nil)
 		return
 	}
 	if err := core.CorrectTurn(r.Context(), id, shouldBe); err != nil {
-		log.Printf("correct turn %d: %v", id, err)
 		// A turn past the retention bound is gone, and saying so is different
 		// from saying the write broke.
 		if errors.Is(err, ipc.ErrNoSuchTrace) {
-			http.Error(w, "that turn is no longer stored", http.StatusNotFound)
+			writeProblem(w, r, http.StatusNotFound, problemResourceNotFound,
+				"that turn is no longer stored", fmt.Errorf("correct turn %d: %w", id, err))
 			return
 		}
-		http.Error(w, "correction failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreChangeFailed,
+			"correction failed", fmt.Errorf("correct turn %d: %w", id, err))
 		return
 	}
 	stamp := shouldBe

cmd/mavweb/ecosystem.go

@@ -33,17 +33,29 @@ func getEco(ctx context.Context, base, path string, out any) string {
 	}
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, base+path, nil)
 	if err != nil {
-		return err.Error()
+		log.Printf("ecosystem panel request_id=%s build %q: %v", requestIDFromContext(ctx), path, err)
+		return "invalid endpoint"
+	}
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("X-Requested-By", "mavweb")
+	// These are direct browser-surface reads rather than an action initiated in
+	// mavend, so the HTTP request ID is the natural correlation root. Calls that
+	// pass through core mint their action correlation inside mavend instead.
+	if id := requestIDFromContext(ctx); id != "" {
+		req.Header.Set("X-Correlation-ID", id)
 	}
 	resp, err := ecoClient.Do(req)
 	if err != nil {
+		log.Printf("ecosystem panel request_id=%s GET %s: %v", requestIDFromContext(ctx), path, err)
 		return "unreachable"
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != 200 {
+		log.Printf("ecosystem panel request_id=%s GET %s: HTTP %d", requestIDFromContext(ctx), path, resp.StatusCode)
 		return fmt.Sprintf("http %d", resp.StatusCode)
 	}
 	if err := json.NewDecoder(resp.Body).Decode(out); err != nil {
+		log.Printf("ecosystem panel request_id=%s decode %s: %v", requestIDFromContext(ctx), path, err)
 		return "bad json"
 	}
 	return ""
@@ -111,7 +123,7 @@ func handleEcosystem(w http.ResponseWriter, r *http.Request, urls ecoURLs, core
 	if core == nil {
 		d.Calls.Err = "not configured"
 	} else if rows, err := core.RecentEcosystemTraces(ctx, 50); err != nil {
-		log.Printf("ecosystem traces: %v", err)
+		log.Printf("ecosystem traces request_id=%s: %v", requestIDFromContext(ctx), err)
 		d.Calls.Err = "core read failed"
 	} else {
 		d.Calls.Rows = rows

cmd/mavweb/events_test.go

@@ -75,8 +75,13 @@ func TestEventsPageReportsAReadFailure(t *testing.T) {
 		t.Fatalf("status = %d, want 200 with the error rendered", w.Code)
 	}
 	body := w.Body.String()
-	if !strings.Contains(body, "journal unavailable") || !strings.Contains(body, "core is down") {
-		t.Errorf("page did not report the read failure: %s", body)
+	if !strings.Contains(body, "intake journal unavailable") ||
+		!strings.Contains(body, string(problemCoreReadFailed)) ||
+		!strings.Contains(body, "request ") {
+		t.Errorf("page did not report a traceable, sanitized read failure: %s", body)
+	}
+	if strings.Contains(body, "core is down") {
+		t.Errorf("page disclosed the internal read error: %s", body)
 	}
 	if strings.Contains(body, "nothing has arrived yet") {
 		t.Error("a failed read rendered as an empty journal")

cmd/mavweb/facts.go

@@ -3,6 +3,7 @@ package main
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"log"
 	"net/http"
 	"strings"
@@ -32,16 +33,18 @@ var presenceSignals = map[string]string{
 // is a marker. Only allowlisted keys are accepted (see presenceSignals).
 func handleSignal(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !requireCore(w, core, "presence ingest") {
+	if !requireCore(w, r, core, "presence ingest") {
 		return
 	}
 	key := r.URL.Query().Get("key")
 	source, ok := presenceSignals[key]
 	if !ok {
-		http.Error(w, "unknown signal key", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"unknown signal key", nil)
 		return
 	}
 	// kind=env: an observation about the device/surface, NOT a self-fact — a
@@ -56,8 +59,8 @@ func handleSignal(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 		Source:     source,
 		Confidence: 1.0,
 	}); err != nil {
-		log.Printf("signal %s: %v", key, err)
-		http.Error(w, "write failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreWriteFailed,
+			"write failed", fmt.Errorf("write presence signal %q: %w", key, err))
 		return
 	}
 	w.WriteHeader(http.StatusNoContent)
@@ -65,29 +68,32 @@ func handleSignal(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 
 func handleRevert(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !requireCore(w, core, "revert") {
+	if !requireCore(w, r, core, "revert") {
 		return
 	}
-	if !stepUpGate(w, session, requireStepUp) {
+	if !stepUpGate(w, r, session, requireStepUp) {
 		return
 	}
 
 	key := strings.TrimSpace(r.FormValue("key"))
 	if key == "" {
-		http.Error(w, "key required", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"key required", nil)
 		return
 	}
 	newID, err := core.RevertFact(r.Context(), key)
 	if err != nil {
-		log.Printf("revert %q: %v", key, err)
 		if errors.Is(err, ipc.ErrNoFact) {
-			http.Error(w, "no fact to revert", http.StatusNotFound)
+			writeProblem(w, r, http.StatusNotFound, problemResourceNotFound,
+				"no fact to revert", fmt.Errorf("revert fact %q: %w", key, err))
 			return
 		}
-		http.Error(w, "revert failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreChangeFailed,
+			"revert failed", fmt.Errorf("revert fact %q: %w", key, err))
 		return
 	}
 	log.Printf("reverted fact for key=%s, new_id=%d", key, newID)

cmd/mavweb/handlers_test.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -1218,7 +1219,7 @@ func TestHandleTools_GET_MCPUnavailable(t *testing.T) {
 
 // --- voice-path step-up gate (Vikunja #317) ---
 //
-// POST /api/ptt and GET /ws proxy audio into mavend's voice port, which runs
+// POST /api/ptt proxies audio into mavend's voice port, which runs
 // the same router, LLM and act path as POST /api/chat. They used to be
 // ungated on the grounds that the voice port is only reachable inside the
 // deploy, but mavweb is the thing proxying into it from outside. Speaking
@@ -1269,29 +1270,31 @@ func TestHandlePTT_FailOpenByDefault(t *testing.T) {
 	}
 }
 
-func TestHandleWS_RequireStepUp_FailsClosed(t *testing.T) {
+type endlessByteReader struct{}
+
+func (endlessByteReader) Read(p []byte) (int, error) {
+	for i := range p {
+		p[i] = 'x'
+	}
+	return len(p), nil
+}
+
+func TestHandlePTT_RejectsOversizeAudioBeforeDial(t *testing.T) {
+	req := httptest.NewRequest(http.MethodPost, "/api/ptt", nil)
+	req.Body = io.NopCloser(io.LimitReader(endlessByteReader{}, maxPTTAudioBytes+1))
+	req.ContentLength = maxPTTAudioBytes + 1
 	rr := httptest.NewRecorder()
-	handleWS(rr, httptest.NewRequest(http.MethodGet, "/ws", nil), unreachableVoice, nil, true)
-	if rr.Code != http.StatusForbidden {
-		t.Fatalf("status = %d, want 403; body=%s", rr.Code, rr.Body.String())
+	handlePTT(rr, req, unreachableVoice, nil, false)
+	if rr.Code != http.StatusRequestEntityTooLarge {
+		t.Fatalf("status = %d, want 413; body=%s", rr.Code, rr.Body.String())
 	}
 }
 
-func TestHandleWS_UnassertedSession_Denied(t *testing.T) {
-	rr := httptest.NewRecorder()
-	handleWS(rr, httptest.NewRequest(http.MethodGet, "/ws", nil), unreachableVoice, webauthn.NewPasskeySession(5*time.Minute), false)
-	if rr.Code != http.StatusForbidden {
-		t.Fatalf("status = %d, want 403; body=%s", rr.Code, rr.Body.String())
-	}
-}
-
-// Past the gate the handshake itself fails (httptest's recorder cannot be
-// hijacked), which is not a 403. That is all this asserts: the gate let it by.
-func TestHandleWS_AssertedSession_PassesGate(t *testing.T) {
-	rr := httptest.NewRecorder()
-	handleWS(rr, httptest.NewRequest(http.MethodGet, "/ws", nil), unreachableVoice, stepUpSession(), true)
-	if rr.Code == http.StatusForbidden {
-		t.Fatalf("status = 403 on an asserted session; body=%s", rr.Body.String())
+func TestMavwebHTTPServerHasTransportLimits(t *testing.T) {
+	srv := mavwebHTTPServer("127.0.0.1:0", http.NewServeMux())
+	if srv.ReadHeaderTimeout != mavwebReadHeaderTimeout || srv.ReadTimeout != mavwebReadTimeout ||
+		srv.IdleTimeout != mavwebIdleTimeout || srv.MaxHeaderBytes != mavwebMaxHeaderBytes {
+		t.Fatalf("server transport limits are incomplete: %+v", srv)
 	}
 }
 

cmd/mavweb/main.go

@@ -41,16 +41,21 @@ func main() {
 	coreSock := flag.String("core", "", "mavend IPC socket path for presence-signal ingest (empty = disabled)")
 	pkOrigin := flag.String("webauthn-origin", "", "WebAuthn origin URL (e.g. https://maven.kvmx.ru)")
 	pkRPID := flag.String("webauthn-rpid", "", "WebAuthn RP ID (e.g. maven.kvmx.ru)")
-	requireStepUp := flag.Bool("require-stepup", false, "fail closed on step-up-gated actions (POST /tools, /routines, /models, /api/revert, /api/chat, /api/ptt and GET /ws) when WebAuthn step-up cannot be asserted; default false preserves the historical fail-open behaviour")
+	requireStepUp := flag.Bool("require-stepup", false, "fail closed on step-up-gated actions (POST /tools, /routines, /models, /api/revert, /api/chat and /api/ptt) when WebAuthn step-up cannot be asserted; default false preserves the historical fail-open behaviour")
 	pkFile := flag.String("passkey-file", "./passkeys.json", "path to WebAuthn credential store (JSON)")
 	nexusURL := flag.String("nexus", "", "Nexus base URL for the /ecosystem panel (empty = not configured)")
 	praxisURL := flag.String("praxis", "", "Praxis base URL for the /ecosystem panel (empty = not configured)")
 	hexisURL := flag.String("hexis", "", "Hexis base URL for the /ecosystem panel (empty = not configured)")
 	// Shared secret for POST /api/ambient, the notification-relay ingest that
 	// reads the work calendar as a signal instead of holding a work credential
-	// (see ambient.go). Empty ⇒ the route is not registered at all.
-	ambientToken := flag.String("ambient-token", "", "shared secret for POST /api/ambient notification ingest (empty = ingest disabled, route not registered)")
+	// (see ambient.go). Enabling and authenticating are separate on purpose: an
+	// expanded-empty secret cannot silently turn a live integration off.
+	ambientEnabled := flag.Bool("ambient-enabled", false, "enable POST /api/ambient notification ingest (requires -ambient-token)")
+	ambientToken := flag.String("ambient-token", "", "shared secret for POST /api/ambient notification ingest")
 	flag.Parse()
+	if err := validateAmbientConfig(*ambientEnabled, *ambientToken); err != nil {
+		log.Fatal(err)
+	}
 
 	var core ipc.CoreAPI
 	// swapConn — a second connection, for /models and nothing else. A model swap
@@ -129,9 +134,9 @@ func main() {
 		w.Write([]byte(*ntfyWS))
 	})
 	mux.HandleFunc("/api/signal", corePage(handleSignal))
-	// Off unless configured: no token, no route — an unconfigured ingest is not
-	// a 503 waiting to be probed, it does not exist.
-	if *ambientToken != "" {
+	// Off unless explicitly enabled: a dark ingest has no route at all, while an
+	// enabled ingest with no token was rejected before the server was built.
+	if *ambientEnabled {
 		mux.HandleFunc("/api/ambient", func(w http.ResponseWriter, r *http.Request) {
 			handleAmbient(w, r, core, *ambientToken)
 		})
@@ -194,7 +199,6 @@ func main() {
 	//   POST /api/chat   step-up  — reaches the router, LLM and the act path
 	//   POST /api/ptt    step-up  — audio into runTurn, so the same router,
 	//                               LLM and act path as /api/chat
-	//   GET  /ws         step-up  — same, streamed
 	//   POST /api/signal none     — appends a presence fact, no argv, no act
 	//   POST /api/ambient shared secret — notification relay, constant-time
 	//                               token compare, poster is a phone service
@@ -203,7 +207,7 @@ func main() {
 	// "step-up" means stepUpOK: asserted passkey when WebAuthn is configured,
 	// otherwise fail-open unless -require-stepup, which denies.
 	//
-	// /api/ptt and /ws used to be ungated, justified by mavend's voice port
+	// /api/ptt used to be ungated, justified by mavend's voice port
 	// being reachable only inside the deploy. That argument does not hold:
 	// mavweb is the thing proxying into it from outside. Speaking "выключи
 	// свет" is not a smaller act than typing it (Vikunja #317).
@@ -232,14 +236,11 @@ func main() {
 	mux.HandleFunc("/models", func(w http.ResponseWriter, r *http.Request) {
 		handleModels(w, r, core, swapConn, stepUpSession, *requireStepUp)
 	})
-	mux.HandleFunc("/ws", func(w http.ResponseWriter, r *http.Request) {
-		handleWS(w, r, *voiceAddr, stepUpSession, *requireStepUp)
-	})
 	mux.HandleFunc("/api/ptt", func(w http.ResponseWriter, r *http.Request) {
 		handlePTT(w, r, *voiceAddr, stepUpSession, *requireStepUp)
 	})
 
-	srv := &http.Server{Addr: *addr, Handler: mux}
+	srv := mavwebHTTPServer(*addr, mux)
 
 	go func() {
 		sig := make(chan os.Signal, 1)
@@ -255,6 +256,13 @@ func main() {
 	}
 }
 
+func validateAmbientConfig(enabled bool, token string) error {
+	if enabled && token == "" {
+		return errors.New("mavweb: ambient ingest is enabled but -ambient-token is empty")
+	}
+	return nil
+}
+
 // logUnguardedSurfaces names, at startup, what step-up would have covered had
 // WebAuthn been configured. One surface per line: these are read in a terminal
 // at the moment someone is deciding whether the box is safe to expose.
@@ -266,7 +274,6 @@ func logUnguardedSurfaces(requireStepUp bool) {
 		"POST /api/revert   voids the latest fact for a key",
 		"POST /api/chat     reaches the router, the LLM and, through applyAction, the act path",
 		"POST /api/ptt      the same, from audio",
-		"GET  /ws           the same, streamed",
 	}
 	if requireStepUp {
 		log.Printf("SECURITY: step-up verification is DISABLED (-webauthn-origin/-webauthn-rpid unset) and -require-stepup is set. These surfaces will be DENIED (403):")
@@ -282,3 +289,21 @@ func logUnguardedSurfaces(requireStepUp bool) {
 		log.Printf("SECURITY: they rest on the transport-level auth in front of mavweb (wg+nginx+auth). Do NOT expose -addr on a public interface. Set -webauthn-origin and -webauthn-rpid to require passkey step-up, or pass -require-stepup to fail closed instead.")
 	}
 }
+
+const (
+	mavwebReadHeaderTimeout = 10 * time.Second
+	mavwebReadTimeout       = 2 * time.Minute
+	mavwebIdleTimeout       = 2 * time.Minute
+	mavwebMaxHeaderBytes    = 32 << 10
+)
+
+func mavwebHTTPServer(addr string, handler http.Handler) *http.Server {
+	return &http.Server{
+		Addr:              addr,
+		Handler:           withRequestID(handler),
+		ReadHeaderTimeout: mavwebReadHeaderTimeout,
+		ReadTimeout:       mavwebReadTimeout,
+		IdleTimeout:       mavwebIdleTimeout,
+		MaxHeaderBytes:    mavwebMaxHeaderBytes,
+	}
+}

cmd/mavweb/models.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	_ "embed"
 	"errors"
+	"fmt"
 	"log"
 	"net/http"
 	"strconv"
@@ -57,7 +58,8 @@ type modelsPage struct {
 // the reply. On its own connection the swap only blocks the swap.
 func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swapConn modelController, session *webauthn.PasskeySession, requireStepUp bool) {
 	if core == nil {
-		http.Error(w, "models disabled (no -core)", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemCoreUnavailable,
+			"models disabled (no -core)", nil)
 		return
 	}
 	mc, ok := swapConn, swapConn != nil
@@ -65,7 +67,8 @@ func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swap
 		mc, ok = core.(modelController)
 	}
 	if !ok {
-		http.Error(w, "models unavailable: core connection does not support model swap", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemModelsUnavailable,
+			"models unavailable: core connection does not support model swap", nil)
 		return
 	}
 	ctx := r.Context()
@@ -73,12 +76,14 @@ func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swap
 
 	if r.Method == http.MethodPost {
 		if !stepUpOK(session, requireStepUp) {
-			http.Error(w, "step-up required: assert a passkey first", http.StatusForbidden)
+			writeProblem(w, r, http.StatusForbidden, problemStepUpRequired,
+				"step-up required: assert a passkey first", nil)
 			return
 		}
 		path := strings.TrimSpace(r.FormValue("model_path"))
 		if path == "" {
-			http.Error(w, "model_path required", http.StatusBadRequest)
+			writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+				"model_path required", nil)
 			return
 		}
 		// Only the path comes off the form. n_ctx and n_gpu_layers are load
@@ -93,20 +98,26 @@ func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swap
 			page.Msg = "loaded " + res.Model + " (" + strconv.FormatInt(res.TookMs, 10) + "ms)"
 			log.Printf("models: swapped to %s (%s) in %dms", res.ModelPath, res.Model, res.TookMs)
 		case errors.Is(err, ipc.ErrForbidden):
-			http.Error(w, "refused: that model is not in phraser.swap_models, or step-up was not asserted", http.StatusForbidden)
+			writeProblem(w, r, http.StatusForbidden, problemModelsForbidden,
+				"refused: that model is not in phraser.swap_models, or step-up was not asserted",
+				fmt.Errorf("swap model %q: %w", path, err))
 			return
 		case errors.Is(err, ipc.ErrUnknownMethod):
-			http.Error(w, "swap not configured on this core", http.StatusServiceUnavailable)
+			writeProblem(w, r, http.StatusServiceUnavailable, problemModelsUnavailable,
+				"swap not configured on this core", fmt.Errorf("swap model %q: %w", path, err))
 			return
 		case res.NoBackend:
-			page.Err = "swap failed AND the rollback failed — no model is loaded. She is answering from templates and routing on the classifier. Try loading a model again; a restart is not needed."
-			log.Printf("models: swap to %s failed and the rollback failed, no model loaded: %v", path, err)
+			page.Err = inlineProblem(r, problemModelsUnavailable,
+				"swap failed AND the rollback failed — no model is loaded. She is answering from templates and routing on the classifier. Try loading a model again; a restart is not needed.",
+				fmt.Errorf("swap model %q and rollback: %w", path, err))
 		case res.RolledBack:
-			page.Err = "swap failed, rolled back to " + res.Model + " — she is still answering, with the old model"
-			log.Printf("models: swap to %s failed, rolled back: %v", path, err)
+			page.Err = inlineProblem(r, problemModelsUnavailable,
+				"swap failed, rolled back to "+res.Model+" — she is still answering, with the old model",
+				fmt.Errorf("swap model %q, rolled back to %q: %w", path, res.Model, err))
 		default:
-			page.Err = "swap failed: " + err.Error()
-			log.Printf("models: swap to %s failed: %v", path, err)
+			page.Err = inlineProblem(r, problemModelsUnavailable,
+				"swap failed; the current model state is shown below",
+				fmt.Errorf("swap model %q: %w", path, err))
 		}
 	}
 
@@ -115,8 +126,8 @@ func handleModels(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, swap
 		if errors.Is(err, ipc.ErrUnknownMethod) {
 			page.Off = true
 		} else {
-			log.Printf("models: status: %v", err)
-			http.Error(w, "core read failed", http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+				"core read failed", fmt.Errorf("read model status: %w", err))
 			return
 		}
 	}

cmd/mavweb/models_test.go

@@ -149,6 +149,27 @@ type errBrokenModel struct{}
 
 func (errBrokenModel) Error() string { return "llm: server did not start" }
 
+type errPrivateModel struct{}
+
+func (errPrivateModel) Error() string { return "exec /private/llama-server: token rejected" }
+
+func TestModels_SwapFailureIsSanitizedAndTraceable(t *testing.T) {
+	core := &fakeModelCore{
+		swapErr: errPrivateModel{},
+		status:  ipc.ModelStatusResp{Model: "qwen3", ModelPath: "/m/old.gguf"},
+	}
+	w := modelsPOST(t, core, nil, false, "/m/cpt.gguf")
+	body := w.Body.String()
+	for _, want := range []string{"swap failed", string(problemModelsUnavailable), "request "} {
+		if !strings.Contains(body, want) {
+			t.Errorf("sanitized model error missing %q:\n%s", want, body)
+		}
+	}
+	if strings.Contains(body, "/private/llama-server") || strings.Contains(body, "token rejected") {
+		t.Errorf("model page disclosed the backend error:\n%s", body)
+	}
+}
+
 func TestModels_TotalFailureDoesNotSaySheIsStillAnswering(t *testing.T) {
 	// The load failed and so did the rollback: nothing is loaded. The page used
 	// to branch on RolledBack first and render "rolled back to  — she is still

cmd/mavweb/notifications.go

@@ -2,7 +2,7 @@ package main
 
 import (
 	_ "embed"
-	"log"
+	"fmt"
 	"net/http"
 	"strconv"
 
@@ -48,14 +48,14 @@ func deliveryRows(as []ipc.DeliveryAttempt) []deliveryRow {
 }
 
 func handleNotifications(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "notifications") {
+	if !requireCore(w, r, core, "notifications") {
 		return
 	}
 	ctx := r.Context()
 	nudges, err := core.RecentNudges(ctx, 50)
 	if err != nil {
-		log.Printf("notifications: %v", err)
-		http.Error(w, "notifications error: "+err.Error(), http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"notifications unavailable", fmt.Errorf("read recent nudges: %w", err))
 		return
 	}
 	// The outbox, on the page that already answers "what did she send".
@@ -66,7 +66,8 @@ func handleNotifications(w http.ResponseWriter, r *http.Request, core ipc.CoreAP
 	if err != nil {
 		// The nudge list is still worth showing, so this is a note on the page
 		// rather than a dead page.
-		log.Printf("notifications: delivery attempts: %v", err)
+		logProblem(r, http.StatusOK, problemCoreReadFailed,
+			"delivery attempts unavailable", fmt.Errorf("read delivery attempts: %w", err))
 	}
 	renderPage(w, notificationsTmpl, map[string]any{
 		"Nudges":   nudges,

cmd/mavweb/pages.go

@@ -3,8 +3,8 @@ package main
 import (
 	"cmp"
 	_ "embed"
+	"fmt"
 	"html/template"
-	"log"
 	"net/http"
 	"strings"
 	"time"
@@ -73,7 +73,7 @@ var voiceTmpl = parsePage("voice", voiceHTML, nil)
 var ecosystemTmpl = parsePage("ecosystem", ecosystemHTML, nil)
 
 func handleDash(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "dash") {
+	if !requireCore(w, r, core, "dash") {
 		return
 	}
 	ctx := r.Context()
@@ -82,8 +82,8 @@ func handleDash(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	nudges, err3 := core.RecentNudges(ctx, 50)
 	notes, err4 := core.RecentNotes(ctx, 50)
 	if err := cmp.Or(err1, err2, err3, err4); err != nil {
-		log.Printf("dash: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("read dashboard: %w", err))
 		return
 	}
 	renderPage(w, dashTmpl, struct {
@@ -95,13 +95,13 @@ func handleDash(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 }
 
 func handleHistory(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "history") {
+	if !requireCore(w, r, core, "history") {
 		return
 	}
 	facts, err := core.RecentFacts(r.Context(), 200)
 	if err != nil {
-		log.Printf("history: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("read fact history: %w", err))
 		return
 	}
 	renderPage(w, historyTmpl, struct {
@@ -110,13 +110,13 @@ func handleHistory(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 }
 
 func handleTrace(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "trace") {
+	if !requireCore(w, r, core, "trace") {
 		return
 	}
 	trace, err := core.TickTrace(r.Context())
 	if err != nil {
-		log.Printf("trace: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("read tick trace: %w", err))
 		return
 	}
 	// The turn records share this page rather than getting one of their own
@@ -127,7 +127,8 @@ func handleTrace(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	// deploy.
 	turns, err := core.TurnDecisions(r.Context(), 25)
 	if err != nil {
-		log.Printf("trace: turn decisions: %v", err)
+		logProblem(r, http.StatusOK, problemCoreReadFailed,
+			"turn decisions unavailable", fmt.Errorf("read turn decisions: %w", err))
 	}
 	renderPage(w, traceTmpl, traceData{Tick: trace, Turns: turns})
 }
@@ -149,14 +150,14 @@ type morningView struct {
 }
 
 func handleMorning(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "morning") {
+	if !requireCore(w, r, core, "morning") {
 		return
 	}
 	ctx := r.Context()
 	status, err := core.MorningStatus(ctx)
 	if err != nil {
-		log.Printf("morning: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("read morning status: %w", err))
 		return
 	}
 	view := morningView{Routines: status}
@@ -165,8 +166,8 @@ func handleMorning(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	// down with it — the page degrades to what it had before.
 	plan, err := core.DayPlan(ctx)
 	if err != nil {
-		log.Printf("morning: day plan: %v", err)
-		view.PlanErr = err.Error()
+		view.PlanErr = inlineProblem(r, problemCoreReadFailed,
+			"day plan unavailable", fmt.Errorf("read day plan: %w", err))
 	} else {
 		view.Plan = &plan
 	}
@@ -186,14 +187,14 @@ type eventsView struct {
 const eventsPageLimit = 200
 
 func handleEvents(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "intake journal") {
+	if !requireCore(w, r, core, "intake journal") {
 		return
 	}
 	var view eventsView
 	evs, err := core.RecentEvents(r.Context(), eventsPageLimit)
 	if err != nil {
-		log.Printf("events: %v", err)
-		view.Err = err.Error()
+		view.Err = inlineProblem(r, problemCoreReadFailed,
+			"intake journal unavailable", fmt.Errorf("read intake journal: %w", err))
 	} else {
 		view.Events = evs
 	}

cmd/mavweb/problems.go

@@ -0,0 +1,118 @@
+package main
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+)
+
+// problemCode is the stable, low-cardinality name a client can key on. The
+// request ID identifies one occurrence; the code identifies the class of
+// failure without exposing the wrapped implementation error.
+type problemCode string
+
+const (
+	problemMethodNotAllowed  problemCode = "request.method_not_allowed"
+	problemInvalidRequest    problemCode = "request.invalid"
+	problemPayloadTooLarge   problemCode = "request.payload_too_large"
+	problemUnauthorized      problemCode = "auth.unauthorized"
+	problemStepUpRequired    problemCode = "auth.step_up_required"
+	problemResourceNotFound  problemCode = "resource.not_found"
+	problemIntegrationOff    problemCode = "integration.disabled"
+	problemCoreUnavailable   problemCode = "core.unavailable"
+	problemCoreReadFailed    problemCode = "core.read_failed"
+	problemCoreWriteFailed   problemCode = "core.write_failed"
+	problemCoreChangeFailed  problemCode = "core.change_failed"
+	problemToolsChange       problemCode = "tools.change_failed"
+	problemRoutinesChange    problemCode = "routines.change_failed"
+	problemModelsUnavailable problemCode = "models.unavailable"
+	problemModelsForbidden   problemCode = "models.forbidden"
+	problemWebAuthnBegin     problemCode = "webauthn.begin_failed"
+	problemWebAuthnFinish    problemCode = "webauthn.finish_failed"
+	problemWebAuthnStepUp    problemCode = "webauthn.step_up_failed"
+	problemVoiceUnavailable  problemCode = "voice.unavailable"
+	problemVoiceTransport    problemCode = "voice.transport_failed"
+	problemVoiceResponse     problemCode = "voice.response_failed"
+)
+
+type requestIDKey struct{}
+
+// problemLogger is separate from the package-wide logger so the contract test
+// can capture exactly one problem line without redirecting unrelated output.
+var problemLogger = log.New(os.Stderr, "", log.LstdFlags)
+
+// problemResponse is the one non-success envelope returned by mavweb. Error is
+// deliberately a public message, never err.Error(). Code is stable across
+// occurrences; request_id joins this answer to the full server-side log line.
+type problemResponse struct {
+	Error     string      `json:"error"`
+	Code      problemCode `json:"code"`
+	RequestID string      `json:"request_id"`
+}
+
+// withRequestID mints the request identifier at the HTTP boundary. A caller's
+// X-Request-ID is ignored: accepting it would let an untrusted client forge a
+// link to another request's logs. The generated ID is also returned on success,
+// which lets an operator start from any surprising response, not errors alone.
+func withRequestID(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		id := rand.Text()
+		w.Header().Set("X-Request-ID", id)
+		ctx := context.WithValue(r.Context(), requestIDKey{}, id)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func requestIDFromContext(ctx context.Context) string {
+	id, _ := ctx.Value(requestIDKey{}).(string)
+	return id
+}
+
+func problemRequestID(r *http.Request) string {
+	id := requestIDFromContext(r.Context())
+	if id == "" {
+		id = rand.Text()
+	}
+	return id
+}
+
+func logProblem(r *http.Request, status int, code problemCode, public string, err error) string {
+	id := problemRequestID(r)
+	if err == nil {
+		err = errors.New(public)
+	}
+	problemLogger.Printf("mavweb problem request_id=%s code=%s status=%d method=%s path=%q: %v",
+		id, code, status, r.Method, r.URL.Path, err)
+	return id
+}
+
+// inlineProblem preserves a useful partial page when one panel fails, while
+// applying the same disclosure and correlation rules as an HTTP problem.
+func inlineProblem(r *http.Request, code problemCode, public string, err error) string {
+	id := logProblem(r, http.StatusOK, code, public, err)
+	return fmt.Sprintf("%s (code %s, request %s)", public, code, id)
+}
+
+// writeProblem is the only mavweb HTTP error writer. The wrapped error is
+// logged in full and only the explicit public message, stable code and request
+// ID cross the HTTP boundary.
+func writeProblem(w http.ResponseWriter, r *http.Request, status int, code problemCode, public string, err error) {
+	// Unit-level handlers and embedders may call a handler without installing
+	// the server middleware. They still get the same traceable contract.
+	id := logProblem(r, status, code, public, err)
+	w.Header().Set("X-Request-ID", id)
+
+	w.Header().Set("Content-Type", "application/problem+json; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(status)
+	// A failed client connection leaves nowhere useful to report an encoder
+	// error; the full problem is already in the server log before this write.
+	_ = json.NewEncoder(w).Encode(problemResponse{
+		Error: public, Code: code, RequestID: id,
+	})
+}

cmd/mavweb/problems_test.go

@@ -0,0 +1,135 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"io"
+	"log"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestWriteProblemSanitizesAndCorrelates(t *testing.T) {
+	var logs bytes.Buffer
+	old := problemLogger
+	problemLogger = logForTest(&logs)
+	t.Cleanup(func() { problemLogger = old })
+
+	const id = "TESTREQUESTID"
+	r := httptest.NewRequest(http.MethodPost, "/tools", nil)
+	r = r.WithContext(context.WithValue(r.Context(), requestIDKey{}, id))
+	w := httptest.NewRecorder()
+	internal := errors.New("dial unix /run/private/mavend.sock: bearer secret-token")
+	writeProblem(w, r, http.StatusBadGateway, problemToolsChange, "enable failed", internal)
+
+	if w.Code != http.StatusBadGateway {
+		t.Fatalf("status = %d, want 502", w.Code)
+	}
+	if got := w.Header().Get("X-Request-ID"); got != id {
+		t.Fatalf("X-Request-ID = %q, want %q", got, id)
+	}
+	if got := w.Header().Get("Content-Type"); !strings.HasPrefix(got, "application/problem+json") {
+		t.Fatalf("Content-Type = %q", got)
+	}
+	var got problemResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatalf("decode problem: %v", err)
+	}
+	if got.Error != "enable failed" || got.Code != problemToolsChange || got.RequestID != id {
+		t.Fatalf("problem = %+v", got)
+	}
+	if strings.Contains(w.Body.String(), "private") || strings.Contains(w.Body.String(), "secret-token") {
+		t.Fatalf("HTTP response disclosed the wrapped error: %s", w.Body.String())
+	}
+	for _, want := range []string{id, string(problemToolsChange), internal.Error()} {
+		if !strings.Contains(logs.String(), want) {
+			t.Errorf("server log missing %q: %s", want, logs.String())
+		}
+	}
+}
+
+func TestRequestIDMiddlewareMintsAndIgnoresCallerID(t *testing.T) {
+	var seen string
+	h := withRequestID(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		seen = requestIDFromContext(r.Context())
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	r := httptest.NewRequest(http.MethodGet, "/api/ping", nil)
+	r.Header.Set("X-Request-ID", "caller-chosen")
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+
+	if seen == "" || seen == "caller-chosen" {
+		t.Fatalf("request ID = %q; want a server-generated value", seen)
+	}
+	if got := w.Header().Get("X-Request-ID"); got != seen {
+		t.Fatalf("response request ID = %q, context ID = %q", got, seen)
+	}
+}
+
+func TestEcosystemPanelPropagatesRequestID(t *testing.T) {
+	const id = "WEBREQUESTCORRELATION"
+	var correlation, requester string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		correlation = r.Header.Get("X-Correlation-ID")
+		requester = r.Header.Get("X-Requested-By")
+		_, _ = io.WriteString(w, `[]`)
+	}))
+	defer srv.Close()
+	ctx := context.WithValue(context.Background(), requestIDKey{}, id)
+	var rows []ecoEntity
+	if got := getEco(ctx, srv.URL, "/entities", &rows); got != "" {
+		t.Fatalf("getEco error = %q", got)
+	}
+	if correlation != id || requester != "mavweb" {
+		t.Fatalf("correlation = %q, requester = %q", correlation, requester)
+	}
+}
+
+// The contract is architectural, not a convention people must remember. Keep
+// a syntax-level guard so a new handler cannot bypass writeProblem by adding
+// another http.Error call.
+func TestProductionHandlersUseOneProblemWriter(t *testing.T) {
+	entries, err := os.ReadDir(".")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, entry := range entries {
+		name := entry.Name()
+		if entry.IsDir() || !strings.HasSuffix(name, ".go") || strings.HasSuffix(name, "_test.go") {
+			continue
+		}
+		file, err := parser.ParseFile(token.NewFileSet(), filepath.Clean(name), nil, 0)
+		if err != nil {
+			t.Fatalf("parse %s: %v", name, err)
+		}
+		ast.Inspect(file, func(n ast.Node) bool {
+			call, ok := n.(*ast.CallExpr)
+			if !ok {
+				return true
+			}
+			sel, ok := call.Fun.(*ast.SelectorExpr)
+			if !ok || sel.Sel.Name != "Error" {
+				return true
+			}
+			pkg, ok := sel.X.(*ast.Ident)
+			if ok && pkg.Name == "http" {
+				t.Errorf("%s contains http.Error; use writeProblem", name)
+			}
+			return true
+		})
+	}
+}
+
+func logForTest(w io.Writer) *log.Logger {
+	return log.New(w, "", 0)
+}

cmd/mavweb/reminders.go

@@ -3,7 +3,7 @@ package main
 import (
 	_ "embed"
 	"encoding/json"
-	"log"
+	"fmt"
 	"net/http"
 	"strings"
 
@@ -26,6 +26,7 @@ type reminderRow struct {
 	Created string
 	Fires   string
 	Status  string
+	Detail  string
 	Text    string
 }
 
@@ -50,10 +51,19 @@ func reminderText(payload string) string {
 func reminderRows(rs []ipc.Reminder) []reminderRow {
 	out := make([]reminderRow, 0, len(rs))
 	for _, r := range rs {
+		status := r.Status
+		detail := ""
+		if !r.DeliveryBlockedTs.IsZero() {
+			status = "blocked"
+			detail = r.DeliveryBlockedError
+		} else if r.DeliveryAttempts > 0 && !r.NextAttemptTs.IsZero() {
+			detail = "retry " + r.NextAttemptTs.Local().Format("02 Jan 15:04")
+		}
 		out = append(out, reminderRow{
 			Created: r.CreatedTs.Local().Format("02 Jan 15:04"),
 			Fires:   r.FireTs.Local().Format("02 Jan 15:04"),
-			Status:  r.Status,
+			Status:  status,
+			Detail:  detail,
 			Text:    reminderText(r.Payload),
 		})
 	}
@@ -61,13 +71,13 @@ func reminderRows(rs []ipc.Reminder) []reminderRow {
 }
 
 func handleReminders(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "reminders") {
+	if !requireCore(w, r, core, "reminders") {
 		return
 	}
 	reminders, err := core.ListReminders(r.Context(), 50)
 	if err != nil {
-		log.Printf("reminders: %v", err)
-		http.Error(w, "reminders error: "+err.Error(), http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"reminders unavailable", fmt.Errorf("list reminders: %w", err))
 		return
 	}
 	renderPage(w, remindersTmpl, map[string]any{"Reminders": reminderRows(reminders)})

cmd/mavweb/reminders.html

@@ -5,7 +5,7 @@
 {{range .Reminders}}<tr>
 <td class=hint>{{.Created}}</td>
 <td>{{.Fires}}</td>
-<td><span class="badge {{.Status}}">{{.Status}}</span></td>
+<td><span class="badge {{.Status}}">{{.Status}}</span>{{if .Detail}}<div class=hint>{{.Detail}}</div>{{end}}</td>
 <td class=text-max>{{.Text}}</td>
 </tr>{{end}}</table></div>
 {{else}}<div class=empty>

cmd/mavweb/reminders_test.go

@@ -31,6 +31,19 @@ func TestReminderRowsUnwrapAndLocalise(t *testing.T) {
 	}
 }
 
+func TestReminderRowsExposeBlockedDelivery(t *testing.T) {
+	blocked := time.Date(2026, 8, 13, 8, 0, 0, 0, time.UTC)
+	rows := reminderRows([]ipc.Reminder{{
+		Status:               "pending",
+		Payload:              `{"text":"позвонить врачу"}`,
+		DeliveryBlockedTs:    blocked,
+		DeliveryBlockedError: "ntfy credentials rejected",
+	}})
+	if len(rows) != 1 || rows[0].Status != "blocked" || rows[0].Detail != "ntfy credentials rejected" {
+		t.Fatalf("blocked reminder is not visible: %+v", rows)
+	}
+}
+
 // A payload that is not the envelope is his own words, so it is shown as it is.
 func TestReminderTextKeepsPlainPayload(t *testing.T) {
 	for _, tc := range []struct{ in, want string }{

cmd/mavweb/routines.go

@@ -5,7 +5,6 @@ import (
 	_ "embed"
 	"errors"
 	"fmt"
-	"log"
 	"net/http"
 	"strconv"
 	"strings"
@@ -41,7 +40,7 @@ type routineView struct {
 // gated — it only ever removes a reason to speak, so the worst a weaker caller
 // can do is make maven quieter.
 func handleRoutines(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
-	if !requireCore(w, core, "routines") {
+	if !requireCore(w, r, core, "routines") {
 		return
 	}
 	ctx := r.Context()
@@ -54,8 +53,8 @@ func handleRoutines(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, se
 	}
 	proposed, err := core.ListProposedRoutines(ctx)
 	if err != nil {
-		log.Printf("routines: list: %v", err)
-		http.Error(w, "routines error: "+err.Error(), http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"routines unavailable", fmt.Errorf("list proposed routines: %w", err))
 		return
 	}
 	renderPage(w, routinesTmpl, struct {
@@ -76,44 +75,45 @@ func applyRoutinePost(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI,
 	// already the step-up-gated surface for this table, and a second gated
 	// surface is a second thing to get wrong.
 	if action == "seed" {
-		if !stepUpGate(w, session, requireStepUp) {
+		if !stepUpGate(w, r, session, requireStepUp) {
 			return "", false
 		}
 		out, err := seedRoutineEvent(ctx, core, r)
 		if err != nil {
-			log.Printf("routines: seed: %v", err)
-			http.Error(w, "seed failed: "+err.Error(), http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemRoutinesChange,
+				"seed failed", fmt.Errorf("seed routine event: %w", err))
 			return "", false
 		}
 		return out, true
 	}
 
-	idStr := r.FormValue("id")
-	var rid int64
-	if n, _ := fmt.Sscanf(idStr, "%d", &rid); n != 1 {
-		http.Error(w, "invalid id", http.StatusBadRequest)
+	rid, err := strconv.ParseInt(strings.TrimSpace(r.FormValue("id")), 10, 64)
+	if err != nil || rid <= 0 {
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"invalid id", err)
 		return "", false
 	}
 	switch action {
 	case "accept":
-		if !stepUpGate(w, session, requireStepUp) {
+		if !stepUpGate(w, r, session, requireStepUp) {
 			return "", false
 		}
 		if err := acceptRoutine(ctx, core, rid); err != nil {
-			log.Printf("routines: accept %d: %v", rid, err)
-			http.Error(w, "accept failed: "+err.Error(), http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemRoutinesChange,
+				"accept failed", fmt.Errorf("accept routine %d: %w", rid, err))
 			return "", false
 		}
 		return "accepted routine — maven will remind you", true
 	case "dismiss":
 		if err := core.DismissProposedRoutine(ctx, rid); err != nil {
-			log.Printf("routines: dismiss %d: %v", rid, err)
-			http.Error(w, "dismiss failed: "+err.Error(), http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemRoutinesChange,
+				"dismiss failed", fmt.Errorf("dismiss routine %d: %w", rid, err))
 			return "", false
 		}
 		return "dismissed routine", true
 	default:
-		http.Error(w, "unknown action", http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"unknown action", nil)
 		return "", false
 	}
 }

cmd/mavweb/shell.go

@@ -159,9 +159,10 @@ func renderPage(w http.ResponseWriter, t *template.Template, data any) {
 // requireCore answers whether the surface has a core to read. mavweb runs
 // without -core (voice-only), and every page that needs mavend says so with a
 // 503 naming itself rather than a blank error.
-func requireCore(w http.ResponseWriter, core ipc.CoreAPI, surface string) bool {
+func requireCore(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, surface string) bool {
 	if core == nil {
-		http.Error(w, surface+" disabled (no -core)", http.StatusServiceUnavailable)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemCoreUnavailable,
+			surface+" disabled (no -core)", nil)
 		return false
 	}
 	return true
@@ -169,11 +170,12 @@ func requireCore(w http.ResponseWriter, core ipc.CoreAPI, surface string) bool {
 
 // stepUpGate reports whether the caller may proceed through the AuthStepUp
 // gate, writing the 403 itself when it may not. See stepUpOK for the policy.
-func stepUpGate(w http.ResponseWriter, session *webauthn.PasskeySession, requireStepUp bool) bool {
+func stepUpGate(w http.ResponseWriter, r *http.Request, session *webauthn.PasskeySession, requireStepUp bool) bool {
 	if stepUpOK(session, requireStepUp) {
 		return true
 	}
-	http.Error(w, "step-up required: assert a passkey first", http.StatusForbidden)
+	writeProblem(w, r, http.StatusForbidden, problemStepUpRequired,
+		"step-up required: assert a passkey first", nil)
 	return false
 }
 

cmd/mavweb/tasks.go

@@ -5,7 +5,6 @@ import (
 	_ "embed"
 	"errors"
 	"fmt"
-	"log"
 	"net/http"
 	"strconv"
 	"strings"
@@ -88,7 +87,7 @@ func rowOf(t ipc.Task) taskRow {
 // from something she read into work he owns. That review step is why derived
 // tasks are captured as candidates in the first place.
 func handleTasks(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
-	if !requireCore(w, core, "tasks") {
+	if !requireCore(w, r, core, "tasks") {
 		return
 	}
 	ctx := r.Context()
@@ -97,15 +96,14 @@ func handleTasks(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 		var err error
 		msg, err = applyTaskPost(ctx, core, r)
 		if err != nil {
-			log.Printf("tasks: %v", err)
-			errMsg = err.Error()
+			errMsg = inlineProblem(r, problemCoreChangeFailed, taskPublicMessage(err), err)
 		}
 	}
 
 	all, err := core.ListTasks(ctx, "")
 	if err != nil {
-		log.Printf("tasks: list: %v", err)
-		http.Error(w, "tasks error: "+err.Error(), http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"tasks unavailable", fmt.Errorf("list tasks: %w", err))
 		return
 	}
 	// Live rows are ordered by the same ranker the spoken list uses, so the page
@@ -162,6 +160,39 @@ func handleTasks(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 	}{msg, errMsg, tasks.Stalls(live, now()), cands, open, resolved, resolvedTotal > len(resolved)})
 }
 
+// taskInputError is a form/domain refusal safe to show back to the owner. IPC,
+// storage and transport errors never use this type and therefore receive the
+// generic task failure text plus a request reference.
+type taskInputError struct{ message string }
+
+func (e *taskInputError) Error() string { return e.message }
+
+func taskInput(message string) error { return &taskInputError{message: message} }
+
+func taskInputf(format string, args ...any) error {
+	return &taskInputError{message: fmt.Sprintf(format, args...)}
+}
+
+type taskPartialError struct {
+	public string
+	err    error
+}
+
+func (e *taskPartialError) Error() string { return e.public + ": " + e.err.Error() }
+func (e *taskPartialError) Unwrap() error { return e.err }
+
+func taskPublicMessage(err error) string {
+	var input *taskInputError
+	if errors.As(err, &input) {
+		return input.message
+	}
+	var partial *taskPartialError
+	if errors.As(err, &partial) {
+		return partial.public
+	}
+	return "task update failed"
+}
+
 // applyTaskPost performs one write and returns the message to show. A bad
 // request returns an error, which the page renders inline rather than as a
 // bare 400 — this is a form surface, not an API.
@@ -170,7 +201,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 	if action == "add" {
 		text := strings.TrimSpace(r.FormValue("text"))
 		if text == "" {
-			return "", errors.New("empty task text")
+			return "", taskInput("empty task text")
 		}
 		req := ipc.CaptureTaskReq{Text: text, Source: "tap:web", Status: "open", Ts: now()}
 		wgt, err := formWeight(r)
@@ -198,7 +229,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 
 	id, err := strconv.ParseInt(r.FormValue("id"), 10, 64)
 	if err != nil {
-		return "", errors.New("invalid id")
+		return "", taskInput("invalid id")
 	}
 
 	if action == "promote" {
@@ -214,7 +245,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 		// is not editable here: that ladder is one-way and has its own buttons.
 		text := strings.TrimSpace(r.FormValue("text"))
 		if text == "" {
-			return "", errors.New("empty task text")
+			return "", taskInput("empty task text")
 		}
 		wgt, err := formWeight(r)
 		if err != nil {
@@ -230,9 +261,9 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 		case errors.Is(err, ipc.ErrTaskDuplicate):
 			// Naming the collision instead of merging: two live rows carry two
 			// provenances, and picking one is not the page's call.
-			return "", errors.New("another open task already says this — drop one of the two")
+			return "", taskInput("another open task already says this — drop one of the two")
 		case errors.Is(err, ipc.ErrTaskResolved):
-			return "", errors.New("a resolved task keeps the text it was finished under")
+			return "", taskInput("a resolved task keeps the text it was finished under")
 		default:
 			return "", err
 		}
@@ -247,7 +278,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 	case "drop":
 		status, msg = "dropped", "dropped task"
 	default:
-		return "", fmt.Errorf("unknown action %q", action)
+		return "", taskInputf("unknown action %q", action)
 	}
 	if err := core.SetTaskStatus(ctx, id, status, now(), "tap:web"); err != nil {
 		return "", statusWriteErr(err)
@@ -257,7 +288,7 @@ func applyTaskPost(ctx context.Context, core ipc.CoreAPI, r *http.Request) (stri
 
 // errNoDoneWhen — the refusal has to name what is missing, or the button looks
 // broken. The field it asks for arrives with the intake form (Vikunja #511).
-var errNoDoneWhen = errors.New("write a definition of done before confirming this candidate")
+var errNoDoneWhen = taskInput("write a definition of done before confirming this candidate")
 
 // statusWriteErr translates a SetTaskStatus failure into what the page says.
 func statusWriteErr(err error) error {
@@ -281,11 +312,11 @@ func statusWriteErr(err error) error {
 func promoteCandidate(ctx context.Context, core ipc.CoreAPI, r *http.Request, id int64) (string, error) {
 	doneWhen := strings.TrimSpace(r.FormValue("done_when"))
 	if doneWhen == "" {
-		return "", errors.New("write a definition of done — what has to be true for this to be finished")
+		return "", taskInput("write a definition of done — what has to be true for this to be finished")
 	}
 	text := strings.TrimSpace(r.FormValue("text"))
 	if text == "" {
-		return "", errors.New("empty task text")
+		return "", taskInput("empty task text")
 	}
 	due, err := formDue(r, now())
 	if err != nil {
@@ -326,7 +357,7 @@ func promoteCandidate(ctx context.Context, core ipc.CoreAPI, r *http.Request, id
 	if _, err := core.CreateReminder(ctx, fire, text, ""); err != nil {
 		// The task IS promoted; only the reminder failed. Saying "confirmed"
 		// and nothing else would leave him expecting a nudge that will not come.
-		return "", fmt.Errorf("confirmed, but the reminder did not save: %w", err)
+		return "", &taskPartialError{public: "task confirmed, but the reminder did not save", err: err}
 	}
 	return "confirmed, and maven will remind you that morning", nil
 }
@@ -343,15 +374,15 @@ func resolveBlocker(ctx context.Context, core ipc.CoreAPI, field string) (string
 	ref, err := core.ResolveEntity(ctx, name, []string{"person"})
 	switch {
 	case errors.Is(err, ipc.ErrNotImplemented):
-		return "", errors.New("no identity service here, so blocked-on cannot be stored — leave it empty")
+		return "", taskInput("no identity service here, so blocked-on cannot be stored — leave it empty")
 	case errors.Is(err, ipc.ErrNoEntity):
-		return "", fmt.Errorf("nexus does not know %q", name)
+		return "", taskInputf("nexus does not know %q", name)
 	case err != nil:
 		return "", fmt.Errorf("resolving %q: %w", name, err)
 	case ref.Ambiguous:
 		// Asking, not picking: a task blocked on the wrong person is a
 		// mistake nobody can see afterwards.
-		return "", fmt.Errorf("%q matches %s — say which", name, strings.Join(ref.Candidates, ", "))
+		return "", taskInputf("%q matches %s — say which", name, strings.Join(ref.Candidates, ", "))
 	}
 	return ref.ID, nil
 }
@@ -366,7 +397,7 @@ func formWeight(r *http.Request) (int, error) {
 	}
 	wgt, err := strconv.Atoi(v)
 	if err != nil || wgt < 0 {
-		return 0, fmt.Errorf("bad weight %q", v)
+		return 0, taskInputf("bad weight %q", v)
 	}
 	if wgt > tasks.MaxWeight {
 		wgt = tasks.MaxWeight
@@ -383,7 +414,7 @@ func formDue(r *http.Request, now time.Time) (*time.Time, error) {
 	}
 	due, err := time.ParseInLocation("2006-01-02", d, now.Location())
 	if err != nil {
-		return nil, fmt.Errorf("bad due date %q", d)
+		return nil, taskInputf("bad due date %q", d)
 	}
 	return &due, nil
 }

cmd/mavweb/tasks_test.go

@@ -191,6 +191,24 @@ func TestHandleTasksRejectsBadPost(t *testing.T) {
 	}
 }
 
+func TestHandleTasksSanitizesCoreWriteFailure(t *testing.T) {
+	core := &fakeTaskCore{captureErr: fmt.Errorf("sqlite /private/maven.db: key material rejected")}
+	form := url.Values{"action": {"add"}, "text": {"что-то"}}
+	req := httptest.NewRequest(http.MethodPost, "/tasks", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec := httptest.NewRecorder()
+	handleTasks(rec, req, core)
+	body := rec.Body.String()
+	for _, want := range []string{"task update failed", string(problemCoreChangeFailed), "request "} {
+		if !strings.Contains(body, want) {
+			t.Errorf("sanitized task error missing %q: %s", want, body)
+		}
+	}
+	if strings.Contains(body, "/private/maven.db") || strings.Contains(body, "key material") {
+		t.Errorf("task page disclosed the core error: %s", body)
+	}
+}
+
 func TestHandleTasksNoCore(t *testing.T) {
 	rec := httptest.NewRecorder()
 	handleTasks(rec, httptest.NewRequest(http.MethodGet, "/tasks", nil), nil)

cmd/mavweb/tools.go

@@ -3,8 +3,8 @@ package main
 import (
 	"cmp"
 	_ "embed"
+	"fmt"
 	"html/template"
-	"log"
 	"net/http"
 	"strings"
 	"time"
@@ -32,13 +32,13 @@ var toolsTmpl = parsePage("tools", toolsHTML, template.FuncMap{
 // shell-word parsing; the box owner controls this input, quote a wrapper script
 // if an arg needs spaces).
 func handleTools(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
-	if !requireCore(w, core, "tools") {
+	if !requireCore(w, r, core, "tools") {
 		return
 	}
 	ctx := r.Context()
 	var msg string
 	if r.Method == http.MethodPost {
-		if !stepUpGate(w, session, requireStepUp) {
+		if !stepUpGate(w, r, session, requireStepUp) {
 			return
 		}
 		action := r.FormValue("action")
@@ -49,54 +49,59 @@ func handleTools(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, sessi
 			cmd := strings.Fields(r.FormValue("cmd"))
 			destructive := r.FormValue("destructive") != ""
 			if name == "" || len(cmd) == 0 {
-				http.Error(w, "name and cmd required", http.StatusBadRequest)
+				writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+					"name and cmd required", nil)
 				return
 			}
 			if err := core.EnableTool(ctx, name, cmd, destructive, scope, time.Now()); err != nil {
-				log.Printf("tools: enable %q: %v", name, err)
-				http.Error(w, "enable failed: "+err.Error(), http.StatusBadGateway)
+				writeProblem(w, r, http.StatusBadGateway, problemToolsChange,
+					"enable failed", fmt.Errorf("enable tool %q: %w", name, err))
 				return
 			}
 			msg = "enabled " + name
 		case "disable":
 			if name == "" {
-				http.Error(w, "name required", http.StatusBadRequest)
+				writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+					"name required", nil)
 				return
 			}
 			if err := core.DisableTool(ctx, name); err != nil {
-				log.Printf("tools: disable %q: %v", name, err)
-				http.Error(w, "disable failed: "+err.Error(), http.StatusBadGateway)
+				writeProblem(w, r, http.StatusBadGateway, problemToolsChange,
+					"disable failed", fmt.Errorf("disable tool %q: %w", name, err))
 				return
 			}
 			msg = "disabled " + name
 		case "dismiss":
 			if name == "" {
-				http.Error(w, "name required", http.StatusBadRequest)
+				writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+					"name required", nil)
 				return
 			}
 			if err := core.DeleteTool(ctx, name); err != nil {
-				log.Printf("tools: dismiss %q: %v", name, err)
-				http.Error(w, "dismiss failed: "+err.Error(), http.StatusBadGateway)
+				writeProblem(w, r, http.StatusBadGateway, problemToolsChange,
+					"dismiss failed", fmt.Errorf("dismiss tool %q: %w", name, err))
 				return
 			}
 			msg = "dismissed " + name
 		default:
-			http.Error(w, "unknown action", http.StatusBadRequest)
+			writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+				"unknown action", nil)
 			return
 		}
 	}
 	proposed, err1 := core.ListTools(ctx, "proposed")
 	enabled, err2 := core.ListTools(ctx, "enabled")
 	if err := cmp.Or(err1, err2); err != nil {
-		log.Printf("tools: %v", err)
-		http.Error(w, "core read failed", http.StatusBadGateway)
+		writeProblem(w, r, http.StatusBadGateway, problemCoreReadFailed,
+			"core read failed", fmt.Errorf("list tools: %w", err))
 		return
 	}
 	// MCP is off by default and an older core may not know the method at all,
 	// so a failure here renders an empty section rather than breaking the page.
 	servers, err := core.MCPServers(ctx)
 	if err != nil {
-		log.Printf("tools: mcp servers: %v", err)
+		logProblem(r, http.StatusOK, problemCoreReadFailed,
+			"MCP server status unavailable", fmt.Errorf("read MCP server status: %w", err))
 		servers = nil
 	}
 	// Enabled rows are shown grouped by capability domain (Vikunja #452). A

cmd/mavweb/voiceproxy.go

@@ -1,9 +1,9 @@
 package main
 
 import (
-	"context"
 	"encoding/binary"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log"
@@ -12,22 +12,26 @@ import (
 	"net/url"
 	"time"
 
-	"github.com/coder/websocket"
 	"github.com/kami/maven/internal/audio"
 	"github.com/kami/maven/internal/voice"
 	"github.com/kami/maven/internal/webauthn"
 )
 
-// The two proxies onto mavend's voice port: GET /ws streams turns over a
-// websocket, POST /api/ptt does one turn over plain HTTP. Both carry the same
-// step-up gate, because speaking an act is not a smaller act than typing one
-// (Vikunja #317). The length-prefixed framing they share is at the bottom.
+// POST /api/ptt proxies one turn onto mavend's voice port. It carries the same
+// step-up gate as typed chat, because speaking an act is not a smaller act than
+// typing one (Vikunja #317). The length-prefixed voice framing is at the bottom.
 
 // maxFrame caps a single voice frame in either direction.
 const maxFrame = 64 << 20
 
-// pushToTalk builds the one request either proxy sends. Surface is
-// SurfacePCClient for both: the browser is standing in for the PC client.
+// maxPTTAudioBytes is ten minutes of canonical 16 kHz mono int16 PCM. A PTT
+// turn should be seconds, but the generous cap preserves long dictation while
+// keeping both the HTTP allocation and the base64-expanded voice frame bounded.
+// Meeting capture has its own streaming/blob path and does not use this route.
+const maxPTTAudioBytes int64 = 10 * 60 * 16000 * 2
+
+// pushToTalk builds the request the HTTP proxy sends. SurfacePCClient records
+// that the browser is standing in for the PC client.
 func pushToTalk(pcm []byte) voice.Request {
 	return voice.Request{
 		ID:     uint64(time.Now().UnixNano()),
@@ -40,95 +44,30 @@ func pushToTalk(pcm []byte) voice.Request {
 	}
 }
 
-func handleWS(w http.ResponseWriter, r *http.Request, voiceAddr string, session *webauthn.PasskeySession, requireStepUp bool) {
-	if !stepUpGate(w, session, requireStepUp) {
-		return
-	}
-	conn, err := websocket.Accept(w, r, &websocket.AcceptOptions{
-		OriginPatterns: []string{"*"},
-	})
-	if err != nil {
-		log.Printf("ws accept: %v", err)
-		return
-	}
-	defer conn.Close(websocket.StatusNormalClosure, "bye")
-
-	ctx := r.Context()
-
-	var d net.Dialer
-	tc, err := d.DialContext(ctx, "tcp", voiceAddr)
-	if err != nil {
-		log.Printf("dial voice: %v", err)
-		writeWSErr(conn, ctx, "voice unavailable")
-		return
-	}
-	defer tc.Close()
-
-	for {
-		_, msg, err := conn.Read(ctx)
-		if err != nil {
-			log.Printf("ws read: %v", err)
-			return
-		}
-		if len(msg) < 4 {
-			log.Printf("ws msg too short (%d bytes)", len(msg))
-			continue
-		}
-
-		log.Printf("ws got %d bytes from client", len(msg))
-		req := pushToTalk(msg)
-		if err := writeFrame(tc, &req); err != nil {
-			log.Printf("write voice req: %v", err)
-			return
-		}
-
-		// Read frames until we get the matching Response (handling any interleaved Pushes)
-		for {
-			resp, push, err := readOneFrame(tc)
-			if err != nil {
-				log.Printf("read voice: %v", err)
-				return
-			}
-			if push != nil {
-				data, _ := json.Marshal(push)
-				conn.Write(ctx, websocket.MessageText, data)
-				continue
-			}
-			if resp.Error != nil {
-				writeWSErr(conn, ctx, resp.Error.Message)
-				break
-			}
-			var pttResp voice.PushToTalkResp
-			if err := json.Unmarshal(resp.Result, &pttResp); err != nil {
-				log.Printf("unmarshal resp: %v", err)
-				break
-			}
-			if pttResp.ReplyText != "" {
-				conn.Write(ctx, websocket.MessageText, []byte(pttResp.ReplyText))
-			}
-			if len(pttResp.ReplyAudio.Bytes) > 0 {
-				conn.Write(ctx, websocket.MessageBinary, pttResp.ReplyAudio.Bytes)
-			}
-			break
-		}
-	}
-}
-
 func handlePTT(w http.ResponseWriter, r *http.Request, voiceAddr string, session *webauthn.PasskeySession, requireStepUp bool) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", 405)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
-	if !stepUpGate(w, session, requireStepUp) {
+	if !stepUpGate(w, r, session, requireStepUp) {
 		return
 	}
-	body, err := io.ReadAll(r.Body)
+	body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, maxPTTAudioBytes))
 	if err != nil {
-		http.Error(w, err.Error(), 400)
+		var tooLarge *http.MaxBytesError
+		if errors.As(err, &tooLarge) {
+			writeProblem(w, r, http.StatusRequestEntityTooLarge, problemPayloadTooLarge,
+				"audio exceeds the ten-minute PTT limit", err)
+			return
+		}
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"read audio", fmt.Errorf("read PTT audio: %w", err))
 		return
 	}
 	if len(body) < 4 {
-		http.Error(w, "too short", 400)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"audio too short", nil)
 		return
 	}
 
@@ -137,36 +76,38 @@ func handlePTT(w http.ResponseWriter, r *http.Request, voiceAddr string, session
 	var d net.Dialer
 	tc, err := d.DialContext(r.Context(), "tcp", voiceAddr)
 	if err != nil {
-		log.Printf("ptt dial voice: %v", err)
-		http.Error(w, "voice unavailable", 503)
+		writeProblem(w, r, http.StatusServiceUnavailable, problemVoiceUnavailable,
+			"voice unavailable", fmt.Errorf("dial voice service: %w", err))
 		return
 	}
 	defer tc.Close()
 
 	req := pushToTalk(body)
 	if err := writeFrame(tc, &req); err != nil {
-		log.Printf("ptt write: %v", err)
-		http.Error(w, err.Error(), 500)
+		writeProblem(w, r, http.StatusBadGateway, problemVoiceTransport,
+			"voice request failed", fmt.Errorf("write voice request: %w", err))
 		return
 	}
 
 	for {
 		resp, push, err := readOneFrame(tc)
 		if err != nil {
-			log.Printf("ptt read: %v", err)
-			http.Error(w, err.Error(), 500)
+			writeProblem(w, r, http.StatusBadGateway, problemVoiceTransport,
+				"voice response failed", fmt.Errorf("read voice response: %w", err))
 			return
 		}
 		if push != nil {
 			continue
 		}
 		if resp.Error != nil {
-			http.Error(w, resp.Error.Message, 500)
+			writeProblem(w, r, http.StatusBadGateway, problemVoiceResponse,
+				"voice turn failed", fmt.Errorf("voice RPC error: %s", resp.Error.Message))
 			return
 		}
 		var pttResp voice.PushToTalkResp
 		if err := json.Unmarshal(resp.Result, &pttResp); err != nil {
-			http.Error(w, err.Error(), 500)
+			writeProblem(w, r, http.StatusBadGateway, problemVoiceResponse,
+				"voice response failed", fmt.Errorf("decode voice response: %w", err))
 			return
 		}
 		w.Header().Set("Content-Type", "audio/l16;rate=16000;channels=1")
@@ -182,10 +123,6 @@ func handlePTT(w http.ResponseWriter, r *http.Request, voiceAddr string, session
 	}
 }
 
-func writeWSErr(conn *websocket.Conn, ctx context.Context, msg string) {
-	conn.Write(ctx, websocket.MessageText, []byte(`{"error":"`+msg+`"}`))
-}
-
 func writeFrame(w io.Writer, v any) error {
 	body, err := json.Marshal(v)
 	if err != nil {

cmd/mavweb/webauthn.go

@@ -92,8 +92,8 @@ var passkeyTmpl = parsePage("passkey", passkeyPageHTML, nil)
 func (h *PasskeyHandle) RegisterBegin(w http.ResponseWriter, r *http.Request) {
 	opts, challenge, err := h.rp.CreationOptions([]byte("maven-user"), "maven user")
 	if err != nil {
-		log.Printf("webauthn: register begin: %v", err)
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		writeProblem(w, r, http.StatusInternalServerError, problemWebAuthnBegin,
+			"passkey registration could not start", fmt.Errorf("webauthn register begin: %w", err))
 		return
 	}
 	w.Header().Set("Content-Type", "application/json")
@@ -102,7 +102,8 @@ func (h *PasskeyHandle) RegisterBegin(w http.ResponseWriter, r *http.Request) {
 
 func (h *PasskeyHandle) RegisterFinish(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
 	var body struct {
@@ -110,7 +111,8 @@ func (h *PasskeyHandle) RegisterFinish(w http.ResponseWriter, r *http.Request) {
 		Credential map[string]any `json:"credential"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		http.Error(w, "bad request: "+err.Error(), http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"invalid registration request", fmt.Errorf("decode webauthn registration: %w", err))
 		return
 	}
 	save := func(id string, publicKey []byte, _ []byte, _ string) error {
@@ -118,8 +120,8 @@ func (h *PasskeyHandle) RegisterFinish(w http.ResponseWriter, r *http.Request) {
 	}
 	credID, err := h.rp.FinishRegistration(save, body.Challenge, body.Credential)
 	if err != nil {
-		log.Printf("webauthn: register finish: %v", err)
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemWebAuthnFinish,
+			"passkey registration failed", fmt.Errorf("webauthn register finish: %w", err))
 		return
 	}
 	log.Printf("webauthn: registered credential %s", credID)
@@ -140,8 +142,8 @@ func (h *PasskeyHandle) RegisterFinish(w http.ResponseWriter, r *http.Request) {
 func (h *PasskeyHandle) AssertBegin(w http.ResponseWriter, r *http.Request) {
 	opts, challenge, err := h.rp.AssertionOptions()
 	if err != nil {
-		log.Printf("webauthn: assert begin: %v", err)
-		http.Error(w, err.Error(), http.StatusInternalServerError)
+		writeProblem(w, r, http.StatusInternalServerError, problemWebAuthnBegin,
+			"passkey assertion could not start", fmt.Errorf("webauthn assert begin: %w", err))
 		return
 	}
 	w.Header().Set("Content-Type", "application/json")
@@ -150,7 +152,8 @@ func (h *PasskeyHandle) AssertBegin(w http.ResponseWriter, r *http.Request) {
 
 func (h *PasskeyHandle) AssertFinish(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
-		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		writeProblem(w, r, http.StatusMethodNotAllowed, problemMethodNotAllowed,
+			"POST only", nil)
 		return
 	}
 	var body struct {
@@ -176,7 +179,8 @@ func (h *PasskeyHandle) AssertFinish(w http.ResponseWriter, r *http.Request) {
 		Explicit bool `json:"explicit"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
-		http.Error(w, "bad request: "+err.Error(), http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemInvalidRequest,
+			"invalid assertion request", fmt.Errorf("decode webauthn assertion: %w", err))
 		return
 	}
 
@@ -189,8 +193,8 @@ func (h *PasskeyHandle) AssertFinish(w http.ResponseWriter, r *http.Request) {
 
 	credID, err := h.rp.FinishAssertion(lookup, update, body.Challenge, body.Credential)
 	if err != nil {
-		log.Printf("webauthn: assert finish: %v", err)
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		writeProblem(w, r, http.StatusBadRequest, problemWebAuthnFinish,
+			"passkey assertion failed", fmt.Errorf("webauthn assert finish: %w", err))
 		return
 	}
 
@@ -201,8 +205,8 @@ func (h *PasskeyHandle) AssertFinish(w http.ResponseWriter, r *http.Request) {
 		ctx, cancel := context.WithTimeout(r.Context(), 5*time.Second)
 		defer cancel()
 		if err := h.assertFn.AssertStepUp(ctx); err != nil {
-			log.Printf("webauthn: assert step-up: %v", err)
-			http.Error(w, "step-up assertion failed", http.StatusBadGateway)
+			writeProblem(w, r, http.StatusBadGateway, problemWebAuthnStepUp,
+				"step-up assertion failed", fmt.Errorf("assert step-up in core: %w", err))
 			return
 		}
 	}

deploy/README.md

@@ -11,6 +11,11 @@ dir and read-only models.
 cp deploy/db_key.env.example deploy/db_key.env
 printf 'MAVEN_DB_KEY=%s\n' "$(openssl rand 32 | base64 -w0)" > deploy/db_key.env
 
+# 1b. review the complete secret inventory. Copy homesrv values to
+# deploy/telegram.env, ambient enable/token values to .env, and workpc values
+# to the destinations named in the example. Live blocks reject empty secrets.
+cp deploy/telegram.env.example deploy/telegram.env
+
 # 2. build + start
 docker compose build
 docker compose up -d

deploy/asoundrc

@@ -0,0 +1,27 @@
+# mavmic — the Scarlett Solo 4th Gen microphone alone, for mavwaked.
+#
+# The card's USB capture stream is 4 channels, not 2:
+#
+#   ch1  PCM 01 <- DSP 1 <- Analogue 1   the line/instrument jack
+#   ch2  PCM 02 <- DSP 2 <- Analogue 2   the XLR microphone
+#   ch3  PCM 03 <- Mix C  <- PCM 1       loopback of workstation playback, L
+#   ch4  PCM 04 <- Mix D  <- PCM 2       loopback of workstation playback, R
+#
+# plughw asks ALSA for mono and gets a downmix of all four, so half of what
+# mavwaked scored was whatever the workstation was playing, at unity gain and
+# untouched by the front-panel gain knob. Measured 2026-08-09 with the gain at
+# 0 and a show playing: ch1 rms 0.00000, ch2 0.00002, ch3 0.08834, ch4 0.09045.
+#
+# Air and 48V are named for Line In 2, and both belong to a microphone preamp,
+# so Analogue 2 is the XLR input on this card and Analogue 1 is the jack.
+#
+# This takes slave channel 1 and nothing else. It does not change the card, so
+# the loopback stays available to everything else on the box.
+pcm.mavmic {
+    type plug
+    slave {
+        pcm "hw:CARD=Gen,DEV=0"
+        channels 4
+    }
+    ttable.0.1 1
+}

deploy/cw2/serve.py

@@ -20,6 +20,7 @@ every stutter on the way there.
 """
 
 import hmac
+import ipaddress
 import json
 import logging
 import os
@@ -71,6 +72,18 @@ def authorised(headers):
     return hmac.compare_digest(got, "Bearer " + TOKEN)
 
 
+def validate_listener_auth(host, token):
+    """Refuse a network listener without its bearer boundary."""
+    try:
+        loopback = ipaddress.ip_address(host).is_loopback
+    except ValueError:
+        loopback = host.casefold() == "localhost"
+    if not loopback and not token.strip():
+        raise ValueError(
+            f"CW2_TOKEN is required while CW2_HOST={host!r} is reachable from the network"
+        )
+
+
 class Handler(BaseHTTPRequestHandler):
     protocol_version = "HTTP/1.1"
 
@@ -142,8 +155,10 @@ class Handler(BaseHTTPRequestHandler):
 
 
 def main():
-    if not TOKEN:
-        log.warning("no CW2_TOKEN set: anything on the LAN can post audio here")
+    try:
+        validate_listener_auth(HOST, TOKEN)
+    except ValueError as exc:
+        raise SystemExit(str(exc)) from exc
     # Bind before loading, so a restart answers 503 rather than refusing the
     # connection. Both make Maven fall back, but only one of them says why.
     srv = ThreadingHTTPServer((HOST, PORT), Handler)

deploy/cw2/test_serve.py

@@ -0,0 +1,24 @@
+import unittest
+
+import serve
+
+
+class ListenerAuthTest(unittest.TestCase):
+    def test_network_listener_requires_token(self):
+        for host in ("0.0.0.0", "192.168.1.105", "::"):
+            for token in ("", "   "):
+                with self.subTest(host=host, token=token):
+                    with self.assertRaises(ValueError):
+                        serve.validate_listener_auth(host, token)
+
+    def test_loopback_listener_may_be_explicitly_unauthenticated(self):
+        for host in ("127.0.0.1", "::1", "localhost"):
+            with self.subTest(host=host):
+                serve.validate_listener_auth(host, "")
+
+    def test_network_listener_accepts_token(self):
+        serve.validate_listener_auth("0.0.0.0", "secret")
+
+
+if __name__ == "__main__":
+    unittest.main()

deploy/mavend.json

@@ -31,14 +31,14 @@
     "rule — three things in series that have each failed once, and when they do",
     "a sev4 nudge has nowhere to go. ntfy shares none of them: it is reached",
     "directly, no relay.",
-    "It is not only a spare. The routing table sends sev3-away and away",
-    "reminders here and NOWHERE else, so with this block absent those two",
-    "routes hit a nil sink and vanish without a log or an outbox row.",
+    "It is the preferred away reach. Reminders fall back to Telegram in order,",
+    "and every missing reach is recorded in the outbox rather than disappearing.",
     "The credential is an ntfy access token, scoped write-only to this one",
     "topic, so a popped sink can push to it and cannot read it back. Set it in",
     "deploy/telegram.env beside the telegram secrets; that file is gitignored."
   ],
   "ntfy": {
+    "disabled": true,
     "base_url": "https://ntfy.kvmx.ru",
     "topic": "maven",
     "token": "${NTFY_TOKEN}"
@@ -76,7 +76,9 @@
     "resident model without saying so. Deleting this block restores exactly",
     "the behaviour homesrv had before it existed.",
     "Addressed by LAN address, not container name: mavgpud runs on another",
-    "machine and there is no shared docker network to name it on."
+    "machine and there is no shared docker network to name it on.",
+    "model_disabled keeps only this model arm dark until MAVEN_GPU_TOKEN is",
+    "provisioned; the independently authenticated STT arm below stays live."
   ],
   "//workstation.stt": [
     "CrisperWhisper 2.0 turbo on the same machine, a second service on port",
@@ -93,7 +95,9 @@
     "The token is what stops anything on the LAN posting audio to that port."
   ],
   "workstation": {
+    "model_disabled": true,
     "url": "http://192.168.1.105:8080",
+    "token": "${MAVEN_GPU_TOKEN}",
     "probe": "15s",
     "timeout": "90s",
     "stt": {

deploy/mavgpud.json

@@ -1,5 +1,14 @@
 {
   "listen": ":8080",
+  "//token_file": [
+    "The bearer token every request must carry. homesrv is the client and it",
+    "is on the LAN, so this port cannot be loopback and the token is what",
+    "stops anything else on the network spending the card or reading /slots.",
+    "A path, never the token: mavgpud refuses to start when listen is",
+    "reachable from the network and this is unset.",
+    "Same value as MAVEN_GPU_TOKEN in homesrv's deploy/telegram.env."
+  ],
+  "token_file": "/home/kami/.config/mavgpud.token",
   "llama_addr": "127.0.0.1:10000",
   "llama_bin": "llama-server",
   "//llama_args": [

deploy/mavwaked.service

@@ -32,6 +32,7 @@
 # means out of this unit's own journal, never by guessing.
 #
 #   install: cp to ~/.config/systemd/user/ on workpc
+#            cp ../deploy/asoundrc to ~/.asoundrc on workpc
 #            systemctl --user enable --now mavwaked.service
 
 [Unit]
@@ -41,18 +42,35 @@ Requires=maven-voice-tunnel.service
 After=maven-voice-tunnel.service
 
 [Service]
-# card 0 is the fifine USB microphone. Named, and not "default", because the
-# default device follows whatever pipewire last decided and this daemon should
-# not change ears when he plugs in a headset.
+# The Scarlett Solo 4th Gen, and not the fifine. The fifine was the device
+# here for three days and mavwaked never logged one utterance in them, because
+# it returns RMS 0.00004 with its capture switch on and its ALSA volume at the
+# full 496 of 496. That silence is in the hardware, so no flag reaches it.
 #
-# plughw and not hw. mavwaked asks arecord for 16kHz mono, which is what the
-# whole pipeline is canonical in. The fifine offers 2 channels at 44100 or
-# 48000 and nothing else, so bare hw:0,0 dies on "Channels count non
-# available" before a frame is read. plughw puts ALSA's downmix and resampler
-# in front. Any replacement microphone wants the same treatment.
+# mavmic and not plughw:CARD=Gen,DEV=0. deploy/asoundrc defines mavmic and
+# carries the whole reason: the card's capture stream is 4 channels, and two of
+# them are a unity-gain loopback of everything the workstation plays. plughw
+# downmixes all four, so a TV show woke her with the gain knob at 0. Install
+# that file as ~/.asoundrc on workpc or this device does not resolve.
+#
+# Named CARD=Gen inside mavmic and not card 4, because a USB card number moves
+# when something else is replugged and this daemon must not change ears quietly.
+# Not "default" either: that follows whatever pipewire last decided.
+#
+# mavmic is a plug device and not hw. mavwaked asks arecord for 16kHz mono,
+# which is what the whole pipeline is canonical in. Neither microphone offers
+# it, so bare hw dies on "Channels count non available" before a frame is read.
+# Any replacement wants ALSA's resampler in front the same way.
+#
+# The mic is on the XLR, which is Analogue 2 on this card and not Analogue 1:
+# Air and 48V are both named for Line In 2 and both belong to a mic preamp.
+# Measured 2026-08-09 through mavmic at 16kHz mono, gain up: rms 0.01826 peak
+# 0.09290 spoken, against a 0.00031 preamp floor, and 0.00002 for the whole
+# stream with a show playing. Front-panel gain is still the thing to raise if
+# she mishears, and it is a knob, not a control ALSA exposes.
 Environment=LD_LIBRARY_PATH=%h/.local/lib
 ExecStart=%h/.local/bin/mavwaked \
-  -device plughw:0,0 \
+  -device mavmic \
   -addr 127.0.0.1:9100 \
   -lang ru \
   -vad-model %h/.local/share/maven/models/silero_vad.onnx \

deploy/telegram.env.example

@@ -10,3 +10,40 @@ TELEGRAM_CHAT_ID=
 #   ntfy token add --expires=never maven
 # Read access is not needed — mavend publishes and never subscribes.
 NTFY_TOKEN=
+
+# Bearer token for mavgpud, the workstation's GPU supervisor (V-673). It fronts
+# the big model on a LAN port, so the token is the whole boundary in front of
+# the card. Any long random string; mint one with:
+#   openssl rand -hex 32
+# The same value goes in a file on workpc, named by token_file in
+# deploy/mavgpud.json. Empty is valid only while workstation.model_disabled is
+# true; enabling the LAN model arm without it fails Maven's config validation.
+MAVEN_GPU_TOKEN=
+
+# Bearer token used by Maven when it sends audio to the workstation's
+# CrisperWhisper service. The matching CW2_TOKEN is installed on workpc; these
+# two values must be identical. Leaving both unset is only safe while that
+# remote STT service is bound to loopback or its STT block is disabled.
+MAVEN_STT_TOKEN=
+
+# Home Assistant is currently explicitly disabled in deploy/mavend.json. Keep
+# this name in the canonical inventory so enabling that block cannot turn into
+# a valid-looking configuration with an expanded-empty token.
+HA_TOKEN=
+
+# docker compose reads these from the repository-root `.env`, before it starts
+# containers; they are listed here even though their destination differs so
+# this remains the complete deployment inventory. Copy both lines to `.env`.
+# Enabling with an empty token fails startup; false is the explicit dark state.
+# MAVEN_AMBIENT_ENABLED=false
+# MAVEN_AMBIENT_TOKEN=
+
+# Workstation-side counterpart to MAVEN_STT_TOKEN. Install this line in the
+# EnvironmentFile named by deploy/mavgpud.service (currently
+# %h/Programs/cw2-service/cw2.env), not in homesrv's telegram.env.
+# CW2_TOKEN=
+
+# The encrypted database key has its own narrowly mounted file,
+# deploy/db_key.env, and its own generator in deploy/README.md. It is named
+# here so an operator auditing this one inventory sees every deployed secret.
+# MAVEN_DB_KEY=

docker-compose.yml

@@ -97,15 +97,17 @@ services:
     <<: *image
     # voice.bind is 0.0.0.0:9100 in deploy/mavend.json so mavweb can reach it
     # cross-container. Verified 2026-07-06.
-    # -ambient-token turns on POST /api/ambient (Vikunja #126): the phone posts
-    # notification text, mavweb keeps only a meeting time. Empty ⇒ no route at
-    # all, which is what a missing MAVEN_AMBIENT_TOKEN gives. The value comes
-    # from the gitignored .env docker compose reads for interpolation, NOT from
-    # an env_file — flags are interpolated before any service env exists.
+    # -ambient-enabled turns on POST /api/ambient (Vikunja #126): the phone posts
+    # notification text, mavweb keeps only a meeting time. The explicit enabled
+    # flag prevents an unset token from looking like an intentional dark state.
+    # Both values come from the gitignored .env docker compose reads for
+    # interpolation, NOT from an env_file — flags are interpolated before any
+    # service env exists.
     # Weakness worth naming: mavweb takes this as a flag, so it is visible in
     # `ps` inside this container, unlike the zenmoney and IMAP secrets which are
     # read from files.
     command: ["mavweb", "-addr", ":9201", "-voice", "mavend:9100", "-core", "/run/maven/mavend.sock",
+              "-ambient-enabled=${MAVEN_AMBIENT_ENABLED:-false}",
               "-ambient-token", "${MAVEN_AMBIENT_TOKEN:-}",
               "-nexus", "http://nexus:9740", "-praxis", "http://praxis:8989", "-hexis", "http://hexis:9741"]
     depends_on: [mavend]

docs/CLAUDE.md

@@ -0,0 +1,30 @@
+# docs/
+
+Everything an agent needs that is not a rule and not code. `CLAUDE.md` at the
+root carries the rules and points here. Nothing here restates a rule.
+
+The tier is the path, so staleness is visible from the filename.
+
+| path | holds | lifetime |
+| --- | --- | --- |
+| `docs/*.md` | living. One file per subsystem: the reasoning, corrected in place. Each carries `Last verified: <date> @ <sha>`. | until it is wrong |
+| `docs/evals/` | dated measurements, one file per measurement. **Never edited after the day.** A newer number is a new file. Indexed in `docs/evals/CLAUDE.md`, which marks each one live or superseded. | forever |
+| `docs/caveats/` | known limits, one entry per limit, each with a task id and a revisit trigger. Indexed in `docs/caveats/CLAUDE.md`. | until fixed, then deleted |
+| `docs/plans/` | the plan for one piece of work, frozen once it starts. Indexed in `docs/plans/CLAUDE.md`. | until the work lands |
+| `docs/archive/` | dead. Read by nobody by default. | forever |
+
+## Rules for this directory
+
+* One fact, one home. A measurement is cited from a living doc, never copied
+  into it. The two drift the moment they are both edited.
+* A living doc is corrected in place and its `Last verified` line moves with the
+  correction. Do not append a changelog to it.
+* A number in prose with no `docs/evals/` file behind it is an opinion.
+* Fixing something deletes its caveat. It does not edit the eval that found it.
+
+## Where a subsystem's reasoning lives
+
+`routing.md`, `language.md`, `world.md`, `offload.md`, `deployment.md`,
+`ecosystem.md`, `workflow.md`, `design.md`, `rearchitecture.md`,
+`determinism.md`, `protocol.md`, `handler-wiring.md`, `operations.md`, `qa.md`.
+The root `CLAUDE.md` says which one to read before touching what.

docs/caveats/CLAUDE.md

@@ -0,0 +1,46 @@
+# docs/caveats/
+
+One entry per known limit: something broken, deferred or unsafe that a session
+will otherwise walk into. An entry names what fails, who it costs, and the
+condition that makes it worth fixing.
+
+Two things do not belong here. The evidence is a dated file under `docs/evals/`.
+The reasoning behind a subsystem is its living doc directly under `docs/`. A
+caveat is the pointer between them plus the trigger.
+
+## Rules for this directory
+
+* One file per area, one `##` section per limit, each carrying its task id.
+* **A caveat with no revisit trigger is a complaint.** Give it one or delete it.
+* Closing a limit deletes its entry. It does not edit it to say "fixed", and it
+  never edits the frozen measurement it came from. The durable record of a fix
+  is the commit and the subsystem's living doc.
+* An entry whose task is closed but whose limit is still live is the failure
+  mode to watch for. The id joins the two directions, so check both.
+
+## Index
+
+Every entry below came from the 2026-08-10 deep audit
+(`docs/evals/2026-08-10-repo-audit.md`), except the last, which came from wiring
+the gate the audit asked for. Twelve of the twenty findings are fixed and have no
+entry. The unauthenticated mavgpud proxy was V-673. The 20 reachable advisories
+in the toolchain and `x/text` were V-682. The missing analyzers were V-694, and
+what they now report is the baseline entry under V-701. The invalid STT and
+weather responses were V-675/V-676, the stuck TCP close was V-679, and the
+unbounded PTT path was V-688. The two unguarded
+invariants were V-692 and V-693, and their guards are described in
+`docs/routing.md`. The complete secret inventory and fail-closed integration
+validation were V-691. The atomic reminder transition was V-678. The traceable,
+sanitized mavweb problem contract was V-689.
+
+| limit | severity |
+| --- | --- |
+| [Anyone past the proxy can enroll a passkey](security.md#enrollment) | high |
+| [Passkey credentials are rewritten in place](security.md#credentials) | medium |
+| [Dialogue persistence errors are swallowed](storage.md#dialogue) | medium |
+| [A recall miss scans two whole tables](storage.md#recall) | medium |
+| [Fact enrichment is a 20-call serial waterfall](workers.md#enrichment) | medium |
+| [Committed absolute paths pin the build to this box](config.md#paths) | medium |
+| [The analyzers pass against a baseline, not zero](dependencies.md#baseline) | medium |
+| [Domain packages depend on store and IPC types](layering.md#dtos) | low |
+| [Eleven symbols are unreachable](layering.md#deadcode) | low |

docs/caveats/config.md

@@ -0,0 +1,10 @@
+# Configuration and environment
+
+## Committed absolute paths pin the build to this box [#690] {#paths}
+
+Costs: `go.mod` replaces Hexis with `/home/kami/apps/hexis`, `start-maven.sh`
+hardcodes the checkout and the data directory, and `deploy/mavgpud.json` holds
+workstation model and Python paths. Vendoring hides the `go.mod` problem for an
+ordinary build. `-mod=mod`, `go mod tidy` and a fresh checkout all fail.
+Revisit when: anyone clones this repo elsewhere, or a `tidy` is needed.
+Workaround: build only from this checkout, with the vendor directory.

docs/caveats/dependencies.md

@@ -0,0 +1,13 @@
+# Dependencies
+
+## The analyzers pass against a baseline, not against zero [#701] {#baseline}
+
+Costs: `make lint` and `make deadcode` are wired and green (V-694), but green
+means "nothing new since 2026-08-11". The accepted set is 16 staticcheck
+findings and 13 unreachable symbols, listed with a reason each in
+`scripts/analyzers/*.baseline`. Three of the unreachable symbols must stay:
+[layering.md](layering.md#deadcode).
+Revisit when: V-701 sweeps the baseline, or a fix deletes an entry. The gate
+fails on an entry whose finding is gone, so the deletion is not optional.
+Workaround: none needed. Reachability claims are checkable now. Read the
+baseline before trusting that a target reporting clean means the tree is clean.

docs/caveats/layering.md

@@ -0,0 +1,25 @@
+# Layering and dead surface
+
+Neither entry breaks anything today. Both make a later change cost more than it
+should, which is why they are low and not medium.
+
+## Domain packages depend on store and IPC types [#685] {#dtos}
+
+Costs: dialogue exposes `store.DialogueSessionRow` in its port, the pure
+morning planner takes a `store.Fact`, and auth policy imports IPC method and
+caller types. There is no Go import cycle. A schema change reaches further than
+it should.
+Revisit when: the dialogue or fact schema changes, or a second transport
+appears beside IPC.
+Workaround: none needed. It compiles and it is correct.
+
+## Eleven symbols are unreachable [#686] {#deadcode}
+
+Costs: extra API and test surface, and comments that claim callers which no
+longer exist. Three of the eleven must not be deleted. `HisGender` is a
+documented seam tied to V-399. `AudioDuration` duplicates `internal/audio` and
+should call it. `CountWord` is a one-line alias nobody uses and can go.
+Revisit when: `deadcode` is wired into the audit gate, which needs the
+allowlist this entry describes. **An unannotated list invites deleting the
+three above.**
+Workaround: none needed.

docs/caveats/security.md

@@ -0,0 +1,26 @@
+# Security
+
+Both entries are mavweb's passkey seam. Assertion itself is sound and is not
+the problem: `userVerification` is required, and a sign count that does not
+increase is rejected.
+
+## Anyone past the proxy can enroll a passkey [#683] {#enrollment}
+
+Costs: registration is gated on nothing, so any client that reaches mavweb can
+enroll its own key and become him. Step-up is worse than per-client: one
+process-global `assertedAt` means every client inherits the same five-minute
+window after any successful assertion. The voice WebSocket accepts every
+origin, which makes cross-site use easier. V-317 covers which routes are gated
+and V-605 covers challenge-map growth. Neither covers this.
+Revisit when: mavweb is reachable from anything but the tunnel, and before any
+new credential is enrolled.
+Workaround: the reverse proxy is the only boundary today. That is the finding.
+
+## Passkey credentials are rewritten in place [#684] {#credentials}
+
+Costs: `os.WriteFile` over the live file. A crash, a full disk or an
+interrupted write corrupts every enrolled credential at once, and mavweb will
+not start afterwards.
+Revisit when: a second credential is enrolled, since the blast radius grows
+with the count. Sooner if the box loses power unexpectedly.
+Workaround: back the file up before enrolling.

docs/caveats/storage.md

@@ -0,0 +1,22 @@
+# Storage
+
+The DB seam: what it loses quietly, and what it reads more of than it needs.
+
+## Dialogue persistence errors are swallowed [#677] {#dialogue}
+
+Costs: restart continuity can vanish with nothing in the log, and a failed
+delete can bring stale conversation state back. Current-turn dialogue is
+unaffected, which is why this has never been noticed.
+Revisit when: a restart is reported as losing context. Sooner if a turn starts
+reading dialogue rows back to him.
+Workaround: none. The failure is invisible from outside.
+
+## A recall miss scans two whole tables [#681] {#recall}
+
+Costs: every missed recall reads all of `memory_vectors` and then decodes and
+sorts every note vector. Not an N+1, and the memory scan is cheap per losing
+row on purpose. The duplicated decode is the legacy notes path alone.
+Revisit when: the note count makes a miss measurably slow. Also when the two
+exclusion filters are proven to agree. `QueryNotes` uses `notHisWordsSQL` and
+`Search` uses `memory.NonRecallPrefix`. The fallback cannot go until they match.
+Workaround: none needed at today's row counts.

docs/caveats/workers.md

@@ -0,0 +1,13 @@
+# Background workers
+
+The entry is a tick doing expensive work it did not need to do.
+
+## Fact enrichment is a 20-call serial waterfall [#680] {#enrichment}
+
+Costs: each fact is resolved in turn and each ecosystem call can spend ten
+seconds. A slow but reachable Nexus holds one tick for minutes, so the worker
+stops observing its configured interval. V-647 covered the duplicate queue
+scan, not this.
+Revisit when: Nexus gets slow, or when a batch-resolution endpoint exists.
+Workaround: an unreachable Nexus is fine. It is the slow-but-answering case
+that hurts.

docs/deployment.md

@@ -78,7 +78,10 @@ vocabulary size. CW2's 51897 tokens shift seven special token ids. So CW2 is its
 own transformers service on port 8081 (`deploy/cw2/serve.py`).
 `stt.HTTPTranscriber` posts raw PCM to it with a bearer token, because audio is
 the most sensitive thing that crosses this seam. The switch is `workstation.stt`
-in `deploy/mavend.json`, and deleting the block sends every utterance to mavsttd.
+in `deploy/mavend.json`. A LAN URL with an empty token fails config validation;
+`workstation.stt.disabled: true` is the STT-only dark state;
+`workstation.disabled: true` disables both remote arms. The model has its own
+`model_disabled` switch because CW2 can remain live without the model proxy.
 
 **mavgpud runs that service as a second child.** This is not an optimisation.
 CW2 is a ROCm process on the same card, so it registers on the KFD like any
@@ -102,7 +105,7 @@ Text-to-speech has not moved. piper on homesrv is the only synthesizer.
 | `mavpoll` | Environment poller: netdata alarms, uptime-kuma, zenmoney, wireguard presence. Writes facts, sends nothing. Telegram is `internal/delivery/telegramsink`. |
 | `mavcaldav` | CalDAV calendar sync. |
 | `mavmaild` | Mail reader (IMAP, read-only). Holds the IMAP password, core never sees it. |
-| `mavgpud` | GPU supervisor. **Runs on workpc**, own unit `deploy/mavgpud.service`. Keeps llama-server loaded while the card is free (V-488). Maven never asks it for anything and reads `/health` through `llm.Pair`. |
+| `mavgpud` | GPU supervisor. **Runs on workpc**, own unit `deploy/mavgpud.service`. Keeps llama-server loaded while the card is free (V-488). Maven never asks it for anything and reads `/health` through `llm.Pair`. Its LAN port needs a bearer token in the file named by `token_file`, matching `MAVEN_GPU_TOKEN` on homesrv, or it refuses to start (V-673). |
 | `mavupdate` | Not a daemon. Operator CLI a human runs on the box to deploy a new build. |
 
 Two binaries have no Makefile target and neither is deployed. `mavseal` encrypts
@@ -166,9 +169,21 @@ the GPU. A model that will not load is logged and not fatal.
 `-barge-in` is not passed. The threshold is room-specific and this room has no
 number yet. Read the "suppressed while speaking" means out of the journal first.
 
-The device is `plughw:0,0` and not `hw:0,0`. The fifine offers 2 channels at
-44100 or 48000 and nothing else, and mavwaked asks arecord for 16kHz mono. Bare
-`hw` dies on "Channels count non available" before a frame is read.
+The device is `plughw:CARD=Gen,DEV=0`, the Scarlett Solo. It is `plughw` and
+not `hw` because mavwaked asks arecord for 16kHz mono. No microphone here
+offers that, so bare `hw` dies on "Channels count non available" before a
+frame is read. It is named `CARD=Gen` and not card 4 because a USB card number
+moves when something else is replugged.
+
+It used to be the fifine on card 0, and that cost three days. mavwaked logged
+zero completed utterances across them, before the wake word existed and after.
+The fifine returns RMS 0.00004 with its capture switch on and its ALSA volume
+at the full 496 of 496. That silence is in the hardware and no flag reaches
+it. Over the same eight seconds of speech the onboard ALC897 read 0.142 and
+the camera 0.289, both clipping at peak 1.0. The Scarlett read 0.003 clean.
+
+Check the level before blaming the gate. Stop the unit, run `arecord` against
+the device for five seconds, and measure. A live room floor reads near 0.001.
 
 The three `-wake-` flags require the keyword "Мэйвен" (V-487 stage two). Drop
 them and the loop runs open, which is what it did before. The threshold is the
@@ -196,6 +211,18 @@ rule.
 
 ## Web UI conventions
 
+Every HTTP response carries a server-generated `X-Request-ID`. Error responses
+use `application/problem+json` with three fields: a sanitized `error`, a stable
+low-cardinality `code`, and that `request_id`. `writeProblem` is the only error
+writer: it records the full wrapped error beside the same ID in the mavweb log,
+while implementation paths, transport messages and credentials never reach the
+browser. A page that can usefully degrade instead of failing keeps HTTP 200 and
+renders the same code/request reference beside its sanitized panel error.
+
+The `/ecosystem` panel uses its HTTP request ID as `X-Correlation-ID` on its
+direct Nexus, Praxis and Hexis reads. Calls routed through mavend retain
+mavend's action-scoped correlation contract instead.
+
 Server-rendered pages share `cmd/mavweb/static/ui.css` (served at `/ui.css`) and
 the shell partial in `cmd/mavweb/shell.html`. A page opens with
 `{{template "shellTop" "<page-key>"}}` and closes with `{{template "shellBottom"}}`,

docs/design.md

@@ -1,6 +1,6 @@
 # Maven — Design
 
-*Last verified: 2026-08-07 @ beb093a. Living doc: correct it in place, do not append.*
+*Last verified: 2026-08-13 @ a0e6643 + V-542 working tree. Living doc: correct it in place, do not append.*
 
 > Folded 2026-07-30 from `SPEC.md` (north star, 2026-07-03), `maven.md`
 > (consolidated decisions, 2026-06-30) and `ROADMAP.md` (execution plan,
@@ -338,6 +338,44 @@ one run-on thought:
 > вот что я нашла: вайфай пароль лежит в ящике стола, на какое время поставить
 > напоминание?
 
+#### Conversation context is independent of intent
+
+Decided 2026-08-13 (V-542). A conversation is a sequence of turns, not a run of
+one route label. The utterance "давай поболтаем: я купил новый монитор" may
+correctly produce a grounded fact, and the next question may correctly route as
+query. Neither decision is permission to discard the words that make "он" in
+the next turn mean the monitor.
+
+`dialogue.Session.Utterance` therefore stores the exact user turn separately
+from `Slots.Text`. Slots are intent payloads: a fact may normalize them, a
+stage-0 route may leave them empty, and a continuation may deliberately carry
+an older topic. None of those is a transcript. `Session.History` holds up to
+four prior turns in speaking order and is persisted with the session; blobs
+written by older binaries fall back to their old `Slots.Text` field until they
+expire.
+
+`Session.Conversational` is orthogonal state too. A chat route sets it, as does
+an explicit cooperative opener such as "давай поговорим" even when the
+substantive clause routes fact. The opener is recognised from the closed marker
+plus `lexicon.ConversationVerbs`, with Russian forms compared by `morph`; there
+is no route regex or substring carve-out. Conversational state carries across
+later intents and uses the existing 15-minute chat TTL instead of expiring the
+anchor after two minutes.
+
+After routing, `followUpMerge` may use state the router cannot see. A routed
+query containing an anaphoric pronoun and a live prior transcript becomes chat,
+with query-only source provenance cleared. `PhraseChat` then receives the prior
+turns and the current utterance exactly once. This is narrower than adding the
+transcript to every query source: a non-anaphoric calendar, recall or world
+question still walks its evidence chain unchanged. Acts are never widened by
+this rule; an unresolved "выключи его" still has no executable function and
+must fail closed.
+
+An explicit conversational opener does not suppress a substantive side effect.
+The monitor statement remains a fact and also becomes the dialogue anchor.
+Conversation state and save-where are orthogonal, so making the first route
+chat would merely lose a true fact to work around a session defect.
+
 ### save-where — the two-memory routing axis
 
 One discriminator: **does the loop evaluate a predicate against it?**
@@ -896,7 +934,7 @@ Condensed from `ROADMAP.md` (2026-07-06). The live queue is the Vikunja board
 | 1.3 | desk_active presence script on desk PC | P1 | **not done** — operator action on `linux` (systemd user timer + hypridle listener); 0 facts ever written, presence runs on `page_heartbeat` alone |
 | 2.1 | Cold-start unlock (passkey → L3 key seam) | P2 | code done `b0932a1`+`15fe7bb`, **tests missing** — wrap/unwrap round-trip, wrong-cred unwrap fails, locked-mode IPC rejects non-unlock methods |
 | 3.1 | Always-on listening | P3 | MVP `e57647c` (energy-VAD only); remaining: wake-word model in `vad.go` |
-| 3.2 | Conversation depth (multi-turn) | P3 | done `05236ad` — anaphora resolver + cross-intent `followUpMerge` + `Session.History` |
+| 3.2 | Conversation depth (multi-turn) | P3 | repaired V-542 on 2026-08-13 — intent-independent utterance history; anaphoric queries reach chat context across fact/query/chat boundaries |
 | 3.3 | Latency / streaming (streaming STT/TTS, barge-in) | P3 | not started; recommended path is WebSocket voice, keeping TCP for non-browser clients |
 | 4.1 | Routing quality (dev embedder) | P4 | done `b7eb53a` — `make download-embedder`, configurable `voice.query_min_score` |
 | 4.2 | Act surface broadening | P4 | not a code item (operator config) |

docs/evals/2026-08-10-repo-audit.md

@@ -0,0 +1,261 @@
+# Repository deep-audit report
+
+Date: 2026-08-10
+Revised: 2026-08-11, a verification pass over every cited line. Six claims were
+wrong as first written and are corrected in place. Two findings were added.
+
+Frozen 2026-08-11, V-674. A dated measurement is never edited after the day,
+and that holds for a finding which later gets fixed. The live state of each one
+sits in `docs/caveats/` with its task id. The fix sits in the subsystem's living
+doc under `docs/`. Read this file for the evidence, not for what is still true.
+
+Read-only audit complete. I found **20 issue-specific candidates not represented by a matching Vikunja task**: **3 High, 15 Medium, 2 Low**. No code or Vikunja tasks were changed.
+
+I compared all 366 tasks in Maven project 2. Existing items such as V-317, V-589, V-597, V-603, V-605, V-608, V-643 and V-647 were excluded except where a new finding is clearly separate.
+
+## 1. Unhandled edge cases and silent failures
+
+### Empty STT responses suppress the local fallback
+
+**A — Location:** `internal/stt/http.go:85` accepts `{}` as a successful transcript and returns empty text at line 89. `internal/stt/pair.go:143` only falls back when `err != nil`.
+
+**B — Severity:** Medium. A malformed `200 OK` from the workstation silently drops a voice turn instead of invoking `mavsttd`.
+
+**C — Proposed fix:** Require nonblank transcript text and a valid confidence range; treat missing required fields as an error so `Pair` falls back. Bound the response decoder and add `{}`, `{"text":""}`, oversized-body and invalid-confidence tests.
+
+### Open-Meteo can report invented zero-degree weather
+
+**A — Location:** `internal/weather/openmeteo.go:47` uses value fields, while line 95 accepts `{}` and line 100 interprets it as WMO 0 and 0°C.
+
+**B — Severity:** Medium. A valid JSON error/degraded response becomes plausible but false weather. This is separate from V-589, which covered HTTP status handling.
+
+**C — Proposed fix:** Make `current_weather` and its required members pointer/nullable fields, validate presence and ranges, and cap both forecast and geocoder bodies.
+
+### Dialogue persistence errors disappear completely
+
+**A — Location:** Corrupt rows are silently skipped at `internal/dialogue/session.go:127`; delete failures are discarded at line 191; marshal and save failures are swallowed at lines 201 and 209.
+
+**B — Severity:** Medium. Restart continuity can silently vanish, while failed deletes can resurrect stale conversation state.
+
+**C — Proposed fix:** Return or report persistence errors with session ID and operation; quarantine/delete corrupt rows; use bounded contexts instead of `context.Background()`. Keep current-turn availability, but expose the lost restart guarantee through logs/metrics.
+
+## 2. Concurrency and race conditions
+
+### Reminder state transition is a read-then-write lost update
+
+**A — Location:** `internal/store/reminders.go:172` reads `pending`, then line 182 updates without checking the old state.
+
+**B — Severity:** Medium now; High once V-622 adds cancellation surfaces. Concurrent fire/cancel operations can both succeed and the last writer wins. This invariant is not described in V-622.
+
+**C — Proposed fix:** Use one conditional statement: `UPDATE ... WHERE id=? AND status='pending'`; inspect `RowsAffected`, then distinguish not-found from invalid transition. Add simultaneous fired/cancelled tests under `-race`.
+
+### TCP listener shutdown can leave `Accept` blocked forever
+
+**A — Location:** `internal/netaddr/netaddr.go:180` waits only on `conns` and `errc`. During close, line 201 may select the already-closed `done` branch without publishing the listener error; `Close` at line 225 does not wake `Accept`.
+
+**B — Severity:** Medium. During close both `errc` and `done` are ready in `acceptLoop`'s select and Go picks uniformly, so roughly one close in two strands a waiting `Accept` forever on a TCP seam.
+
+**C — Proposed fix:** Add `case <-l.done: return nil, net.ErrClosed` to `Accept`, and make error/channel closure ownership explicit. Test an in-flight `Accept` concurrently with `Close`.
+
+## 3. Data fetching: waterfalls and duplicated scans
+
+### Fact enrichment performs a serial 20-call network waterfall
+
+**A — Location:** `cmd/mavend/factenrichment.go:160` resolves each fact sequentially; line 223 makes the Nexus call. Each request can consume ten seconds at `cmd/mavend/ecosystem.go:63`.
+
+**B — Severity:** Medium. A slow-but-reachable Nexus can hold one tick for roughly 20 × 10s, preventing the worker from observing its intended interval. V-647 only covered the duplicate queue scan.
+
+**C — Proposed fix:** Prefer a Nexus batch-resolution endpoint. Otherwise use bounded concurrency, such as four workers, while preserving per-fact backoff and the 20-attempt ceiling.
+
+### A recall miss scans two whole tables
+
+**A — Location:** The query source table runs embed, memory and notes in order at `cmd/mavend/actions_query.go:161` through line 164. `MemoryStore.Search` scans every row of `memory_vectors` at `internal/store/memory.go:82`; a miss then calls the legacy notes query at `cmd/mavend/actions_query.go:718`, which decodes every note vector at `internal/store/notes.go:63` and sorts the whole table at line 69.
+
+**B — Severity:** Medium at scale. This is not an N+1. It is two full scans per missed recall. The memory scan is already cheap per losing row on purpose, costing one dot product read off the stored bytes with no `[]float32` materialized, so the duplicated decode cost is the notes path alone. Both recall widths are tiny (`memoryRecallWidth` 3, `noteRecallWidth` 5), so the work is in the scan, not the result set. V-581 is a generic sweep of this file, but does not identify this issue.
+
+**C — Proposed fix:** Establish the invariant that every recallable note exists in `memory_vectors`, then remove the fallback. `internal/store/backfill.go` already rewrites note rows into the unified index, so the backfill exists; what is missing is proof that the two exclusion filters agree, since `QueryNotes` filters on `notHisWordsSQL` while `Search` filters on `memory.NonRecallPrefix`. Until they do, query only notes missing from the unified index and rank with the existing bounded top-K heap.
+
+## 4. Dependency health and version pinning
+
+### Reachable published vulnerabilities in the pinned toolchain and `x/text`
+
+**A — Location:** `go.mod:3` and `Makefile:7` pin Go 1.25.5; `go.mod:25` pins `x/text` 0.14.0. Reachable traces include normalization at `internal/router/onnxembedder.go:364`, HTML rendering at `cmd/mavweb/shell.go:154`, email header decoding at `internal/email/message.go:244`, and reverse proxying at `cmd/mavgpud/main.go:212`.
+
+**B — Severity:** High. `govulncheck` found **20 reachable advisories**: one in `x/text` and 19 in the Go standard library, including template XSS, parser complexity/DoS and TLS issues. The official database says `x/text` before 0.39.0 can loop on invalid UTF-8; Go 1.25.12 contains the accumulated security corrections. See [GO-2026-5970](https://pkg.go.dev/vuln/GO-2026-5970), [GO-2026-4980](https://pkg.go.dev/vuln/GO-2026-4980), and the [Go release history](https://go.dev/doc/devel/release#go1.25.0).
+
+**C — Proposed fix:** Upgrade the vendored toolchain to at least 1.25.12, preferably current 1.26.5 after compatibility testing; upgrade `x/text` to at least 0.39.0/current 0.40.0; tidy and re-vendor. Add `govulncheck ./...` to the repository gate.
+
+No dependency was three major versions behind. The remaining direct updates were minor/patch releases. `.opencode`'s `npm audit` reported zero vulnerabilities and no peer conflicts.
+
+## 5. Security exposure
+
+### WebAuthn enrollment is open and step-up state is process-global
+
+**A — Location:** Registration endpoints have no existing-credential or bootstrap authorization at `cmd/mavweb/webauthn.go:92` and line 103. `RegisterBegin` also answers GET, while `RegisterFinish` requires POST. A single server-wide session is created at `cmd/mavweb/main.go:170`, backed by one `assertedAt` timestamp at `internal/webauthn/session.go:20`. The voice WebSocket accepts every origin at `cmd/mavweb/voiceproxy.go:48`.
+
+**B — Severity:** High, and scoped to enrollment and session binding. Assertion itself is sound. `internal/webauthn/webauthn.go:221` requests `userVerification: "required"`, and line 304 rejects a sign count that did not increase. What is broken is that any client past the reverse proxy can enroll its own key, and that after any successful assertion every client inherits the same five-minute step-up window. The wildcard WebSocket origin makes cross-site use easier. V-317 covers which routes are gated, and V-605 covers challenge-map growth, not enrollment or session binding.
+
+**C — Proposed fix:** Permit first enrollment only through a local/one-time bootstrap ceremony; require an already-authenticated credential for subsequent enrollment. Bind step-up to a signed, HttpOnly, SameSite browser session and exact RP origin. Restrict WebSocket origins and add CSRF/origin validation to mutating routes.
+
+### `mavgpud` exposes an unauthenticated GPU/model proxy on the LAN
+
+**Closed 2026-08-11, V-673.** The reasoning now lives in `docs/offload.md`,
+beside the rest of the workstation seam, and `docs/deployment.md` carries the
+operational line in the daemon table. This block is a pointer, not a second
+home: read those, not this.
+
+- Boundary and limits: `cmd/mavgpud/auth.go`, wired in `cmd/mavgpud/main.go`.
+- Client half: `internal/llm/client.go`, `internal/llm/remote.go`,
+  `internal/config/workstation.go`, `cmd/mavend/voicewire.go`.
+- Deploy: `token_file` in `deploy/mavgpud.json`, `MAVEN_GPU_TOKEN` in
+  `deploy/telegram.env.example`.
+- Commits: `95e7427`, `1c13d22`, `5596cdd`, `9bb3425`.
+
+**Deploy step, not yet done:** write the token to
+`/home/kami/.config/mavgpud.token` on workpc and put the same value in
+`MAVEN_GPU_TOKEN` on homesrv, before restarting either side. mavgpud refuses to
+start without it, and a homesrv missing it falls back to the resident model.
+
+### Passkey credential persistence is not crash-atomic
+
+**A — Location:** `cmd/mavweb/credentials.go:36` serializes the full credential map and overwrites the live file directly with `os.WriteFile` at line 41.
+
+**B — Severity:** Medium. A crash, disk-full event or interrupted write can corrupt every enrolled credential and prevent mavweb from starting.
+
+**C — Proposed fix:** Write a `0600` temporary file in the same directory, `fsync`, rename atomically, then sync the directory. Preserve the last known-good file and test simulated write failures.
+
+No new tracked hardcoded keys, raw user-concatenated SQL, `eval`, or shell execution of untrusted strings were found. The historical DB-key exposure is already covered by V-12.
+
+## 6. Circular dependencies and layering
+
+### Domain packages depend directly on storage/wire DTOs
+
+**A — Location:** Dialogue imports `store` and exposes `store.DialogueSessionRow` in its port at `internal/dialogue/session.go:9` and line 75. The pure morning planner accepts `store.Fact` at `internal/morning/plan.go:72`. Auth policy imports IPC method and caller types at `internal/auth/policy.go:8` and `internal/auth/scope.go:33`.
+
+**B — Severity:** Low. There is no current Go import cycle, but domain changes are coupled to database and IPC schema changes.
+
+**C — Proposed fix:** Make domain packages own their DTOs and ports—dialogue persistence records, morning evidence, auth operation/caller identity—and adapt them in store/IPC/cmd wiring.
+
+No circular Go imports were found; compilation and `go vet` both succeeded.
+
+## 7. Dead code and zombie endpoints
+
+### Eleven production symbols are unreachable
+
+**A — Location:** `deadcode` found:
+
+- `cmd/mavwaked/vad.go:244` — `PCMToF32`
+- `cmd/mavwaked/vad.go:265` — `AudioDuration`
+- `internal/crawl/watch.go:86` — `Watcher.Watches`
+- `internal/phraser/confirm.go:137` — `IsC`
+- `internal/phraser/plural.go:13` — `CountWord`
+- `internal/phraser/eval/checks.go:80` — `HisGender`
+- `internal/update/update.go:363` — `WithClock`
+- `internal/voice/errors.go:72` — `jsonMarshal`
+- `internal/voice/errors.go:73` — `jsonUnmarshal`
+- `internal/webauthn/cbor.go:98` — `cborValue.At`
+- `internal/worker/server.go:64` — `Server.SetSynthesizer`
+
+Three of the eleven do not want deleting, and the 2026-08-11 pass checked each:
+
+- `internal/phraser/eval/checks.go:80` `HisGender` is deliberately exposed and deliberately uncalled. The comment at line 72 ties the trio to V-399, and `cmd/mavend/personaguard.go:94` states why this one is not run on a phrased message. Deleting it removes a documented seam.
+- `cmd/mavwaked/vad.go:265` `AudioDuration` duplicates what `internal/audio` already computes. Call that instead of deleting the body.
+- `internal/phraser/plural.go:13` `CountWord` is a one-line alias for `say.CountWord`, and every real caller already uses `say` directly. Safe to delete outright.
+
+**B — Severity:** Low. They increase API and test surface, and some comments claim callers that no longer exist.
+
+**C — Proposed fix:** Delete the genuinely obsolete symbols. Where one is an intended extension seam, add the actual caller and a contract test, or record why it stays. Add `deadcode ./...` with an explicit allowlist to the audit gate, since an unannotated list invites deleting the three above.
+
+The repository history begins on 2026-07-03, so a six-month rotten-feature-flag check is not yet applicable. One zombie HTTP route does exist: `/ws` is wired at `cmd/mavweb/main.go:235` and no shipped client reaches it, since the browser posts to `/api/ptt`. Section 8 carries the detail.
+
+## 8. Performance hot paths and memory/resource leaks
+
+### Digest dedupe happens after paying the LLM cost
+
+**A — Location:** `cmd/mavend/tick_digest.go:147` calls `PhraseNudge` before `EnqueueDigestEntry` reports the dedupe at line 153. The `else if deduped { continue }` is the last statement in the loop body, so it changes nothing.
+
+**B — Severity:** Medium. Every tick that continues suppressing the same rule can invoke the model again, contrary to the cache claim in the preceding comment.
+
+**C — Proposed fix:** Check for a live pending entry by stable rule/candidate fingerprint before phrasing, or persist/cache the phrased result with a TTL. Add a test asserting one phraser call across repeated suppressed ticks.
+
+### PTT reads an unbounded body and neither server sets header or idle limits
+
+**A — Location:** `handlePTT` performs an unlimited `io.ReadAll` at `cmd/mavweb/voiceproxy.go:125`. Mavweb and mavgpud construct servers without header or idle limits at `cmd/mavweb/main.go:242` and `cmd/mavgpud/main.go:148`. Separately, `handleWS` never calls `conn.SetReadLimit`, so the dependency default of 32,768 bytes applies at `vendor/github.com/coder/websocket/read.go:92`, about one second of 16kHz mono PCM.
+
+**B — Severity:** Medium for the HTTP side. A client can force unbounded body allocation or hold a connection open indefinitely. Low for the WebSocket read limit, because `/ws` has no caller: the browser client posts PCM to `/api/ptt` at `cmd/mavweb/static/app.js:114`, and `/ws` is wired at `cmd/mavweb/main.go:235` but reached only from `handlers_test.go`. The 64MiB `maxFrame` at `cmd/mavweb/voiceproxy.go:27` is not an unapplied declaration. It caps the mavend voice wire at line 194 and line 212, which is the "either direction" its comment names.
+
+**C — Proposed fix:** Use `http.MaxBytesReader` for PTT and return 413 on overflow. Configure `ReadHeaderTimeout`, `IdleTimeout` and header limits on both servers. Decide `/ws` separately: either give it an audio-duration read limit and a client, or delete it. See section 7.
+
+## 9. Error propagation and user feedback
+
+### Mavweb has no consistent, traceable error contract
+
+**A — Location:** Some handlers expose raw internal errors, such as `cmd/mavweb/tools.go:57`, `cmd/mavweb/routines.go:58` and `cmd/mavweb/webauthn.go:122`. Others return generic errors without a request/incident identifier, such as `cmd/mavweb/facts.go:90`. No HTTP request-ID middleware was found.
+
+**B — Severity:** Medium. Raw errors can disclose implementation details, while generic errors cannot be correlated with the correct log entry.
+
+**C — Proposed fix:** Add a central `writeProblem`/error-page helper with a stable error code and generated request ID; log the full wrapped error server-side and return only a sanitized message plus the ID. Carry the ID into IPC/ecosystem correlation where possible.
+
+## 10. Configuration drift and environment assumptions
+
+### Committed absolute paths make builds and deployment host-specific
+
+**A — Location:** `go.mod:31` replaces Hexis with `/home/kami/apps/hexis`. `start-maven.sh:11` hardcodes the Maven checkout and line 40 hardcodes the data directory. `deploy/mavgpud.json:12` and line 35 contain workstation-specific model/Python paths.
+
+**B — Severity:** Medium. Vendoring masks the `go.mod` problem for ordinary builds, but `-mod=mod`, tidy and fresh non-Kami checkouts fail. Deployment files cannot be reused safely on another host.
+
+**C — Proposed fix:** Pin a real Hexis module revision; keep local replacement in an uncommitted `go.work`. Derive script root from the script location and make data paths configurable. Split mavgpud into a committed template plus host-local override.
+
+### Environment examples do not cover deployed variables
+
+**A — Location:** Active config references `MAVEN_STT_TOKEN` at `deploy/mavend.json:101`, Compose references `MAVEN_AMBIENT_TOKEN` at `docker-compose.yml:109`, and the GPU service expects `CW2_TOKEN` at `deploy/mavgpud.service:15`. `deploy/telegram.env.example:5` documents only Telegram and ntfy. The loader deliberately converts missing variables to empty settings at `internal/config/config.go:333`.
+
+**B — Severity:** Medium. A fresh deployment can lose remote STT or ambient authentication and run on fallback behavior despite apparently valid config. It is not silent: `internal/config/config.go:340` logs which variables were unset and states that whatever they configure is off. What is missing is a startup failure and an example file naming them.
+
+**C — Proposed fix:** Maintain one canonical secret manifest/example covering every referenced variable, or service-specific examples with validation. Fail startup when an enabled integration lacks its required secret; permit empty variables only for explicitly disabled blocks.
+
+No production/staging debug-mode or mock-gateway drift was found.
+
+## 11. Declared invariants with no guard
+
+`CLAUDE.md` names several rules as load-bearing. Two of them are enforced by
+nothing, which the first pass missed because it audited generic categories only.
+
+### `heads_path` may equal `model_path` and nothing objects
+
+**A — Location:** `cmd/mavend/voicewire.go:168` reads `cfg.Voice.Embedder.HeadsPath` and loads it without comparing it to the model path. The rule is stated at `internal/config/voice.go:41`, which says the heads graph is a fine-tuned COPY, and again in `CLAUDE.md`.
+
+**B — Severity:** Medium. Pointing both keys at the same file degrades recall, because the routing heads then score with the same graph the resident e5-small uses. There is no error and no log line, so the failure looks like ordinary recall drift.
+
+**C — Proposed fix:** Reject the config at load when `heads_path` equals `model_path` after path cleaning. A daemon that cannot route well should refuse to start rather than answer worse.
+
+### `baselineGrammars` mirrors `buildRouter` by hand
+
+**A — Location:** `internal/router/eval/eval_test.go:263` restates the stage 0 rule set in the daemon's order, and its own comment says so. `claims_test.go:30`, `heads_test.go:76` and `eval_test.go:221` all score against it. Nothing compares the two lists.
+
+**B — Severity:** Medium. A grammar added to `buildRouter` and not to the fixture means every routing measurement scores a set nobody runs, which is the failure mode `CLAUDE.md` warns about by name.
+
+**C — Proposed fix:** Export the grammar set from one place and have both `buildRouter` and the fixture consume it, or add a test that diffs the two by grammar name and fails on drift.
+
+`tokenizerRev` and `preRouteLadder` were checked and need nothing.
+`internal/router/onnxembedder.go:91` bakes the rev into the embedder key, so a
+bump changes the key and triggers re-embedding. `cmd/mavend/voice.go:278` passes
+`preRouteLadder` to `decision.Expect`, so a missing rung is observable.
+
+## Cross-cutting subsystem candidates
+
+The recurring findings suggest five reusable patterns:
+
+- A bounded, required-field-validating JSON client for STT, weather, ecosystem and model calls.
+- Authenticated remote-service middleware providing token checks, body limits, concurrency limits and correlation IDs.
+- Atomic state-transition helpers using conditional SQL and `RowsAffected`.
+- A uniform HTTP problem/error envelope.
+- A repository health gate combining `staticcheck`, `govulncheck`, `deadcode` and dependency audits.
+
+## Validation
+
+- `make fmt-check` and `make vet` passed. `make audit` passed too, but it is a git-grep inventory over loc, todo, stubs, docs, tests and gaps (`scripts/audit.sh`), not a static-analysis gate. Do not read it as one.
+- `staticcheck`, `govulncheck`, `deadcode`, tracked-secret and history scans and npm audit were run out of tree. None of the three Go analyzers is installed on this box or wired into any make target, which is the argument for section 4's proposed gate.
+- The advisory version numbers in section 4 could not be re-checked offline on 2026-08-11. `deps/go/go/VERSION` reads `go1.25.5`, built 2025-11-26, so the eight-month gap behind current supports the upgrade claim.
+- The first whole-tree race run failed once in `cmd/mavend` while analyzers were compiling concurrently; a fresh isolated `go test -race -count=1 ./cmd/mavend` passed in 100.6 seconds, so the transient result was not counted as a defect.
+- The pre-existing `deploy/mavwaked.service` modification and untracked `deploy/asoundrc` remained untouched.

docs/evals/2026-08-11-classifier-baseline-after-tokenizer-fix.md

@@ -0,0 +1,71 @@
+# The classifier baseline after the tokenizer fix
+
+Measured 2026-08-11 on master at `2cf8b7e`, the classifier cascade with the ONNX
+multilingual embedder, the configuration homesrv runs. `make t
+PKG=./internal/router/eval/ RUN=TestONNXBaseline V=1`. Covers V-704.
+
+## Result
+
+Intent is **72/96 (75.0%)**. Destination is **11/33 (33.3%)**.
+
+`docs/evals/2026-08-08-destination-fixture.md` recorded 73/96 (76.0%) and 12/33
+(36.4%) three days earlier, and `CLAUDE.md` and `docs/routing.md` both carried
+that pair until today. Same fixture, same 33 labelled cases, so the two pairs
+are comparable and one case moved.
+
+| | 2026-08-08 | today |
+|---|---|---|
+| intent | 73/96 (76.0%) | 72/96 (75.0%) |
+| destination | 12/33 (36.4%) | 11/33 (33.3%) |
+| world | 5/5 | 5/5 |
+| the `SourceUnknown` floor | 5/7 | 4/7 |
+| calendar | 2/6 | 2/6 |
+| recall | 0/15 | 0/15 |
+
+## One case moved, and it cost both numbers
+
+`en-query-002`, "how long since the last backup finished". It routed `query` on
+08-08 and routes `fact` today, at 0.870.
+
+The case carries `want_source` present and empty, the floor label. `Score`
+credits a destination only after the route lands the intent. So the case paid
+once on the intent and once on the destination. Two numbers moved by one case,
+which is why the drift read as two regressions.
+
+## The commit
+
+`feabf9f`, "The tokenizer read every long word backwards" (V-664), landed
+2026-08-08 after the destination measurement.
+
+Bisected by running `TestONNXBaseline` at each commit:
+
+| commit | intent | destination |
+|---|---|---|
+| `b6eaa70` V-659, the 08-08 measurement | 73/96 | 12/33 |
+| `e470435` V-661 | 73/96 | 12/33 |
+| `a886217` V-663 | 73/96 | 12/33 |
+| `50c6637` merge #205, parent of the fix | 73/96 | 12/33 |
+| **`feabf9f` V-664, the tokenizer fix** | **72/96** | **11/33** |
+| `c938148` V-666 | 72/96 | 11/33 |
+| `2cf8b7e` master today | 72/96 | 11/33 |
+
+Nothing between `a886217` and `feabf9f` touches routing except that commit and
+one merge, and the merge holds the old pair.
+
+## What this means for the pair
+
+The higher pair is not a target to restore. Before `feabf9f`, `encodeWord`
+emitted the characters of every long word in reverse. So the 76.0% and 36.4%
+were scored on embeddings from a broken encoder. One case landed right under the
+defect and lands wrong under the fix.
+
+So 75.0% and 33.3% is the honest floor, and `en-query-002` is not a regression to
+chase. It is a case the corrected encoder gets wrong, worth the same attention as
+the other 23 intent misses and no more.
+
+## What this does not measure
+
+The routing heads row and the two gemma rows in `docs/routing.md` were not
+re-run. The heads commits all land after `feabf9f`, so that row was already
+measured against the corrected tokenizer. The gemma rows are the model arm and
+were not checked either way.

docs/evals/2026-08-13-conversation-continuity.md

@@ -0,0 +1,48 @@
+# Five turns retain one referent across fact, query and chat routes
+
+Measured 2026-08-13 on homesrv from `master` at `a0e6643` plus the V-542
+working tree. Task: V-542. The run uses the deterministic simulator phraser;
+no resident model is needed.
+
+## Setup
+
+`conversation_anaphora.json` replays the five Russian turns that exposed the
+defect. Their scripted router decisions remain the observed
+fact/query/query/chat/query sequence. Each of the four contextual replies is
+accepted only if the chat phraser receives history containing the original
+`купил новый монитор` turn; this prevents a canned response from hiding a
+missing transcript.
+
+Commands:
+
+```sh
+make t PKG=./cmd/mavend RUN='TestExplicitConversationOpenerKeepsCrossIntentSessionAlive|TestConversationOpenerDoesNotMatchAnotherDavaiCommand|TestFollowUpMerge|TestSimulatorScenarios/conversation_anaphora' V=1 RACE=1
+make t PKG=./internal/dialogue RUN=TestSessionSurvivesRestart V=1 RACE=1
+make t PKG=./internal/router RUN=TestAnaphoraResolverUsesTokenBoundariesAcrossPunctuation V=1 RACE=1
+MAVEN_DIALOGUE_NO_SKIP=1 make t PKG=./cmd/mavend RUN=TestDialogueTraces V=1 RACE=0
+```
+
+## Result
+
+| Gate | before | after |
+| --- | ---: | ---: |
+| contextual replies that name the monitor | 0/4 | **4/4** |
+| replies proven to receive the original turn in history | 0/4 | **4/4** |
+| original grounded fact still written | 1/1 | **1/1** |
+| unsolicited sends in five turns plus one tick | 0/6 | **0/6** |
+| focused race-tested packages | — | **3/3 pass** |
+
+The forced dialogue suite passed 18/22 rows. Its four failures are the existing,
+unrelated offline-floor cases for a mid-flow note, a correction while a question
+is parked, a whole-day reminder, and a short correction that does not park a
+clarification. None exercises V-542; the continuity scenario and all focused
+race gates pass.
+
+## What this rules out
+
+The fix does not rewrite pronouns into guessed nouns or add a phrase regex.
+Exact utterances form a persisted, chronological transcript independently of
+intent slots. An anaphoric query with live dialogue context moves to chat and
+clears query-source provenance; non-anaphoric queries retain their source path,
+and acts are never widened. An explicit conversation opener extends session
+lifetime without suppressing the fact side effect in its substantive clause.

docs/evals/2026-08-13-onnx-runtime-lifecycle.md

@@ -0,0 +1,65 @@
+# ONNX aggregate gate lifecycle — 2026-08-13
+
+Vikunja: V-716.
+
+## Finding
+
+`router.NewONNXEmbedder` initialized `onnxruntime_go` unconditionally. Its
+`Close` method destroyed the model session but left the package-global runtime
+environment alive. In one Go process the first `TestONNX*` therefore ran and
+every later constructor returned `The onnxruntime has already been initialized`.
+Those tests converted the constructor error into `t.Skip`, so the aggregate
+package still reported `PASS`.
+
+Reproduction before the fix:
+
+```text
+TestONNXBaseline     PASS  classifier+onnx 72/96
+TestONNXRoutingHeads SKIP  onnx: init environment: already initialized
+package              PASS
+```
+
+## Contract
+
+The router now owns ONNX Runtime through reference-counted leases. Every model
+session holds one lease; routing heads hold their own, so daemon shutdown order
+cannot unload the library underneath a live graph. The last lease destroys an
+environment Maven initialized. Package `TestMain` holds one extra lease across
+all model-aware tests in `internal/router/eval` and `cmd/mavend`.
+
+The aggregate router command additionally requires two named gates to record
+execution only after all of their model dependencies loaded. A second-test
+skip can no longer satisfy the command.
+
+## Measurement
+
+Runtime and model:
+
+```text
+deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so.1.26.0
+models/embedder/multilingual-e5-small/model_quantized.onnx
+models/embedder/router-heads/router_heads.onnx
+```
+
+Focused aggregate, one process:
+
+```text
+TestONNXBaseline     PASS  72/96 full (75.0%), destination 11/33
+TestONNXRoutingHeads PASS  93/96 full (96.9%), destination 25/33
+ONNX aggregate proof: verified 2 required model gates:
+  [TestONNXBaseline TestONNXRoutingHeads]
+```
+
+The separate lifecycle test released the last lease and successfully acquired
+the runtime again. A second same-process package run also executed all three
+selected mavend gates without a skip:
+
+```text
+TestONNXPersonalBoundary         PASS  29/29
+TestONNXPersonalBoundaryFourFold PASS  99/104
+TestONNXTopics                   PASS  43/43
+```
+
+Finally, `make eval-router` completed the full package. In addition to the two
+required proof gates, `TestONNXClaimConfidenceDistribution` and
+`TestReachBaselineONNX` executed; ecosystem reach remained 28/30.

docs/evals/2026-08-13-personal-boundary-linear-head.md

@@ -0,0 +1,101 @@
+# A class-balanced linear head closes every held-out personal-boundary cell
+
+Measured 2026-08-13 on homesrv from `master` at `56254a5` plus the V-702
+working tree. Embedder: quantized multilingual-e5-small through ONNX Runtime
+1.26.0. This supersedes
+`2026-08-13-personal-boundary-neighbourhood.md`.
+
+Commands:
+
+```sh
+MAVEN_ONNX_LIB="$PWD/deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so.1.26.0" \
+  go test ./cmd/mavend -run '^TestONNXPersonalBoundary$' -count=1 -v
+MAVEN_ONNX_LIB="$PWD/deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so.1.26.0" \
+MAVEN_EVAL_PERSONAL_BOUNDARY=1 \
+  go test ./cmd/mavend -run '^TestONNXPersonalBoundaryStratified$' -count=1 -v
+```
+
+## Setup
+
+The prior three-neighbour scorer passed the 29-case regression table but
+missed 11 of a new 72-case fixture. The fixture is balanced across Russian and
+English, expected personal and world classes, and six sentence shapes:
+remembered speech, possession, narrative, first-person preamble, current
+advice/information and public proper nouns. Its hygiene test rejects copied
+training phrases and repeated Baikal variants.
+
+Production uses a binary logistic head fitted over 132 bilingual examples.
+Each class has total sample weight 0.5 even though the class sizes differ. The
+optimiser is deterministic: 5,000 full-batch steps, decaying learning rate from
+10, L2 coefficient 0.0003. The fitted 384 weights are frozen into the binary
+and pinned to the embedder model ID; a model-backed test retrains from the text
+corpus and rejects any drift. An unknown embedder ID falls back to fitting its
+own corpus rather than applying weights from another vector space.
+
+No evaluation utterance is in the training corpus. Ordinary CI checks class
+balancing, mixed dimensions, exact regression-table leakage, and generalisation
+across synthetic semantic directions. The model-backed gate also runs
+four-fold cross-validation over the expanded corpus, stratified inside each
+sentence shape and class; the original compact corpus remains in every fold as
+the historical floor.
+
+The six shapes of the training corpus were chosen after the first 72-case
+matrix exposed their gaps, so 72/72 is a regression gate, not independent proof
+of generalisation. The first independently authored 24-case challenge then
+exposed one remaining miss, `на каком порту я решил поднять тестовый сервис?`,
+at personal probability 0.4666. It became model-selection data at that point
+and cannot honestly remain the independent result.
+
+A comparison rejected shrinkage LDA (24/24 challenge but 69/72 stratified) and
+an LDA/logistic blend (24/24 but 71/72). Increasing only the balanced logistic
+head's L2 coefficient from 0.0001 to 0.0003 kept the corpus and stratified gates
+intact while improving evidence that did not contain that sentence: four-fold
+cross-validation rose from 97/104 to 99/104 and whole-semantic-group holdout
+rose from 91/104 to 92/104. It also moved the original challenge to 24/24,
+although its +0.0001 minimum signed probability margin is correctly treated as
+a regression, not fresh proof.
+
+Three checks now supply the honest evidence beyond the 72-case regression:
+
+- Four-fold within-shape cross-validation scores 99/104.
+- Whole-group holdout scores 92/104 in aggregate.
+- A second 24-case challenge was written after the coefficient and frozen head
+  were fixed. It returns to private configuration, commitments and stored
+  choices versus public technical facts, compatibility and maintenance with
+  new subjects. It scores 24/24 with minimum signed probability margin +0.1718.
+  Its rows remain outside the training corpus and no result from it was used to
+  retune this revision.
+
+Whole-semantic-group holdout is intentionally diagnostic rather than claimed
+as perfect: remembered speech 14/16, possession 19/22, narrative 16/16,
+first-person preamble 15/16, advice/current information 13/16, and public proper
+nouns 15/18. This shows the embedder has a shared boundary direction but some
+ambiguities genuinely need shape coverage.
+
+## Result
+
+| Gate | three-neighbour | linear head |
+| --- | ---: | ---: |
+| historical regression | 29/29 | **29/29** |
+| stratified fixture | 61/72 | **72/72** |
+| Russian | 30/36 | **36/36** |
+| English | 31/36 | **36/36** |
+| expected personal | 28/36 | **36/36** |
+| expected world | 33/36 | **36/36** |
+
+Every one of the six strata is 12/12. The minimum signed probability margin is
++0.0522 after the independently supported regularisation change. The decision
+remains personal probability greater than 0.5; neither a lexical exception nor
+a shifted privacy prior was introduced.
+
+Cold first-boundary load plus score is 15.179µs; steady inference is 1.112µs per
+score over 100,000 iterations. The previous runtime corpus fit took 5.618s on
+the same box, which is why fitting moved to the model-backed build gate.
+The unconfigured `HashEmbedder` floor still fits its own 1024-dimensional head
+because these ONNX weights do not belong in that space; its sparse-vector fit
+uses 400 steps and measures 93.818ms on first use.
+
+The ONNX Runtime wrapper is process-global today, so these model-backed tests
+must be invoked in separate `go test` processes until V-716 repairs the harness;
+otherwise only the first test runs and the rest self-skip. The figures above
+were all collected as separate commands.

docs/evals/2026-08-13-personal-boundary-neighbourhood.md

@@ -0,0 +1,53 @@
+# Three neighbours keep a public noun from opening the personal boundary
+
+Measured 2026-08-13 on homesrv from `master` at `56254a5` plus the V-702
+working tree. Embedder: quantized multilingual-e5-small through ONNX Runtime
+1.26.0. Command:
+
+```sh
+make t PKG=./cmd/mavend/ RUN=TestONNXPersonalBoundary V=1 RACE=0
+make t PKG=./cmd/mavend/ RUN=TestONNXTopics V=1 RACE=0
+```
+
+This supersedes `2026-08-03-personal-boundary.md` for the boundary score. That
+file remains the measurement of why possession markers were replaced.
+
+## Defect
+
+The boundary used the best cosine on each side: one-nearest-neighbour
+classification. Its world class correctly includes narrative questions such
+as `расскажи про байкал`, while its personal class includes remembered-speech
+questions. The held-out `я рассказывал тебе про байкал?` therefore scored
+personal 0.9068 against world 0.9413. The public subject outweighed the question
+about what the owner had previously told Maven, and the boundary opened toward
+SearXNG.
+
+Adding two plausible personal paraphrases did not move either score. Candidate
+similarities to the failing turn ranged from 0.8373 to 0.9022, still below the
+world proper-noun neighbour. This ruled out a missing synonym and argued against
+putting the held-out sentence or another Baikal-shaped exception into the seed
+set.
+
+## Change
+
+Each class now scores as the mean of its three nearest seeds. The same `k=3`
+applies on both sides, so the larger world class cannot win merely by having
+more coverage. Only the local neighbourhood is averaged because the personal
+class has two modes—possession and remembered speech—and a whole-class centroid
+would dilute them into each other.
+
+This is a scoring change, not a seed or a phrase rule. The Baikal utterance
+remains held out.
+
+## Result
+
+| Gate | one neighbour | three neighbours |
+| --- | ---: | ---: |
+| personal boundary | 28/29 | **29/29** |
+| Baikal margin | -0.0345 | **+0.0147** |
+| topic recognisers | 43/43 | **43/43** |
+
+The nearest personal true positive is `когда мой следующий отпуск` at +0.0110.
+The nearest world true negative is `расскажи про эверест` at -0.0135. No extra
+threshold is justified between them. The gate remains the sign of the class
+difference, favouring local refusal over sending owner-related text outward.

docs/evals/CLAUDE.md

@@ -0,0 +1,135 @@
+# docs/evals/
+
+One file per measurement, named for the day it was taken. **Never edited after
+that day.** A newer number is a new file, never an edit to an old one.
+
+Reasoning does not belong here. It belongs in the subsystem's living doc under
+`docs/`. An eval holds the setup, the numbers and what they rule out.
+
+## Rules for this directory
+
+* Filename is `YYYY-MM-DD-<what-was-measured>.md`. The date is the day it ran.
+* The first line is the claim, not the topic. A reader picks a file from this
+  index without opening it, so the H1 has to carry the finding.
+* Head the file with the date, the task id, the box and the build.
+* **A file that replaces an older number says so.** It names the file it
+  replaces. This index then marks that one superseded.
+* A superseded file is not deleted and not edited. It records what was believed
+  that day. A living doc may still cite it for the run itself.
+
+## Reading a number out of here
+
+Check the state column before citing a row. **A number in a living doc must
+cite a live file.** The 2026-08-11 classifier baseline exists for that reason.
+A pair in `docs/routing.md` went stale unnoticed. Its source predated the
+`encodeWord` fix at `feabf9f`. Nothing failed (V-704).
+
+## Routing: the arms and the cascade
+
+| measurement | state |
+| --- | --- |
+| [Routing evaluation](2026-07-31-routing.md) | superseded |
+| [Resident model bake-off](2026-07-31-model-bakeoff.md) | live |
+| [gemma-4-12b on the workstation, against the resident Qwen3-1.7B](2026-08-02-workstation-gemma4-12b.md) | live |
+| [Routing from audio: four paths, one fixture](2026-08-05-audio-in-routing.md) | live |
+| [Routing with the resident model, re-measured](2026-08-05-routing-resident-model.md) | live |
+| [The routing trajectory, and the number that is missing](2026-08-06-routing-trajectory.md) | live |
+| [Gemma as a label function, and what it found in the seeds](2026-08-06-seed-labels-vs-router-prompt.md) | live |
+| [Moving the seed files onto the router prompt's boundaries](2026-08-06-seeds-to-prompt-boundary.md) | live |
+| [The first destination number](2026-08-08-destination-fixture.md) | superseded |
+| [The destination, with a model that can name one](2026-08-08-destination-model-arm.md) | live |
+| [The routing heads, running in Go](2026-08-08-routing-heads-in-go.md) | live |
+| [Two heads on e5-small, and the first destination the router did not need a model for](2026-08-08-routing-heads-two-head.md) | live |
+| [A slot head, and the corpus that did not exist this morning](2026-08-08-slot-head-three-head.md) | live |
+| [A clarify head, and a confidence that is not a hardcode](2026-08-08-clarify-head-four-head.md) | live |
+| [MASSIVE Russian warm-start for the routing heads](2026-08-08-massive-warm-start.md) | live |
+| [gemma-4-E4B against gemma-4-12B on the routing fixture](2026-08-09-e4b-vs-12b-routing.md) | live |
+| [The classifier baseline after the tokenizer fix](2026-08-11-classifier-baseline-after-tokenizer-fix.md) | live |
+
+`docs/routing.md` holds the arm table these feed. Cite from there, not from here.
+
+## Stage 0, slots and the turn
+
+| measurement | state |
+| --- | --- |
+| [Five turns retain one referent across fact, query and chat routes](2026-08-13-conversation-continuity.md) | live |
+| [Personal boundary, seed scoring vs possession markers](2026-08-03-personal-boundary.md) | superseded |
+| [Three neighbours keep a public noun from opening the personal boundary](2026-08-13-personal-boundary-neighbourhood.md) | superseded |
+| [A class-balanced linear head closes every held-out personal-boundary cell](2026-08-13-personal-boundary-linear-head.md) | live |
+| [Half-past and quarter-to hours](2026-08-05-half-past-hours.md) | live |
+| [Praxis reach at stage 0](2026-08-05-praxis-reach.md) | live |
+| [Alarm verbs reach stage 0](2026-08-06-alarm-verbs-reach-stage-0.md) | live |
+| [Russian acts reach tools](2026-08-06-russian-acts-reach-tools.md) | live |
+| [The fact parser: closed classes against the substring stems they replaced](2026-08-06-fact-parser.md) | live |
+| [The reminder completeness rule, measured on the box](2026-08-06-reminder-completeness-on-the-box.md) | live |
+| [Nine claimants interrupting a parked reminder](2026-08-06-claimant-interleave.md) | live |
+| [The parked clarify ride, bounded and re-measured](2026-08-08-parked-clarify-ride.md) | live |
+
+## Ecosystem
+
+| measurement | state |
+| --- | --- |
+| [Ecosystem reach, measured](2026-08-04-ecosystem-reach.md) | live |
+| [Ecosystem reach with the resident model as router](2026-08-05-reach-llm-router.md) | live |
+
+## Recall and memory
+
+| measurement | state |
+| --- | --- |
+| [Note recall evaluation](2026-07-31-recall.md) | superseded |
+| [Recall topic veto, what it costs and what it buys](2026-08-03-recall-topic-veto.md) | live |
+| [Note recall after the e5-small swap](2026-08-04-recall-e5-small.md) | live |
+
+## Phrasing and talk
+
+| measurement | state |
+| --- | --- |
+| [Phrasing evaluation](2026-07-31-phrasing.md) | superseded |
+| [Conversational phrasing eval](2026-07-31-talk.md) | superseded |
+| [Talk fixture against the resident model](2026-08-05-talk-fixture-resident.md) | live |
+| [Talk temperature sweep: Qwen3-1.7B, 4 temperatures times 3 runs](2026-08-05-temperature-sweep.md) | live |
+| [gemma-4-E4B on the phrasing and talk fixtures](2026-08-09-e4b-phrasing.md) | live |
+
+## World: search and Kiwix
+
+| measurement | state |
+| --- | --- |
+| [Does the ZIM answer when the line is down?](2026-08-05-kiwix-offline-fallback.md) | live |
+| [Does SearXNG claim a question it cannot answer?](2026-08-05-search-quality-signals.md) | live |
+| [Kiwix answered the wrong question, and the fix was not a relevance gate](2026-08-09-kiwix-topic-retrieval.md) | live |
+
+## Speech in and out
+
+| measurement | state |
+| --- | --- |
+| [CrisperWhisper 2.0 in Russian, measured](2026-08-09-crisperwhisper2-russian-wer.md) | live |
+| [silero-vad against the energy threshold in mavwaked](2026-08-09-silero-vad.md) | live |
+| [The "Мэйвен" wake word: what it hears and what it invents](2026-08-09-wake-word.md) | live |
+
+## Runtime and storage
+
+| measurement | state |
+| --- | --- |
+| [Both ONNX routing gates execute in one process](2026-08-13-onnx-runtime-lifecycle.md) | live |
+| [Where the resident model's 7.9GB of RSS goes](2026-08-03-llama-prompt-cache.md) | live |
+| [Does one sqlite connection make reads queue? No](2026-08-07-store-connection-cap.md) | live |
+
+## Whole-system runs
+
+Each run pairs a write-up with its raw transcript. The transcript is the
+evidence and is not summarised anywhere else.
+
+| measurement | state |
+| --- | --- |
+| [A week of talking to Maven](2026-08-07-week-of-usage.md), [transcript](2026-08-07-week-of-usage-transcript.md) | live |
+| [Two weeks of talking to Maven, as a baseline to re-run](2026-08-08-two-weeks.md), [transcript](2026-08-08-two-weeks-transcript.md) | live |
+| [The same fortnight, after V-655 merged](2026-08-08-two-weeks-after-merge.md), [transcript](2026-08-08-two-weeks-after-merge-transcript.md) | live |
+
+## Audit
+
+| measurement | state |
+| --- | --- |
+| [Repository deep-audit report](2026-08-10-repo-audit.md) | live |
+
+Its open findings live in `docs/caveats/`, one entry each with a revisit
+trigger. Read the index there, not this file, for what is still broken.

docs/offload.md

@@ -105,6 +105,22 @@ how we find out whether the blind spot is real.
 untouched. The model, the context size, the layer count and the MTP flags are the
 owner's business and not this daemon's schema.
 
+**The port carries a bearer token and cannot be loopback** (V-673). homesrv is
+the client, so this hop is on the LAN. Until 2026-08-11 anything on the network
+could spend the card, hold the model resident by touching the idle clock, and
+read `/slots`, which returns other callers' prompts. mavgpud now reads
+`token_file` and refuses to start when the listen address is reachable from the
+network without one. Downgrading to loopback instead would look safe and take
+the model arm down. Maven sends the same token from `workstation.token`, on the
+completion and on the `/health` probe alike. An unsigned probe answers 401,
+which Pair reads as a busy card, but Maven now rejects a live LAN workstation
+block with a missing token at startup: fallback must describe a temporarily
+unavailable machine, not hide a broken secret source. `model_disabled: true`
+is the explicit resident-only state and does not take CW2 down with it. The
+proxy also
+allowlists the five paths Maven calls, so a leaked token buys the model API and
+not llama-server's admin surface.
+
 **Every GPU service on that box belongs under this supervisor**, added to
 `cmd/mavgpud` rather than to systemd beside it. The rule was learned on
 2026-08-09. The CW2 transcriber ran as its own user unit and registered on the

docs/operations.md

@@ -67,14 +67,30 @@ Config path: `~/.config/maven/mavend.json`. Full example with all options.
 
 Omit the `embedder` block entirely to use the deterministic HashEmbedder floor (no ML, no ONNX runtime dependency). Useful for testing or low-resource setups.
 
-`${NTFY_TOKEN}` and the `${TELEGRAM_*}` vars are expanded from `deploy/telegram.env`, which is gitignored. Copy `deploy/telegram.env.example` and fill it in. Mint a scoped token rather than reusing an admin one. It needs write access to the `maven` topic and nothing else:
+`deploy/telegram.env.example` is the canonical inventory for every deployed
+secret, including values whose destination is the root `.env`, the workpc CW2
+environment file, or `deploy/db_key.env`. Copy values only to the destination
+named beside them; never commit the populated files. Maven expands the homesrv
+sink, workstation, and Home Assistant variables from `deploy/telegram.env`.
+
+Every written integration block is either explicitly disabled or live. A live
+Telegram, ntfy, LAN workstation model/STT, Home Assistant, ambient, CW2, or
+encrypted-database configuration with an empty credential fails startup. This
+keeps a missing env file from quietly becoming fallback behavior. The deployed
+ntfy is currently `disabled: true`, and the workstation model arm is
+`model_disabled: true`; the separately credentialed CW2 STT arm remains live.
+Remove a dark-state flag only after provisioning that arm's credential.
+
+Mint a scoped ntfy token rather than reusing an admin one. It needs write access
+to the `maven` topic and nothing else:
 
 ```sh
 ntfy access maven maven write-only
 ntfy token add --expires=never maven
 ```
 
-Deleting the `ntfy` block turns the reach off, and that is not a no-op. The routing table sends sev3-away nudges and away reminders to ntfy and nowhere else. With no sink wired they hit a nil and vanish, leaving no log line and no `delivery_attempts` row (V-649).
+`disabled: true` keeps a documented ntfy block dark. When enabled, reminders
+try ntfy and fall through to Telegram; delivery attempts record each reach.
 
 ## mavsttd — STT worker (optional, remote whisper.cpp)
 

docs/plans/03-memory-evaluation.md

@@ -28,7 +28,7 @@
 
 ---
 
-## Status 2026-08-01 — foundation shipped (Vikunja #248)
+## Status 2026-08-01 — foundation shipped (V-248)
 
 **Shipped:** `internal/memeval` (not `internal/memory/eval.go` — `internal/store`
 imports `internal/memory` for the vector backend, so an evaluator that reads

docs/plans/07-vision.md

@@ -17,7 +17,7 @@ describing half is **BLOCKED on a model download** — see "What is blocked" bel
 | IPC method `describe_image` (`AuthRead`) | `internal/ipc/{wire,api,client,server}.go`, `internal/auth/policy.go` |
 | Daemon wiring + hourly retention prune | `cmd/mavend/vision.go` |
 
-`internal/media` is deliberately shared: hearing (#253) and speaker recognition (#255) have
+`internal/media` is deliberately shared: hearing (V-253) and speaker recognition (V-255) have
 the same intake problem — a blob arrives, gets stored, gets described — and they store their
 audio in the same place under the same retention.
 
@@ -77,7 +77,7 @@ To unblock, download one pair to `/mnt/hdd1/llms/vision/` (bind-mounted to
 - `moondream2` — smallest, English-only in practice. Do not bother, per the sub-500M lesson.
 
 Then run a second llama-server on 8081 with `--mmproj`, point `vision.endpoint` at it, and
-walk the QA steps on Vikunja #252.
+walk the QA steps on V-252.
 
 ## Config
 

docs/plans/08-hearing.md

@@ -14,14 +14,14 @@ shipped is the workpc-side microphone agent and the router intent — see "Still
 |---|---|
 | Session state machine: start / append / stop / abort / status | `internal/capture/capture.go` |
 | Map-reduce summarisation against `n_ctx` 4096 | `internal/capture/summarize.go` |
-| Audio blobs in the shared store, pruned by `media.retention` | `internal/media` (from #252) |
+| Audio blobs in the shared store, pruned by `media.retention` | `internal/media` (from V-252) |
 | Config block `capture`, off by default | `internal/config/config.go` |
 | IPC `capture_start` / `capture_append` / `capture_stop` / `capture_status` | `internal/ipc/{wire,api,client,server}.go` |
 | Authority: the three write methods `AuthWrite`, status `AuthRead` | `internal/auth/policy.go` |
 | Daemon wiring, note write, STT reuse | `cmd/mavend/capture.go` |
 
 The audio lands in the same content-addressed blob store as images, under the same retention
-loop, because #252 and #253 have the same intake problem and solving it twice would mean two
+loop, because V-252 and V-253 have the same intake problem and solving it twice would mean two
 directories to remember to prune.
 
 ## The refusals, and why
@@ -117,5 +117,5 @@ Both absent by default. `capture` alone does nothing without `media`.
   talking, so the recorder's stop and the speech barge-in must not collide.
 - **A `/dash` panel** showing a running session, so a recording is visible on a surface and not
   only in a log line.
-- **Speaker attribution** — who said what — is #255 and is blocked on a model; see
+- **Speaker attribution** — who said what — is V-255 and is blocked on a model; see
   `docs/plans/10-speaker-recognition.md`.

docs/plans/10-speaker-recognition.md

@@ -3,7 +3,7 @@
 **Goal:** Maven can tell who is speaking on the voice channel, and tag what she writes with
 who said it.
 
-**Status (2026-08-01, Vikunja #255):** the enrolment half is shipped. The recognising half is
+**Status (2026-08-01, V-255):** the enrolment half is shipped. The recognising half is
 **BLOCKED on a model download** — there is no speaker-embedding model on this box, and one
 was not invented to fill the gap. See "Blocked, and on what" below.
 
@@ -125,6 +125,6 @@ lied.
 - **An enrolment surface.** The three IPC methods exist; no page drives them. Enrolment is
   step-up, so it belongs on `/dash` behind a passkey, with a per-profile forget button next to
   each row — that button is the reason `list_speakers` exists.
-- **A speaker column on the meeting recorder** (#253). Attributing lines in a transcript is
+- **A speaker column on the meeting recorder** (V-253). Attributing lines in a transcript is
   the obvious pairing, and it is the place where getting attribution wrong is most damaging,
   so it waits for a real model too.

docs/plans/13-rss-news-feeds.md

@@ -30,7 +30,7 @@
 
 ---
 
-## Shipped 2026-08-01 (#258)
+## Shipped 2026-08-01 (V-258)
 
 `internal/webfetch` (the guarded HTTP door: scheme, allow/deny hosts, private-address
 refusal in the dialer, size cap, redirect cap, per-host rate limit), `internal/rss`

docs/plans/14-web-crawler.md

@@ -29,11 +29,11 @@
 8. Add `crawls` block to `config.Config` and `deploy/mavend.json`
 9. Test with a static HTML page — verify extraction matches expected values, verify scheduling fires correctly
 
-## Shipped 2026-08-01 (#259)
+## Shipped 2026-08-01 (V-259)
 
 Built as `internal/crawl` (pure: robots, extraction, watcher) plus
 `cmd/mavend/crawls.go` (fetcher, ticker, dedup facts), on top of the guarded
-`internal/webfetch` door added with the feed reader (#258). Off unless
+`internal/webfetch` door added with the feed reader (V-258). Off unless
 configured, in two separately-switched halves: `crawl.on_demand` for a URL he
 names, `crawl.watches` for a scheduled re-read.
 

docs/plans/15-board-surface.md

@@ -1,6 +1,6 @@
 # Plan: The work board surface
 
-**The decision Vikunja #431 asked for. Written 04-08-2026.**
+**The decision V-431 asked for. Written 04-08-2026.**
 
 **Verdict: build it, in a smaller shape than the task imagined.** The board is worth
 moving out of the file. The intake form belongs on the `/tasks` page, not on the voice

docs/plans/16-ambient-calendar.md

@@ -1,6 +1,6 @@
 # Plan: What the ambient calendar path should be
 
-**The decision Vikunja #432 asked for. Written 04-08-2026.**
+**The decision V-432 asked for. Written 04-08-2026.**
 
 **Verdict: keep the endpoint, change the contract.** The relay app sends structured
 fields, not a notification blob. The free-text parser stays as the degraded path, because
@@ -9,7 +9,7 @@ if the answer to the one open question below is no.
 
 ## First, the task's premise is out of date
 
-#432 states as confirmed that every ambient event lands on the day the notification was
+V-432 states as confirmed that every ambient event lands on the day the notification was
 posted, because there is no date parsing at all. That was true when the task was filed
 and it is not true now.
 
@@ -17,7 +17,7 @@ and it is not true now.
 "завтра в 15:00" now dates to tomorrow. The same commit added `ambientPastGrace`, which
 refuses an event landing more than two hours before the notification, on the reasoning
 that the day was inferred and a stale inference is wrong rather than late. `45a5e37`
-(#482, this week) fixed a second dating bug the task did not know about: the wall clock
+(V-482, this week) fixed a second dating bug the task did not know about: the wall clock
 was resolved against the notification's own zone, so every ambient meeting on a non-UTC
 box landed off by the deploy's UTC offset.
 
@@ -38,7 +38,7 @@ Everything follows from this and nothing in this repo can answer it.
 A `NotificationListenerService` sees a title and a body. It cannot know a meeting's real
 start, end or organiser, because those are not in the notification. So if the relay is
 limited to the notification stream, free-text parsing on this side is not a choice, it is
-the only thing available, and #432's suggestion that the phone send structured JSON
+the only thing available, and V-432's suggestion that the phone send structured JSON
 cannot be honoured.
 
 If the app may instead read `CalendarContract`, it has the actual event rows, and the
@@ -73,7 +73,7 @@ closes this without code, and it is his to give.
 
 ## What not to do
 
-Do not add date parsing to the free-text path yet. That is the patch #432 explicitly
+Do not add date parsing to the free-text path yet. That is the patch V-432 explicitly
 refuses to accept as closure, and it is the wrong order: if the relay can send a date, no
 date parser is needed, and if it cannot, the parser is guessing at a date from text that
 was never meant to carry one.

docs/plans/17-where-the-voice-loop-runs.md

@@ -1,6 +1,6 @@
 # Plan: Where mavwaked and mavenclient run
 
-**The decision Vikunja #463 asked for. Written 04-08-2026.**
+**The decision V-463 asked for. Written 04-08-2026.**
 
 **Verdict: not in compose on homesrv. They run on a client machine in the room he is in.**
 The transport for that already exists and nothing needs building to allow it. What needs
@@ -11,7 +11,7 @@ building is a way to check the wake path at all, which is a separate task.
 `docker-compose.yml` runs mavend, mavsttd, mavttsd, mavweb and mavpoll. `mavwaked` and
 `mavenclient` appear in no compose file and run as no host process. Both build under
 `make build`. So the wake word and the voice-activity gate are untested by construction:
-QA session 1 step 2 covers push-to-talk from `/dash` only, and #287 (voice session
+QA session 1 step 2 covers push-to-talk from `/dash` only, and V-287 (voice session
 quality) can never be more than half-answered while this holds.
 
 ## The reason is not hardware

docs/plans/18-routing-heads-on-e5-small.md

@@ -1,6 +1,6 @@
 # Plan: route with heads on e5-small, not with a generative model
 
-**Owner's call, 05-08-2026. Vikunja #546.**
+**Owner's call, 05-08-2026. V-546.**
 
 **Verdict: the routing model is the 118M multilingual-e5-small already resident on
 homesrv.** It gets one classification head per output. No LoRA on a decoder, no 100M model

docs/plans/21-persisting-the-routing-trace.md

@@ -1,6 +1,6 @@
 # Plan: persist the routing trace
 
-**Owner's call, 06-08-2026. Vikunja #629, umbrella #628.**
+**Owner's call, 06-08-2026. V-629, umbrella V-628.**
 
 **Verdict: the per-turn decision record now persists.** That reverses a written decision,
 which is the point of this file. It is not an incidental telemetry

docs/plans/CLAUDE.md

@@ -0,0 +1,41 @@
+# docs/plans/
+
+The plan for one piece of work, written before it starts and frozen once it
+does. A plan is what was intended. What happened is the commits, the
+subsystem's living doc under `docs/`, and the measurement under `docs/evals/`.
+
+Changes of mind go to the Vikunja task, never back into the plan. The value of
+a frozen plan is that it can be compared to the outcome afterwards.
+
+## Rules for this directory
+
+* **A plan carries its task id in the `V-<id>` form.** `V-` and not `#`,
+  because Gitea autolinks `#123` to the wrong tracker. Put it in the first three
+  lines, so it is visible without reading the plan.
+* A plan whose work has landed stays. It is not edited to say "shipped" beyond
+  a dated status line, and it is never rewritten to match what was built.
+* A plan nobody will act on goes to `docs/archive/`, not to the bin.
+
+## Two naming schemes, on purpose
+
+`NN-<name>.md` is a Maven feature plan. The number is an append-order id and
+carries no priority. A new plan takes the next free number. Six Go source
+comments cite these paths, so renaming one is a code change.
+
+`YYYY-MM-DD-<name>.md` is a training runbook for the model rig on workpc, not
+for this repo's daemons. Five exist, all from July 2026, all predating the
+numbering. They are dated because a runbook is read as of a day. Renumbering
+would put the oldest plans last and imply an order that is not real. Do not do
+it.
+
+## Plans with no task id
+
+These have never carried one. Do not invent ids for them. Resolve each against
+Vikunja project Maven (ID 2) before citing it, or file a task if none exists.
+
+`01-email-reader.md`, `02-pattern-proposal.md`, `04-self-update.md`,
+`05-model-swap.md`, `06-mcp-support.md`, `09-behavioral-memory.md`,
+`11-smarthome-integration.md`, `12-bluetooth-network-scan.md`.
+
+The five training runbooks have no id either. The nearest live task is V-122,
+which owns finishing the Qwen3-1.7B CPT run on workpc.

docs/qa.md

@@ -301,6 +301,23 @@ make eval-recall
 
 A large miss against 72.7% means the deploy differs from the bench harness.
 
+`make eval-router` is also the aggregate ONNX lifecycle gate. When the default
+runtime path is non-empty it requires both `TestONNXBaseline` and
+`TestONNXRoutingHeads` to load their models and execute in the same Go process.
+The final line names both verified gates. A later test that skips because the
+first one consumed the process-global runtime now makes the command fail rather
+than leaving a green package result. To exercise the proof directly:
+
+```sh
+MAVEN_ONNX_LIB="$PWD/deps/onnxruntime-linux-x64-1.26.0/lib/libonnxruntime.so" \
+MAVEN_ONNX_REQUIRED_GATES=2 \
+  go test -v -count=1 \
+  -run '^(TestONNXBaseline|TestONNXRoutingHeads)$' ./internal/router/eval/
+```
+
+Set `MAVEN_ONNX_LIB=` explicitly when the intended measurement is the portable
+hash floor; that also disables the aggregate ONNX requirement.
+
 **Run on 02-08-2026 @ af9d213. The deploy matches the bench.** `eval-models`
 scored 56 of 77: 72.7% full, 77.9% intent-only, 2 false clarifies and 1 missed.
 That is the recorded figure to the decimal, and calendar sat at 2 of 2, so the