Wire staticcheck and deadcode, and gate both on a baseline (V-694)

The 2026-08-10 audit asked for three analyzers. V-682 wired the first as `make
vuln`. The other two were still absent: neither was installed on the box and no
target ran them, so every reachability claim in the audit stood unchecked.

`make lint` runs staticcheck v0.7.0 and `make deadcode` runs deadcode v0.48.0.
Both are pinned in the Makefile beside GO_VERSION and installed into deps/bin
the way govulncheck is, because a tool is not a dependency of the module. Both
carry the CGO env `test` carries, or the four CGO daemons fail to load and the
analyzer reports a build error instead of a finding. `make analyze` runs all
three. None joins `make test`: they install over the network and `test` has to
pass on a box with no route out.

Neither reports zero, so neither fails on its own output. staticcheck finds 20
and deadcode finds 13, and the audit asked for an allowlist by name, because
three of deadcode's eleven production symbols are deliberate and an unannotated
list invites deleting them. The accepted set lives in
scripts/analyzers/*.baseline, one line per finding with the reason it stays, and
scripts/analyzer-gate.sh gives the verdict. A key holds file, check id and
message, never a line number: a line number goes stale on the next edit above
it, and a gate that reports moved findings as new ones teaches the reader to
skip it. An entry whose finding is gone also fails, so a fix that leaves its
line behind does not pass.

deadcode runs with -test, because a test is a caller. Without the flag the
report is 172 lines, most of internal/router/eval, and none of it is a mistake.
With it, the 11 symbols the audit listed come back exactly, plus two test
helpers it did not count.

Three staticcheck findings were checked and are false positives, recorded as
such: the iCal determinism test must call RenderICal twice, the morning hedge
loop breaks after the first rune on purpose, and the SA9009 line is prose about
//go:embed with the real directive below it. One is V-687 already. The remaining
17 are V-701 with the judgement on each.

The analyzers caveat is deleted rather than edited. What replaces it is the
limit that is now true: the gates are green against a baseline, not against
zero.

CLAUDE.md

@@ -17,6 +17,8 @@ under `docs/`. Read that doc before changing the subsystem.
 | `docs/ecosystem.md` | touching Nexus, Praxis or Hexis |
 | `docs/rearchitecture.md`, `docs/design.md` | changing the shape of anything |
 | `docs/workflow.md` | the five stores, the doc tiers, the guards |
+| `docs/caveats/` | a known limit, its task id and its revisit trigger |
+| `docs/CLAUDE.md` | which tier a doc belongs in, and what each one holds |
 | `AGENTS.md` | local preview, screenshots, model downloads |
 
 ## What Maven is
@@ -52,8 +54,15 @@ carries `-count=1` and sets `MAVEN_ONNX_LIB`. Without that variable the four
 make build   # all 11 binaries. make build-web for one (web/waked/poll/caldav skip CGO)
 make test    # go test -race across ./internal/... ./cmd/... with CGO env set
 make t PKG=./internal/router/eval/ RUN='TestONNX' V=1   # V=1 for -v, RACE=0 to drop -race
+make analyze # staticcheck, deadcode and govulncheck. Not in `test`: all three need the network
 ```
 
+**The static gates pass against a baseline, not against zero**
+(`scripts/analyzers/*.baseline`, reasoning in `docs/workflow.md`). A fix must
+delete its baseline entry, because the gate also fails on an entry whose finding
+is gone. **`make audit` is a git-grep inventory, not analysis.** Do not cite it
+as a reachability check.
+
 ## The daemons
 
 Eleven binaries under `cmd/`, wired socket-to-socket over `internal/ipc`, not

Makefile

@@ -4,7 +4,7 @@
 # `test` below fail on the two packages that have no test files. deps-go builds
 # the missing tools in, so the vendored tree is self-sufficient. Keep the version
 # here in step with the `go` directive in go.mod.
-GO_VERSION := 1.25.5
+GO_VERSION := 1.25.12
 GO       := $(shell pwd)/deps/go/go/bin/go
 export GOTOOLCHAIN := local
 GOFLAGS  :=
@@ -16,7 +16,7 @@ PIPER_BIN     := $(shell pwd)/deps/piper/piper
 PIPER_MODEL   := $(shell pwd)/models/tts/ru_RU-irina-medium.onnx
 PIPER_ESPEAK  := $(shell pwd)/deps/piper/espeak-ng-data
 
-.PHONY: t audit simulate stt-fixtures test-stt-golden all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel tidy eval-router eval-reach eval-recall eval-phrasing eval-models build-gpud
+.PHONY: t audit simulate stt-fixtures test-stt-golden all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel deps-vuln vuln deps-lint lint deadcode analyze tidy eval-router eval-reach eval-recall eval-phrasing eval-models build-gpud
 
 all: build
 
@@ -73,7 +73,7 @@ run-web: build-web
 # builds them on demand, but `go test -coverprofile` calls covdata through
 # base.Tool(), which only stats pkg/tool and exits. So build them in once here.
 GO_TARBALL := go$(GO_VERSION).linux-amd64.tar.gz
-GO_SHA256  := 9e9b755d63b36acf30c12a9a3fc379243714c1c6d3dd72861da637f336ebb35b
+GO_SHA256  := 234828b7a89e0e303d2556310ee549fbcf253d28de937bac3da13d6294262ac1
 deps-go: deps-sentinel
 	@mkdir -p deps/go
 	cd deps/go && curl -fLO 'https://go.dev/dl/$(GO_TARBALL)'
@@ -95,6 +95,70 @@ deps-sentinel:
 	@mkdir -p deps
 	@printf 'module github.com/kami/maven/deps\n\ngo 1.21\n' > deps/go.mod
 
+# vuln — the advisory gate the 2026-08-10 audit found missing (V-682). It reads
+# the published database over the network, so it is not part of `test`, which
+# has to pass on a box with no route out. Run it before a toolchain or
+# dependency bump lands, because that is what it grades: on 2026-08-11 the
+# pinned Go 1.25.5 and x/text 0.14.0 carried 20 reachable advisories and the
+# bumped pair carries none.
+#
+# govulncheck is a tool and not a dependency, so it is installed into deps/ like
+# the toolchain rather than added to go.mod. The version is pinned here for the
+# same reason GO_VERSION is: a gate that moves on its own is not a gate.
+GOVULNCHECK_VERSION := v1.6.0
+GOVULNCHECK := $(shell pwd)/deps/bin/govulncheck
+
+deps-vuln: deps-sentinel
+	@mkdir -p deps/bin
+	GOTOOLCHAIN=local GOBIN=$(shell pwd)/deps/bin \
+		$(GO) install golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION)
+
+# The CGO env is the same one `test` carries: govulncheck loads the packages,
+# and the four CGO daemons do not load without it.
+vuln: deps-vuln
+	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
+		PATH="$(shell pwd)/deps/go/go/bin:$$PATH" GOTOOLCHAIN=local $(GOVULNCHECK) ./...
+
+# lint and deadcode — the other two analyzers the 2026-08-10 audit asked for
+# (V-694). They are not part of `test` for the same reason `vuln` is not: they
+# install over the network, and they are slow enough that a change to one Go
+# file should not pay for them.
+#
+# Neither reports zero, so neither fails on its own output. The accepted set
+# lives in scripts/analyzers/*.baseline and scripts/analyzer-gate.sh decides.
+# What is new fails, and so does a baseline entry whose finding is gone.
+#
+# deadcode runs with -test, so a test file is a root. Without it the report is
+# 172 lines, most of internal/router/eval, and none of it is a mistake.
+STATICCHECK_VERSION := v0.7.0
+DEADCODE_VERSION    := v0.48.0
+STATICCHECK := $(shell pwd)/deps/bin/staticcheck
+DEADCODE    := $(shell pwd)/deps/bin/deadcode
+
+deps-lint: deps-sentinel
+	@mkdir -p deps/bin
+	GOTOOLCHAIN=local GOBIN=$(shell pwd)/deps/bin \
+		$(GO) install honnef.co/go/tools/cmd/staticcheck@$(STATICCHECK_VERSION)
+	GOTOOLCHAIN=local GOBIN=$(shell pwd)/deps/bin \
+		$(GO) install golang.org/x/tools/cmd/deadcode@$(DEADCODE_VERSION)
+
+# Both load the packages, so both carry the CGO env `test` carries. Without it
+# the four CGO daemons do not load and the analyzer reports a build error
+# instead of a finding -- which analyzer-gate.sh fails on rather than filters.
+ANALYZER_ENV = CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" \
+	LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
+	PATH="$(shell pwd)/deps/go/go/bin:$$PATH" GOTOOLCHAIN=local
+
+lint: deps-lint
+	@$(ANALYZER_ENV) $(STATICCHECK) ./... | scripts/analyzer-gate.sh staticcheck
+
+deadcode: deps-lint
+	@$(ANALYZER_ENV) $(DEADCODE) -test ./... | scripts/analyzer-gate.sh deadcode
+
+# Every static gate in one command. Not `check`, because it is not the thing to
+# run before a commit: vuln reads the network and all three are slow.
+analyze: lint deadcode vuln
+
 # Run the tidy the sentinel makes possible. Not part of `test`: it rewrites
 # go.mod, and a build target that edits the module file is a surprise.
 # vendor/ is committed, so a tidy that drops a requirement must be followed by

cmd/mavend/voicewire.go

@@ -386,8 +386,13 @@ func modelSeam(cfg *config.Config, resident *llm.Client) (router.Completer, *llm
 		return resident, nil
 	}
 	ws := cfg.Workstation
+	remote := llm.New(ws.URL, time.Duration(ws.Timeout))
+	remote.SetToken(ws.Token)
+	if ws.Token == "" {
+		log.Printf("voice: no workstation.token — mavgpud refuses an unauthenticated request, so this reads as a card that is always busy")
+	}
 	pair := llm.NewPair(
-		llm.New(ws.URL, time.Duration(ws.Timeout)),
+		remote,
 		resident,
 		ws.Health,
 		time.Duration(ws.Probe),

cmd/mavgpud/auth.go

@@ -0,0 +1,145 @@
+package main
+
+import (
+	"crypto/sha256"
+	"crypto/subtle"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+)
+
+// The boundary in front of the card.
+//
+// mavgpud has to listen on the LAN, because homesrv is the client and a
+// loopback default takes the model arm down. That makes this the one hop on the
+// workstation anything on the network could reach, and until 2026-08-11 it
+// reverse-proxied every path to llama-server unauthenticated: any client could
+// spend the card, hold the model resident by touching the idle clock, and read
+// /slots, which carries the prompts of whoever else was using it.
+//
+// So: a bearer token every request must carry, read from a file, and a path
+// allowlist so a token that leaks buys the model API and not the admin one. The
+// CW2 transcriber beside this daemon has worked this way since it shipped; this
+// is the same arrangement, not a new one.
+
+// readToken loads the bearer token. The file holds the token and nothing else,
+// trailing newline allowed. A path that is set and unreadable is fatal to the
+// caller: a supervisor that silently ran without its boundary is the failure
+// this exists to prevent.
+func readToken(path string) (string, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("token_file: %w", err)
+	}
+	tok := strings.TrimSpace(string(b))
+	if tok == "" {
+		return "", fmt.Errorf("token_file %s is empty", path)
+	}
+	return tok, nil
+}
+
+// loopbackListen reports whether addr can only be reached from this machine.
+// An empty or wildcard host is not loopback, which is the case that matters:
+// ":8080" is the shipped default and it answers the whole LAN.
+func loopbackListen(addr string) bool {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		host = addr
+	}
+	host = strings.Trim(host, "[]")
+	if host == "" {
+		return false
+	}
+	if host == "localhost" {
+		return true
+	}
+	ip := net.ParseIP(host)
+	return ip != nil && ip.IsLoopback()
+}
+
+// allowed is what a token buys. Everything llama-server exposes beyond this is
+// refused, because the endpoints Maven does not call are the expensive ones to
+// hand out: /slots returns other callers' prompts, and its save/restore actions
+// write files chosen by the request.
+//
+// Adding a caller means adding its path here. That is deliberate — the list is
+// short because Maven's use of the workstation is.
+var allowed = map[string]string{
+	"/v1/chat/completions": http.MethodPost,
+	"/v1/completions":      http.MethodPost,
+	"/v1/embeddings":       http.MethodPost,
+	"/v1/models":           http.MethodGet,
+	"/props":               http.MethodGet,
+}
+
+// requireToken authenticates, then bounds. Order matters: an unauthenticated
+// client must not be able to make this daemon allocate a body buffer.
+//
+// /health is not exempt. It reports whether the card is loaded and free, which
+// is exactly what someone deciding whether to take it from him would ask.
+func requireToken(token string, maxBody int64, next http.Handler) http.Handler {
+	want := sha256.Sum256([]byte(token))
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		got := sha256.Sum256([]byte(bearer(r)))
+		if subtle.ConstantTimeCompare(got[:], want[:]) != 1 {
+			w.Header().Set("WWW-Authenticate", "Bearer")
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		r.Body = http.MaxBytesReader(w, r.Body, maxBody)
+		next.ServeHTTP(w, r)
+	})
+}
+
+// bearer pulls the credential out of the header. A malformed header yields the
+// empty string, which fails the comparison like any other wrong token — there
+// is no separate error for it, because telling a caller *how* it was wrong is
+// the only thing a probe learns from a 401.
+func bearer(r *http.Request) string {
+	h := r.Header.Get("Authorization")
+	const prefix = "Bearer "
+	if len(h) <= len(prefix) || !strings.EqualFold(h[:len(prefix)], prefix) {
+		return ""
+	}
+	return strings.TrimSpace(h[len(prefix):])
+}
+
+// allowlist refuses a path the model arm does not use. It answers 404 rather
+// than 403 so a scan cannot map llama-server's surface through this hop.
+func allowlist(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		method, ok := allowed[r.URL.Path]
+		if !ok {
+			http.NotFound(w, r)
+			return
+		}
+		if r.Method != method {
+			w.Header().Set("Allow", method)
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// limitInflight caps concurrent proxied requests. A waiter leaves when its own
+// context ends, so a client that gave up does not keep a slot: llama-server
+// runs with -np 1 and queueing here is cheaper than queueing inside the child
+// with a body held in memory on both sides.
+func limitInflight(n int, next http.Handler) http.Handler {
+	if n <= 0 {
+		return next
+	}
+	slots := make(chan struct{}, n)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		select {
+		case slots <- struct{}{}:
+			defer func() { <-slots }()
+			next.ServeHTTP(w, r)
+		case <-r.Context().Done():
+			http.Error(w, "client went away", http.StatusServiceUnavailable)
+		}
+	})
+}

cmd/mavgpud/auth_test.go

@@ -0,0 +1,180 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// ok is what the boundary is protecting: anything that reaches it has spent
+// the card.
+func ok(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusTeapot) }
+
+func TestRequireTokenRefusesEveryWrongCredential(t *testing.T) {
+	h := requireToken("s3cret", 1<<20, http.HandlerFunc(ok))
+	cases := []struct {
+		name string
+		auth string
+		want int
+	}{
+		{"no header", "", http.StatusUnauthorized},
+		{"wrong token", "Bearer wrong", http.StatusUnauthorized},
+		{"prefix of the token", "Bearer s3cre", http.StatusUnauthorized},
+		{"token with no scheme", "s3cret", http.StatusUnauthorized},
+		{"basic auth", "Basic czNjcmV0", http.StatusUnauthorized},
+		{"right token", "Bearer s3cret", http.StatusTeapot},
+		{"scheme is case-insensitive", "bearer s3cret", http.StatusTeapot},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/health", nil)
+			if tc.auth != "" {
+				r.Header.Set("Authorization", tc.auth)
+			}
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, r)
+			if w.Code != tc.want {
+				t.Errorf("status %d, want %d", w.Code, tc.want)
+			}
+		})
+	}
+}
+
+// The 401 must not say which part was wrong. A probe that can tell a malformed
+// header from a wrong token learns the header shape for free.
+func TestUnauthorizedSaysNothingUseful(t *testing.T) {
+	h := requireToken("s3cret", 1<<20, http.HandlerFunc(ok))
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/health", nil))
+	if got := strings.TrimSpace(w.Body.String()); got != "unauthorized" {
+		t.Errorf("body %q, want %q", got, "unauthorized")
+	}
+	if got := w.Header().Get("WWW-Authenticate"); got != "Bearer" {
+		t.Errorf("WWW-Authenticate %q, want Bearer", got)
+	}
+}
+
+// The body cap applies to an authenticated request. An unauthenticated one
+// never gets far enough to allocate anything.
+func TestRequireTokenCapsTheBody(t *testing.T) {
+	var read error
+	h := requireToken("t", 8, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		buf := make([]byte, 64)
+		for read == nil {
+			if _, read = r.Body.Read(buf); read != nil {
+				break
+			}
+		}
+	}))
+	r := httptest.NewRequest(http.MethodPost, "/v1/chat/completions", strings.NewReader(strings.Repeat("x", 4096)))
+	r.Header.Set("Authorization", "Bearer t")
+	h.ServeHTTP(httptest.NewRecorder(), r)
+	if read == nil || !strings.Contains(read.Error(), "too large") {
+		t.Errorf("read error %v, want the body cap", read)
+	}
+}
+
+func TestAllowlistRefusesWhatMavenDoesNotCall(t *testing.T) {
+	h := allowlist(http.HandlerFunc(ok))
+	cases := []struct {
+		method, path string
+		want         int
+	}{
+		{http.MethodPost, "/v1/chat/completions", http.StatusTeapot},
+		{http.MethodGet, "/v1/models", http.StatusTeapot},
+		// /slots returns the prompts of whoever else is using the card, and
+		// its actions write files the request names.
+		{http.MethodGet, "/slots", http.StatusNotFound},
+		{http.MethodPost, "/slots/0?action=save", http.StatusNotFound},
+		{http.MethodGet, "/", http.StatusNotFound},
+		{http.MethodGet, "/v1/chat/completions", http.StatusMethodNotAllowed},
+	}
+	for _, tc := range cases {
+		t.Run(tc.method+" "+tc.path, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, httptest.NewRequest(tc.method, tc.path, nil))
+			if w.Code != tc.want {
+				t.Errorf("status %d, want %d", w.Code, tc.want)
+			}
+		})
+	}
+}
+
+func TestLimitInflightCapsConcurrency(t *testing.T) {
+	const cap = 2
+	var mu sync.Mutex
+	now, peak := 0, 0
+	release := make(chan struct{})
+	h := limitInflight(cap, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		mu.Lock()
+		now++
+		if now > peak {
+			peak = now
+		}
+		mu.Unlock()
+		<-release
+		mu.Lock()
+		now--
+		mu.Unlock()
+	}))
+
+	var wg sync.WaitGroup
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			h.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodPost, "/v1/chat/completions", nil))
+		}()
+	}
+	// Let the first wave arrive, then drain. The assertion is the peak, and a
+	// peak that never reached the cap still cannot exceed it.
+	close(release)
+	wg.Wait()
+	if peak > cap {
+		t.Errorf("%d requests in flight at once, cap is %d", peak, cap)
+	}
+}
+
+func TestLoopbackListen(t *testing.T) {
+	cases := map[string]bool{
+		":8080":              false, // the shipped default, and the whole LAN
+		"0.0.0.0:8080":       false,
+		"[::]:8080":          false,
+		"192.168.1.105:8080": false,
+		"127.0.0.1:8080":     true,
+		"[::1]:8080":         true,
+		"localhost:8080":     true,
+	}
+	for addr, want := range cases {
+		if got := loopbackListen(addr); got != want {
+			t.Errorf("loopbackListen(%q) = %v, want %v", addr, got, want)
+		}
+	}
+}
+
+func TestReadToken(t *testing.T) {
+	dir := t.TempDir()
+	good := filepath.Join(dir, "tok")
+	if err := os.WriteFile(good, []byte("  abc123\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	got, err := readToken(good)
+	if err != nil || got != "abc123" {
+		t.Errorf("readToken = %q, %v; want abc123", got, err)
+	}
+
+	blank := filepath.Join(dir, "blank")
+	if err := os.WriteFile(blank, []byte("\n\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readToken(blank); err == nil {
+		t.Error("an empty token file is not a token")
+	}
+	if _, err := readToken(filepath.Join(dir, "absent")); err == nil {
+		t.Error("a missing token file is not a token")
+	}
+}

cmd/mavgpud/gpu_test.go

@@ -104,9 +104,11 @@ func TestHealthAndProxyRefuseWhenNotReady(t *testing.T) {
 	s := &supervisor{run: newRunner("fake", "/bin/true", nil, "")}
 	h := s.handler(mustURL(t, "http://127.0.0.1:1"))
 
-	for _, path := range []string{"/health", "/v1/chat/completions"} {
+	// The completion is a POST because the allowlist is in front of the
+	// readiness check now, and it answers 405 to a method it never serves.
+	for path, method := range map[string]string{"/health": http.MethodGet, "/v1/chat/completions": http.MethodPost} {
 		w := httptest.NewRecorder()
-		h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, path, nil))
+		h.ServeHTTP(w, httptest.NewRequest(method, path, nil))
 		if w.Code != http.StatusServiceUnavailable {
 			t.Errorf("%s with no model: got %d, want 503", path, w.Code)
 		}

cmd/mavgpud/main.go

@@ -36,6 +36,21 @@ type config struct {
 	Listen    string `json:"listen"`     // what Maven talks to
 	LlamaAddr string `json:"llama_addr"` // where llama-server binds
 	LlamaBin  string `json:"llama_bin"`
+
+	// TokenFile holds the bearer token every request must carry. It is a path
+	// and never the token itself, the rule mavpoll, mavmaild and the CW2
+	// transcriber already follow: a secret in a committed config is a secret
+	// in the history. Empty is allowed only on a loopback Listen, and
+	// requireToken is where that is decided.
+	TokenFile string `json:"token_file,omitempty"`
+
+	// MaxBody bounds a proxied request body. A completion is a prompt, and a
+	// prompt that does not fit here would not fit the context window either.
+	MaxBody int64 `json:"max_body_bytes,omitempty"`
+	// MaxInflight bounds how many proxied requests reach llama-server at once.
+	// It runs with -np 1, so anything above a handful only queues inside the
+	// child while holding a connection and a body in memory here.
+	MaxInflight int `json:"max_inflight,omitempty"`
 	// LlamaArgs must include the flags that bind LlamaAddr. They are passed
 	// through untouched so the model, context size and layer count stay the
 	// owner's business and not this daemon's schema.
@@ -88,6 +103,8 @@ func defaults() config {
 		MinFreeVRAM: 15 << 30,
 		EvictAfter:  2,
 		StartAfter:  5,
+		MaxBody:     8 << 20,
+		MaxInflight: 4,
 	}
 }
 
@@ -123,6 +140,20 @@ func main() {
 		log.Fatal("mavgpud: llama_bin is required")
 	}
 
+	// A LAN listener with no token is refused rather than downgraded to
+	// loopback. Downgrading would look like a safe default and would take the
+	// model arm down instead: homesrv is the client and it is on the LAN.
+	var token string
+	if cfg.TokenFile != "" {
+		var err error
+		if token, err = readToken(cfg.TokenFile); err != nil {
+			log.Fatalf("mavgpud: %v", err)
+		}
+	} else if !loopbackListen(cfg.Listen) {
+		log.Fatalf("mavgpud: listen %s is reachable from the network and token_file is unset — "+
+			"set token_file, or listen on 127.0.0.1 and accept that Maven cannot reach it", cfg.Listen)
+	}
+
 	base := "http://" + cfg.LlamaAddr
 	run := newRunner("llama-server", cfg.LlamaBin, cfg.LlamaArgs, base+"/health")
 	sup := &supervisor{
@@ -145,7 +176,20 @@ func main() {
 	if err != nil {
 		log.Fatalf("mavgpud: llama_addr: %v", err)
 	}
-	srv := &http.Server{Addr: cfg.Listen, Handler: sup.handler(target)}
+	var h http.Handler = sup.handler(target)
+	if token != "" {
+		h = requireToken(token, cfg.MaxBody, h)
+	}
+	srv := &http.Server{
+		Addr:    cfg.Listen,
+		Handler: h,
+		// A slow-loris client holds a connection and a header buffer for free
+		// otherwise. No ReadTimeout or WriteTimeout: a completion legitimately
+		// takes minutes on this card, and either one would cut it off.
+		ReadHeaderTimeout: 10 * time.Second,
+		IdleTimeout:       60 * time.Second,
+		MaxHeaderBytes:    1 << 16,
+	}
 	go func() {
 		log.Printf("mavgpud: listening on %s, model %s", cfg.Listen, cfg.LlamaBin)
 		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
@@ -203,14 +247,14 @@ func (s *supervisor) handler(target *url.URL) http.Handler {
 		w.Header().Set("Content-Type", "application/json")
 		_, _ = w.Write([]byte(`{"status":"ok"}`))
 	})
-	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+	mux.Handle("/", allowlist(limitInflight(s.cfg.MaxInflight, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if !s.run.isReady() {
 			http.Error(w, "model not loaded", http.StatusServiceUnavailable)
 			return
 		}
 		s.touch()
 		proxy.ServeHTTP(w, r)
-	})
+	}))))
 	return mux
 }
 

cmd/mavwaked/wakefeatures.go

@@ -71,15 +71,30 @@ func newWakeModels(melPath, embedPath, headPath, libPath string) (*wakeModels, e
 			return nil, fmt.Errorf("wake word: onnx runtime: %w", err)
 		}
 	}
+	// One thread per session, not the default of every core. Measured on
+	// workpc: the default took mavwaked from 68% of one core to 335% of
+	// three, for three graphs that each run in well under 80ms single
+	// threaded. An always-on gate that eats a quarter of the workstation is
+	// not a gate he will leave running.
+	opts, err := ort.NewSessionOptions()
+	if err != nil {
+		return nil, fmt.Errorf("wake word: session options: %w", err)
+	}
+	defer opts.Destroy()
+	if err := opts.SetIntraOpNumThreads(1); err != nil {
+		return nil, fmt.Errorf("wake word: intra-op threads: %w", err)
+	}
+	if err := opts.SetInterOpNumThreads(1); err != nil {
+		return nil, fmt.Errorf("wake word: inter-op threads: %w", err)
+	}
 	open := func(p string, in, out []string) (*ort.DynamicAdvancedSession, error) {
-		s, err := ort.NewDynamicAdvancedSession(p, in, out, nil)
+		s, err := ort.NewDynamicAdvancedSession(p, in, out, opts)
 		if err != nil {
 			return nil, fmt.Errorf("wake word: load %s: %w", p, err)
 		}
 		return s, nil
 	}
 	m := &wakeModels{}
-	var err error
 	if m.mel, err = open(melPath, []string{"input"}, []string{"output"}); err != nil {
 		return nil, err
 	}

cmd/mavwaked/wakeword.go

@@ -21,11 +21,15 @@ import (
 	"sync"
 )
 
-// defaultWakeThreshold — score above which the keyword was said. Picked from
-// the false-accept rate on held-out Russian speech, not from accuracy: a miss
-// costs him a repeat, a false accept costs a turn nobody asked for. See
-// docs/evals for the wakes-per-hour this buys.
-const defaultWakeThreshold = 0.99
+// defaultWakeThreshold — score above which the keyword was said.
+//
+// Picked from the false-accept rate on held-out Russian speech, not from
+// accuracy: a miss costs him a repeat, a false accept costs a turn nobody
+// asked for. Over 65 minutes of Common Voice, 0.99 woke her three times and
+// 0.999 once, and the difference in recall was one render out of 126. So the
+// default is the strict one. `docs/evals/2026-08-09-wake-word.md` has both
+// tables.
+const defaultWakeThreshold = 0.999
 
 // wakeWord is the streaming state around wakeModels. It is fed the same
 // capture frames the VAD sees and answers whether the keyword has just been

deploy/mavend.json

@@ -94,6 +94,7 @@
   ],
   "workstation": {
     "url": "http://192.168.1.105:8080",
+    "token": "${MAVEN_GPU_TOKEN}",
     "probe": "15s",
     "timeout": "90s",
     "stt": {

deploy/mavgpud.json

@@ -1,5 +1,14 @@
 {
   "listen": ":8080",
+  "//token_file": [
+    "The bearer token every request must carry. homesrv is the client and it",
+    "is on the LAN, so this port cannot be loopback and the token is what",
+    "stops anything else on the network spending the card or reading /slots.",
+    "A path, never the token: mavgpud refuses to start when listen is",
+    "reachable from the network and this is unset.",
+    "Same value as MAVEN_GPU_TOKEN in homesrv's deploy/telegram.env."
+  ],
+  "token_file": "/home/kami/.config/mavgpud.token",
   "llama_addr": "127.0.0.1:10000",
   "llama_bin": "llama-server",
   "//llama_args": [

deploy/mavwaked.service

@@ -4,11 +4,22 @@
 # user unit because it needs his ALSA session and his ssh agent, and because
 # it should stop when he logs out.
 #
-# THERE IS NO WAKE WORD YET (V-487 stage two). Anything spoken near the fifine
-# becomes a turn. What makes that safe rather than expensive is voiceSender:
-# it sends Surface=SurfaceVoice, which caps every command at L0, so no
-# accidental trigger runs a destructive act. It does not stop her answering
-# out loud, so this unit is his to stop when the room is not his alone.
+# The keyword is "Мэйвен" and the three -wake- flags are what require it
+# (V-487 stage two). Without them anything spoken near the fifine becomes a
+# turn, which voiceSender makes safe rather than expensive: it sends
+# Surface=SurfaceVoice, capping every command at L0. That does not stop her
+# answering out loud, which is the whole reason the keyword exists.
+#
+# The threshold is 0.999 and it is the binary's default, so it is not passed.
+# It came from 65 minutes of held-out Russian speech through this same binary:
+# 0.9 false wakes an hour against 2.8 at 0.99, for one lost render out of 126
+# (docs/evals/2026-08-09-wake-word.md). If the room proves noisier than the
+# corpus, read the scores out of this unit's journal and pass -wake-threshold.
+# Do not lower it by guessing.
+#
+# A keyword shorter than 1.32s can be heard too late to be used, because the
+# head scores 1.28s of audio and the VAD has closed the utterance by then.
+# "Мэйвен, <request>" is unaffected. A bare "Мэйвен" is the case that fails.
 #
 # -vad-model is passed on purpose. Silero answers "is this frame speech" where
 # the energy floor answers "is this frame loud". It declines white noise at
@@ -24,27 +35,39 @@
 #            systemctl --user enable --now mavwaked.service
 
 [Unit]
-Description=Maven always-on listening (VAD, no wake word yet)
+Description=Maven always-on listening (silero VAD, "Мэйвен" keyword)
 # The tunnel is the only path to mavend and the only thing authenticating it.
 Requires=maven-voice-tunnel.service
 After=maven-voice-tunnel.service
 
 [Service]
-# card 0 is the fifine USB microphone. Named, and not "default", because the
-# default device follows whatever pipewire last decided and this daemon should
-# not change ears when he plugs in a headset.
+# The Scarlett Solo 4th Gen, and not the fifine. The fifine was the device
+# here for three days and mavwaked never logged one utterance in them, because
+# it returns RMS 0.00004 with its capture switch on and its ALSA volume at the
+# full 496 of 496. That silence is in the hardware, so no flag reaches it.
+#
+# Named CARD=Gen and not card 4, because a USB card number moves when
+# something else is replugged and this daemon must not change ears quietly.
+# Not "default" either: that follows whatever pipewire last decided.
 #
 # plughw and not hw. mavwaked asks arecord for 16kHz mono, which is what the
-# whole pipeline is canonical in. The fifine offers 2 channels at 44100 or
-# 48000 and nothing else, so bare hw:0,0 dies on "Channels count non
-# available" before a frame is read. plughw puts ALSA's downmix and resampler
-# in front. Any replacement microphone wants the same treatment.
+# whole pipeline is canonical in. Neither microphone offers it, so bare hw
+# dies on "Channels count non available" before a frame is read. plughw puts
+# ALSA's downmix and resampler in front. Any replacement wants the same.
+#
+# The Scarlett measured RMS 0.003 against 0.14 on the onboard input, so its
+# front-panel gain is the thing to raise if she mishears. That is a knob, not
+# a control ALSA exposes. The two loud devices, the onboard ALC897 and the
+# camera, both clip at peak 1.0 and are worse candidates, not better ones.
 Environment=LD_LIBRARY_PATH=%h/.local/lib
 ExecStart=%h/.local/bin/mavwaked \
-  -device plughw:0,0 \
+  -device plughw:CARD=Gen,DEV=0 \
   -addr 127.0.0.1:9100 \
   -lang ru \
   -vad-model %h/.local/share/maven/models/silero_vad.onnx \
+  -wake-model %h/.local/share/maven/models/maven_wakeword.onnx \
+  -wake-mel %h/.local/share/maven/models/melspectrogram.onnx \
+  -wake-embed %h/.local/share/maven/models/embedding_model.onnx \
   -onnx-lib %h/.local/lib/libonnxruntime.so
 Restart=on-failure
 RestartSec=5

deploy/telegram.env.example

@@ -10,3 +10,12 @@ TELEGRAM_CHAT_ID=
 #   ntfy token add --expires=never maven
 # Read access is not needed — mavend publishes and never subscribes.
 NTFY_TOKEN=
+
+# Bearer token for mavgpud, the workstation's GPU supervisor (V-673). It fronts
+# the big model on a LAN port, so the token is the whole boundary in front of
+# the card. Any long random string; mint one with:
+#   openssl rand -hex 32
+# The same value goes in a file on workpc, named by token_file in
+# deploy/mavgpud.json. Unset here and every workstation turn falls back to the
+# resident model, because mavgpud answers 401 and Maven reads that as down.
+MAVEN_GPU_TOKEN=

docs/CLAUDE.md

@@ -0,0 +1,30 @@
+# docs/
+
+Everything an agent needs that is not a rule and not code. `CLAUDE.md` at the
+root carries the rules and points here. Nothing here restates a rule.
+
+The tier is the path, so staleness is visible from the filename.
+
+| path | holds | lifetime |
+| --- | --- | --- |
+| `docs/*.md` | living. One file per subsystem: the reasoning, corrected in place. Each carries `Last verified: <date> @ <sha>`. | until it is wrong |
+| `docs/evals/` | dated measurements, one file per measurement. **Never edited after the day.** A newer number is a new file. | forever |
+| `docs/caveats/` | known limits, one entry per limit, each with a task id and a revisit trigger. Indexed in `docs/caveats/CLAUDE.md`. | until fixed, then deleted |
+| `docs/plans/` | the plan for one piece of work, frozen once it starts | until the work lands |
+| `docs/archive/` | dead. Read by nobody by default. | forever |
+
+## Rules for this directory
+
+* One fact, one home. A measurement is cited from a living doc, never copied
+  into it. The two drift the moment they are both edited.
+* A living doc is corrected in place and its `Last verified` line moves with the
+  correction. Do not append a changelog to it.
+* A number in prose with no `docs/evals/` file behind it is an opinion.
+* Fixing something deletes its caveat. It does not edit the eval that found it.
+
+## Where a subsystem's reasoning lives
+
+`routing.md`, `language.md`, `world.md`, `offload.md`, `deployment.md`,
+`ecosystem.md`, `workflow.md`, `design.md`, `rearchitecture.md`,
+`determinism.md`, `protocol.md`, `handler-wiring.md`, `operations.md`, `qa.md`.
+The root `CLAUDE.md` says which one to read before touching what.

docs/caveats/CLAUDE.md

@@ -0,0 +1,50 @@
+# docs/caveats/
+
+One entry per known limit: something broken, deferred or unsafe that a session
+will otherwise walk into. An entry names what fails, who it costs, and the
+condition that makes it worth fixing.
+
+Two things do not belong here. The evidence is a dated file under `docs/evals/`.
+The reasoning behind a subsystem is its living doc directly under `docs/`. A
+caveat is the pointer between them plus the trigger.
+
+## Rules for this directory
+
+* One file per area, one `##` section per limit, each carrying its task id.
+* **A caveat with no revisit trigger is a complaint.** Give it one or delete it.
+* Closing a limit deletes its entry. It does not edit it to say "fixed", and it
+  never edits the frozen measurement it came from. The durable record of a fix
+  is the commit and the subsystem's living doc.
+* An entry whose task is closed but whose limit is still live is the failure
+  mode to watch for. The id joins the two directions, so check both.
+
+## Index
+
+Every entry below came from the 2026-08-10 deep audit
+(`docs/evals/2026-08-10-repo-audit.md`), except the last, which came from wiring
+the gate the audit asked for. Three of the twenty findings are fixed and have no
+entry. The unauthenticated mavgpud proxy was V-673. The 20 reachable advisories
+in the toolchain and `x/text` were V-682. The missing analyzers were V-694, and
+what they now report is the baseline entry under V-701.
+
+| limit | severity |
+| --- | --- |
+| [Anyone past the proxy can enroll a passkey](security.md#enrollment) | high |
+| [Passkey credentials are rewritten in place](security.md#credentials) | medium |
+| [An empty STT transcript reads as a successful one](external-inputs.md#stt) | medium |
+| [Open-Meteo's empty body becomes 0°C](external-inputs.md#weather) | medium |
+| [Dialogue persistence errors are swallowed](storage.md#dialogue) | medium |
+| [The reminder transition is a lost update](storage.md#reminders) | medium |
+| [A recall miss scans two whole tables](storage.md#recall) | medium |
+| [Closing a TCP listener can strand Accept](transport.md#accept) | medium |
+| [PTT reads an unbounded body](transport.md#ptt) | medium |
+| [mavweb errors cannot be traced](transport.md#errors) | medium |
+| [Fact enrichment is a 20-call serial waterfall](workers.md#enrichment) | medium |
+| [A suppressed nudge is phrased anyway](workers.md#nudges) | medium |
+| [heads_path may equal model_path](invariants.md#heads) | medium |
+| [baselineGrammars is mirrored by hand](invariants.md#grammars) | medium |
+| [Committed absolute paths pin the build to this box](config.md#paths) | medium |
+| [The env example omits deployed variables](config.md#secrets) | medium |
+| [The analyzers pass against a baseline, not zero](dependencies.md#baseline) | medium |
+| [Domain packages depend on store and IPC types](layering.md#dtos) | low |
+| [Eleven symbols are unreachable](layering.md#deadcode) | low |

docs/caveats/config.md

@@ -0,0 +1,21 @@
+# Configuration and environment
+
+## Committed absolute paths pin the build to this box [#690] {#paths}
+
+Costs: `go.mod` replaces Hexis with `/home/kami/apps/hexis`, `start-maven.sh`
+hardcodes the checkout and the data directory, and `deploy/mavgpud.json` holds
+workstation model and Python paths. Vendoring hides the `go.mod` problem for an
+ordinary build. `-mod=mod`, `go mod tidy` and a fresh checkout all fail.
+Revisit when: anyone clones this repo elsewhere, or a `tidy` is needed.
+Workaround: build only from this checkout, with the vendor directory.
+
+## The env example omits deployed variables [#691] {#secrets}
+
+Costs: a fresh deploy can lose remote speech-to-text or ambient authentication
+and run on fallback behaviour with an apparently valid config. Three variables
+are referenced and undocumented: `MAVEN_STT_TOKEN`, `MAVEN_AMBIENT_TOKEN` and
+`CW2_TOKEN`. V-673 added `MAVEN_GPU_TOKEN` to the example.
+It is not silent. The loader logs which variables were unset and says whatever
+they configure is off. What is missing is a startup failure.
+Revisit when: the box is redeployed from scratch, or a new secret is added.
+Workaround: read that log line at startup.

docs/caveats/dependencies.md

@@ -0,0 +1,13 @@
+# Dependencies
+
+## The analyzers pass against a baseline, not against zero [#701] {#baseline}
+
+Costs: `make lint` and `make deadcode` are wired and green (V-694), but green
+means "nothing new since 2026-08-11". The accepted set is 19 staticcheck
+findings and 13 unreachable symbols, listed with a reason each in
+`scripts/analyzers/*.baseline`. Three of the unreachable symbols must stay:
+[layering.md](layering.md#deadcode). One accepted staticcheck finding is V-687.
+Revisit when: V-701 sweeps the baseline, or a fix deletes an entry. The gate
+fails on an entry whose finding is gone, so the deletion is not optional.
+Workaround: none needed. Reachability claims are checkable now. Read the
+baseline before trusting that a target reporting clean means the tree is clean.

docs/caveats/external-inputs.md

@@ -0,0 +1,20 @@
+# External inputs
+
+What arrives from a service Maven does not run, and what happens when it
+arrives malformed. The shared shape: a JSON decode into value fields cannot
+tell "absent" from "zero", so a degraded response becomes a confident answer.
+
+## An empty STT transcript reads as a successful one [#675] {#stt}
+
+Costs: one dropped voice turn per malformed 200 from workpc. The mavsttd floor
+is never asked, because `stt.Pair` falls back on a non-nil error alone.
+Revisit when: CW2 returns a 200 with no text. Sooner if a proxy is put between
+homesrv and port 8081.
+Workaround: none. It is silent by design and the fallback is never spoken.
+
+## Open-Meteo's empty body becomes 0°C [#676] {#weather}
+
+Costs: he is told the weather is clear and 0°C when the service answered
+nothing. Distinct from V-589, which covered the HTTP status and not the body.
+Revisit when: a weather answer is reported as wrong, or the geocoder changes.
+Workaround: none.

docs/caveats/invariants.md

@@ -0,0 +1,27 @@
+# Unguarded invariants
+
+`CLAUDE.md` names these as load-bearing. Nothing enforces either one. A rule
+that lives only in prose gets broken by whoever did not read the prose. Both of
+these fail silently when broken.
+
+`tokenizerRev` and `preRouteLadder` were checked and need nothing. The rev is
+baked into the embedder key, so a bump triggers re-embedding. A missing ladder
+rung is observable in the decision record.
+
+## heads_path may equal model_path [#692] {#heads}
+
+Costs: the routing heads then score with the same graph the resident e5-small
+uses, and recall degrades. There is no error and no log line, so it reads as
+ordinary drift rather than a misconfiguration.
+Revisit when: `deploy/mavend.json` is edited by hand, or a fine-tuned heads
+graph is swapped in.
+Workaround: check the two keys by eye. That is the whole guard today.
+
+## baselineGrammars is mirrored by hand [#693] {#grammars}
+
+Costs: the eval fixture restates the stage 0 rule set in the daemon's order,
+and its own comment says so. Three test files score against it. A grammar added
+to `buildRouter` alone means every routing measurement scores a set nobody
+runs. `CLAUDE.md` warns about this failure by name.
+Revisit when: the next stage 0 grammar is added. That is when it bites.
+Workaround: add to both lists, which is what the rule already says.

docs/caveats/layering.md

@@ -0,0 +1,25 @@
+# Layering and dead surface
+
+Neither entry breaks anything today. Both make a later change cost more than it
+should, which is why they are low and not medium.
+
+## Domain packages depend on store and IPC types [#685] {#dtos}
+
+Costs: dialogue exposes `store.DialogueSessionRow` in its port, the pure
+morning planner takes a `store.Fact`, and auth policy imports IPC method and
+caller types. There is no Go import cycle. A schema change reaches further than
+it should.
+Revisit when: the dialogue or fact schema changes, or a second transport
+appears beside IPC.
+Workaround: none needed. It compiles and it is correct.
+
+## Eleven symbols are unreachable [#686] {#deadcode}
+
+Costs: extra API and test surface, and comments that claim callers which no
+longer exist. Three of the eleven must not be deleted. `HisGender` is a
+documented seam tied to V-399. `AudioDuration` duplicates `internal/audio` and
+should call it. `CountWord` is a one-line alias nobody uses and can go.
+Revisit when: `deadcode` is wired into the audit gate, which needs the
+allowlist this entry describes. **An unannotated list invites deleting the
+three above.**
+Workaround: none needed.

docs/caveats/security.md

@@ -0,0 +1,26 @@
+# Security
+
+Both entries are mavweb's passkey seam. Assertion itself is sound and is not
+the problem: `userVerification` is required, and a sign count that does not
+increase is rejected.
+
+## Anyone past the proxy can enroll a passkey [#683] {#enrollment}
+
+Costs: registration is gated on nothing, so any client that reaches mavweb can
+enroll its own key and become him. Step-up is worse than per-client: one
+process-global `assertedAt` means every client inherits the same five-minute
+window after any successful assertion. The voice WebSocket accepts every
+origin, which makes cross-site use easier. V-317 covers which routes are gated
+and V-605 covers challenge-map growth. Neither covers this.
+Revisit when: mavweb is reachable from anything but the tunnel, and before any
+new credential is enrolled.
+Workaround: the reverse proxy is the only boundary today. That is the finding.
+
+## Passkey credentials are rewritten in place [#684] {#credentials}
+
+Costs: `os.WriteFile` over the live file. A crash, a full disk or an
+interrupted write corrupts every enrolled credential at once, and mavweb will
+not start afterwards.
+Revisit when: a second credential is enrolled, since the blast radius grows
+with the count. Sooner if the box loses power unexpectedly.
+Workaround: back the file up before enrolling.

docs/caveats/storage.md

@@ -0,0 +1,30 @@
+# Storage
+
+The DB seam: what it loses quietly, and what it reads more of than it needs.
+
+## Dialogue persistence errors are swallowed [#677] {#dialogue}
+
+Costs: restart continuity can vanish with nothing in the log, and a failed
+delete can bring stale conversation state back. Current-turn dialogue is
+unaffected, which is why this has never been noticed.
+Revisit when: a restart is reported as losing context. Sooner if a turn starts
+reading dialogue rows back to him.
+Workaround: none. The failure is invisible from outside.
+
+## The reminder transition is a lost update [#678] {#reminders}
+
+Costs: a concurrent fire and cancel both succeed and the last writer wins.
+Medium today because cancellation has no surface. High the moment V-622 adds
+one, and V-622 does not describe this invariant.
+Revisit when: V-622 starts, whichever comes first.
+Workaround: none, but the window is small while nothing can cancel.
+
+## A recall miss scans two whole tables [#681] {#recall}
+
+Costs: every missed recall reads all of `memory_vectors` and then decodes and
+sorts every note vector. Not an N+1, and the memory scan is cheap per losing
+row on purpose. The duplicated decode is the legacy notes path alone.
+Revisit when: the note count makes a miss measurably slow. Also when the two
+exclusion filters are proven to agree. `QueryNotes` uses `notHisWordsSQL` and
+`Search` uses `memory.NonRecallPrefix`. The fallback cannot go until they match.
+Workaround: none needed at today's row counts.

docs/caveats/transport.md

@@ -0,0 +1,34 @@
+# Transport
+
+The HTTP and socket seams. What a client can do to them, and what a shutdown
+can do to us.
+
+## Closing a TCP listener can strand Accept [#679] {#accept}
+
+Costs: during close, both `errc` and `done` are ready in `acceptLoop`'s select.
+Go picks uniformly. So roughly one close in two leaves a waiting `Accept`
+blocked forever on a TCP seam. Unix sockets are unaffected.
+Revisit when: a daemon is seen hanging on shutdown, or before any new TCP
+listener is added.
+Workaround: the process usually exits anyway, which hides it.
+
+## PTT reads an unbounded body [#688] {#ptt}
+
+Costs: `handlePTT` does an unlimited `io.ReadAll`, and mavweb sets no header or
+idle timeouts. A client can force unbounded allocation or hold a connection
+open. mavgpud's half of this was fixed in V-673.
+Revisit when: mavweb is reachable from anything but the tunnel.
+Workaround: mavweb is not LAN-exposed today.
+
+`/ws` rides along with this entry. It never calls `SetReadLimit`, so the
+dependency default of 32,768 bytes applies, about a second of audio. Nothing
+reaches it: the browser posts PCM to `/api/ptt`, and only `handlers_test.go`
+opens `/ws`. It gets a caller and a real limit, or it gets deleted.
+
+## mavweb errors cannot be traced [#689] {#errors}
+
+Costs: some handlers return the raw internal error, which discloses internals.
+Others return a generic one with no identifier, which cannot be joined to its
+log line. There is no request-id middleware to join them.
+Revisit when: a reported UI failure cannot be found in the log.
+Workaround: read the log by timestamp.

docs/caveats/workers.md

@@ -0,0 +1,23 @@
+# Background workers
+
+Both entries are a tick doing expensive work it did not need to do.
+
+## Fact enrichment is a 20-call serial waterfall [#680] {#enrichment}
+
+Costs: each fact is resolved in turn and each ecosystem call can spend ten
+seconds. A slow but reachable Nexus holds one tick for minutes, so the worker
+stops observing its configured interval. V-647 covered the duplicate queue
+scan, not this.
+Revisit when: Nexus gets slow, or when a batch-resolution endpoint exists.
+Workaround: an unreachable Nexus is fine. It is the slow-but-answering case
+that hurts.
+
+## A suppressed nudge is phrased anyway [#687] {#nudges}
+
+Costs: `PhraseNudge` runs before the dedupe is known. The `continue` meant to
+skip it is the last statement in the loop body. Every tick that
+keeps suppressing the same rule pays the resident model again. The comment
+above it claims the opposite.
+Revisit when: digestion ticks show up in the model's load, or when nudge rules
+grow past a handful.
+Workaround: none.

docs/deployment.md

@@ -102,7 +102,7 @@ Text-to-speech has not moved. piper on homesrv is the only synthesizer.
 | `mavpoll` | Environment poller: netdata alarms, uptime-kuma, zenmoney, wireguard presence. Writes facts, sends nothing. Telegram is `internal/delivery/telegramsink`. |
 | `mavcaldav` | CalDAV calendar sync. |
 | `mavmaild` | Mail reader (IMAP, read-only). Holds the IMAP password, core never sees it. |
-| `mavgpud` | GPU supervisor. **Runs on workpc**, own unit `deploy/mavgpud.service`. Keeps llama-server loaded while the card is free (V-488). Maven never asks it for anything and reads `/health` through `llm.Pair`. |
+| `mavgpud` | GPU supervisor. **Runs on workpc**, own unit `deploy/mavgpud.service`. Keeps llama-server loaded while the card is free (V-488). Maven never asks it for anything and reads `/health` through `llm.Pair`. Its LAN port needs a bearer token in the file named by `token_file`, matching `MAVEN_GPU_TOKEN` on homesrv, or it refuses to start (V-673). |
 | `mavupdate` | Not a daemon. Operator CLI a human runs on the box to deploy a new build. |
 
 Two binaries have no Makefile target and neither is deployed. `mavseal` encrypts
@@ -166,11 +166,35 @@ the GPU. A model that will not load is logged and not fatal.
 `-barge-in` is not passed. The threshold is room-specific and this room has no
 number yet. Read the "suppressed while speaking" means out of the journal first.
 
-The device is `plughw:0,0` and not `hw:0,0`. The fifine offers 2 channels at
-44100 or 48000 and nothing else, and mavwaked asks arecord for 16kHz mono. Bare
-`hw` dies on "Channels count non available" before a frame is read.
+The device is `plughw:CARD=Gen,DEV=0`, the Scarlett Solo. It is `plughw` and
+not `hw` because mavwaked asks arecord for 16kHz mono. No microphone here
+offers that, so bare `hw` dies on "Channels count non available" before a
+frame is read. It is named `CARD=Gen` and not card 4 because a USB card number
+moves when something else is replugged.
 
-There is no wake word yet (V-487 stage two), so the loop runs open.
+It used to be the fifine on card 0, and that cost three days. mavwaked logged
+zero completed utterances across them, before the wake word existed and after.
+The fifine returns RMS 0.00004 with its capture switch on and its ALSA volume
+at the full 496 of 496. That silence is in the hardware and no flag reaches
+it. Over the same eight seconds of speech the onboard ALC897 read 0.142 and
+the camera 0.289, both clipping at peak 1.0. The Scarlett read 0.003 clean.
+
+Check the level before blaming the gate. Stop the unit, run `arecord` against
+the device for five seconds, and measure. A live room floor reads near 0.001.
+
+The three `-wake-` flags require the keyword "Мэйвен" (V-487 stage two). Drop
+them and the loop runs open, which is what it did before. The threshold is the
+binary's default of 0.999 and is not passed. Over 65 minutes of held-out
+Russian speech it woke her 0.9 times an hour against 2.8 at 0.99. That cost one
+lost render out of 126 (`docs/evals/2026-08-09-wake-word.md`).
+
+The three sessions are pinned to one thread each. onnxruntime otherwise sizes
+its pool to every core and spins between runs, which took mavwaked from 68% of
+one core to 335%. With the cap it sits at 81%, so the gate costs about 13%.
+
+A keyword shorter than 1.32s can be heard too late to be used. The head scores
+1.28s of audio, and the VAD has closed the utterance by then.
+"Мэйвен, <request>" is unaffected. A bare "Мэйвен" is the case that fails.
 
 mavwaked connects at startup and holds the conn, so a nudge routed to voice
 reaches the speaker before he has said anything (V-671). It used to connect

docs/evals/2026-08-09-wake-word.md

@@ -0,0 +1,112 @@
+# The "Мэйвен" wake word: what it hears and what it invents
+
+*Measured 2026-08-09 on workpc and homesrv. V-487, stage two of two.*
+
+Stage one gave mavwaked silero-vad, which answers "is this frame speech".
+Nothing answered "was this said to her", so every utterance near the
+microphone became a turn. SurfaceVoice caps acts at L0, which made that safe
+rather than expensive. L0 does not cap reading, so the room could still hear
+his facts read back.
+
+The keyword is "Мэйвен". openWakeWord's two frozen feature models do the
+hearing and a 100KB head trained here draws the boundary. It runs on CPU
+beside silero and never touches the GPU.
+
+## Why a per-window accuracy is not a number anyone can act on
+
+The gate scores every 80ms. A 1.7% false-accept rate per window sounds small
+and means a wake every few seconds. The useful question is how many times an hour
+it wakes on speech that was not the keyword. So every table below counts
+threshold crossings over whole clips and divides by the audio duration.
+
+A crossing, not a window above the threshold. A keyword held high for half a
+second is one wake, not six.
+
+## The data
+
+Positives are 600 silero TTS renders of three stressings of the keyword, six
+speakers, ten trailing phrases, augmented eight ways each. Hard negatives are
+560 renders of confusable Russian words. Real speech is Common Voice ru and Golos.
+The 74257 Common Voice clips were already on workpc from the CrisperWhisper
+work. The 200 Golos clips came from the CW2 WER eval.
+
+Splits are by source file. Augmented copies of one render on both sides of a
+split would measure memorisation.
+
+Golos was never trained on at any stage, so it answers the harder question:
+does this survive a change of speakers and rooms.
+
+## Three heads
+
+Each row is a full retrain. The false-accept column is 8.89 hours of Common
+Voice that no stage of training had seen.
+
+| trained on | recall (window) | false wakes/hour @0.99 |
+|---|---|---|
+| TTS + 13.7 min of Golos | 0.869 | not measurable |
+| + 4000 Common Voice clips | 0.836 | 21.9 |
+| + 3837 mined hard negatives | 0.784 | 4.2 |
+| + 753 more mined | 0.810 | 3.4 |
+
+The first row is why the second exists. Thirteen minutes of held-out speech
+cannot measure a rate for a gate that scores twelve times a second. A head
+trained only against TTS learns to tell TTS from not-TTS.
+
+Mining is the whole story after that. Random negatives teach the head what
+most speech sounds like. They do not teach it the few syllable sequences that
+score high, because 4000 clips barely contain them. So the current head was
+run over 20000 fresh clips, keeping every window it scored above 0.05. That
+found 3837 windows in 855512. Repeating those ten times in the next training
+run cut the rate five-fold.
+
+The second round found 753 in 852240, a fifth of the yield, and bought a
+further 20%. It also recovered recall, which the first round had cost. Whether
+a third round is worth 25 minutes of workpc is untested.
+
+## Where the threshold came from
+
+Both columns are held out. Positives are the 126 renders in the test split.
+Speech is 65.1 minutes of Common Voice, disjoint from every training and
+mining pool. Both were run through the built `mavwaked` binary reading PCM from a
+file, not through the python that trained the head.
+
+| threshold | renders shipped | false wakes/hour |
+|---|---|---|
+| 0.99 | 116 / 126 | 2.8 |
+| 0.999 | 115 / 126 | 0.9 |
+
+One render against a third of the false wakes. `defaultWakeThreshold` is
+0.999.
+
+Golos disagrees. It gave 2 wakes in 14 minutes at every threshold, which is
+8.7 per hour. Two events is not a rate. What it does say is that a handful of real utterances score above 0.999
+and no threshold will move them.
+
+## What it costs him
+
+Ten of the 126 held-out renders were heard and still dropped, and every one
+was an utterance shorter than 1.32s. The head scores 16 embeddings, or 1.28s of
+audio. The score therefore peaks up to a second after a short keyword ends.
+By then the VAD has closed the utterance and dispatch has already asked.
+
+Real commands are "Мэйвен, <request>" and run past two seconds, which gives
+the head the whole request to peak during. A bare "Мэйвен" with nothing after
+it is the case that fails. One fix would hold an ignored utterance for a grace
+period and ship it if the keyword lands late. It is not built.
+
+## What it costs the workstation
+
+Under systemd on workpc, mavwaked sat at 335% of a core with the gate on and
+68% with only silero. onnxruntime sizes its thread pool to every core and spins
+between runs, and this gate runs three graphs twelve times a second. Pinning
+all three sessions to one thread brought it to 81%, so the keyword costs about
+13% of one core. The three graphs each finish in well under 80ms that way.
+
+## What was not measured
+
+No room recordings. Every negative above is a clean corpus clip. This gate
+will live among a television, a fan and the far side of a kitchen. None of
+those are in these numbers.
+
+No measurement of him. Training on his voice means copying his transcripts off
+homesrv, which is his call and has not been asked.

docs/evals/2026-08-10-repo-audit.md

@@ -0,0 +1,261 @@
+# Repository deep-audit report
+
+Date: 2026-08-10
+Revised: 2026-08-11, a verification pass over every cited line. Six claims were
+wrong as first written and are corrected in place. Two findings were added.
+
+Frozen 2026-08-11, V-674. A dated measurement is never edited after the day,
+and that holds for a finding which later gets fixed. The live state of each one
+sits in `docs/caveats/` with its task id. The fix sits in the subsystem's living
+doc under `docs/`. Read this file for the evidence, not for what is still true.
+
+Read-only audit complete. I found **20 issue-specific candidates not represented by a matching Vikunja task**: **3 High, 15 Medium, 2 Low**. No code or Vikunja tasks were changed.
+
+I compared all 366 tasks in Maven project 2. Existing items such as V-317, V-589, V-597, V-603, V-605, V-608, V-643 and V-647 were excluded except where a new finding is clearly separate.
+
+## 1. Unhandled edge cases and silent failures
+
+### Empty STT responses suppress the local fallback
+
+**A — Location:** `internal/stt/http.go:85` accepts `{}` as a successful transcript and returns empty text at line 89. `internal/stt/pair.go:143` only falls back when `err != nil`.
+
+**B — Severity:** Medium. A malformed `200 OK` from the workstation silently drops a voice turn instead of invoking `mavsttd`.
+
+**C — Proposed fix:** Require nonblank transcript text and a valid confidence range; treat missing required fields as an error so `Pair` falls back. Bound the response decoder and add `{}`, `{"text":""}`, oversized-body and invalid-confidence tests.
+
+### Open-Meteo can report invented zero-degree weather
+
+**A — Location:** `internal/weather/openmeteo.go:47` uses value fields, while line 95 accepts `{}` and line 100 interprets it as WMO 0 and 0°C.
+
+**B — Severity:** Medium. A valid JSON error/degraded response becomes plausible but false weather. This is separate from V-589, which covered HTTP status handling.
+
+**C — Proposed fix:** Make `current_weather` and its required members pointer/nullable fields, validate presence and ranges, and cap both forecast and geocoder bodies.
+
+### Dialogue persistence errors disappear completely
+
+**A — Location:** Corrupt rows are silently skipped at `internal/dialogue/session.go:127`; delete failures are discarded at line 191; marshal and save failures are swallowed at lines 201 and 209.
+
+**B — Severity:** Medium. Restart continuity can silently vanish, while failed deletes can resurrect stale conversation state.
+
+**C — Proposed fix:** Return or report persistence errors with session ID and operation; quarantine/delete corrupt rows; use bounded contexts instead of `context.Background()`. Keep current-turn availability, but expose the lost restart guarantee through logs/metrics.
+
+## 2. Concurrency and race conditions
+
+### Reminder state transition is a read-then-write lost update
+
+**A — Location:** `internal/store/reminders.go:172` reads `pending`, then line 182 updates without checking the old state.
+
+**B — Severity:** Medium now; High once V-622 adds cancellation surfaces. Concurrent fire/cancel operations can both succeed and the last writer wins. This invariant is not described in V-622.
+
+**C — Proposed fix:** Use one conditional statement: `UPDATE ... WHERE id=? AND status='pending'`; inspect `RowsAffected`, then distinguish not-found from invalid transition. Add simultaneous fired/cancelled tests under `-race`.
+
+### TCP listener shutdown can leave `Accept` blocked forever
+
+**A — Location:** `internal/netaddr/netaddr.go:180` waits only on `conns` and `errc`. During close, line 201 may select the already-closed `done` branch without publishing the listener error; `Close` at line 225 does not wake `Accept`.
+
+**B — Severity:** Medium. During close both `errc` and `done` are ready in `acceptLoop`'s select and Go picks uniformly, so roughly one close in two strands a waiting `Accept` forever on a TCP seam.
+
+**C — Proposed fix:** Add `case <-l.done: return nil, net.ErrClosed` to `Accept`, and make error/channel closure ownership explicit. Test an in-flight `Accept` concurrently with `Close`.
+
+## 3. Data fetching: waterfalls and duplicated scans
+
+### Fact enrichment performs a serial 20-call network waterfall
+
+**A — Location:** `cmd/mavend/factenrichment.go:160` resolves each fact sequentially; line 223 makes the Nexus call. Each request can consume ten seconds at `cmd/mavend/ecosystem.go:63`.
+
+**B — Severity:** Medium. A slow-but-reachable Nexus can hold one tick for roughly 20 × 10s, preventing the worker from observing its intended interval. V-647 only covered the duplicate queue scan.
+
+**C — Proposed fix:** Prefer a Nexus batch-resolution endpoint. Otherwise use bounded concurrency, such as four workers, while preserving per-fact backoff and the 20-attempt ceiling.
+
+### A recall miss scans two whole tables
+
+**A — Location:** The query source table runs embed, memory and notes in order at `cmd/mavend/actions_query.go:161` through line 164. `MemoryStore.Search` scans every row of `memory_vectors` at `internal/store/memory.go:82`; a miss then calls the legacy notes query at `cmd/mavend/actions_query.go:718`, which decodes every note vector at `internal/store/notes.go:63` and sorts the whole table at line 69.
+
+**B — Severity:** Medium at scale. This is not an N+1. It is two full scans per missed recall. The memory scan is already cheap per losing row on purpose, costing one dot product read off the stored bytes with no `[]float32` materialized, so the duplicated decode cost is the notes path alone. Both recall widths are tiny (`memoryRecallWidth` 3, `noteRecallWidth` 5), so the work is in the scan, not the result set. V-581 is a generic sweep of this file, but does not identify this issue.
+
+**C — Proposed fix:** Establish the invariant that every recallable note exists in `memory_vectors`, then remove the fallback. `internal/store/backfill.go` already rewrites note rows into the unified index, so the backfill exists; what is missing is proof that the two exclusion filters agree, since `QueryNotes` filters on `notHisWordsSQL` while `Search` filters on `memory.NonRecallPrefix`. Until they do, query only notes missing from the unified index and rank with the existing bounded top-K heap.
+
+## 4. Dependency health and version pinning
+
+### Reachable published vulnerabilities in the pinned toolchain and `x/text`
+
+**A — Location:** `go.mod:3` and `Makefile:7` pin Go 1.25.5; `go.mod:25` pins `x/text` 0.14.0. Reachable traces include normalization at `internal/router/onnxembedder.go:364`, HTML rendering at `cmd/mavweb/shell.go:154`, email header decoding at `internal/email/message.go:244`, and reverse proxying at `cmd/mavgpud/main.go:212`.
+
+**B — Severity:** High. `govulncheck` found **20 reachable advisories**: one in `x/text` and 19 in the Go standard library, including template XSS, parser complexity/DoS and TLS issues. The official database says `x/text` before 0.39.0 can loop on invalid UTF-8; Go 1.25.12 contains the accumulated security corrections. See [GO-2026-5970](https://pkg.go.dev/vuln/GO-2026-5970), [GO-2026-4980](https://pkg.go.dev/vuln/GO-2026-4980), and the [Go release history](https://go.dev/doc/devel/release#go1.25.0).
+
+**C — Proposed fix:** Upgrade the vendored toolchain to at least 1.25.12, preferably current 1.26.5 after compatibility testing; upgrade `x/text` to at least 0.39.0/current 0.40.0; tidy and re-vendor. Add `govulncheck ./...` to the repository gate.
+
+No dependency was three major versions behind. The remaining direct updates were minor/patch releases. `.opencode`'s `npm audit` reported zero vulnerabilities and no peer conflicts.
+
+## 5. Security exposure
+
+### WebAuthn enrollment is open and step-up state is process-global
+
+**A — Location:** Registration endpoints have no existing-credential or bootstrap authorization at `cmd/mavweb/webauthn.go:92` and line 103. `RegisterBegin` also answers GET, while `RegisterFinish` requires POST. A single server-wide session is created at `cmd/mavweb/main.go:170`, backed by one `assertedAt` timestamp at `internal/webauthn/session.go:20`. The voice WebSocket accepts every origin at `cmd/mavweb/voiceproxy.go:48`.
+
+**B — Severity:** High, and scoped to enrollment and session binding. Assertion itself is sound. `internal/webauthn/webauthn.go:221` requests `userVerification: "required"`, and line 304 rejects a sign count that did not increase. What is broken is that any client past the reverse proxy can enroll its own key, and that after any successful assertion every client inherits the same five-minute step-up window. The wildcard WebSocket origin makes cross-site use easier. V-317 covers which routes are gated, and V-605 covers challenge-map growth, not enrollment or session binding.
+
+**C — Proposed fix:** Permit first enrollment only through a local/one-time bootstrap ceremony; require an already-authenticated credential for subsequent enrollment. Bind step-up to a signed, HttpOnly, SameSite browser session and exact RP origin. Restrict WebSocket origins and add CSRF/origin validation to mutating routes.
+
+### `mavgpud` exposes an unauthenticated GPU/model proxy on the LAN
+
+**Closed 2026-08-11, V-673.** The reasoning now lives in `docs/offload.md`,
+beside the rest of the workstation seam, and `docs/deployment.md` carries the
+operational line in the daemon table. This block is a pointer, not a second
+home: read those, not this.
+
+- Boundary and limits: `cmd/mavgpud/auth.go`, wired in `cmd/mavgpud/main.go`.
+- Client half: `internal/llm/client.go`, `internal/llm/remote.go`,
+  `internal/config/workstation.go`, `cmd/mavend/voicewire.go`.
+- Deploy: `token_file` in `deploy/mavgpud.json`, `MAVEN_GPU_TOKEN` in
+  `deploy/telegram.env.example`.
+- Commits: `95e7427`, `1c13d22`, `5596cdd`, `9bb3425`.
+
+**Deploy step, not yet done:** write the token to
+`/home/kami/.config/mavgpud.token` on workpc and put the same value in
+`MAVEN_GPU_TOKEN` on homesrv, before restarting either side. mavgpud refuses to
+start without it, and a homesrv missing it falls back to the resident model.
+
+### Passkey credential persistence is not crash-atomic
+
+**A — Location:** `cmd/mavweb/credentials.go:36` serializes the full credential map and overwrites the live file directly with `os.WriteFile` at line 41.
+
+**B — Severity:** Medium. A crash, disk-full event or interrupted write can corrupt every enrolled credential and prevent mavweb from starting.
+
+**C — Proposed fix:** Write a `0600` temporary file in the same directory, `fsync`, rename atomically, then sync the directory. Preserve the last known-good file and test simulated write failures.
+
+No new tracked hardcoded keys, raw user-concatenated SQL, `eval`, or shell execution of untrusted strings were found. The historical DB-key exposure is already covered by V-12.
+
+## 6. Circular dependencies and layering
+
+### Domain packages depend directly on storage/wire DTOs
+
+**A — Location:** Dialogue imports `store` and exposes `store.DialogueSessionRow` in its port at `internal/dialogue/session.go:9` and line 75. The pure morning planner accepts `store.Fact` at `internal/morning/plan.go:72`. Auth policy imports IPC method and caller types at `internal/auth/policy.go:8` and `internal/auth/scope.go:33`.
+
+**B — Severity:** Low. There is no current Go import cycle, but domain changes are coupled to database and IPC schema changes.
+
+**C — Proposed fix:** Make domain packages own their DTOs and ports—dialogue persistence records, morning evidence, auth operation/caller identity—and adapt them in store/IPC/cmd wiring.
+
+No circular Go imports were found; compilation and `go vet` both succeeded.
+
+## 7. Dead code and zombie endpoints
+
+### Eleven production symbols are unreachable
+
+**A — Location:** `deadcode` found:
+
+- `cmd/mavwaked/vad.go:244` — `PCMToF32`
+- `cmd/mavwaked/vad.go:265` — `AudioDuration`
+- `internal/crawl/watch.go:86` — `Watcher.Watches`
+- `internal/phraser/confirm.go:137` — `IsC`
+- `internal/phraser/plural.go:13` — `CountWord`
+- `internal/phraser/eval/checks.go:80` — `HisGender`
+- `internal/update/update.go:363` — `WithClock`
+- `internal/voice/errors.go:72` — `jsonMarshal`
+- `internal/voice/errors.go:73` — `jsonUnmarshal`
+- `internal/webauthn/cbor.go:98` — `cborValue.At`
+- `internal/worker/server.go:64` — `Server.SetSynthesizer`
+
+Three of the eleven do not want deleting, and the 2026-08-11 pass checked each:
+
+- `internal/phraser/eval/checks.go:80` `HisGender` is deliberately exposed and deliberately uncalled. The comment at line 72 ties the trio to V-399, and `cmd/mavend/personaguard.go:94` states why this one is not run on a phrased message. Deleting it removes a documented seam.
+- `cmd/mavwaked/vad.go:265` `AudioDuration` duplicates what `internal/audio` already computes. Call that instead of deleting the body.
+- `internal/phraser/plural.go:13` `CountWord` is a one-line alias for `say.CountWord`, and every real caller already uses `say` directly. Safe to delete outright.
+
+**B — Severity:** Low. They increase API and test surface, and some comments claim callers that no longer exist.
+
+**C — Proposed fix:** Delete the genuinely obsolete symbols. Where one is an intended extension seam, add the actual caller and a contract test, or record why it stays. Add `deadcode ./...` with an explicit allowlist to the audit gate, since an unannotated list invites deleting the three above.
+
+The repository history begins on 2026-07-03, so a six-month rotten-feature-flag check is not yet applicable. One zombie HTTP route does exist: `/ws` is wired at `cmd/mavweb/main.go:235` and no shipped client reaches it, since the browser posts to `/api/ptt`. Section 8 carries the detail.
+
+## 8. Performance hot paths and memory/resource leaks
+
+### Digest dedupe happens after paying the LLM cost
+
+**A — Location:** `cmd/mavend/tick_digest.go:147` calls `PhraseNudge` before `EnqueueDigestEntry` reports the dedupe at line 153. The `else if deduped { continue }` is the last statement in the loop body, so it changes nothing.
+
+**B — Severity:** Medium. Every tick that continues suppressing the same rule can invoke the model again, contrary to the cache claim in the preceding comment.
+
+**C — Proposed fix:** Check for a live pending entry by stable rule/candidate fingerprint before phrasing, or persist/cache the phrased result with a TTL. Add a test asserting one phraser call across repeated suppressed ticks.
+
+### PTT reads an unbounded body and neither server sets header or idle limits
+
+**A — Location:** `handlePTT` performs an unlimited `io.ReadAll` at `cmd/mavweb/voiceproxy.go:125`. Mavweb and mavgpud construct servers without header or idle limits at `cmd/mavweb/main.go:242` and `cmd/mavgpud/main.go:148`. Separately, `handleWS` never calls `conn.SetReadLimit`, so the dependency default of 32,768 bytes applies at `vendor/github.com/coder/websocket/read.go:92`, about one second of 16kHz mono PCM.
+
+**B — Severity:** Medium for the HTTP side. A client can force unbounded body allocation or hold a connection open indefinitely. Low for the WebSocket read limit, because `/ws` has no caller: the browser client posts PCM to `/api/ptt` at `cmd/mavweb/static/app.js:114`, and `/ws` is wired at `cmd/mavweb/main.go:235` but reached only from `handlers_test.go`. The 64MiB `maxFrame` at `cmd/mavweb/voiceproxy.go:27` is not an unapplied declaration. It caps the mavend voice wire at line 194 and line 212, which is the "either direction" its comment names.
+
+**C — Proposed fix:** Use `http.MaxBytesReader` for PTT and return 413 on overflow. Configure `ReadHeaderTimeout`, `IdleTimeout` and header limits on both servers. Decide `/ws` separately: either give it an audio-duration read limit and a client, or delete it. See section 7.
+
+## 9. Error propagation and user feedback
+
+### Mavweb has no consistent, traceable error contract
+
+**A — Location:** Some handlers expose raw internal errors, such as `cmd/mavweb/tools.go:57`, `cmd/mavweb/routines.go:58` and `cmd/mavweb/webauthn.go:122`. Others return generic errors without a request/incident identifier, such as `cmd/mavweb/facts.go:90`. No HTTP request-ID middleware was found.
+
+**B — Severity:** Medium. Raw errors can disclose implementation details, while generic errors cannot be correlated with the correct log entry.
+
+**C — Proposed fix:** Add a central `writeProblem`/error-page helper with a stable error code and generated request ID; log the full wrapped error server-side and return only a sanitized message plus the ID. Carry the ID into IPC/ecosystem correlation where possible.
+
+## 10. Configuration drift and environment assumptions
+
+### Committed absolute paths make builds and deployment host-specific
+
+**A — Location:** `go.mod:31` replaces Hexis with `/home/kami/apps/hexis`. `start-maven.sh:11` hardcodes the Maven checkout and line 40 hardcodes the data directory. `deploy/mavgpud.json:12` and line 35 contain workstation-specific model/Python paths.
+
+**B — Severity:** Medium. Vendoring masks the `go.mod` problem for ordinary builds, but `-mod=mod`, tidy and fresh non-Kami checkouts fail. Deployment files cannot be reused safely on another host.
+
+**C — Proposed fix:** Pin a real Hexis module revision; keep local replacement in an uncommitted `go.work`. Derive script root from the script location and make data paths configurable. Split mavgpud into a committed template plus host-local override.
+
+### Environment examples do not cover deployed variables
+
+**A — Location:** Active config references `MAVEN_STT_TOKEN` at `deploy/mavend.json:101`, Compose references `MAVEN_AMBIENT_TOKEN` at `docker-compose.yml:109`, and the GPU service expects `CW2_TOKEN` at `deploy/mavgpud.service:15`. `deploy/telegram.env.example:5` documents only Telegram and ntfy. The loader deliberately converts missing variables to empty settings at `internal/config/config.go:333`.
+
+**B — Severity:** Medium. A fresh deployment can lose remote STT or ambient authentication and run on fallback behavior despite apparently valid config. It is not silent: `internal/config/config.go:340` logs which variables were unset and states that whatever they configure is off. What is missing is a startup failure and an example file naming them.
+
+**C — Proposed fix:** Maintain one canonical secret manifest/example covering every referenced variable, or service-specific examples with validation. Fail startup when an enabled integration lacks its required secret; permit empty variables only for explicitly disabled blocks.
+
+No production/staging debug-mode or mock-gateway drift was found.
+
+## 11. Declared invariants with no guard
+
+`CLAUDE.md` names several rules as load-bearing. Two of them are enforced by
+nothing, which the first pass missed because it audited generic categories only.
+
+### `heads_path` may equal `model_path` and nothing objects
+
+**A — Location:** `cmd/mavend/voicewire.go:168` reads `cfg.Voice.Embedder.HeadsPath` and loads it without comparing it to the model path. The rule is stated at `internal/config/voice.go:41`, which says the heads graph is a fine-tuned COPY, and again in `CLAUDE.md`.
+
+**B — Severity:** Medium. Pointing both keys at the same file degrades recall, because the routing heads then score with the same graph the resident e5-small uses. There is no error and no log line, so the failure looks like ordinary recall drift.
+
+**C — Proposed fix:** Reject the config at load when `heads_path` equals `model_path` after path cleaning. A daemon that cannot route well should refuse to start rather than answer worse.
+
+### `baselineGrammars` mirrors `buildRouter` by hand
+
+**A — Location:** `internal/router/eval/eval_test.go:263` restates the stage 0 rule set in the daemon's order, and its own comment says so. `claims_test.go:30`, `heads_test.go:76` and `eval_test.go:221` all score against it. Nothing compares the two lists.
+
+**B — Severity:** Medium. A grammar added to `buildRouter` and not to the fixture means every routing measurement scores a set nobody runs, which is the failure mode `CLAUDE.md` warns about by name.
+
+**C — Proposed fix:** Export the grammar set from one place and have both `buildRouter` and the fixture consume it, or add a test that diffs the two by grammar name and fails on drift.
+
+`tokenizerRev` and `preRouteLadder` were checked and need nothing.
+`internal/router/onnxembedder.go:91` bakes the rev into the embedder key, so a
+bump changes the key and triggers re-embedding. `cmd/mavend/voice.go:278` passes
+`preRouteLadder` to `decision.Expect`, so a missing rung is observable.
+
+## Cross-cutting subsystem candidates
+
+The recurring findings suggest five reusable patterns:
+
+- A bounded, required-field-validating JSON client for STT, weather, ecosystem and model calls.
+- Authenticated remote-service middleware providing token checks, body limits, concurrency limits and correlation IDs.
+- Atomic state-transition helpers using conditional SQL and `RowsAffected`.
+- A uniform HTTP problem/error envelope.
+- A repository health gate combining `staticcheck`, `govulncheck`, `deadcode` and dependency audits.
+
+## Validation
+
+- `make fmt-check` and `make vet` passed. `make audit` passed too, but it is a git-grep inventory over loc, todo, stubs, docs, tests and gaps (`scripts/audit.sh`), not a static-analysis gate. Do not read it as one.
+- `staticcheck`, `govulncheck`, `deadcode`, tracked-secret and history scans and npm audit were run out of tree. None of the three Go analyzers is installed on this box or wired into any make target, which is the argument for section 4's proposed gate.
+- The advisory version numbers in section 4 could not be re-checked offline on 2026-08-11. `deps/go/go/VERSION` reads `go1.25.5`, built 2025-11-26, so the eight-month gap behind current supports the upgrade claim.
+- The first whole-tree race run failed once in `cmd/mavend` while analyzers were compiling concurrently; a fresh isolated `go test -race -count=1 ./cmd/mavend` passed in 100.6 seconds, so the transient result was not counted as a defect.
+- The pre-existing `deploy/mavwaked.service` modification and untracked `deploy/asoundrc` remained untouched.

docs/offload.md

@@ -105,6 +105,19 @@ how we find out whether the blind spot is real.
 untouched. The model, the context size, the layer count and the MTP flags are the
 owner's business and not this daemon's schema.
 
+**The port carries a bearer token and cannot be loopback** (V-673). homesrv is
+the client, so this hop is on the LAN. Until 2026-08-11 anything on the network
+could spend the card, hold the model resident by touching the idle clock, and
+read `/slots`, which returns other callers' prompts. mavgpud now reads
+`token_file` and refuses to start when the listen address is reachable from the
+network without one. Downgrading to loopback instead would look safe and take
+the model arm down. Maven sends the same token from `workstation.token`, on the
+completion and on the `/health` probe alike. An unsigned probe answers 401,
+which Pair reads as a busy card, so a missing token degrades to the resident
+model rather than breaking a turn. The proxy also
+allowlists the five paths Maven calls, so a leaked token buys the model API and
+not llama-server's admin surface.
+
 **Every GPU service on that box belongs under this supervisor**, added to
 `cmd/mavgpud` rather than to systemd beside it. The rule was learned on
 2026-08-09. The CW2 transcriber ran as its own user unit and registered on the

docs/workflow.md

@@ -1,6 +1,6 @@
 # Session workflow: the five stores and the guards
 
-*Last verified: 2026-08-09 @ a9b480a*
+*Last verified: 2026-08-11 @ 557f5a3*
 
 How a session starts, where each kind of writing belongs, and what the hooks
 refuse. `CLAUDE.md` carries the commands. This file carries the reasoning.
@@ -78,3 +78,40 @@ blocks further edits past 600 changed lines on a `task/` branch.
 budget read high.
 
 `--no-verify` exists. Using it means saying why in the commit body.
+
+## Static gates
+
+Three analyzers, one target each, and `make analyze` for all three. The
+2026-08-10 audit asked for them because none was installed on the box and
+`make audit` is a git-grep inventory, not analysis. Do not read `make audit` as
+a gate.
+
+- `make vuln`, govulncheck over `./...` (V-682).
+- `make lint`, staticcheck over `./...` (V-694).
+- `make deadcode`, deadcode with `-test` over `./...` (V-694).
+
+None of the three joins `make test`. All three install over the network, and
+`test` has to pass on a box with no route out. `vuln` reads the advisory
+database at run time as well. Run `make analyze` before a dependency or
+toolchain bump lands, and before calling a symbol unreachable.
+
+Each tool is pinned in the Makefile beside `GO_VERSION`. A gate that moves on
+its own is not a gate. Each installs into `deps/bin`, because a tool is not a
+dependency of the module.
+
+**staticcheck and deadcode pass against a baseline, not against zero.** The
+accepted findings live in `scripts/analyzers/*.baseline`, one line each. A key
+holds file, check id and message, never a line number. A line number goes stale
+on the next edit above it. The output then reports moved findings as new ones,
+and the reader learns to skip it.
+
+`scripts/analyzer-gate.sh` gives the verdict. A finding absent from the baseline
+fails. So does a baseline entry whose finding is gone, which is what stops the
+accepted set from outliving the repo. Deleting the entry is part of each fix.
+
+`deadcode` runs with `-test` because a test is a caller. Without the flag the
+report is 172 lines, most of `internal/router/eval`, none of it a mistake.
+
+A baseline entry carries the reason it stays. Three reasons appear. Another task
+owns the finding. The check cannot see through a false positive. A cosmetic
+finding waits for a sweep.

go.mod

@@ -1,6 +1,6 @@
 module github.com/kami/maven
 
-go 1.25.5
+go 1.25.12
 
 require (
 	github.com/coder/websocket v1.8.12
@@ -22,7 +22,7 @@ require (
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	golang.org/x/text v0.14.0
+	golang.org/x/text v0.40.0
 	modernc.org/libc v1.74.1 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect

go.sum

@@ -25,13 +25,13 @@ github.com/yalue/onnxruntime_go v1.31.0 h1:1ln4YW1SFOFfGJZXe3jNOb2JUSt+l2pEneZfV
 github.com/yalue/onnxruntime_go v1.31.0/go.mod h1:b4X26A8pekNb1ACJ58wAXgNKeUCGEAQ9dmACut9Sm/4=
 golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
 golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
 golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
+golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
 golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 modernc.org/cc/v4 v4.29.0 h1:CXgwL8cvxmyzBQZzbSl/6xFtMCryb6u8IOqDci39cgc=

internal/config/workstation.go

@@ -27,6 +27,13 @@ type WorkstationConfig struct {
 	// signal, so it must be the supervisor's endpoint and not llama-server's.
 	Health string `json:"health,omitempty"`
 
+	// Token — the bearer credential mavgpud requires, expanded from the
+	// environment like every other secret here. It is what stops anything on
+	// the LAN spending the card, so a URL that is not loopback needs one.
+	// Wrong or missing reads as a workstation that is down, and Maven falls
+	// back to the resident model.
+	Token string `json:"token,omitempty"`
+
 	// Probe — how often admission is re-checked. 0 ⇒ DefaultWorkstationProbe.
 	// Nothing on the hot path waits for it: the answer is cached and read
 	// atomically, so this only sets how late Maven notices the card came back.

internal/llm/client.go

@@ -51,6 +51,10 @@ type Client struct {
 	base string
 	swap SwapGate
 	http *http.Client
+	// token — the bearer credential for a server that asks for one. Empty for
+	// the resident model, which is reached over loopback on the same box.
+	// mavgpud on the workstation requires it: that hop is on the LAN.
+	token string
 
 	// gate / background — priority on the single llama-server slot. Set once
 	// at wiring time (SetGate), read on every request. nil gate ⇒ no gating,
@@ -101,6 +105,27 @@ func New(baseURL string, timeout time.Duration) *Client {
 	return &Client{base: baseURL, http: &http.Client{Timeout: timeout}}
 }
 
+// SetToken installs the bearer credential this client sends. Wiring-time, like
+// SetGate: an empty token means the server is not asking for one.
+func (c *Client) SetToken(t string) {
+	c.mu.Lock()
+	c.token = t
+	c.mu.Unlock()
+}
+
+// authorize adds the credential when there is one. Exported to the package so
+// the Pair prober signs /health with the same token as the completion — a
+// probe that answers 401 would otherwise read as a workstation that is down,
+// and Maven would fall back forever without saying why.
+func (c *Client) authorize(req *http.Request) {
+	c.mu.RLock()
+	t := c.token
+	c.mu.RUnlock()
+	if t != "" {
+		req.Header.Set("Authorization", "Bearer "+t)
+	}
+}
+
 // SetBaseURL re-points the client at another llama-server. Safe to call while
 // requests are in flight: a request that already read the old base finishes
 // against the old base (or fails, and every caller of Complete has a fallback),
@@ -196,6 +221,7 @@ func (c *Client) Complete(ctx context.Context, r Req) (string, error) {
 		return "", err
 	}
 	req.Header.Set("Content-Type", "application/json")
+	c.authorize(req)
 	httpResp, err := c.http.Do(req)
 	if err != nil {
 		return "", err

internal/llm/remote.go

@@ -132,6 +132,9 @@ func (p *Pair) probe(ctx context.Context) {
 		p.set(false)
 		return
 	}
+	if p.remote != nil {
+		p.remote.authorize(req)
+	}
 	resp, err := p.http.Do(req)
 	if err != nil {
 		p.set(false)

internal/llm/remote_test.go

@@ -250,3 +250,35 @@ func TestNoFloorIsAnError(t *testing.T) {
 		t.Fatalf("err = %v, want ErrNoFloor", err)
 	}
 }
+
+// The workstation is behind mavgpud, which requires a bearer token on the
+// completion and on /health alike. A probe that did not carry it would answer
+// 401, Pair would read that as a card that is busy, and every turn would fall
+// back to the resident model with nothing in the log naming why.
+func TestPairSignsTheProbeAndTheCompletion(t *testing.T) {
+	seen := make(chan string, 2)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		seen <- r.Header.Get("Authorization")
+		if r.URL.Path == "/health" {
+			return
+		}
+		_, _ = w.Write([]byte(`{"choices":[{"message":{"content":"ok"}}]}`))
+	}))
+	defer srv.Close()
+
+	remote := New(srv.URL, time.Second)
+	remote.SetToken("s3cret")
+	p := NewPair(remote, New(srv.URL, time.Second), srv.URL+"/health", time.Hour)
+	p.probe(context.Background())
+	if !p.Available() {
+		t.Fatal("the probe did not admit an answering workstation")
+	}
+	if _, err := p.Complete(context.Background(), Req{User: "привет"}); err != nil {
+		t.Fatalf("complete: %v", err)
+	}
+	for i := 0; i < 2; i++ {
+		if got := <-seen; got != "Bearer s3cret" {
+			t.Errorf("request %d carried %q, want the bearer token", i, got)
+		}
+	}
+}

scripts/analyzer-gate.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# analyzer-gate.sh — turn an analyzer's output into a pass/fail verdict.
+#
+# The 2026-08-10 audit asked for staticcheck, govulncheck and deadcode
+# (V-694). govulncheck needed no gate of this shape because it already
+# reported zero after the toolchain bump. The other two do not: staticcheck
+# reports 20 findings today and deadcode reports 11 unreachable symbols, and
+# three of those eleven are deliberate. A target that fails on the first run
+# is not a gate, it is a target nobody runs. So the accepted set is written
+# down, and only what is NOT in it fails.
+#
+#   staticcheck ./... | scripts/analyzer-gate.sh staticcheck
+#   deadcode -test ./... | scripts/analyzer-gate.sh deadcode
+#
+# The baseline is keyed on file, check id and message, never on line number.
+# A key carrying a line number goes stale on the next edit above it and then
+# reports moved findings as new ones, which trains the reader to ignore it.
+# The cost of dropping the line is that two identical findings in one file
+# share one key, so the second is accepted with the first. That is the right
+# way round: the same check firing twice on the same file is one thing to fix.
+#
+# A baseline entry with no finding left also fails. Fixing something and
+# leaving its entry behind is how the accepted set stops describing the repo.
+# The fix is one line: delete the entry the failure names.
+#
+# Reads stdin, writes a report, never writes a file.
+
+set -uo pipefail
+cd "$(dirname "$0")/.." || exit 1
+
+tool="${1:?usage: analyzer-gate.sh <staticcheck|deadcode>}"
+baseline="scripts/analyzers/$tool.baseline"
+[ -f "$baseline" ] || { printf 'analyzer-gate: no baseline at %s\n' "$baseline" >&2; exit 2; }
+
+# Normalise to "<file>\t<id>\t<message>". Anything that does not parse is an
+# analyzer error, not a finding, and it fails without consulting the baseline.
+# staticcheck: path.go:12:34: message (SA1234)
+# deadcode:    path.go:12:34: unreachable func: Symbol
+found=$(mktemp) || exit 2
+malformed=$(mktemp) || exit 2
+trap 'rm -f "$found" "$malformed"' EXIT
+
+while IFS= read -r line; do
+  [ -n "$line" ] || continue
+  case "$tool" in
+    staticcheck)
+      if [[ "$line" =~ ^([^:]+):[0-9]+:[0-9]+:\ (.*)\ \(([A-Z]+[0-9]+)\)$ ]]; then
+        # SA1019 ends its message with a space. Trim, so no baseline entry
+        # depends on trailing whitespace surviving an editor.
+        msg="${BASH_REMATCH[2]}"
+        printf '%s\t%s\t%s\n' "${BASH_REMATCH[1]}" "${BASH_REMATCH[3]}" "${msg%"${msg##*[![:space:]]}"}" >>"$found"
+      else
+        printf '%s\n' "$line" >>"$malformed"
+      fi
+      ;;
+    deadcode)
+      if [[ "$line" =~ ^([^:]+):[0-9]+:[0-9]+:\ unreachable\ func:\ (.*)$ ]]; then
+        printf '%s\tunreachable\t%s\n' "${BASH_REMATCH[1]}" "${BASH_REMATCH[2]}" >>"$found"
+      else
+        printf '%s\n' "$line" >>"$malformed"
+      fi
+      ;;
+    *) printf 'analyzer-gate: unknown tool %s\n' "$tool" >&2; exit 2 ;;
+  esac
+done
+
+if [ -s "$malformed" ]; then
+  printf '%s: the analyzer said something that is not a finding:\n' "$tool" >&2
+  sed 's/^/  /' "$malformed" >&2
+  exit 1
+fi
+
+accepted=$(mktemp) || exit 2
+trap 'rm -f "$found" "$malformed" "$accepted"' EXIT
+grep -v '^[[:space:]]*\(#\|$\)' "$baseline" | sort -u >"$accepted"
+sort -u "$found" -o "$found"
+
+new=$(comm -23 "$found" "$accepted")
+gone=$(comm -13 "$found" "$accepted")
+status=0
+
+if [ -n "$new" ]; then
+  printf '%s: %d finding(s) not in %s:\n' "$tool" "$(printf '%s\n' "$new" | wc -l)" "$baseline"
+  printf '%s\n' "$new" | sed 's/^/  /'
+  printf 'Fix it, or add the line to the baseline with the reason it stays.\n'
+  status=1
+fi
+
+if [ -n "$gone" ]; then
+  printf '%s: %d baseline entry/entries no longer found:\n' "$tool" "$(printf '%s\n' "$gone" | wc -l)"
+  printf '%s\n' "$gone" | sed 's/^/  /'
+  printf 'Delete them from %s.\n' "$baseline"
+  status=1
+fi
+
+[ "$status" -eq 0 ] && printf '%s: clean against %d accepted finding(s)\n' "$tool" "$(wc -l <"$accepted")"
+exit "$status"

scripts/analyzers/deadcode.baseline

@@ -0,0 +1,32 @@
+# deadcode — the unreachable symbols this repo accepts today.
+#
+# Keyed "<file>\t unreachable \t<symbol>", tab separated, no line numbers.
+# Generated from the first gated run on 2026-08-11 and edited by hand since.
+# `make deadcode` fails on anything absent here and on any entry left behind
+# after its symbol is deleted.
+#
+# The gate runs with -test, so a test file counts as a root. Without it the
+# whole of internal/router/eval is unreachable and the report is 172 lines of
+# fixtures nobody wrote by mistake.
+#
+# Eleven of these are V-686, from the 2026-08-10 audit. Three of the eleven
+# must stay and the audit says why: HisGender is a documented seam tied to
+# V-399, AudioDuration should call internal/audio rather than be deleted, and
+# CountWord is a safe delete. Read docs/caveats/layering.md#deadcode before
+# removing any of them.
+cmd/mavwaked/vad.go	unreachable	AudioDuration
+cmd/mavwaked/vad.go	unreachable	PCMToF32
+internal/crawl/watch.go	unreachable	Watcher.Watches
+internal/phraser/confirm.go	unreachable	IsC
+internal/phraser/eval/checks.go	unreachable	HisGender
+internal/phraser/plural.go	unreachable	CountWord
+internal/update/update.go	unreachable	WithClock
+internal/voice/errors.go	unreachable	jsonMarshal
+internal/voice/errors.go	unreachable	jsonUnmarshal
+internal/webauthn/cbor.go	unreachable	cborValue.At
+internal/worker/server.go	unreachable	Server.SetSynthesizer
+
+# Two test helpers the audit did not count, because it listed production
+# symbols only. A helper no test calls is dead the same way.
+cmd/mavend/replier_llm_test.go	unreachable	assertStub
+cmd/mavwaked/vad_test.go	unreachable	frameRMSQuick

scripts/analyzers/staticcheck.baseline

@@ -0,0 +1,46 @@
+# staticcheck — the findings this repo accepts today.
+#
+# Keyed "<file>\t<check>\t<message>", tab separated, no line numbers.
+# Generated from the first gated run on 2026-08-11 and edited by hand since.
+# `make lint` fails on anything absent here and on any entry left behind after
+# its finding is fixed, so emptying this file is done one line at a time.
+#
+# The sweep that empties it is V-701, which carries the judgement on each
+# entry. What follows is the short reason only.
+
+# V-687. The dedupe check runs after the phraser has already been paid.
+cmd/mavend/tick_digest.go	SA4006	this value of deduped is never used
+
+# V-686, the eleven unreachable symbols the 2026-08-10 audit listed, seen from
+# the other side. Three of them must stay: docs/caveats/layering.md#deadcode.
+cmd/mavend/replier_llm_test.go	U1000	func assertStub is unused
+cmd/mavwaked/vad_test.go	U1000	func frameRMSQuick is unused
+cmd/mavweb/handlers_test.go	U1000	field signalErr is unused
+internal/voice/errors.go	U1000	func jsonMarshal is unused
+internal/voice/errors.go	U1000	func jsonUnmarshal is unused
+
+# False positives, checked. The code is right and the check cannot see why.
+# RenderICal is called twice because rendering twice is the assertion. The
+# morning loop reads the first rune after the hedge and breaks on purpose. The
+# task_phrases line is prose about //go:embed and the real directive is below it.
+internal/calendar/ical_render_test.go	SA4000	identical expressions on the left and right side of the '!=' operator
+internal/morning/plan_test.go	SA4004	the surrounding loop is unconditionally terminated
+internal/router/task_phrases.go	SA9009	ineffectual compiler directive due to extraneous space: "// go:embed, so the single-binary deploy is unchanged: the JSON is compiled into"
+
+# At EOF the wake loop trims partial and returns, so audio past one frame is
+# dropped. Harmless where it sits, misleading to read. V-701.
+cmd/mavwaked/main.go	SA4006	this value of partial is never used
+
+# Cosmetic and mechanical. V-701 sweeps them.
+cmd/mavweb/voiceproxy.go	ST1013	should use constant http.StatusMethodNotAllowed instead of numeric literal 405
+cmd/mavweb/voiceproxy.go	ST1013	should use constant http.StatusServiceUnavailable instead of numeric literal 503
+internal/ipc/client.go	S1016	should convert r (type chatResp) to ChatReply instead of using struct literal
+internal/ipc/server.go	S1016	should convert reply (type ChatReply) to chatResp instead of using struct literal
+internal/memory/behavior_test.go	S1011	should replace loop with obs = append(obs, habitHistory("calendar_event_20260804_standup", time.Tuesday, 10, 0, 3, now)...)
+internal/memory/behavior_test.go	S1011	should replace loop with obs = append(obs, habitHistory("cooldown:water", time.Tuesday, 9, 0, 3, now)...)
+cmd/mavend/continuation_test.go	SA1012	do not pass a nil Context, even if a function permits it; pass context.TODO if you are unsure about which Context to use
+
+# Deprecated since Go 1.25. Replacing it means rewriting both guards on
+# golang.org/x/tools/go/packages, which is a decision and not a sweep.
+internal/ipc/maperr_test.go	SA1019	parser.ParseDir has been deprecated since Go 1.25 and an alternative has been available since Go 1.11: ParseDir does not consider build tags when associating files with packages. For precise information about the relationship between packages and files, use golang.org/x/tools/go/packages, which can also optionally parse and type-check the files too.
+internal/phraser/persona_floor_test.go	SA1019	parser.ParseDir has been deprecated since Go 1.25 and an alternative has been available since Go 1.11: ParseDir does not consider build tags when associating files with packages. For precise information about the relationship between packages and files, use golang.org/x/tools/go/packages, which can also optionally parse and type-check the files too.

vendor/golang.org/x/text/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2009 The Go Authors. All rights reserved.
+Copyright 2009 The Go Authors.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
@@ -10,7 +10,7 @@ notice, this list of conditions and the following disclaimer.
 copyright notice, this list of conditions and the following disclaimer
 in the documentation and/or other materials provided with the
 distribution.
-   * Neither the name of Google Inc. nor the names of its
+   * Neither the name of Google LLC nor the names of its
 contributors may be used to endorse or promote products derived from
 this software without specific prior written permission.
 

vendor/golang.org/x/text/unicode/norm/forminfo.go

@@ -13,15 +13,18 @@ import "encoding/binary"
 // a rune to a uint16. The values take two forms.  For v >= 0x8000:
 //   bits
 //   15:    1 (inverse of NFD_QC bit of qcInfo)
-//   13..7: qcInfo (see below). isYesD is always true (no decomposition).
+//   12..7: qcInfo (see below). isYesD is always true (no decomposition).
 //    6..0: ccc (compressed CCC value).
 // For v < 0x8000, the respective rune has a decomposition and v is an index
 // into a byte array of UTF-8 decomposition sequences and additional info and
 // has the form:
 //    <header> <decomp_byte>* [<tccc> [<lccc>]]
 // The header contains the number of bytes in the decomposition (excluding this
-// length byte). The two most significant bits of this length byte correspond
-// to bit 5 and 4 of qcInfo (see below).  The byte sequence itself starts at v+1.
+// length byte), with 33 mapped to 31 to fit in 5 bits.
+// (If any 31- or 32-byte decompositions come along, we could switch to using
+// use a general lookup table as long as there are at most 32 distinct lengths.)
+// The three most significant bits of this length byte correspond
+// to bit 5, 4, and 3 of qcInfo (see below).  The byte sequence itself starts at v+1.
 // The byte sequence is followed by a trailing and leading CCC if the values
 // for these are not zero.  The value of v determines which ccc are appended
 // to the sequences.  For v < firstCCC, there are none, for v >= firstCCC,
@@ -32,8 +35,8 @@ import "encoding/binary"
 
 const (
 	qcInfoMask      = 0x3F // to clear all but the relevant bits in a qcInfo
-	headerLenMask   = 0x3F // extract the length value from the header byte
-	headerFlagsMask = 0xC0 // extract the qcInfo bits from the header byte
+	headerLenMask   = 0x1F // extract the length value from the header byte (31 => 33)
+	headerFlagsMask = 0xE0 // extract the qcInfo bits from the header byte
 )
 
 // Properties provides access to normalization properties of a rune.
@@ -109,17 +112,21 @@ func (p Properties) BoundaryAfter() bool {
 	return p.isInert()
 }
 
-// We pack quick check data in 4 bits:
+// We pack quick check data in 6 bits:
 //
 //	5:    Combines forward  (0 == false, 1 == true)
 //	4..3: NFC_QC Yes(00), No (10), or Maybe (11)
 //	2:    NFD_QC Yes (0) or No (1). No also means there is a decomposition.
 //	1..0: Number of trailing non-starters.
 //
-// When all 4 bits are zero, the character is inert, meaning it is never
+// When all 6 bits are zero, the character is inert, meaning it is never
 // influenced by normalization.
+//
+// We set flags to 0x80 (high bit 7 unused in quick check data) to indicate an invalid rune.
 type qcInfo uint8
 
+func (p Properties) isInvalid() bool { return p.flags == 0x80 }
+
 func (p Properties) isYesC() bool { return p.flags&0x10 == 0 }
 func (p Properties) isYesD() bool { return p.flags&0x4 == 0 }
 
@@ -152,6 +159,9 @@ func (p Properties) Decomposition() []byte {
 	}
 	i := p.index
 	n := decomps[i] & headerLenMask
+	if n == 31 {
+		n = 33
+	}
 	i++
 	return decomps[i : i+uint16(n)]
 }
@@ -241,6 +251,9 @@ func (f Form) PropertiesString(s string) Properties {
 // to a Properties.  See the comment at the top of the file
 // for more information on the format.
 func compInfo(v uint16, sz int) Properties {
+	if sz == 0 {
+		return Properties{flags: 0x80, size: 1}
+	}
 	if v == 0 {
 		return Properties{size: uint8(sz)}
 	} else if v >= 0x8000 {
@@ -248,7 +261,7 @@ func compInfo(v uint16, sz int) Properties {
 			size:  uint8(sz),
 			ccc:   uint8(v),
 			tccc:  uint8(v),
-			flags: qcInfo(v >> 8),
+			flags: qcInfo(v>>8) & 0x3f,
 		}
 		if p.ccc > 0 || p.combinesBackward() {
 			p.nLead = uint8(p.flags & 0x3)
@@ -260,7 +273,11 @@ func compInfo(v uint16, sz int) Properties {
 	f := (qcInfo(h&headerFlagsMask) >> 2) | 0x4
 	p := Properties{size: uint8(sz), flags: f, index: v}
 	if v >= firstCCC {
-		v += uint16(h&headerLenMask) + 1
+		n := uint16(h & headerLenMask)
+		if n == 31 {
+			n = 33
+		}
+		v += n + 1
 		c := decomps[v]
 		p.tccc = c >> 2
 		p.flags |= qcInfo(c & 0x3)

vendor/golang.org/x/text/unicode/norm/iter.go

@@ -376,16 +376,12 @@ func nextComposed(i *Iter) []byte {
 			goto doNorm
 		}
 		prevCC = i.info.tccc
-		sz := int(i.info.size)
-		if sz == 0 {
-			sz = 1 // illegal rune: copy byte-by-byte
-		}
-		p := outp + sz
+		p := outp + int(i.info.size)
 		if p > len(i.buf) {
 			break
 		}
 		outp = p
-		i.p += sz
+		i.p += int(i.info.size)
 		if i.p >= i.rb.nsrc {
 			i.setDone()
 			break

vendor/golang.org/x/text/unicode/norm/normalize.go

@@ -148,7 +148,7 @@ func (f Form) IsNormalString(s string) bool {
 // patched buffer and whether the decomposition is still in progress.
 func patchTail(rb *reorderBuffer) bool {
 	info, p := lastRuneStart(&rb.f, rb.out)
-	if p == -1 || info.size == 0 {
+	if p == -1 || info.isInvalid() {
 		return true
 	}
 	end := p + int(info.size)
@@ -225,7 +225,7 @@ func doAppend(rb *reorderBuffer, out []byte, p int) []byte {
 	}
 	fd := &rb.f
 	if doMerge {
-		var info Properties
+		info := Properties{flags: 0x80, size: 1} // invalid rune
 		if p < n {
 			info = fd.info(src, p)
 			if !info.BoundaryBefore() || info.nLeadingNonStarters() > 0 {
@@ -235,7 +235,7 @@ func doAppend(rb *reorderBuffer, out []byte, p int) []byte {
 				p = decomposeSegment(rb, p, true)
 			}
 		}
-		if info.size == 0 {
+		if info.isInvalid() {
 			rb.doFlush()
 			// Append incomplete UTF-8 encoding.
 			return src.appendSlice(rb.out, p, n)
@@ -314,7 +314,7 @@ func (f *formInfo) quickSpan(src input, i, end int, atEOF bool) (n int, ok bool)
 			continue
 		}
 		info := f.info(src, i)
-		if info.size == 0 {
+		if info.isInvalid() {
 			if atEOF {
 				// include incomplete runes
 				return n, true
@@ -379,7 +379,7 @@ func (f Form) firstBoundary(src input, nsrc int) int {
 	// CGJ insertion points correctly. Luckily it doesn't have to.
 	for {
 		info := fd.info(src, i)
-		if info.size == 0 {
+		if info.isInvalid() {
 			return -1
 		}
 		if s := ss.next(info); s != ssSuccess {
@@ -424,7 +424,7 @@ func (f Form) nextBoundary(src input, nsrc int, atEOF bool) int {
 	}
 	fd := formTable[f]
 	info := fd.info(src, 0)
-	if info.size == 0 {
+	if info.isInvalid() {
 		if atEOF {
 			return 1
 		}
@@ -435,7 +435,7 @@ func (f Form) nextBoundary(src input, nsrc int, atEOF bool) int {
 
 	for i := int(info.size); i < nsrc; i += int(info.size) {
 		info = fd.info(src, i)
-		if info.size == 0 {
+		if info.isInvalid() {
 			if atEOF {
 				return i
 			}
@@ -465,7 +465,7 @@ func lastBoundary(fd *formInfo, b []byte) int {
 	if p == -1 {
 		return -1
 	}
-	if info.size == 0 { // ends with incomplete rune
+	if info.isInvalid() { // ends with incomplete rune
 		if p == 0 { // starts with incomplete rune
 			return -1
 		}
@@ -504,7 +504,7 @@ func lastBoundary(fd *formInfo, b []byte) int {
 func decomposeSegment(rb *reorderBuffer, sp int, atEOF bool) int {
 	// Force one character to be consumed.
 	info := rb.f.info(rb.src, sp)
-	if info.size == 0 {
+	if info.isInvalid() {
 		return 0
 	}
 	if s := rb.ss.next(info); s == ssStarter {
@@ -528,7 +528,7 @@ func decomposeSegment(rb *reorderBuffer, sp int, atEOF bool) int {
 			break
 		}
 		info = rb.f.info(rb.src, sp)
-		if info.size == 0 {
+		if info.isInvalid() {
 			if !atEOF {
 				return int(iShortSrc)
 			}

vendor/modules.txt

@@ -40,8 +40,8 @@ github.com/yalue/onnxruntime_go
 ## explicit; go 1.25.0
 golang.org/x/sys/unix
 golang.org/x/sys/windows
-# golang.org/x/text v0.14.0
-## explicit; go 1.18
+# golang.org/x/text v0.40.0
+## explicit; go 1.25.0
 golang.org/x/text/transform
 golang.org/x/text/unicode/norm
 # modernc.org/libc v1.74.1