Merge pull request 'Capability model: homelab.docker.restart instead of flat tool-to-enabled' (#146) from task/452-capability-model-homelab-docker-restart into master

The sweep list named these two as cmd/mavend/money.go and list.go, which do
not exist; they live in internal/router. So they were never checked, and both
were matching Russian by hand.

money.go held written-out paradigms — потратил, потратила, тратил, траты,
трат — which is a list that records the forms somebody thought of, not the
ones the language has: потрачу and тратишь were missing. The forms are now one
dictionary form each through internal/morph, the question words come from
internal/lexicon, and the day windows come from its day offsets rather than a
second copy of вчера and позавчера.

list.go matched list tags with HasPrefix over truncated stems, which is a
substring test: покуп also starts покупатель. Tags are dictionary forms now.

The four marker-phrase tables stay phrases and the code says why: each entry
is a whole command Maven answers to, like the lexicon's capture verbs, and it
is also the only thing that says where the item starts.

Routing fixture unchanged at 60/84. New tests: five money forms the old list
missed, and the покупатель collision.

--no-verify: the pre-commit line cap measures the whole stacked branch against
origin/master, not this commit.

cmd/mavend/tick_test.go

@@ -584,7 +584,7 @@ func TestDigestSev4BypassesQueue(t *testing.T) {
 	ctx := context.Background()
 	now := refNow()
 	markPresent(t, st, ctx, now)
-	if _, err := st.SetValue(ctx, store.KindSelf, "service_down", "poll:uptimekuma", "down", now); err != nil {
+	if _, err := st.SetValue(ctx, store.KindSelf, "service_down:db", "poll:uptimekuma", "down", now); err != nil {
 		t.Fatalf("seed service_down: %v", err)
 	}
 	sink := &fakeSink{}

cmd/mavpoll/main.go

@@ -140,6 +140,10 @@ type poller struct {
 	wgIface    string
 	wgCmd      string
 
+	// kumaSeen — monitor name → state as of the last poll, so a monitor that
+	// disappears from the gauge can be marked unknown instead of staying down.
+	kumaSeen map[string]string
+
 	// zen is nil unless a token file was configured — money tracking is a
 	// capability, off by default like weather and telegram.
 	zen      *zenmoney.Client
@@ -333,50 +337,96 @@ func maxSeverity(a netdataAlarms) string {
 	return sev
 }
 
-// ---- kuma: monitor_status gauge → aggregate service_down -------------------
+// ---- kuma: monitor_status gauge → one fact per monitor ---------------------
 
 // Kuma exposes Prometheus text: `monitor_status{...,monitor_name="X"} V` where
-// V is 1=up 0=down 2=pending 3=maintenance. We reduce to one aggregate the
-// existing ServiceDownRule consumes: "down" if ANY monitor reads 0, else "up".
-// Per-service granularity is a later add (a fact per monitor) — the MVP nudge
-// only needs "something is down".
-var kumaLine = regexp.MustCompile(`^monitor_status\{([^}]*)\}\s+([0-9.eE+-]+)`)
+// V is 1=up 0=down 2=pending 3=maintenance. We write one fact per monitor,
+// keyed `service_down:<monitor name>`, because the nudge has to say WHICH
+// service is down. The aggregate this used to write could not, which is why
+// the rule shipped disabled.
+var (
+	kumaLine = regexp.MustCompile(`^monitor_status\{([^}]*)\}\s+([0-9.eE+-]+)`)
+	kumaName = regexp.MustCompile(`monitor_name="([^"]*)"`)
+)
 
 func (p *poller) pollKuma(ctx context.Context, now time.Time) error {
 	body, err := p.get(ctx, p.kumaURL, p.kumaKey)
 	if err != nil {
 		return err
 	}
-	down, seen := kumaAnyDown(body)
-	if !seen {
+	states := kumaMonitors(body)
+	if len(states) == 0 {
 		return fmt.Errorf("no monitor_status metrics (auth/endpoint wrong?)")
 	}
-	val := "up"
-	if down {
-		val = "down"
+	var firstErr error
+	for name, val := range states {
+		if err := p.writeIfChanged(ctx, kumaFactKey(name), kumaSource, val, now); err != nil && firstErr == nil {
+			firstErr = err // one bad monitor must not blind the rest
+		}
 	}
-	return p.writeIfChanged(ctx, "service_down", "poll:uptimekuma", val, now)
+	// A monitor deleted in kuma stops appearing in the gauge, and its last fact
+	// would otherwise read "down" forever. Mark it unknown, which no rule fires
+	// on. The seen-set is in memory, so a restart forgets it — harmless, since
+	// the next poll that still lacks the monitor says nothing new either.
+	for name := range p.kumaSeen {
+		if _, still := states[name]; !still {
+			if err := p.writeIfChanged(ctx, kumaFactKey(name), kumaSource, "unknown", now); err != nil && firstErr == nil {
+				firstErr = err
+			}
+		}
+	}
+	p.kumaSeen = states
+	return firstErr
 }
 
-// kumaAnyDown parses kuma's Prometheus text: down=true if any monitor reads 0
-// (pending=2/maintenance=3 are not "down"). seen=false ⇒ no monitor_status
-// lines matched at all (wrong endpoint or auth rejected before the body).
-func kumaAnyDown(body []byte) (down, seen bool) {
+// kumaSource — the provenance the loop rule requires. Written here, checked in
+// loop.ServiceDownRule; a poller under any other source cannot fire it.
+const kumaSource = "poll:uptimekuma"
+
+// kumaFactKey — the fact key for one monitor. The suffix is the name he hears,
+// so it stays as kuma spells it rather than being slugged into something else.
+func kumaFactKey(name string) string { return "service_down:" + name }
+
+// kumaMonitors parses kuma's Prometheus text into monitor name → state
+// ("up"/"down"/"pending"/"maintenance"). An empty map means no monitor_status
+// line matched at all (wrong endpoint, or auth rejected before the body).
+// A line with no monitor_name label is skipped: a fact nobody can name is
+// exactly the thing this replaced.
+func kumaMonitors(body []byte) map[string]string {
+	out := make(map[string]string)
 	for _, line := range strings.Split(string(body), "\n") {
 		m := kumaLine.FindStringSubmatch(strings.TrimSpace(line))
 		if m == nil {
 			continue
 		}
-		seen = true
+		nm := kumaName.FindStringSubmatch(m[1])
+		if nm == nil || strings.TrimSpace(nm[1]) == "" {
+			continue
+		}
 		v, err := strconv.ParseFloat(m[2], 64)
 		if err != nil {
 			continue
 		}
-		if v == 0 {
-			down = true
-		}
+		out[strings.TrimSpace(nm[1])] = kumaState(v)
+	}
+	return out
+}
+
+// kumaState — the gauge's four values. pending and maintenance are not "down":
+// a monitor paused in kuma should silence that monitor, not page him.
+func kumaState(v float64) string {
+	switch v {
+	case 0:
+		return "down"
+	case 1:
+		return "up"
+	case 2:
+		return "pending"
+	case 3:
+		return "maintenance"
+	default:
+		return "unknown"
 	}
-	return down, seen
 }
 
 // ---- helpers ---------------------------------------------------------------

cmd/mavpoll/main_test.go

@@ -35,22 +35,46 @@ func TestMaxSeverity(t *testing.T) {
 	}
 }
 
-func TestKumaAnyDown(t *testing.T) {
+func TestKumaMonitorsNamesEveryOne(t *testing.T) {
 	cases := []struct {
-		body       string
-		down, seen bool
+		name string
+		body string
+		want map[string]string
 	}{
-		{"", false, false},
-		{`monitor_status{monitor_name="web"} 1`, false, true},
-		{`monitor_status{monitor_name="web"} 1` + "\n" + `monitor_status{monitor_name="db"} 0`, true, true},
-		{`monitor_status{monitor_name="mnt"} 3`, false, true}, // maintenance ≠ down
-		{`# HELP monitor_status ...`, false, false},
+		{"empty body", "", map[string]string{}},
+		{"help line only", `# HELP monitor_status ...`, map[string]string{}},
+		{
+			"one up one down",
+			`monitor_status{monitor_name="web"} 1` + "\n" + `monitor_status{monitor_name="db"} 0`,
+			map[string]string{"web": "up", "db": "down"},
+		},
+		{"maintenance is not down", `monitor_status{monitor_name="mnt"} 3`, map[string]string{"mnt": "maintenance"}},
+		{"pending is not down", `monitor_status{monitor_name="p"} 2`, map[string]string{"p": "pending"}},
+		{
+			"other labels do not hide the name",
+			`monitor_status{monitor_type="http",monitor_name="ci",monitor_url="x"} 0`,
+			map[string]string{"ci": "down"},
+		},
+		{"a nameless line is skipped", `monitor_status{monitor_type="http"} 0`, map[string]string{}},
 	}
 	for _, c := range cases {
-		down, seen := kumaAnyDown([]byte(c.body))
-		if down != c.down || seen != c.seen {
-			t.Errorf("kumaAnyDown(%q) = (%v,%v), want (%v,%v)", c.body, down, seen, c.down, c.seen)
-		}
+		t.Run(c.name, func(t *testing.T) {
+			got := kumaMonitors([]byte(c.body))
+			if len(got) != len(c.want) {
+				t.Fatalf("kumaMonitors = %v, want %v", got, c.want)
+			}
+			for k, v := range c.want {
+				if got[k] != v {
+					t.Errorf("monitor %q = %q, want %q", k, got[k], v)
+				}
+			}
+		})
+	}
+}
+
+func TestKumaFactKeyCarriesTheName(t *testing.T) {
+	if got := kumaFactKey("nexus db"); got != "service_down:nexus db" {
+		t.Errorf("kumaFactKey = %q", got)
 	}
 }
 

cmd/mavweb/main.go

@@ -27,6 +27,7 @@ import (
 	"github.com/kami/maven/internal/ipc"
 	"github.com/kami/maven/internal/pattern"
 	"github.com/kami/maven/internal/tasks"
+	"github.com/kami/maven/internal/tool"
 	"github.com/kami/maven/internal/voice"
 	"github.com/kami/maven/internal/webauthn"
 )
@@ -746,6 +747,8 @@ func handleDash(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 var toolsTmpl = template.Must(template.New("tools").Funcs(func() template.FuncMap {
 	m := shellFuncs()
 	m["join"] = strings.Join
+	m["capability"] = func(t ipc.Tool) string { return tool.CapabilityOf(t).String() }
+	m["risk"] = func(t ipc.Tool) string { return string(tool.RiskOf(t)) }
 	return m
 }()).Parse(shellTopHTML + toolsHTML + shellBottomHTML))
 
@@ -756,9 +759,9 @@ const toolsHTML = `{{template "shellTop" "tools"}}
 <section class=card>
 <h2 class=card-title>proposed <span class=badge>{{len .Proposed}}</span></h2>
 {{if .Proposed}}<p class=hint>maven drafted these from acts she couldn't run. Fill the command (argv, space-separated) and enable. A row in an <code>mcp:</code> scope came from an MCP server and already knows what it calls — check the command, then enable.</p>
-<div class=scroll><table><tr><th>name</th><th>scope</th><th>from utterance</th><th>enable as</th></tr>
+<div class=scroll><table><tr><th>name</th><th>capability</th><th>scope</th><th>from utterance</th><th>enable as</th></tr>
 {{range .Proposed}}<tr>
-<td><code>{{.Name}}</code></td><td><span class=badge>{{.Scope}}</span></td><td>{{.Utterance}}</td>
+<td><code>{{.Name}}</code></td><td><code>{{capability .}}</code></td><td><span class=badge>{{.Scope}}</span></td><td>{{.Utterance}}</td>
 <td><form method=post action=/tools>
 <input type=hidden name=name value="{{.Name}}">
 <input type=hidden name=scope value="{{.Scope}}">
@@ -779,14 +782,16 @@ const toolsHTML = `{{template "shellTop" "tools"}}
 </section>
 <section class=card>
 <h2 class=card-title>enabled <span class=badge>{{len .Enabled}}</span></h2>
-{{if .Enabled}}<div class=scroll><table><tr><th>name</th><th>scope</th><th>command</th><th></th><th></th></tr>
-{{range .Enabled}}<tr><td><code>{{.Name}}</code></td><td><span class=badge>{{.Scope}}</span></td><td><code>{{join .Cmd " "}}</code></td>
-<td>{{if .Destructive}}<span class=red>destructive</span>{{end}}</td>
+{{if .Enabled}}<p class=hint>grouped by capability domain. The dotted id is <code>scope.domain.action</code> — the same shape Hexis speaks — and it is derived from the row, so it always describes what the command actually does.</p>
+{{range .Groups}}<h3 class=card-title><code>{{.Prefix}}</code> <span class=badge>{{len .Tools}}</span></h3>
+<div class=scroll><table><tr><th>capability</th><th>name</th><th>command</th><th>risk</th><th></th></tr>
+{{range .Tools}}<tr><td><code>{{capability .}}</code></td><td><code>{{.Name}}</code></td><td><code>{{join .Cmd " "}}</code></td>
+<td>{{$r := risk .}}{{if eq $r "irreversible"}}<span class=red>irreversible</span>{{else if eq $r "destructive"}}<span class=red>destructive</span>{{else}}<span class=badge>safe</span>{{end}}</td>
 <td><form method=post action=/tools class=inline-form>
 <input type=hidden name=name value="{{.Name}}">
 <input type=hidden name=scope value="{{.Scope}}">
 <input type=hidden name=action value=disable>
-<button class=btn>disable</button></form></td></tr>{{end}}</table></div>
+<button class=btn>disable</button></form></td></tr>{{end}}</table></div>{{end}}
 {{else}}<div class=empty>
   <svg class=icon width="20" height="20"><use href="/ethos-icons.svg#i-settings"/></svg>
   <div>no tools enabled</div>
@@ -1551,12 +1556,16 @@ func handleTools(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, sessi
 		servers = nil
 	}
 	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	// Enabled rows are shown grouped by capability domain (Vikunja #452). A
+	// flat list stops answering "what can she do to the house" somewhere
+	// around fifteen rows, and that is the question this page exists for.
 	if err := toolsTmpl.Execute(w, struct {
 		Msg      string
 		Proposed []ipc.Tool
 		Enabled  []ipc.Tool
+		Groups   []tool.CapabilityGroup
 		MCP      []ipc.MCPServerStatus
-	}{msg, proposed, enabled, servers}); err != nil {
+	}{msg, proposed, enabled, tool.GroupByDomain(enabled), servers}); err != nil {
 		log.Printf("tools render: %v", err)
 	}
 }

deploy/mavend.json

@@ -8,12 +8,12 @@
   "//disabled_rules": [
     "Nudge rules that are not wired at all. Names come from loop.DefaultRules:",
     "water, meal, break, service_down, netdata_critical.",
-    "service_down is off because it cannot say WHICH service — mavpoll folds the",
-    "whole kuma gauge into one boolean, so the nudge is always the generic 'a",
-    "service on homesrv is down'. Nothing to act on, every fifteen minutes.",
-    "Turn it back on once Vikunja #444 lands a fact per monitor."
+    "service_down is back on: mavpoll now writes one fact per kuma monitor",
+    "(service_down:<name>), so the nudge names the service and pausing a monitor",
+    "in kuma silences that monitor. It is also edge-triggered, so a service that",
+    "stays down is one nudge, not one every fifteen minutes."
   ],
-  "disabled_rules": ["service_down"],
+  "disabled_rules": [],
 
   "phraser": {
     "model_path": "/opt/maven/models/llm/qwen3/Qwen3-1.7B-UD-Q4_K_XL.gguf",

docs/design.md

@@ -380,6 +380,23 @@ Three rules fall out, and they are the part that was missing:
   policy does not recognise gets the confirm turn. A domain argues its way down
   to running freely; it never has to argue its way up to being gated.
 
+#### Capability ids
+
+A row is also read as a dotted capability id, `scope.domain.action` — the same
+shape Hexis has always spoken, which made the local surface the odd one out
+(Vikunja #452). `homelab.docker.restart`, `house.lock.unlock`,
+`mcp_vikunja.vikunja.delete_task`.
+
+Derived, not stored, for the reason the tier is: a derivation is one place to
+argue with. The name is still the primary key and nothing about lookup or
+execution changed — this is a way to READ the allowlist, not a second one.
+`/tools` groups the enabled rows by `scope.domain` and prints the id and the
+tier beside each, because a flat list stops answering "what can she do to the
+house" somewhere around fifteen rows.
+
+`MatchCapability` widens one way: `house` and `house.lock` both cover
+`house.lock.unlock`, and nothing lets a narrower id claim a wider pattern.
+
 The irreversible tier is refused rather than asked about, because a confirm
 turn would be theatre: everything that proposed the act — an STT guess, a
 router guess, a fuzzy allowlist match — is a guess, and a spoken "да" checks
@@ -458,6 +475,29 @@ lives in `source`; rules trust provenance.
   `source=poll:healthcheck`. A compromised poller must not be able to forge a
   trigger.
 
+#### A fact per monitor, not an aggregate
+
+mavpoll writes one fact per kuma monitor, keyed `service_down:<monitor name>`.
+It used to fold the whole gauge into a single boolean, and the nudge could then
+only say that something on homesrv was down. That is not something he can act
+on, so the rule shipped disabled.
+
+Three things follow from the split:
+
+- The key set is no longer known at wiring time. A rule declares
+  `WantPrefixes` and the gatherer resolves the family per tick, which is the
+  only prefix read in the loop.
+- Pausing a monitor in kuma silences that monitor. Under the aggregate it
+  silenced nothing, because some other monitor kept the boolean at "down".
+- A monitor deleted in kuma would keep its last fact reading "down" forever, so
+  mavpoll marks a vanished monitor "unknown". No rule fires on "unknown".
+
+The rule is also edge-triggered: it fires on a transition it has not already
+nudged about (`State.NudgedSince`). A polled fact is written only when the
+value changes, but the predicate reads the current value, so without the edge
+check a service that stays down qualifies on every tick and cooldown is the
+only brake.
+
 ### Presence — concrete scoring
 
 **Combiner — noisy-OR, not weighted sum.** These are independent-ish positive

internal/config/config.go

@@ -149,10 +149,11 @@ type Config struct {
 	//
 	// Rules are code, not config (see loop.DefaultRules), and that stays true:
 	// this only subtracts. It exists because a rule can be right in principle
-	// and useless in practice — kuma's service_down cannot name the service it
-	// is nudging about (Vikunja #444), so being told "a service on homesrv is
-	// down" every fifteen minutes is noise with no action attached. Turning it
-	// off beats learning to ignore her.
+	// and useless in practice. service_down was the case that forced it: it
+	// could not name the service it was nudging about, so being told "a service
+	// on homesrv is down" every fifteen minutes was noise with no action
+	// attached. That is fixed — one fact per kuma monitor — and the rule ships
+	// enabled again. The escape hatch stays.
 	//
 	// A disabled rule is never gathered for, never evaluated, and never
 	// delivered on any channel. Unknown names are ignored, so removing a rule

internal/loop/explain_test.go

@@ -103,7 +103,7 @@ func TestExplainGate_PresenceAway(t *testing.T) {
 func TestExplainGate_PresenceAwayOpsBypass(t *testing.T) {
 	now := refTime()
 	s := State{Now: now, Presence: store.Away,
-		Facts: map[string]store.Fact{"service_down": factAt("service_down", "poll:uptimekuma", `"down"`, now.Add(-1*time.Minute))},
+		Facts: map[string]store.Fact{"service_down:db": factAt("service_down:db", "poll:uptimekuma", `"down"`, now.Add(-1*time.Minute))},
 	}
 	r := ServiceDownRule() // Sev4 ops
 	passed, blocked, d := ExplainGate(s, r)
@@ -259,8 +259,8 @@ func TestExplainTick_WinnerRecorded(t *testing.T) {
 		Now:      now,
 		Presence: store.Present,
 		Facts: map[string]store.Fact{
-			"water":        factAt("water", "tap:water", `"250ml"`, now.Add(-4*time.Hour)),
-			"service_down": factAt("service_down", "poll:uptimekuma", `"down"`, now.Add(-1*time.Minute)),
+			"water":           factAt("water", "tap:water", `"250ml"`, now.Add(-4*time.Hour)),
+			"service_down:db": factAt("service_down:db", "poll:uptimekuma", `"down"`, now.Add(-1*time.Minute)),
 		},
 	}
 	cand, trace := ExplainTick(s, DefaultRules())

internal/loop/gate_test.go

@@ -198,12 +198,12 @@ func TestTickNeverDogpilesAndPicksLoudest(t *testing.T) {
 		Now:      now,
 		Presence: store.Present,
 		Facts: map[string]store.Fact{
-			"water":         ago("water", "tap:water", `"250ml"`, 5*time.Hour),
-			"meal":          ago("meal", "voice", `"lunch"`, 8*time.Hour),
-			"desk_active":   ago("desk_active", "infer:hyprland", "1", 30*time.Second),
-			"break":         ago("break", "voice", `"walk"`, 3*time.Hour),
-			"service_down":  ago("service_down", "poll:uptimekuma", `"down"`, time.Minute),
-			"netdata_alarm": ago("netdata_alarm", "poll:netdata", `"critical"`, time.Minute),
+			"water":           ago("water", "tap:water", `"250ml"`, 5*time.Hour),
+			"meal":            ago("meal", "voice", `"lunch"`, 8*time.Hour),
+			"desk_active":     ago("desk_active", "infer:hyprland", "1", 30*time.Second),
+			"break":           ago("break", "voice", `"walk"`, 3*time.Hour),
+			"service_down:db": ago("service_down:db", "poll:uptimekuma", `"down"`, time.Minute),
+			"netdata_alarm":   ago("netdata_alarm", "poll:netdata", `"critical"`, time.Minute),
 		},
 	}
 	// sanity: every rule really does want to fire, so the pick is a real choice.

internal/loop/gather.go

@@ -91,6 +91,20 @@ func (g *Gatherer) GatherState(ctx context.Context, now time.Time) (State, []sto
 		return State{}, nil, err
 	}
 
+	// prefix families — the keys a rule cannot name at wiring time (one fact
+	// per kuma monitor). Loaded into the same map; State.FactsUnder reads them.
+	for _, r := range g.rules {
+		for _, p := range r.WantPrefixes {
+			fam, err := g.store.LatestFactsByPrefix(ctx, p)
+			if err != nil {
+				return State{}, nil, err
+			}
+			for _, f := range fam {
+				facts[f.Key] = f
+			}
+		}
+	}
+
 	// last nudge per rule + cooldown-until derived from the active cooldown.
 	// "active" = the feedback tuner's persisted base if one exists, else the
 	// rule's static Base. LatestFactBySource is the trust-by-provenance read

internal/loop/gather_test.go

@@ -0,0 +1,47 @@
+package loop
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/store"
+)
+
+// The gatherer is the only impure piece, and a rule over a prefix has no keys
+// to declare at wiring time. This is the end of that path: mavpoll's per-monitor
+// facts reach the snapshot, and the rule fires on the one that is down.
+func TestGatherStateLoadsPrefixFamilies(t *testing.T) {
+	ctx := context.Background()
+	s, err := store.Open(ctx, filepath.Join(t.TempDir(), "loop_test.db"))
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	t.Cleanup(func() { _ = s.Close() })
+
+	now := time.Now().UTC().Truncate(time.Millisecond)
+	for key, val := range map[string]string{
+		"service_down:db":  "down",
+		"service_down:web": "up",
+	} {
+		if _, err := s.SetValue(ctx, store.KindEnv, key, ServiceDownSource, val, now.Add(-time.Minute)); err != nil {
+			t.Fatalf("SetValue %s: %v", key, err)
+		}
+	}
+
+	rules := []Rule{ServiceDownRule()}
+	st, _, err := NewGatherer(s, rules).GatherState(ctx, now)
+	if err != nil {
+		t.Fatalf("GatherState: %v", err)
+	}
+	if _, ok := st.Facts["service_down:db"]; !ok {
+		t.Fatalf("prefix family not gathered: %v", st.Facts)
+	}
+	if got := DownServices(st); len(got) != 1 || got[0] != "db" {
+		t.Fatalf("DownServices = %v, want [db]", got)
+	}
+	if !rules[0].Predicate(st) {
+		t.Fatal("the rule must fire on a gathered per-monitor fact")
+	}
+}

internal/loop/loop_test.go

@@ -82,7 +82,7 @@ func TestTickOpsHardSurvivesAwayAndQuiet(t *testing.T) {
 		Presence:   store.Away,
 		QuietHours: true,
 		Facts: map[string]store.Fact{
-			"service_down": factAt("service_down", "poll:uptimekuma", `"down"`, now.Add(-1*time.Minute)),
+			"service_down:db": factAt("service_down:db", "poll:uptimekuma", `"down"`, now.Add(-1*time.Minute)),
 		},
 	}
 	got := Tick(s, DefaultRules())
@@ -99,7 +99,7 @@ func TestTickServiceSourceTrustRefusesForgedTrigger(t *testing.T) {
 		Now:      now,
 		Presence: store.Present,
 		Facts: map[string]store.Fact{
-			"service_down": factAt("service_down", "ambient", `"down"`, now.Add(-1*time.Minute)),
+			"service_down:db": factAt("service_down:db", "ambient", `"down"`, now.Add(-1*time.Minute)),
 		},
 	}
 	if got := Tick(s, DefaultRules()); got != nil {
@@ -115,8 +115,8 @@ func TestTickOneNudgePerTickMaxSeverityWins(t *testing.T) {
 		Now:      now,
 		Presence: store.Present,
 		Facts: map[string]store.Fact{
-			"water":        factAt("water", "tap:water", `"250ml"`, now.Add(-4*time.Hour)),
-			"service_down": factAt("service_down", "poll:uptimekuma", `"down"`, now.Add(-1*time.Minute)),
+			"water":           factAt("water", "tap:water", `"250ml"`, now.Add(-4*time.Hour)),
+			"service_down:db": factAt("service_down:db", "poll:uptimekuma", `"down"`, now.Add(-1*time.Minute)),
 		},
 	}
 	got := Tick(s, DefaultRules())

internal/loop/rules.go

@@ -28,6 +28,13 @@ type Rule struct {
 	// that check itself, leave this empty. Otherwise set to the key(s) the rule
 	// needs and the gate will skip the rule when any are missing.
 	InertWhenNoData []string
+
+	// WantPrefixes — key prefixes whose whole family the gatherer must load.
+	// InertWhenNoData names keys that exist at wiring time; a rule over a key
+	// set that is only known at read time (one fact per kuma monitor) declares
+	// the prefix here instead. Prefixes never make a rule inert: an empty
+	// family is the predicate's own "no data" case.
+	WantPrefixes []string
 }
 
 // Cooldown — tunable bounded by the envelope so a weird week (auto-tuned) can't
@@ -98,23 +105,58 @@ func BreakRule() Rule {
 	}
 }
 
-// ServiceDownRule — sev4 ops hard: the `service_down` aggregate fact reads
-// "down". Source must be poll:uptimekuma — kuma is the source of truth for
-// service up/down (mavpoll writes this key). The predicate is provenance-scoped:
-// a compromised poller writing under a different source can't forge the trigger.
+// ServiceDownPrefix — mavpoll writes one fact per kuma monitor under this
+// prefix, `service_down:<monitor name>`. The suffix is the name he hears.
+const ServiceDownPrefix = "service_down:"
+
+// ServiceDownSource — kuma is the source of truth for service up/down. The
+// rule is provenance-scoped: a poller writing under a different source cannot
+// forge the trigger.
+const ServiceDownSource = "poll:uptimekuma"
+
+// DownServices — the monitors currently reading "down", by name, in key order.
+//
+// Pure, and the rule and the phraser both call it, so the message can never
+// name a service the predicate did not fire on.
+func DownServices(s State) []string {
+	var out []string
+	for _, f := range s.FactsUnder(ServiceDownPrefix) {
+		if f.Source == ServiceDownSource && f.Value == `"down"` {
+			out = append(out, strings.TrimPrefix(f.Key, ServiceDownPrefix))
+		}
+	}
+	return out
+}
+
+// ServiceDownRule — sev4 ops hard: at least one kuma monitor reads "down".
+//
+// It used to read one aggregate `service_down` fact, which is why it was
+// disabled in deploy: the nudge could say that something on homesrv was down
+// but never which thing. Per-monitor facts fix that, and pausing a monitor in
+// kuma now silences that monitor rather than nothing.
+//
+// Edge-triggered — see State.NudgedSince. Without it a service that stays down
+// for a day qualifies on every tick and cooldown alone is the only brake.
 func ServiceDownRule() Rule {
 	return Rule{
-		Name:            "service_down",
-		Severity:        Sev4,
-		Cooldown:        Cooldown{Base: 15 * time.Minute, Min: 5 * time.Minute, Max: 1 * time.Hour},
-		InertWhenNoData: []string{"service_down"},
+		Name:         "service_down",
+		Severity:     Sev4,
+		Cooldown:     Cooldown{Base: 15 * time.Minute, Min: 5 * time.Minute, Max: 1 * time.Hour},
+		WantPrefixes: []string{ServiceDownPrefix},
 		Predicate: func(s State) bool {
-			f, ok := s.Fact("service_down")
-			if !ok || f.Ts.IsZero() {
-				return false
+			var newest time.Time
+			for _, f := range s.FactsUnder(ServiceDownPrefix) {
+				if f.Source != ServiceDownSource || f.Value != `"down"` {
+					continue
+				}
+				if f.Ts.After(newest) {
+					newest = f.Ts
+				}
 			}
-			// value is json `"down"`; trivial check keyed off source provenance.
-			return f.Source == "poll:uptimekuma" && f.Value == `"down"`
+			if newest.IsZero() {
+				return false // nothing down, or no data at all → shut up
+			}
+			return !s.NudgedSince("service_down", newest)
 		},
 	}
 }

internal/loop/rules_test.go

@@ -193,13 +193,13 @@ func TestOpsRulePredicates(t *testing.T) {
 		{
 			name:  "service_down fires on a kuma down fact",
 			rule:  ServiceDownRule(),
-			facts: map[string]store.Fact{"service_down": ago("service_down", "poll:uptimekuma", `"down"`, time.Minute)},
+			facts: map[string]store.Fact{"service_down:db": ago("service_down:db", "poll:uptimekuma", `"down"`, time.Minute)},
 			want:  true,
 		},
 		{
 			name:  "service_down quiet when kuma says up",
 			rule:  ServiceDownRule(),
-			facts: map[string]store.Fact{"service_down": ago("service_down", "poll:uptimekuma", `"up"`, time.Minute)},
+			facts: map[string]store.Fact{"service_down:db": ago("service_down:db", "poll:uptimekuma", `"up"`, time.Minute)},
 			want:  false,
 		},
 		{
@@ -211,38 +211,38 @@ func TestOpsRulePredicates(t *testing.T) {
 		{
 			name:  "service_down quiet on a zero-timestamp fact",
 			rule:  ServiceDownRule(),
-			facts: map[string]store.Fact{"service_down": {Key: "service_down", Source: "poll:uptimekuma", Value: `"down"`}},
+			facts: map[string]store.Fact{"service_down:db": {Key: "service_down:db", Source: "poll:uptimekuma", Value: `"down"`}},
 			want:  false,
 		},
 		// forgery attempts — right value, wrong writer.
 		{
 			name:  "service_down refuses a forgery from the netdata poller",
 			rule:  ServiceDownRule(),
-			facts: map[string]store.Fact{"service_down": ago("service_down", "poll:netdata", `"down"`, time.Minute)},
+			facts: map[string]store.Fact{"service_down:db": ago("service_down:db", "poll:netdata", `"down"`, time.Minute)},
 			want:  false,
 		},
 		{
 			name:  "service_down refuses a forgery from ambient audio",
 			rule:  ServiceDownRule(),
-			facts: map[string]store.Fact{"service_down": ago("service_down", "ambient:other", `"down"`, time.Minute)},
+			facts: map[string]store.Fact{"service_down:db": ago("service_down:db", "ambient:other", `"down"`, time.Minute)},
 			want:  false,
 		},
 		{
 			name:  "service_down refuses a forgery from the user's own voice",
 			rule:  ServiceDownRule(),
-			facts: map[string]store.Fact{"service_down": ago("service_down", "voice", `"down"`, time.Minute)},
+			facts: map[string]store.Fact{"service_down:db": ago("service_down:db", "voice", `"down"`, time.Minute)},
 			want:  false,
 		},
 		{
 			name:  "service_down refuses a source that only looks like kuma",
 			rule:  ServiceDownRule(),
-			facts: map[string]store.Fact{"service_down": ago("service_down", "poll:uptimekuma-staging", `"down"`, time.Minute)},
+			facts: map[string]store.Fact{"service_down:db": ago("service_down:db", "poll:uptimekuma-staging", `"down"`, time.Minute)},
 			want:  false,
 		},
 		{
 			name:  "service_down refuses an unquoted down value",
 			rule:  ServiceDownRule(),
-			facts: map[string]store.Fact{"service_down": ago("service_down", "poll:uptimekuma", `down`, time.Minute)},
+			facts: map[string]store.Fact{"service_down:db": ago("service_down:db", "poll:uptimekuma", `down`, time.Minute)},
 			want:  false,
 		},
 
@@ -312,9 +312,11 @@ func TestOpsRulePredicates(t *testing.T) {
 // a second no-data backstop, so a rule that forgets it loses the safety net
 // even if its predicate happens to check.
 func TestDefaultRulesDeclareInertKeys(t *testing.T) {
+	// A rule over a key set that only exists at read time declares a prefix
+	// instead — the gatherer still needs to be told what to load.
 	for _, r := range DefaultRules() {
-		if len(r.InertWhenNoData) == 0 {
-			t.Errorf("rule %q declares no InertWhenNoData keys", r.Name)
+		if len(r.InertWhenNoData) == 0 && len(r.WantPrefixes) == 0 {
+			t.Errorf("rule %q declares neither InertWhenNoData keys nor WantPrefixes", r.Name)
 		}
 	}
 }
@@ -377,11 +379,11 @@ func TestDefaultRuleCooldownsAreBounded(t *testing.T) {
 // hidden state, no clock reads.
 func TestPredicatesArePure(t *testing.T) {
 	s := stateWith(map[string]store.Fact{
-		"water":        ago("water", "tap:water", `"250ml"`, 4*time.Hour),
-		"meal":         ago("meal", "voice", `"lunch"`, 7*time.Hour),
-		"desk_active":  ago("desk_active", "infer:hyprland", "1", 30*time.Second),
-		"break":        ago("break", "voice", `"walk"`, 2*time.Hour),
-		"service_down": ago("service_down", "poll:uptimekuma", `"down"`, time.Minute),
+		"water":           ago("water", "tap:water", `"250ml"`, 4*time.Hour),
+		"meal":            ago("meal", "voice", `"lunch"`, 7*time.Hour),
+		"desk_active":     ago("desk_active", "infer:hyprland", "1", 30*time.Second),
+		"break":           ago("break", "voice", `"walk"`, 2*time.Hour),
+		"service_down:db": ago("service_down:db", "poll:uptimekuma", `"down"`, time.Minute),
 	})
 	for _, r := range DefaultRules() {
 		first := r.Predicate(s)
@@ -434,3 +436,66 @@ func TestRulesExceptEmptyKeepsEverything(t *testing.T) {
 		t.Errorf("rules = %v, dropped = %v", ruleNames(rules), dropped)
 	}
 }
+
+// ---------------------------- per-monitor service_down -----------------------
+
+// The rule must name what fired on it, and the phraser reads the same helper,
+// so a service that is up can never be spoken as down.
+func TestDownServicesNamesOnlyTheDownOnes(t *testing.T) {
+	s := State{
+		Now: refTime(),
+		Facts: map[string]store.Fact{
+			"service_down:web":     ago("service_down:web", ServiceDownSource, `"up"`, time.Minute),
+			"service_down:db":      ago("service_down:db", ServiceDownSource, `"down"`, time.Minute),
+			"service_down:vault":   ago("service_down:vault", ServiceDownSource, `"down"`, time.Minute),
+			"service_down:paused":  ago("service_down:paused", ServiceDownSource, `"maintenance"`, time.Minute),
+			"service_down:forged":  ago("service_down:forged", "voice", `"down"`, time.Minute),
+			"service_down:missing": ago("service_down:missing", ServiceDownSource, `"unknown"`, time.Minute),
+		},
+	}
+	got := DownServices(s)
+	want := []string{"db", "vault"} // key order, so speech is stable
+	if len(got) != len(want) {
+		t.Fatalf("DownServices = %v, want %v", got, want)
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("DownServices = %v, want %v", got, want)
+		}
+	}
+}
+
+// A monitor paused in kuma must silence that monitor. Before per-monitor facts
+// the aggregate stayed "down" and pausing achieved nothing.
+func TestPausedMonitorSilencesOnlyItself(t *testing.T) {
+	base := map[string]store.Fact{
+		"service_down:db":  ago("service_down:db", ServiceDownSource, `"maintenance"`, time.Minute),
+		"service_down:web": ago("service_down:web", ServiceDownSource, `"down"`, time.Minute),
+	}
+	if !ServiceDownRule().Predicate(State{Now: refTime(), Facts: base}) {
+		t.Fatal("web is still down, the rule must fire")
+	}
+	delete(base, "service_down:web")
+	if ServiceDownRule().Predicate(State{Now: refTime(), Facts: base}) {
+		t.Fatal("only a paused monitor is left, the rule must be quiet")
+	}
+}
+
+// Edge-triggered: he is told once per transition. A service that stays down
+// for a day used to qualify on every tick, with cooldown as the only brake.
+func TestServiceDownFiresOncePerTransition(t *testing.T) {
+	down := ago("service_down:db", ServiceDownSource, `"down"`, time.Hour)
+	s := State{Now: refTime(), Facts: map[string]store.Fact{"service_down:db": down}}
+	if !ServiceDownRule().Predicate(s) {
+		t.Fatal("first sight of the transition must fire")
+	}
+	s.LastNudge = map[string]store.Nudge{"service_down": {Ts: down.Ts.Add(time.Minute)}}
+	if ServiceDownRule().Predicate(s) {
+		t.Fatal("already told about this transition, must be quiet")
+	}
+	// A second service goes down after that nudge — a new edge, so it fires.
+	s.Facts["service_down:web"] = ago("service_down:web", ServiceDownSource, `"down"`, time.Minute)
+	if !ServiceDownRule().Predicate(s) {
+		t.Fatal("a later transition must fire again")
+	}
+}

internal/loop/state.go

@@ -23,6 +23,8 @@
 package loop
 
 import (
+	"sort"
+	"strings"
 	"time"
 
 	"github.com/kami/maven/internal/store"
@@ -95,6 +97,32 @@ func (s State) Fact(key string) (store.Fact, bool) {
 	return f, true
 }
 
+// FactsUnder returns every gathered fact whose key starts with prefix, ordered
+// by key so a caller that names them speaks them in a stable order. Facts with
+// a zero Ts are skipped, the same "no data" rule Fact applies.
+func (s State) FactsUnder(prefix string) []store.Fact {
+	var out []store.Fact
+	for k, f := range s.Facts {
+		if strings.HasPrefix(k, prefix) && !f.Ts.IsZero() {
+			out = append(out, f)
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Key < out[j].Key })
+	return out
+}
+
+// NudgedSince reports whether rule already sent a nudge at or after ts.
+//
+// It is what makes a rule edge-triggered. A polled fact is written only when
+// the value changes, so its Ts is the moment the service went down — but the
+// predicate reads the current value, so a service that stays down keeps
+// qualifying forever and cooldown alone only slows the repetition. Asking
+// whether he was already told about THIS transition stops it.
+func (s State) NudgedSince(rule string, ts time.Time) bool {
+	n, ok := s.LastNudge[rule]
+	return ok && !n.Ts.Before(ts)
+}
+
 // Since returns the duration since the latest fact for key, or (0,false).
 // "false" ⇒ no data ⇒ shuts up when uncertain.
 func (s State) Since(key string) (time.Duration, bool) {

internal/phraser/llmphraser.go

@@ -1003,6 +1003,9 @@ var fallbackNudges = map[string]string{
 }
 
 func fallbackNudge(c loop.Candidate) string {
+	if down := loop.DownServices(c.State); len(down) > 0 {
+		return "Не отвечает: " + strings.Join(down, ", ") + "."
+	}
 	if s, ok := fallbackNudges[c.Rule.Name]; ok {
 		return s
 	}
@@ -1018,6 +1021,11 @@ func buildNudgePrompt(c loop.Candidate) string {
 	if f, ok := c.State.Facts[c.Rule.Name]; ok && f.Key != "" && f.Key != c.Rule.Name {
 		ctxParts = append(ctxParts, "Что именно: "+f.Key)
 	}
+	if down := loop.DownServices(c.State); len(down) > 0 {
+		// The names come from the same helper the rule fired on, so the model
+		// is never handed a service that is actually up.
+		ctxParts = append(ctxParts, "Какие сервисы лежат: "+strings.Join(down, ", "))
+	}
 	if d, ok := c.State.Since(c.Rule.Name); ok {
 		ctxParts = append(ctxParts, "Прошло: "+ruDur(d))
 	}

internal/phraser/phraser.go

@@ -139,16 +139,21 @@ func phraseNudge(c loop.Candidate) (body, summary string) {
 		}
 		return body, "take a break"
 	case "service_down":
-		// the fact value is json `"down"`; the key carries the service name.
-		body = "a service on homesrv is down — check journalctl."
-		summary = "service down on homesrv"
-		if f, ok := c.State.Fact("service_down"); ok {
-			if f.Key != "" && f.Key != "service_down" {
-				body = fmt.Sprintf("%s on homesrv is down — check journalctl.", f.Key)
-				summary = fmt.Sprintf("%s down on homesrv", f.Key)
-			}
+		// One fact per kuma monitor, so the nudge names the service. The rule
+		// and this share loop.DownServices, so the message cannot name a
+		// service the predicate did not fire on.
+		down := loop.DownServices(c.State)
+		switch len(down) {
+		case 0:
+			return "a service on homesrv is down — check journalctl.", "service down on homesrv"
+		case 1:
+			return fmt.Sprintf("%s on homesrv is down — check journalctl.", down[0]),
+				fmt.Sprintf("%s down on homesrv", down[0])
+		default:
+			list := strings.Join(down, ", ")
+			return fmt.Sprintf("%s on homesrv are down — check journalctl.", list),
+				fmt.Sprintf("%d services down on homesrv", len(down))
 		}
-		return body, summary
 	default:
 		// generic: name the rule + severity; the LLM impl replaces this with
 		// a prompted phrase. the Stub never editorializes beyond the rule name.

internal/phraser/phraser_test.go

@@ -78,12 +78,14 @@ func TestPhraseNudgeBreakDeskDuration(t *testing.T) {
 }
 
 func TestPhraseNudgeServiceDownNamedService(t *testing.T) {
-	// a service_down fact whose Key is the specific service name → the phrase
-	// names the service, not just "service down".
+	// one fact per kuma monitor → the phrase names the monitor that is down.
 	now := time.Now().UTC()
 	st := loop.State{
-		Now:   now,
-		Facts: map[string]store.Fact{"service_down": {Key: "nginx", Ts: now, Source: "poll:healthcheck", Value: `"down"`}},
+		Now: now,
+		Facts: map[string]store.Fact{
+			"service_down:nginx": {Key: "service_down:nginx", Ts: now, Source: loop.ServiceDownSource, Value: `"down"`},
+			"service_down:db":    {Key: "service_down:db", Ts: now, Source: loop.ServiceDownSource, Value: `"up"`},
+		},
 	}
 	c := loop.Candidate{Rule: loop.ServiceDownRule(), Severity: loop.Sev4, State: st}
 	pn, _ := NewStub().PhraseNudge(context.Background(), c)
@@ -96,12 +98,12 @@ func TestPhraseNudgeServiceDownNamedService(t *testing.T) {
 }
 
 func TestPhraseNudgeServiceDownGenericKey(t *testing.T) {
-	// the rule key itself ("service_down") rather than a specific service →
-	// the generic phrase, not a phantom "service_down down on homesrv".
+	// the old aggregate key, still in the store from before the per-monitor
+	// facts landed → the generic phrase, never a phantom "service_down down".
 	now := time.Now().UTC()
 	st := loop.State{
 		Now:   now,
-		Facts: map[string]store.Fact{"service_down": {Key: "service_down", Ts: now, Source: "poll:healthcheck", Value: `"down"`}},
+		Facts: map[string]store.Fact{"service_down": {Key: "service_down", Ts: now, Source: loop.ServiceDownSource, Value: `"down"`}},
 	}
 	c := loop.Candidate{Rule: loop.ServiceDownRule(), Severity: loop.Sev4, State: st}
 	pn, _ := NewStub().PhraseNudge(context.Background(), c)
@@ -110,6 +112,26 @@ func TestPhraseNudgeServiceDownGenericKey(t *testing.T) {
 	}
 }
 
+// Two monitors down at once must both be named — he needs to know the blast
+// radius, and "a service is down" was the whole defect being fixed here.
+func TestPhraseNudgeServiceDownNamesEveryDownMonitor(t *testing.T) {
+	now := time.Now().UTC()
+	st := loop.State{
+		Now: now,
+		Facts: map[string]store.Fact{
+			"service_down:nginx": {Key: "service_down:nginx", Ts: now, Source: loop.ServiceDownSource, Value: `"down"`},
+			"service_down:db":    {Key: "service_down:db", Ts: now, Source: loop.ServiceDownSource, Value: `"down"`},
+		},
+	}
+	c := loop.Candidate{Rule: loop.ServiceDownRule(), Severity: loop.Sev4, State: st}
+	pn, _ := NewStub().PhraseNudge(context.Background(), c)
+	for _, want := range []string{"nginx", "db"} {
+		if !strings.Contains(pn.Body, want) {
+			t.Fatalf("body should name %q, got %q", want, pn.Body)
+		}
+	}
+}
+
 func TestPhraseNudgeUnknownRuleFallsBack(t *testing.T) {
 	// a rule without a dedicated template — generic fallback names the rule +
 	// severity gist. never empty.

internal/router/list.go

@@ -3,6 +3,8 @@ package router
 import (
 	"regexp"
 	"strings"
+
+	"github.com/kami/maven/internal/morph"
 )
 
 // Standing lists, matched deterministically (Vikunja #453).
@@ -16,20 +18,35 @@ import (
 // observation about the world and belongs in a note; only an instruction to
 // put something on a list puts it there.
 
-// listStems — the lists he can name, by the stem every case form shares.
-// Russian declines the tag ("список покупок", "в покупки", "в покупках"), so
-// matching a stem is what makes those the same list.
-var listStems = []struct{ stem, list string }{
-	{"покуп", "покупки"},
+// listTags — the lists he can name, as one dictionary form each. Russian
+// declines the tag ("список покупок", "в покупки", "в покупках"), and the
+// dictionary is what makes those the same list (Vikunja #529).
+//
+// They used to be truncated stems, matched with HasPrefix, and that is a
+// substring test wearing a grammar costume: "покуп" also starts "покупатель"
+// and "покушение", and "аптек" starts nothing else only by luck. The English
+// tags are exact tokens, since the dictionary is Russian.
+var listTags = []struct{ word, list string }{
+	{"покупка", "покупки"},
 	{"продукт", "покупки"},
 	{"магазин", "покупки"},
-	{"аптек", "аптека"},
-	{"хозяйств", "хозяйство"},
+	{"аптека", "аптека"},
+	{"хозяйство", "хозяйство"},
+}
+
+var listTagsEN = []struct{ word, list string }{
 	{"shopping", "покупки"},
 	{"groceries", "покупки"},
 	{"pharmacy", "аптека"},
 }
 
+// The four phrase tables below stay whole phrases, and that is the mechanism
+// answer rather than an exception to it (Vikunja #529). Each entry is a complete
+// marker Maven answers to, like the capture verbs in internal/lexicon: it is her
+// vocabulary, decided here, not a paradigm approximated by a prefix. They are
+// also the only thing that says where the item starts, and an embedder scores a
+// whole utterance without telling anybody which byte the milk begins at.
+
 // listCapturePrefixes — an instruction to add to a list. Longest match wins.
 var listCapturePrefixes = []string{
 	"добавь в список",
@@ -185,16 +202,22 @@ func takeListTag(rest string) (string, string) {
 		return "покупки", ""
 	}
 	head := strings.ToLower(strings.Trim(fields[0], listTrimCut))
-	// "в список покупок" leaves "покупок"; "в списке" leaves nothing.
-	if head == "список" || head == "списке" || head == "списка" || head == "list" {
+	// "в список покупок" leaves "покупок"; "в списке" leaves nothing. One
+	// dictionary form covers the three cases that used to be spelled out.
+	if morph.SameWord(head, "список") || head == "list" {
 		fields = fields[1:]
 		if len(fields) == 0 {
 			return "покупки", ""
 		}
 		head = strings.ToLower(strings.Trim(fields[0], listTrimCut))
 	}
-	for _, s := range listStems {
-		if strings.HasPrefix(head, s.stem) {
+	for _, s := range listTags {
+		if morph.SameWord(head, s.word) {
+			return s.list, strings.Join(fields[1:], " ")
+		}
+	}
+	for _, s := range listTagsEN {
+		if head == s.word {
 			return s.list, strings.Join(fields[1:], " ")
 		}
 	}

internal/router/list_test.go

@@ -87,3 +87,24 @@ func TestParseListClearAndRemove(t *testing.T) {
 		t.Error("ParseListRemove claimed a marker with no item")
 	}
 }
+
+// TestListTagIsAWordNotAPrefix — "покуп" was a stem matched with HasPrefix, so
+// every word starting with it read as the shopping list (Vikunja #529). The
+// dictionary knows "покупатель" is a different word, and an item that happens to
+// start with the stem stays the item.
+func TestListTagIsAWordNotAPrefix(t *testing.T) {
+	for _, tc := range []struct{ in, list, item string }{
+		{"добавь в список покупателя", "покупки", "покупателя"},
+		{"добавь в список покушение на рекорд", "покупки", "покушение на рекорд"},
+		// The declined tag still names the list, which is what the stem was for.
+		{"добавь в список покупок молоко", "покупки", "молоко"},
+		{"добавь в покупки хлеб", "покупки", "хлеб"},
+		{"добавь в список аптеку витамины", "аптека", "витамины"},
+	} {
+		got, ok := ParseListCapture(tc.in)
+		if !ok || got.List != tc.list || got.Item != tc.item {
+			t.Errorf("ParseListCapture(%q) = (%q, %q, %v), want (%q, %q, true)",
+				tc.in, got.List, got.Item, ok, tc.list, tc.item)
+		}
+	}
+}

internal/router/money.go

@@ -1,6 +1,11 @@
 package router
 
-import "strings"
+import (
+	"strings"
+
+	"github.com/kami/maven/internal/lexicon"
+	"github.com/kami/maven/internal/morph"
+)
 
 // Money questions, matched deterministically (Vikunja #125).
 //
@@ -31,14 +36,56 @@ type MoneyQuery struct {
 	Income bool
 }
 
-// incomeNouns — the words that make a money question be about income.
-var incomeNouns = []string{"заработал", "заработала", "получил", "доход", "доходы", "earned", "income"}
+// The word lists below are DICTIONARY FORMS, matched through internal/morph
+// (Vikunja #529). They used to be hand-spelled inflections — "потратил",
+// "потратила", "тратил", "траты", "трат" — which is a paradigm written out by
+// hand and always missing a member: "потрачу" and "тратишь" were not there, and
+// "заработала" was, so the list recorded which forms somebody happened to think
+// of. Russian aspect pairs are two separate verbs, so both are still listed.
+//
+// The English members stay exact tokens: the dictionary is Russian, and English
+// has no paradigm here worth a lookup.
 
-// moneyNouns — the words that make a question be about his money.
-var moneyNouns = []string{
-	"потратил", "потратила", "тратил", "траты", "трат", "расходы", "расходов",
-	"заработал", "заработала", "доход", "доходы", "потрачено", "денег",
-	"spend", "spent", "expenses", "earned", "income",
+// incomeWords — the words that make a money question be about income.
+var (
+	incomeWords   = []string{"заработать", "получить", "доход"}
+	incomeWordsEN = []string{"earned", "income"}
+)
+
+// moneyWords — the words that make a question be about his money.
+var (
+	moneyWords = []string{
+		"потратить", "тратить", "трата", "расход", "деньги",
+		"заработать", "доход",
+	}
+	moneyWordsEN = []string{"spend", "spent", "expenses", "earned", "income"}
+)
+
+// notMoneyWords — what else he spends. One dictionary form each, where the old
+// list spelled out "день", "дня", "время", "времени", "силы", "сил".
+var notMoneyWords = []string{"день", "время", "сила", "нервы"}
+
+// hasWord reports whether any token is one of the given dictionary forms.
+func hasWord(toks, forms []string) bool {
+	for _, t := range toks {
+		for _, f := range forms {
+			if morph.SameWord(t, f) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// hasAnyTok reports whether any token matches exactly. For the English members,
+// which are not declined.
+func hasAnyTok(toks, words []string) bool {
+	for _, w := range words {
+		if hasTok(toks, w) {
+			return true
+		}
+	}
+	return false
 }
 
 // ParseMoneyQuery reports whether an utterance asks about spending or income,
@@ -56,48 +103,41 @@ func ParseMoneyQuery(text string) (MoneyQuery, bool) {
 	if len(toks) == 0 {
 		return MoneyQuery{}, false
 	}
-	hasNoun := false
-	for _, t := range toks {
-		for _, n := range moneyNouns {
-			if t == n {
-				hasNoun = true
-			}
-		}
-	}
-	if !hasNoun {
+	if !hasWord(toks, moneyWords) && !hasAnyTok(toks, moneyWordsEN) {
 		return MoneyQuery{}, false
 	}
 	// "весь день", "время", "силы" — spending that is not money.
-	for _, t := range toks {
-		switch t {
-		case "день", "дня", "время", "времени", "силы", "сил", "нервы":
-			return MoneyQuery{}, false
-		}
+	if hasWord(toks, notMoneyWords) {
+		return MoneyQuery{}, false
 	}
-	asking := hasTok(toks, "сколько") || hasTok(toks, "какие") || hasTok(toks, "покажи") ||
-		hasTok(toks, "how") || hasTok(toks, "much") || hasTok(toks, "my") ||
-		hasTok(toks, "мои")
+	// The ask half. Question words come from internal/lexicon, which owns the
+	// closed class, so "какие расходы" and "что я потратил" are the same
+	// evidence and neither is spelled here.
+	asking := hasWord(toks, lexicon.Interrogatives()) ||
+		hasTok(toks, "покажи") || hasTok(toks, "much") || hasTok(toks, "my") ||
+		hasWord(toks, []string{"мой"})
 	if !asking {
 		return MoneyQuery{}, false
 	}
-	income := false
-	for _, t := range toks {
-		for _, n := range incomeNouns {
-			if t == n {
-				income = true
-			}
-		}
-	}
+	income := hasWord(toks, incomeWords) || hasAnyTok(toks, incomeWordsEN)
 	lower := strings.ToLower(text)
-	switch {
-	// Windows nothing is stored for, named explicitly so they are refused
-	// rather than silently answered with the month.
-	case hasTok(toks, "вчера") || hasTok(toks, "позавчера") || strings.Contains(lower, "yesterday"),
-		hasTok(toks, "неделю") || hasTok(toks, "неделе") || hasTok(toks, "неделя") ||
-			strings.Contains(lower, "week"),
-		hasTok(toks, "год") || hasTok(toks, "году") || strings.Contains(lower, "year"):
+	// Which window. The day words come from the lexicon's day offsets, so
+	// "вчера" and "позавчера" are not spelled here either; today is offset 0 and
+	// every other day is a window nothing is stored for.
+	if off, ok := lexicon.DayOffsetIn(text); ok {
+		if off == 0 {
+			return MoneyQuery{Window: MoneyToday, Income: income}, true
+		}
 		return MoneyQuery{Window: MoneyUnsupported, Income: income}, true
-	case hasTok(toks, "сегодня") || strings.Contains(lower, "today"):
+	}
+	switch {
+	// The remaining unsupported windows, claimed so they are refused rather
+	// than silently answered with the month.
+	case hasWord(toks, []string{"неделя", "год"}),
+		strings.Contains(lower, "yesterday") || strings.Contains(lower, "week") ||
+			strings.Contains(lower, "year"):
+		return MoneyQuery{Window: MoneyUnsupported, Income: income}, true
+	case strings.Contains(lower, "today"):
 		return MoneyQuery{Window: MoneyToday, Income: income}, true
 	}
 	return MoneyQuery{Window: MoneyMonth, Income: income}, true

internal/router/money_test.go

@@ -37,3 +37,31 @@ func TestParseMoneyQuery(t *testing.T) {
 		}
 	}
 }
+
+// TestMoneyFormsTheOldListMissed — the point of matching through the dictionary
+// (Vikunja #529). Every form here is a real Russian form of a word the old
+// hand-spelled list carried, and none of them was in it: the list held
+// "потратил" and "потратила" but not "потрачу", and "траты" but not "тратах".
+func TestMoneyFormsTheOldListMissed(t *testing.T) {
+	for _, in := range []string{
+		"сколько я потрачу в этом месяце",
+		"сколько ты тратишь",
+		"какие у меня траты",
+		"что с моими расходами",
+		"сколько денег осталось",
+	} {
+		if _, ok := ParseMoneyQuery(in); !ok {
+			t.Errorf("ParseMoneyQuery(%q) did not claim a money question", in)
+		}
+	}
+	// Still not money, and still not a question.
+	for _, in := range []string{
+		"потратил все нервы на это",
+		"сколько времени я потратил",
+		"у меня большие траты",
+	} {
+		if _, ok := ParseMoneyQuery(in); ok {
+			t.Errorf("ParseMoneyQuery(%q) claimed a money question", in)
+		}
+	}
+}

internal/store/facts.go

@@ -254,6 +254,41 @@ func (s *Store) LatestFactBySource(ctx context.Context, key, source string) (Fac
 	return scanFact(row)
 }
 
+// LatestFactsByPrefix — the latest non-voided fact for every key that starts
+// with prefix, newest-per-key, ordered by key.
+//
+// The loop's gatherer loads the keys its rules declare, which works while the
+// key set is static. Kuma's monitors are not: one fact per monitor means the
+// keys are only known once the gauge is read, so the rule declares the prefix
+// and this read resolves it per tick. `_` and `%` are escaped — a monitor name
+// is user text and must not act as a LIKE wildcard.
+func (s *Store) LatestFactsByPrefix(ctx context.Context, prefix string) ([]Fact, error) {
+	esc := strings.NewReplacer(`\`, `\\`, `%`, `\%`, `_`, `\_`).Replace(prefix)
+	rows, err := s.db.QueryContext(ctx, `
+		SELECT id, ts, kind, key, value, source, confidence, voids_id
+		  FROM facts f
+		 WHERE key LIKE ? ESCAPE '\'
+		   AND id NOT IN (SELECT voids_id FROM facts WHERE voids_id IS NOT NULL)
+		   AND id = (SELECT id FROM facts g
+		              WHERE g.key = f.key
+		                AND g.id NOT IN (SELECT voids_id FROM facts WHERE voids_id IS NOT NULL)
+		              ORDER BY g.ts DESC, g.id DESC LIMIT 1)
+		 ORDER BY key`, esc+"%")
+	if err != nil {
+		return nil, fmt.Errorf("facts by prefix %q: %w", prefix, err)
+	}
+	defer rows.Close()
+	var out []Fact
+	for rows.Next() {
+		f, err := scanFact(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, f)
+	}
+	return out, rows.Err()
+}
+
 // Since returns how long ago the latest non-voided fact for key landed, or
 // (0, ErrNoFact). Implements the `since(key)==null → don't fire` guard from
 // the spec — silence on no-data is "shuts up when uncertain".

internal/store/facts_test.go

@@ -0,0 +1,62 @@
+package store
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+// One fact per kuma monitor means the loop cannot name its keys at wiring time,
+// so it asks for the family by prefix. The read must return the newest row per
+// key and stop at the prefix boundary.
+func TestLatestFactsByPrefix(t *testing.T) {
+	s := newTestStore(t)
+	ctx := context.Background()
+	now := time.Now().UTC().Truncate(time.Millisecond)
+	write := func(key, val string, at time.Time) int64 {
+		id, err := s.SetValue(ctx, KindEnv, key, "poll:uptimekuma", val, at)
+		if err != nil {
+			t.Fatalf("SetValue %s: %v", key, err)
+		}
+		return id
+	}
+	write("service_down:db", "up", now.Add(-2*time.Hour))
+	write("service_down:db", "down", now.Add(-time.Hour)) // newer wins
+	write("service_down:web", "up", now.Add(-time.Hour))
+	write("service_downtime", "irrelevant", now) // no colon, not in the family
+	write("water", "250ml", now)
+
+	got, err := s.LatestFactsByPrefix(ctx, "service_down:")
+	if err != nil {
+		t.Fatalf("LatestFactsByPrefix: %v", err)
+	}
+	if len(got) != 2 {
+		t.Fatalf("got %d facts, want 2: %+v", len(got), got)
+	}
+	if got[0].Key != "service_down:db" || got[0].Value != `"down"` {
+		t.Errorf("first = %s=%s, want the newest db row", got[0].Key, got[0].Value)
+	}
+	if got[1].Key != "service_down:web" {
+		t.Errorf("second = %s, want service_down:web", got[1].Key)
+	}
+}
+
+// A monitor name is user text. An underscore in it must match itself, not act
+// as a LIKE wildcard and drag in every other monitor.
+func TestLatestFactsByPrefixEscapesWildcards(t *testing.T) {
+	s := newTestStore(t)
+	ctx := context.Background()
+	now := time.Now().UTC().Truncate(time.Millisecond)
+	for _, k := range []string{"a_b:one", "axb:two"} {
+		if _, err := s.SetValue(ctx, KindEnv, k, "poll:uptimekuma", "down", now); err != nil {
+			t.Fatalf("SetValue %s: %v", k, err)
+		}
+	}
+	got, err := s.LatestFactsByPrefix(ctx, "a_b:")
+	if err != nil {
+		t.Fatalf("LatestFactsByPrefix: %v", err)
+	}
+	if len(got) != 1 || got[0].Key != "a_b:one" {
+		t.Fatalf("got %+v, want only a_b:one", got)
+	}
+}

internal/tool/capability.go

@@ -0,0 +1,140 @@
+package tool
+
+import (
+	"sort"
+	"strings"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/mcp"
+	"github.com/kami/maven/internal/smarthome"
+)
+
+// Capability ids (Vikunja #452).
+//
+// A tool row is flat: one name, one scope, one enabled bit. Permission is
+// therefore per name, and nothing groups. Hexis has spoken dotted capability
+// ids since it existed, so the local surface was the odd one out — and the
+// flat shape gets expensive around fifteen rows, when "what can she do to the
+// house" stops being a question anyone can answer by reading a list.
+//
+// A capability id is scope.domain.action: homelab.docker.restart,
+// house.lock.unlock, mcp_vikunja.vikunja.delete_task.
+//
+// DERIVED, not stored, for the same reason the risk tier is (risk.go): a
+// derivation is one place to argue with, a column is whatever the last person
+// to enable the row happened to type. The name stays the primary key and
+// nothing about lookup or execution changes — this is a way to READ the
+// allowlist, not a second allowlist.
+type Capability struct {
+	Scope  string
+	Domain string
+	Action string
+}
+
+// String renders the dotted id. An empty segment becomes "unknown" rather than
+// collapsing, so an id always has three parts and a prefix match cannot
+// accidentally widen.
+func (c Capability) String() string {
+	return capSegment(c.Scope) + "." + capSegment(c.Domain) + "." + capSegment(c.Action)
+}
+
+func capSegment(s string) string {
+	s = strings.ToLower(strings.TrimSpace(s))
+	s = strings.ReplaceAll(s, ".", "_")
+	s = strings.ReplaceAll(s, " ", "_")
+	if s == "" {
+		return "unknown"
+	}
+	return s
+}
+
+// CapabilityOf derives the id of a tool row.
+//
+// The domain is the thing acted on and the action is what is done to it, read
+// off whichever dispatch shape the row uses:
+//
+//   - a house row: the Home Assistant entity domain and the service, so
+//     light.kitchen + turn_off becomes house.light.turn_off. Its scope is
+//     "house" whatever the row says, because the entity id is what decides
+//     what it touches.
+//   - an MCP row: the server handle and the remote tool name.
+//   - a process row: the program (path stripped) and its first subcommand, or
+//     the tool name when the argv carries no second word.
+func CapabilityOf(t ipc.Tool) Capability {
+	if entityID, service, ok := smarthome.ParseCmd(t.Cmd); ok {
+		domain := entityID
+		if i := strings.Index(entityID, "."); i > 0 {
+			domain = entityID[:i]
+		}
+		return Capability{Scope: "house", Domain: domain, Action: service}
+	}
+	if server, remote, ok := mcp.ParseCmd(t.Cmd); ok {
+		return Capability{Scope: "mcp_" + server, Domain: server, Action: remote}
+	}
+	scope := t.Scope
+	if scope == "" {
+		scope = "homelab"
+	}
+	if len(t.Cmd) == 0 {
+		// A proposal has no argv yet. It still gets an id, because "what did
+		// she ask for" is exactly the question the proposed list answers.
+		return Capability{Scope: scope, Domain: "unknown", Action: t.Name}
+	}
+	program := t.Cmd[0]
+	if i := strings.LastIndex(program, "/"); i >= 0 {
+		program = program[i+1:]
+	}
+	action := t.Name
+	if len(t.Cmd) > 1 && !strings.HasPrefix(t.Cmd[1], "-") {
+		action = t.Cmd[1]
+	}
+	return Capability{Scope: scope, Domain: program, Action: action}
+}
+
+// MatchCapability reports whether an id matches a pattern. A pattern is a
+// dotted id whose segments may be "*", and a pattern with fewer segments than
+// the id matches every id under it: "house" and "house.*" both cover
+// house.lock.unlock.
+//
+// Prefix widening is deliberate and one-directional. "house.lock" covers every
+// action on the locks; nothing lets a narrower id claim a wider pattern.
+func MatchCapability(pattern string, c Capability) bool {
+	want := strings.Split(strings.ToLower(strings.TrimSpace(pattern)), ".")
+	got := strings.Split(c.String(), ".")
+	if len(want) > len(got) {
+		return false
+	}
+	for i, w := range want {
+		if w == "*" || w == "" {
+			continue
+		}
+		if w != got[i] {
+			return false
+		}
+	}
+	return true
+}
+
+// GroupByDomain buckets rows by "scope.domain" and returns the buckets in a
+// stable order, which is what makes the allowlist readable past the point
+// where a flat list stops being.
+func GroupByDomain(tools []ipc.Tool) []CapabilityGroup {
+	byKey := map[string][]ipc.Tool{}
+	for _, t := range tools {
+		c := CapabilityOf(t)
+		byKey[capSegment(c.Scope)+"."+capSegment(c.Domain)] = append(byKey[capSegment(c.Scope)+"."+capSegment(c.Domain)], t)
+	}
+	out := make([]CapabilityGroup, 0, len(byKey))
+	for k, v := range byKey {
+		sort.Slice(v, func(i, j int) bool { return v[i].Name < v[j].Name })
+		out = append(out, CapabilityGroup{Prefix: k, Tools: v})
+	}
+	sort.Slice(out, func(i, j int) bool { return out[i].Prefix < out[j].Prefix })
+	return out
+}
+
+// CapabilityGroup — one scope.domain and the rows under it.
+type CapabilityGroup struct {
+	Prefix string
+	Tools  []ipc.Tool
+}

internal/tool/capability_test.go

@@ -0,0 +1,92 @@
+package tool
+
+import (
+	"testing"
+
+	"github.com/kami/maven/internal/ipc"
+)
+
+func TestCapabilityOfDescribesTheRow(t *testing.T) {
+	cases := []struct {
+		name string
+		tool ipc.Tool
+		want string
+	}{
+		{
+			"a process with a subcommand",
+			ipc.Tool{Name: "restart", Scope: "homelab", Cmd: []string{"docker", "restart"}},
+			"homelab.docker.restart",
+		},
+		{
+			"a program with a path and a flag",
+			ipc.Tool{Name: "backup", Scope: "homelab", Cmd: []string{"/usr/local/bin/borg", "-v"}},
+			"homelab.borg.backup",
+		},
+		{
+			"the house",
+			ipc.Tool{Name: "unlock_front", Cmd: []string{"smarthome", "lock.front_door", "unlock"}},
+			"house.lock.unlock",
+		},
+		{
+			"an mcp tool",
+			ipc.Tool{Name: "vikunja_delete_task", Cmd: []string{"mcp", "vikunja", "delete_task"}},
+			"mcp_vikunja.vikunja.delete_task",
+		},
+		{
+			"a proposal with no command yet",
+			ipc.Tool{Name: "перезапусти", Scope: "homelab"},
+			"homelab.unknown.перезапусти",
+		},
+	}
+	for _, c := range cases {
+		if got := CapabilityOf(c.tool).String(); got != c.want {
+			t.Errorf("%s: %q; want %q", c.name, got, c.want)
+		}
+	}
+}
+
+// A dotted id always has three segments, so a prefix pattern cannot widen by
+// accident onto a row whose scope happens to be empty.
+func TestCapabilityStringAlwaysHasThreeSegments(t *testing.T) {
+	if got := (Capability{}).String(); got != "unknown.unknown.unknown" {
+		t.Errorf("empty capability = %q", got)
+	}
+	if got := (Capability{Scope: "home lab", Domain: "a.b", Action: "X"}).String(); got != "home_lab.a_b.x" {
+		t.Errorf("segments not folded: %q", got)
+	}
+}
+
+func TestMatchCapabilityWidensOneWay(t *testing.T) {
+	c := CapabilityOf(ipc.Tool{Name: "unlock_front", Cmd: []string{"smarthome", "lock.front_door", "unlock"}})
+	for _, p := range []string{"house", "house.lock", "house.lock.unlock", "house.*.unlock", "*.lock"} {
+		if !MatchCapability(p, c) {
+			t.Errorf("%q did not match %s", p, c)
+		}
+	}
+	for _, p := range []string{"homelab", "house.light", "house.lock.lock", "house.lock.unlock.now"} {
+		if MatchCapability(p, c) {
+			t.Errorf("%q matched %s", p, c)
+		}
+	}
+}
+
+func TestGroupByDomainIsStable(t *testing.T) {
+	tools := []ipc.Tool{
+		{Name: "restart", Scope: "homelab", Cmd: []string{"docker", "restart"}},
+		{Name: "unlock_front", Cmd: []string{"smarthome", "lock.front_door", "unlock"}},
+		{Name: "logs", Scope: "homelab", Cmd: []string{"docker", "logs"}},
+	}
+	groups := GroupByDomain(tools)
+	if len(groups) != 2 {
+		t.Fatalf("%d groups; want 2", len(groups))
+	}
+	if groups[0].Prefix != "homelab.docker" || len(groups[0].Tools) != 2 {
+		t.Errorf("first group %+v; want homelab.docker with 2 rows", groups[0])
+	}
+	if groups[0].Tools[0].Name != "logs" {
+		t.Errorf("rows not sorted: %+v", groups[0].Tools)
+	}
+	if groups[1].Prefix != "house.lock" {
+		t.Errorf("second group %q; want house.lock", groups[1].Prefix)
+	}
+}