Wire staticcheck and deadcode, and gate both on a baseline (V-694)

The 2026-08-10 audit asked for three analyzers. V-682 wired the first as `make
vuln`. The other two were still absent: neither was installed on the box and no
target ran them, so every reachability claim in the audit stood unchecked.

`make lint` runs staticcheck v0.7.0 and `make deadcode` runs deadcode v0.48.0.
Both are pinned in the Makefile beside GO_VERSION and installed into deps/bin
the way govulncheck is, because a tool is not a dependency of the module. Both
carry the CGO env `test` carries, or the four CGO daemons fail to load and the
analyzer reports a build error instead of a finding. `make analyze` runs all
three. None joins `make test`: they install over the network and `test` has to
pass on a box with no route out.

Neither reports zero, so neither fails on its own output. staticcheck finds 20
and deadcode finds 13, and the audit asked for an allowlist by name, because
three of deadcode's eleven production symbols are deliberate and an unannotated
list invites deleting them. The accepted set lives in
scripts/analyzers/*.baseline, one line per finding with the reason it stays, and
scripts/analyzer-gate.sh gives the verdict. A key holds file, check id and
message, never a line number: a line number goes stale on the next edit above
it, and a gate that reports moved findings as new ones teaches the reader to
skip it. An entry whose finding is gone also fails, so a fix that leaves its
line behind does not pass.

deadcode runs with -test, because a test is a caller. Without the flag the
report is 172 lines, most of internal/router/eval, and none of it is a mistake.
With it, the 11 symbols the audit listed come back exactly, plus two test
helpers it did not count.

Three staticcheck findings were checked and are false positives, recorded as
such: the iCal determinism test must call RenderICal twice, the morning hedge
loop breaks after the first rune on purpose, and the SA9009 line is prose about
//go:embed with the real directive below it. One is V-687 already. The remaining
17 are V-701 with the judgement on each.

The analyzers caveat is deleted rather than edited. What replaces it is the
limit that is now true: the gates are green against a baseline, not against
zero.

.gitignore

@@ -70,3 +70,5 @@ coverage.out
 
 # root .env — MAVEN_AMBIENT_TOKEN and friends, same class as deploy/telegram.env
 .env
+# silero-vad, downloaded (see AGENTS.md)
+/models/vad/

AGENTS.md

@@ -95,6 +95,22 @@ model: the code puts `query: ` in front of a question and `passage: ` in front
 of a stored note, which is how e5 was trained. The quantized file is the one
 that is downloaded, deployed and measured.
 
+## Voice activity model for mavwaked
+
+`mavwaked` decides an utterance has started with silero-vad when `-vad-model`
+points at it, and with an energy threshold when it does not. The model is 2.3MB
+and is not committed:
+
+```sh
+mkdir -p models/vad
+curl -sL -o models/vad/silero_vad.onnx \
+  https://github.com/snakers4/silero-vad/raw/master/src/silero_vad/data/silero_vad.onnx
+```
+
+It needs the same `libonnxruntime.so` the embedder needs, passed as `-onnx-lib`
+or read from `MAVEN_ONNX_LIB`. The measurement is
+`docs/evals/2026-08-09-silero-vad.md`, and the tests skip without the file.
+
 **Also need ONNX Runtime** (`libonnxruntime.so`):
 
 ```sh

CLAUDE.md

@@ -1,395 +1,209 @@
 # CLAUDE.md
 
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+Guidance for Claude Code (claude.ai/code) working in this repository.
 
-Maven is a self-hosted, privacy-first voice assistant (Russian + English). Go daemons
-talking over unix sockets; one resident small model for routing + phrasing; whisper.cpp STT, piper TTS.
-Deploy target is a Ryzen laptop (homesrv) with Vulkan offload to the Vega iGPU (`n_gpu_layers: 99`,
-compose passes `/dev/dri` + the render gid) — the resident model stays ≤1.7B either way.
+**This is a rules file.** It loads into every session, so it carries only what
+changes what an agent does. A measurement belongs in `docs/evals/`, dated and
+never edited after the day. A subsystem's reasoning belongs in its living doc
+under `docs/`. Read that doc before changing the subsystem.
 
-**Resident model:** currently **Qwen3-1.7B** (`UD-Q4_K_XL`), stock — not yet the CPT'd one.
-It replaced Qwen3.5-0.8B on 2026-07-31 because it measured better on both fixtures we have:
-67.5% vs 59.7% intent-only on the 77-case RU routing fixture, and 20/27 vs 11-17/27 on the
-talk fixture. See `docs/evals/2026-07-31-model-bakeoff.md`. It is a Thinking variant, so `n_ctx` is 4096
-— reasoning tokens need the room, and 4096 is what the scores above were measured at.
-
-The **target** is still the locally CPT'd **Qwen3-1.7B** (Vikunja #122, training in flight).
-Stock already speaks good Russian; what it gets wrong is the persona — it writes `я рад`,
-masculine, where Maven needs `рада`. That is what the CPT is for.
-
-**Do not bother with sub-500M models.** LFM2.5-230M and 350M were measured on 2026-07-31 and
-both are unusable in Russian: the 350M routes at 5.2% (worse than guessing) and answers
-"столица Франции?" with the invented non-word "Сторзит"; the 230M replies to Russian in
-Spanish. Their strong published IFEval/BFCL numbers are English-only. Model files live in
-`/mnt/hdd1/llms`, bind-mounted to `/opt/maven/models/llm` — which **shadows** the repo's
-`models/llm/`, so the LFM2.5 gguf sitting there is not loaded by anything. Swapping the resident
-model is a one-line change to `phraser.model_path` in `deploy/mavend.json`.
-
-See `docs/rearchitecture.md` for the target architecture, `docs/design.md` for the folded design spec, and
-`AGENTS.md` for local-preview + model-download recipes.
-
-**Model work is moving to the workstation** (owner's call, 2026-08-02). homesrv cannot grow a
-GPU and the workstation has 16GB of VRAM. So the resident model, STT and TTS become preferred
-remotes with a floor on homesrv. The workstation is never assumed up. Fall back silently when
-it would only do the job better. Name the gap when the 1.7B cannot do it at all. The embedder
-stays on homesrv permanently, because it backs that floor. It is multilingual-e5-small,
-quantized and asymmetric — `EmbedQuery` and `EmbedPassage` apply the `query:`/`passage:`
-prefixes it was trained with, and calling plain `Embed` on a note is a bug. It replaced
-MiniLM and bought ten points of recall@1 and 2.5× the speed; see
-`docs/evals/2026-08-04-recall-e5-small.md`. Read `docs/offload.md` before
-touching a daemon seam or adding a model caller. Vikunja #483 is the umbrella, #484 to #487
-are the work.
-
-Both halves are wired as of 2026-08-03. Routing and replies prefer the workstation silently
-through `modelSeam`; nudge and reminder phrasing prefer it silently inside the phraser. A
-world question goes through `LLMPhraser.PhraseWorld` and names the gap when the card is not
-free — `worldGap` in `cmd/mavend/worldmodel.go`, which he hears instead of an invented
-answer. A box with no `workstation` block behaves exactly as it did before the seam: naming
-a gap requires a gap. The offload table in `docs/offload.md` says which caller is which.
-
-## Build & test
-
-CGO daemons (`mavend`, `mavsttd`, `mavttsd`, `mavenclient`) need the vendored toolchain
-and libs wired through the Makefile — **do not** call `go build` on them bare, use `make`:
-
-```sh
-make build          # all 9 binaries
-make build-web      # single daemon (pure-Go ones: web/waked/poll/caldav build without CGO)
-make test           # go test -race across ./internal/... ./cmd/... with CGO env set
-```
-
-Run a single test (must carry the CGO env for packages that touch STT/TTS/voice):
-
-```sh
-CGO_CFLAGS="-I$(pwd)/deps/include -I$(pwd)/deps/whisper.cpp/ggml/include" \
-CGO_LDFLAGS="-L$(pwd)/deps/lib -Wl,-rpath,$(pwd)/deps/lib" \
-LD_LIBRARY_PATH="$(pwd)/deps/lib" \
-deps/go/go/bin/go test -run TestName ./internal/router/
-```
-
-Pure-Go packages (`router`, `memory`, `mavweb`, …) run under a plain `go test ./pkg/`.
-
-## The daemons (`cmd/`)
-
-| Binary | Role |
+| Read this | Before |
 |---|---|
-| `mavend` | **Core.** Router, phraser, memory, reminders, digestion tick. Owns the DB + IPC socket. |
-| `mavweb` | HTTP UI + PWA (`/dash`, `/history`, `/trace`, `/notifications`, `/tools`); WebAuthn auth. Connects to mavend's socket. |
-| `mavsttd` | Speech-to-text (whisper.cpp, CGO). |
-| `mavttsd` | Text-to-speech (piper subprocess). |
-| `mavwaked` | Wake-word / VAD gate. **Not on homesrv** — see below. |
-| `mavenclient` | Voice loop client (mic → stt → core → tts). **Not on homesrv** — see below. |
-| `mavpoll` | Telegram long-poll reach. |
-| `mavcaldav` | CalDAV calendar sync. |
-| `mavmaild` | Mail reader (IMAP, read-only). Holds the IMAP password; core never sees it. |
+| `docs/routing.md` | touching `internal/router/` or `queryWalk` |
+| `docs/deployment.md` | touching a daemon, compose, a systemd unit or the web UI |
+| `docs/offload.md` | touching a daemon seam or adding a model caller |
+| `docs/world.md` | touching search, Kiwix or the world chain |
+| `docs/language.md` | changing a prompt contract or a Russian word list |
+| `docs/ecosystem.md` | touching Nexus, Praxis or Hexis |
+| `docs/rearchitecture.md`, `docs/design.md` | changing the shape of anything |
+| `docs/workflow.md` | the five stores, the doc tiers, the guards |
+| `docs/caveats/` | a known limit, its task id and its revisit trigger |
+| `docs/CLAUDE.md` | which tier a doc belongs in, and what each one holds |
+| `AGENTS.md` | local preview, screenshots, model downloads |
 
-Daemons are wired socket-to-socket, not linked. `internal/ipc` is the client/server wire
-protocol; the config in `deploy/mavend.json` (with `${VAR}` env expansion from gitignored
-`deploy/telegram.env`) sets socket paths, model paths, and the phraser/embedder blocks.
+## What Maven is
 
-**Seven of the nine run on homesrv. `mavwaked` and `mavenclient` do not, and that is the
-decision, not an oversight** (Vikunja #463, `docs/plans/17-where-the-voice-loop-runs.md`).
-homesrv has a microphone — it is a laptop — but it is in the wrong room, so a wake-word
-daemon there listens to nobody. They belong on a client machine where he is standing.
-`ipc.Dial` already takes `tcp://host:port?token=...` through the netaddr seam, so nothing
-needs building to allow it, but no such machine exists yet. **The consequence: the wake
-word and the VAD gate are covered by unit tests and by nothing else, and no amount of
-sitting at the box changes that.** Push-to-talk through `/dash` is what QA actually covers.
+A self-hosted, privacy-first voice assistant in Russian and English. Go daemons
+talk over unix sockets. One resident small model routes and phrases. whisper.cpp
+does speech-to-text and piper does text-to-speech.
+
+The resident model is **Qwen3-1.7B** (`UD-Q4_K_XL`) on homesrv, a Thinking
+variant at `n_ctx` 4096. Keep it at 1.7B or under. Sub-500M models are unusable
+in Russian (`docs/evals/2026-07-31-model-bakeoff.md`). Model files live in
+`/mnt/hdd1/llms`, bind-mounted over the repo's `models/llm/`, so a gguf sitting
+in the repo is loaded by nothing.
+
+The workstation is workpc and it holds the remote model and speech-to-text.
+**It is never assumed up.** **Fall back silently** when it would only do the job
+better. **Name the gap** when the resident model cannot do the job at all.
+
+**The embedder stays on homesrv permanently**, because it backs that floor.
+`EmbedQuery` and `EmbedPassage` apply the `query:` and `passage:` prefixes
+multilingual-e5-small was trained with. Calling plain `Embed` on a note is a bug.
+
+## Build and test
+
+CGO daemons (`mavend`, `mavsttd`, `mavttsd`, `mavenclient`) need the vendored
+toolchain wired through the Makefile. **Do not call `go build` on them bare**,
+and **do not hand-write the CGO preamble**. This box runs zsh, so an unquoted
+`-run Test*` dies on "no matches found" before `go` is reached. `make t` also
+carries `-count=1` and sets `MAVEN_ONNX_LIB`. Without that variable the four
+`TestONNX*` measurements self-skip and the run still prints `ok`.
+
+```sh
+make build   # all 11 binaries. make build-web for one (web/waked/poll/caldav skip CGO)
+make test    # go test -race across ./internal/... ./cmd/... with CGO env set
+make t PKG=./internal/router/eval/ RUN='TestONNX' V=1   # V=1 for -v, RACE=0 to drop -race
+make analyze # staticcheck, deadcode and govulncheck. Not in `test`: all three need the network
+```
+
+**The static gates pass against a baseline, not against zero**
+(`scripts/analyzers/*.baseline`, reasoning in `docs/workflow.md`). A fix must
+delete its baseline entry, because the gate also fails on an entry whose finding
+is gone. **`make audit` is a git-grep inventory, not analysis.** Do not cite it
+as a reachability check.
+
+## The daemons
+
+Eleven binaries under `cmd/`, wired socket-to-socket over `internal/ipc`, not
+linked. `mavend` is the core and owns the DB and the IPC socket.
+`deploy/mavend.json` sets sockets, model paths and the phraser and embedder
+blocks, with `${VAR}` expansion from gitignored `deploy/telegram.env`.
+**`docker-compose.yml` runs five**: `mavend`, `mavsttd`, `mavttsd`, `mavweb`,
+`mavpoll`. Count against compose, not against `make build`. `mavwaked` runs on
+workpc under systemd. `docs/deployment.md` says who else is absent and why.
+
+- **Passwords are read from files, never taken as flag values.**
+- **The voice wire is plaintext with no auth.** mavend's voice port stays on
+  homesrv loopback and reaches workpc over ssh. Do not LAN-bind it.
+  `SurfaceVoice` caps acts at L0, and L0 does not cap reading.
+- **A GPU service added beside mavgpud goes in `cmd/mavgpud`, never in systemd.**
+  The card needs one owner. A second unit made mavgpud evict llama-server every
+  few seconds and took the model arm down for eight minutes.
 
 ## The ecosystem: Nexus, Praxis, Hexis
 
-Maven is one of four services. It owns conversation and personal memory. It does not
+Nexus identifies, Praxis observes, Hexis acts, Maven understands. Maven does not
 own identity, operational state, or execution. Full contract in
-`docs/ecosystem.md`.
+`docs/ecosystem.md`. All three are `nil` unless configured and each degrades
+alone. An outage means a named gap, never a broken turn or a guess.
 
-```text
-Nexus identifies.  Praxis observes.  Hexis acts.  Maven understands and coordinates.
-```
-
-| Service | Owns | Maven's client | Configured at |
-|---|---|---|---|
-| **Nexus** | Canonical entity ids, names, aliases, relationships. Projects, services, devices, people, pets, places. | `nexusClient` in `cmd/mavend/ecosystem.go`, `POST /api/v1/resolve` | `nexus.url` (`http://nexus:9740`) |
-| **Praxis** | Operational attention and item lifecycle. What needs looking at, what changed, what is still unresolved. | `praxisClient`, the HTTP tools API under `/api/v1/tools/` | `praxis.url` (`http://praxis:8989`) |
-| **Hexis** | The capability registry and the only path to executing anything. | vendored `github.com/kami/hexis/pkg/client` | `hexis.url` (`http://hexis:9741`) |
-
-All three are `nil` unless configured, and every one of them degrades on its own.
-An outage means a named gap in the answer, never a broken turn and never a guess.
-
-Rules that are not negotiable:
-
-- **No component reads another component's database.** Praxis attention comes over
-  HTTP, never from its SQLite file.
-- **Identity lives in Nexus.** Do not invent a local fact key for something Nexus
-  resolves. `actionFact` already sets `Subject`, and `cmd/mavend/factenrichment.go`
-  resolves it in the background against Nexus.
-- **Free text never reaches a mutating Hexis call.** Resolve to a canonical entity id
-  first. Ambiguous resolution asks the owner, it does not pick.
+- **No component reads another component's database.** Praxis attention comes
+  over HTTP, never from its SQLite file.
+- **Identity lives in Nexus.** Do not invent a local fact key for something
+  Nexus resolves. `cmd/mavend/factenrichment.go` resolves `actionFact.Subject`.
+- **Free text never reaches a mutating Hexis call.** Resolve to a canonical
+  entity id first. Ambiguous resolution asks the owner, it does not pick.
 - **LLM output is not authorization.** Confirmation binds capability id, target
-  entity, arguments, requester and expiry. See `cmd/mavend/confirm.go`.
-- **Praxis lifecycle words mean different things.** Surfaced is not acknowledged,
-  acknowledged is not resolved, execution success is not recovery. Reading an item
-  aloud calls `Surface`, never `Acknowledge`.
-- **No automatic attention-to-action path.** Digestion may summarise Praxis. It may
-  not call Hexis.
+  entity, arguments, requester and expiry (`cmd/mavend/confirm.go`).
+- **Praxis lifecycle words differ.** Surfaced is not acknowledged, acknowledged
+  is not resolved, execution success is not recovery. Reading an item aloud
+  calls `Surface`, never `Acknowledge`.
+- **No automatic attention-to-action path.** Digestion may summarise Praxis and
+  may not call Hexis.
+- Every cross-service call carries a correlation id minted once per action
+  (`withCorrelationID`), a contract version header, and `X-Requested-By: maven`.
 
-Every cross-service call carries a correlation id minted once per action
-(`withCorrelationID`), a contract version header, and `X-Requested-By: maven`.
+## Routing
 
-## Routing — read this before touching the router
+**Read `docs/routing.md` before touching `internal/router/` or `queryWalk`.** It
+carries the reasoning, the measurements and every rule's why. A route produces
+two decisions. **Intent** is one of seven values. **Source** is where the answer
+lives and is read on `IntentQuery` alone. Score them separately. The cascade is
+stage 0 grammars, then the routing heads, then the resident model, then the
+classifier. Every stage may decline and the next one answers.
 
-`internal/router/` has TWO layered engines. **The LLM router is now the default and it is
-on in deploy** — this section used to say it was wired `nil`, which stopped being true on
-2026-07-31.
+- **The classifier is the floor, not dead code.** It answers when the resident
+  model is off, absent, or erroring. **Any model error falls through.**
+- **`baselineGrammars` in `eval_test.go` mirrors `buildRouter`.** A grammar
+  added to one belongs in both, or the fixture scores a set nobody runs.
+- **Go's `\b` is ASCII-only** and never fires after a Cyrillic letter. A Russian
+  pattern needs an explicit `(\s|[?!.]|$)`.
+- **`PraxisGrammars()` is the only path to Praxis**, not a faster one.
+- **`voice.embedder.heads_path` must never point at `model_path`.** Recall
+  depends on the resident e5-small scoring what it scored. Fine-tune a copy.
+- **Routing traces are retained 14 days**, enforced on write and again on start.
+- **Bump `tokenizerRev` on any change to what `encodeWord` emits**, so a
+  tokenizer fix triggers `ReembedAll` the way swapping the model file does.
+- **A new rung in the `runTurn` ladder needs its name in `preRouteLadder`**
+  (`cmd/mavend/decisiontrace.go`), or it is missing from the decision record.
 
-- **LLM router (the intended design, docs/rearchitecture.md):** the resident Qwen3-1.7B (`llmrouter.go`)
-  emits GBNF-constrained structured JSON, and the SAME model phrases replies. Embedder is
-  demoted from a routing gate to a RAG hint. Wired at `voice.go:214` via
-  `pickLLMRouter(cfg.Voice.UseLLMRouter(), llmClient)`; the flag is `voice.llm_router`
-  (`config.go`), `DefaultLLMRouter` is **on**, and `deploy/mavend.json` sets it `true`.
-- **Classifier cascade (the failure floor, not dead code):** `classifier.go` +
-  `embedder.go` nearest-neighbour over frozen seed phrases. It runs when the LLM router is
-  off, when there is no llama-server to talk to (`pickLLMRouter` logs that and degrades),
-  and on any per-turn LLM error. Do not delete it — routing by seed similarity is the known
-  cause of weak RU query handling, but a turn must never break on the model.
+**`queryWalk` takes query sources out and moves none** (`actions_query.go`). That
+is the safety argument and it is not negotiable. The table's order is
+load-bearing and carries "the owner's data first, then the world".
+`SourceUnknown` is the floor and walks the whole chain. A named destination
+removes only the sources marked `guesses: true`, so a source that looks rather
+than guesses is always asked. **The personal boundary is the one exception and
+it is deliberate.** It guesses, so naming `SourceWorld` drops it. **Only a stage
+0 grammar may drop it** (owner's call, V-666). `queryWalk` reads
+`Decision.SourceAnchored` for the source marked `boundary: true` and no other.
 
-Cascade order: `stage0.go` exact-match fast-path → LLM router (when non-nil) → classifier
-fallback. Any LLM error falls through to the classifier so a turn never breaks on the model.
+Judge a routing change against the classifier (76.0% intent, 36.4% destination)
+and the resident model (80.2% intent), since those always answer. The fixture
+has grown from 77 cases to 96, so a number compares only to another number on
+the same fixture.
 
-Measured on the 77-case RU fixture. **Re-measured 2026-08-02: the classifier scores 68.8%
-full accuracy at p50 16.6µs**, not the 36.8% at p50 31ms that stood here from
-`docs/evals/2026-07-31-model-bakeoff.md`. That older figure predates the stage 0 rules and the
-seed additions, both of which now score inside the classifier baseline. Qwen3-1.7B scores
-77.9% intent-only / 72.7% through the cascade. So the router buys about 4 points of accuracy,
-not a doubling, and the trade is worth re-arguing rather than assuming. **The ≈2.7s figure
-that stood here until 2026-08-02 was contention, not the model.** See `docs/evals/2026-07-31-routing.md` line 61, which measures the LLM router at
-p50 825ms / p95 1.2s / max 3.0s and the full cascade at p50 0.80-1.04s. Do not plan latency
-work off the bakeoff table.
+## Language: model output and Russian
 
-**The numbers above are the homesrv floor, not the ceiling.** With the workstation up, routing
-completes through `llm.Pair` against gemma-4-12b and scores **84.4% full / 93.5% intent-only at
-p50 329ms** — better than the resident model and about 2.5× faster (`docs/evals/2026-08-02-workstation-gemma4-12b.md`,
-Vikunja #485). The workstation is never assumed up, so both sets of numbers are live. Judge a
-routing change against the classifier and the resident model, since those are what always answer.
+Both contracts are in `docs/language.md`. What must not be broken:
 
-**The intended third engine is not a generative model** (owner's call, 05-08-2026, V-546,
-`docs/plans/18-routing-heads-on-e5-small.md`). Routing has a bounded output space, so it is
-classification, and the 118M multilingual-e5-small is already resident. Three heads on one
-forward pass: intent, mood, and BIO slot tags. Roughly 5e15 FLOPs to train, so 10 to 30
-minutes on the workstation. A 100M decoder from scratch is 10 to 20 GPU hours. Two things
-it buys that a decoder cannot. No grammar is needed, because a softmax cannot emit a value
-that does not exist. And max softmax is a calibratable confidence, where `Confidence: 1.0`
-was a hardcode. **Fine-tune a copy of the weights.** The resident embedder backs memory
-recall. Training it in place couples routing accuracy to recall@1, with nothing in the
-suite to name the trade.
+- **One parser for model text, `parseResponseMood`** in
+  `internal/phraser/parse.go`. Every phrasing path reaches it. Mood is an enum.
+- **The router prompt is a separate contract** over 7 intents, and
+  `llm/check_prompt_parity.py` keeps the Go and relabelling copies identical.
+- **Russian words are matched by three mechanisms and no fourth**:
+  `internal/lexicon` for closed classes, `internal/morph` for grammar, and
+  `cmd/mavend/topics.go` with the embedder for open sets. A regex whose output
+  is a fact or a route is the defect. A regex over structured input is not.
+- **Seeds are scoring data.** Editing one moves a recogniser and must be
+  re-measured against the `TestONNX*` tests, not eyeballed.
 
-`Confidence: 1.0` used to be hardcoded in `llmrouter.go`, so the LLM
-path could never ask for clarification (6/6 refusal cases missed on the fixture) — Vikunja
-#359. Fixed 31-07-2026 with structural signal (single-token utterance, keyless fact, act with
-no allowlisted fn) feeding the same stage-3 gate the classifier path already had — see
-`gateLLMDecision` in `router.go`. Note the second half of that bug: the LLM branch never
-consulted `r.threshold` at all, so a correct low confidence would have been discarded anyway.
+## Non-goals and hard constraints
 
-Re-measured on the fixture after the fix: **missed clarify 6/6 → 1**, at the cost of 3 false
-clarifies and 2.6pt of full accuracy (72.7% → 70.1%, intent-only 67.5% → 74.0%). Two of the
-three false clarifies are acts the model mis-routed and the gate caught — asking beats wrongly
-executing, so the fixture and the daemon disagree about what is correct there. The third,
-`"поужинал"`, was a real defect: the single-token rule was an English intuition and does not
-transfer to Russian, where one word is routinely a whole sentence.
+Not a nag, not autonomous.
+**The persona is feminine.** Russian self-reference takes feminine forms: `рада`
+not `рад`, `поняла` not `понял`. The owner is male and she speaks to him
+informally. Use "ты", singular, never "вы" or "ваш", and never "он" or "его".
+She talks TO the owner, not about him. Pet names such as "милый" are forbidden.
+The name "Ками" is not. `CheckAddress`, `CheckFeminine` and `CheckCringe` in
+`internal/phraser/eval/checks.go` enforce this, scored by `make eval-phrasing`.
 
-Narrowed 01-08-2026. `thinSingleToken` (`internal/router/singletoken.go`) still thins a bare
-one-word nominal — "вода", "бэкап" — but spares two classes: a closed lexicon of social and
-control singles ("привет", "спасибо", "стоп", "yes"), and any token carrying a Russian verb
-ending (past tense, 2nd person, reflexive), because a verb already contains its subject. Both
-tests are offline and cost nothing. Re-measured: **false clarifies 3 → 2, intent-only 74.0% →
-75.3%, full accuracy unchanged at 70.1%, missed clarify still 1.** The two remaining false
-clarifies are the act-with-no-allowlisted-fn arm of the gate, not this rule.
+**"Never phones home" is deprecated** (owner's call, 2026-07-31). She reads
+external sources, and `docs/world.md` carries that chain. What holds regardless:
 
-Agenda questions taken off the model, 01-08-2026. `AgendaQueryGrammars` (`stage0.go`, wired
-after the clock rules in `buildRouter`) routes "что у меня сегодня", "во сколько у меня
-встреча" and anything naming a calendar to `IntentQuery` at stage 0. They were going to
-`IntentSystem`, where `replySystem` has no agenda arm and answered "пока не умею" — the
-fixture had said `query` since ru-query-019 was written. Measured: **full accuracy 70.1% →
-72.7%, intent-only 75.3% → 77.9%, calendar 0/2 → 2/2**, clarify counts unchanged. Note that
-Go's `\b` is ASCII-only and never fires after a Cyrillic letter; the pattern needs an
-explicit `(\s|[?!.]|$)`.
-
-Two more shapes taken off the model, 04-08-2026 (V-498). `rest-of-day-query` inside
-`AgendaQueryGrammars` claims "что дальше?" / "what's next", and `NarrativeQueryGrammar`
-(`stage0.go`, wired **last** in `buildRouter`, after the capture marker) claims "расскажи про
-X", "объясни X", "опиши X". Neither carries a question mark or an interrogative, so the model
-called both `IntentFact`; the write was caught downstream by `IsQuestionShaped`, so this was a
-latency and fixture defect, not a correctness one. The narrative rule reads the same
-`narrativeRequests` lexicon `IsQuestionShaped` reads, and declines `chatNarrativeTopics` — a
-joke, a bedtime story, herself — because the query chain has no source that answers those.
-New fixture cases ru-query-024 and ru-query-025. Classifier + ONNX baseline **56/80 (70.0%) →
-58/82 (70.7%)**, no case regressed, no new false clarify. The LLM arm was not measured (no
-llama-server in that run), so judge it again before quoting a cascade number.
-
-Praxis taken off the model, 05-08-2026 (V-516). `PraxisGrammars()`
-(`internal/router/praxis.go`, wired in `buildRouter` before the capture marker because
-"отметь" is a capture verb) fills `Slots.Fn` with a Praxis capability name. Praxis reach
-was **0/12 and structurally so**: `handlePraxisAct` compares `Slots.Fn` to a capability
-alias, and that slot is filled from the deployment's enabled tool names, which no Praxis
-alias is on. Measured **16/30 → 27/30 overall, praxis 0/12 → 11/12, lifecycle 0/5 → 5/5**
-(`docs/evals/2026-08-05-praxis-reach.md`). Two rules to know before editing: a **stative**
-lifecycle word ("готово", "принято") needs an item named beside it, while a bare
-**imperative** ("закрывай") may ask which one. The bare arm additionally requires that
-the sentence name no object of its own, or "закрой шторы в комнате" goes to Praxis instead
-of the house. A demonstrative ("отметь это как сделанное") resolves against
-`h.surfacedItems` only when exactly one item was spoken. Otherwise the turn goes back to
-the cascade rather than transitioning the wrong item.
-
-## LLM output contract
-
-All phrasing paths emit `{"response":"...","mood":"..."}` (parsed in `replier_llm.go` and
-`internal/phraser/llmphraser.go`), with fallback to plain text and the legacy
-`{"body","summary"}`. Mood is a fixed enum. Router prompt is a separate contract:
-`[{"intent":<enum>, key?, value?, text?, verb?}, ...]`, 7 intents (`fact, reminder,
-note, query, act, chat, system`). `llm/check_prompt_parity.py` in the training
-workspace enforces that the Go and relabelling prompts remain identical.
-
-## Russian patterns — three mechanisms, no fourth
-
-Hand-written Russian stem patterns were swept out on 2026-08-04 (owner's call: not a
-pattern, and the resident model cannot be asked per turn either). A regex whose output is a
-fact or a route is the defect; a regex over structured input — HTML, MIME, JSON, a URL, an
-argv list — is not. Before writing a Russian word list, pick one of these:
-
-- **`internal/lexicon`** — closed classes, in `lexicon_ru_v1.json`. Interrogatives,
-  capture verbs, reminder verbs, cardinals, day offsets, parts of day, weekdays, months,
-  spoken hours. Editing a word is a data change, and there is exactly one copy: months used
-  to live in three files. Cardinals carry the oblique forms, because a spoken time declines
-  and `в семь` / `к семи` are one hour.
-- **`internal/morph`** — grammar, from the vendored golem Russian dictionary. `IsVerbForm`
-  and `SameWord`. Note that lemma matching is BROADER than stem-plus-one-ending, so a verb
-  slot that means the imperative must be matched exactly — `говори` and `говорил` are one
-  lemma and only one of them is a command (`cmd/mavend/quiet_toggle.go`).
-- **`cmd/mavend/topics.go` and the embedder** — open sets, where the question is what a
-  turn is ABOUT. Frozen seeds per subject plus a real `other` class, scored against the
-  turn's own query vector. Same shape as the personal boundary in `personalboundary.go`,
-  with one difference: a topic must clear the runner-up by `topicMargin`, because a false
-  claim here spends a network scan rather than one honest "не знаю". The old keyword tests
-  stay as the offline floor and may remain narrow, since they are no longer the only answer.
-- **The ecosystem trio** — when the answer is not in the utterance at all. Identity is
-  Nexus's, never a local pattern.
-
-Seeds are scoring data. Editing one moves a recogniser and must be re-measured against the
-`TestONNX*` tests, not eyeballed.
-
-## Non-goals (hard constraints)
-
-Not a nag, not autonomous. Maven's persona is **feminine** — Russian
-self-reference must use feminine forms — `рада`, not `рад`; `поняла`, not `понял`. The owner
-is male and is addressed informally: "ты", singular, never "вы"/"ваш" and never "он"/"его"
-(she talks TO him, not about him). Pet names ("милый", "дорогой") are forbidden; his name
-("Ками") is not. The eval enforces this: `CheckAddress`, `CheckFeminine` and `CheckCringe` in
-`internal/phraser/eval/checks.go`, scored by `make eval-phrasing`.
-
-**"Never phones home" is DEPRECATED** (owner's call, 2026-07-31). It used to be a hard
-constraint and it is not one any more: a 0.8B — and a 1.7B — does not know enough to answer
-world questions, so she needs to read external sources. What replaces it:
-
-- **No telemetry, no cloud model, no third-party account.** That part never changes. Nothing
-  about Maven is reported to anyone, and inference stays on the box.
-- **His data first, then the world.** Every source that reads his facts, notes, calendar,
-  tasks or house runs before anything outside, and the personal boundary sits between them.
-  Reading beats recalling for a small model.
-- **In the world, live search leads and the ZIMs are the fallback** (owner's call,
-  2026-08-02). A self-hosted SearXNG (`search` block) answers first; the Kiwix ZIMs on
-  homesrv answer when the search is empty, unreachable, or the line is down.
-  **Verified with the line down on 2026-08-05** (V-508,
-  `docs/evals/2026-08-05-kiwix-offline-fallback.md`): a stopped SearXNG costs nothing,
-  the ZIM answers in the same turn budget. A blackholed host cost 8 seconds he waited
-  through. So the connect phase alone is capped at `dialTimeout` (1.5s), while a slow
-  instance that did connect keeps the full 8. **A Russian question reads
-  `wikipedia_ru_all_maxi_2026-02` verbatim** through `kiwix.book_ru`. The RU→EN rewriter
-  is the workaround for an English book and is skipped there. Kiwix catalog names come
-  from the filename, not the `<name>` field.
-  `Response.Empty()` is the whole gate and there is no quality threshold in front of it:
-  the three signals one could read were measured on 2026-08-05 and none of them separate a
-  real question from an invented one. Token overlap would cost "столица Франции" its
-  answer, because the answer is Париж and that word is not in the question. See
-  `docs/evals/2026-08-05-search-quality-signals.md` (V-539). **Which query source claimed
-  a turn is readable on `/chat`** as a badge beside the reply, carried on
-  `ipc.ChatReply.Source` and noted by `noteQuerySource` in `cmd/mavend/querysource.go`. It
-  rides the context, so `handleText` keeps the one string signature the mic, telegram and
-  the web share.
-- **External search is allowed and off unless configured**, like the weather and telegram
-  capabilities. The code default is still off. `deploy/mavend.json` now ships a `search`
-  block (owner's call, 2026-08-02), so it is on for this box and deleting the block turns
-  it off again.
-- **His notes and facts are never search input.** Looking up why the sky is blue and sending
-  his stored personal notes to an upstream engine are different acts. Only the utterance goes
-  out, never the persona block, history, or matched notes.
-
-## Web UI conventions
-
-Server-rendered pages share `cmd/mavweb/static/ui.css` (served at `/ui.css`) and the shell
-partial in `cmd/mavweb/shell.html`: a page opens with `{{template "shellTop" "<page-key>"}}`
-and closes with `{{template "shellBottom"}}`, and the key marks the active sidebar link.
-Every page is its own embedded `.html` file next to `main.go` — no page markup lives in Go,
-and the sidebar is data (`sidebarSections`, `pageIcon`) the template renders. No
-per-page `<style>` beyond true one-offs. Wrap every table in `<div class=scroll>` so wide
-data pans on a phone. Local preview + headless screenshot recipe is in `AGENTS.md`.
-
-## Vikunja
-
-This repo is project **Maven** (ID 2) in Vikunja. MCP: `http://localhost:9100/mcp` (or
-`http://192.168.1.104:9100/mcp` from workpc). Feature/bug/deploy tasks go there.
-
-Vikunja is the durable task store. A task holds the goal, the constraints and the
-assumption ledger. Work without a task id is work nobody can resume, so a session that
-has no id asks for one before it starts.
+- **No telemetry, no cloud model, no third-party account.** Inference stays on
+  the box and nothing about Maven is reported to anyone.
+- **The owner's data first, then the world.** Every source reading his facts,
+  notes, calendar, tasks or house runs first, and the personal boundary sits
+  between them and anything outside.
+- **His notes and facts are never search input.** Only the utterance goes out,
+  never the persona block, the history, or matched notes.
+- **External search is allowed and off unless configured.** Deleting the
+  `search` block in `deploy/mavend.json` turns it off.
+- **`Response.Empty()` is the whole gate** on a world answer. There is no
+  quality threshold in front of it and four candidate signals all failed.
 
 ## Session workflow
 
-`~/.local/bin/task` owns the branch, the commit identity and the PR. One task, one
-session, one PR.
+`docs/workflow.md` carries the five stores, the doc tiers and the guards. One
+task, one session, one PR. `/pickup` opens a session and `/wrap` closes it. Wrap
+at roughly half context rather than letting the session compact.
 
 ```sh
 task start <vikunja-id>   # branch off origin/master, write TASK.md, fetch review comments
 task pr                   # push, open or refresh the PR, label Vikunja, notify
-task comments             # re-pull this branch's review comments into .task/
+ToolSearch("select:mcp__vikunja__list_tasks,mcp__vikunja__get_task_details,mcp__vikunja__create_task,mcp__vikunja__update_task")
 ```
 
-Around that, `/pickup` opens a session and `/wrap` closes it. Wrap at roughly half
-context rather than letting the session compact.
-
-Five stores, and each one owns something the others must not hold:
-
-| Store | Holds | Lifetime |
-|---|---|---|
-| Vikunja task | goal, constraints, assumption ledger, status | durable |
-| `CLAUDE.md`, `AGENTS.md` | what an agent must know before touching code | durable |
-| `docs/` | design, measurements, decisions | durable |
-| `TASK.md` | the brief for this branch, written by `task start`, immutable | one branch |
-| `HANDOFF.md` | only what the next agent needs to resume | one session |
-
-`TASK.md` and `.task/` are excluded through `.git/info/exclude`. `HANDOFF.md` is
-gitignored and injected at session start. If a line in the handoff would still matter
-next week, it is in the wrong file.
-
-Docs are tiered by path, so staleness is visible from the filename. Files directly under
-`docs/` are living and carry a `Last verified: <date> @ <sha>` line. Files under
-`docs/evals/` are dated measurements and are never edited after the day, so a newer
-number is a new file. Files under `docs/archive/` are dead and read by nobody by default.
-
-## Git guards
-
-Two hooks in `.githooks/`, tracked, wired with `core.hooksPath`. Fresh clone:
-
-```sh
-git config core.hooksPath .githooks
-```
-
-- `pre-commit` refuses master, and refuses more than 300 changed lines in non-markdown
-  files. Markdown is exempt and may land as one batch.
-- `commit-msg` requires the subject to end with `(V-<id>)`. `V-` and not `#`, because
-  Gitea autolinks `#123` to a Gitea issue, which is the wrong tracker.
-
-Two more guards live outside the repo, in `~/.claude/hooks/`. `diff-budget.sh` blocks
-further edits past 600 changed lines on a `task/` branch. `prose_lint_hook.py` checks
-prose on every write. Both measure against `origin/master`, so a local master that is
-ahead of the remote makes the diff budget read high.
-
-`--no-verify` exists. Using it means saying why in the commit body.
+- This repo is Vikunja project **Maven** (ID 2), MCP at
+  `http://localhost:9100/mcp`, or `http://192.168.1.104:9100/mcp` from workpc.
+- **A session with no task id asks for one before it starts**, because work
+  without one is work nobody can resume.
+- **Close a finished task with `done: true` and nothing else** (owner's call,
+  2026-08-07). `update_task` carrying a `description` resets `done` to false.
+- **`pre-commit` refuses master** and more than 300 changed lines in
+  non-markdown files. Markdown is exempt and may land as one batch.
+- **`commit-msg` requires the subject to end with `(V-<id>)`.** `V-` and not
+  `#`, because Gitea autolinks `#123` to the wrong tracker.
+- **`diff-budget.sh` blocks edits past 600 changed lines** on a `task/` branch.
+- **`--no-verify` exists.** Using it means saying why in the commit body.

Makefile

@@ -4,7 +4,7 @@
 # `test` below fail on the two packages that have no test files. deps-go builds
 # the missing tools in, so the vendored tree is self-sufficient. Keep the version
 # here in step with the `go` directive in go.mod.
-GO_VERSION := 1.25.5
+GO_VERSION := 1.25.12
 GO       := $(shell pwd)/deps/go/go/bin/go
 export GOTOOLCHAIN := local
 GOFLAGS  :=
@@ -16,7 +16,7 @@ PIPER_BIN     := $(shell pwd)/deps/piper/piper
 PIPER_MODEL   := $(shell pwd)/models/tts/ru_RU-irina-medium.onnx
 PIPER_ESPEAK  := $(shell pwd)/deps/piper/espeak-ng-data
 
-.PHONY: simulate stt-fixtures test-stt-golden all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel tidy eval-router eval-reach eval-recall eval-phrasing eval-models build-gpud
+.PHONY: t audit simulate stt-fixtures test-stt-golden all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel deps-vuln vuln deps-lint lint deadcode analyze tidy eval-router eval-reach eval-recall eval-phrasing eval-models build-gpud
 
 all: build
 
@@ -73,7 +73,7 @@ run-web: build-web
 # builds them on demand, but `go test -coverprofile` calls covdata through
 # base.Tool(), which only stats pkg/tool and exits. So build them in once here.
 GO_TARBALL := go$(GO_VERSION).linux-amd64.tar.gz
-GO_SHA256  := 9e9b755d63b36acf30c12a9a3fc379243714c1c6d3dd72861da637f336ebb35b
+GO_SHA256  := 234828b7a89e0e303d2556310ee549fbcf253d28de937bac3da13d6294262ac1
 deps-go: deps-sentinel
 	@mkdir -p deps/go
 	cd deps/go && curl -fLO 'https://go.dev/dl/$(GO_TARBALL)'
@@ -95,6 +95,70 @@ deps-sentinel:
 	@mkdir -p deps
 	@printf 'module github.com/kami/maven/deps\n\ngo 1.21\n' > deps/go.mod
 
+# vuln — the advisory gate the 2026-08-10 audit found missing (V-682). It reads
+# the published database over the network, so it is not part of `test`, which
+# has to pass on a box with no route out. Run it before a toolchain or
+# dependency bump lands, because that is what it grades: on 2026-08-11 the
+# pinned Go 1.25.5 and x/text 0.14.0 carried 20 reachable advisories and the
+# bumped pair carries none.
+#
+# govulncheck is a tool and not a dependency, so it is installed into deps/ like
+# the toolchain rather than added to go.mod. The version is pinned here for the
+# same reason GO_VERSION is: a gate that moves on its own is not a gate.
+GOVULNCHECK_VERSION := v1.6.0
+GOVULNCHECK := $(shell pwd)/deps/bin/govulncheck
+
+deps-vuln: deps-sentinel
+	@mkdir -p deps/bin
+	GOTOOLCHAIN=local GOBIN=$(shell pwd)/deps/bin \
+		$(GO) install golang.org/x/vuln/cmd/govulncheck@$(GOVULNCHECK_VERSION)
+
+# The CGO env is the same one `test` carries: govulncheck loads the packages,
+# and the four CGO daemons do not load without it.
+vuln: deps-vuln
+	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
+		PATH="$(shell pwd)/deps/go/go/bin:$$PATH" GOTOOLCHAIN=local $(GOVULNCHECK) ./...
+
+# lint and deadcode — the other two analyzers the 2026-08-10 audit asked for
+# (V-694). They are not part of `test` for the same reason `vuln` is not: they
+# install over the network, and they are slow enough that a change to one Go
+# file should not pay for them.
+#
+# Neither reports zero, so neither fails on its own output. The accepted set
+# lives in scripts/analyzers/*.baseline and scripts/analyzer-gate.sh decides.
+# What is new fails, and so does a baseline entry whose finding is gone.
+#
+# deadcode runs with -test, so a test file is a root. Without it the report is
+# 172 lines, most of internal/router/eval, and none of it is a mistake.
+STATICCHECK_VERSION := v0.7.0
+DEADCODE_VERSION    := v0.48.0
+STATICCHECK := $(shell pwd)/deps/bin/staticcheck
+DEADCODE    := $(shell pwd)/deps/bin/deadcode
+
+deps-lint: deps-sentinel
+	@mkdir -p deps/bin
+	GOTOOLCHAIN=local GOBIN=$(shell pwd)/deps/bin \
+		$(GO) install honnef.co/go/tools/cmd/staticcheck@$(STATICCHECK_VERSION)
+	GOTOOLCHAIN=local GOBIN=$(shell pwd)/deps/bin \
+		$(GO) install golang.org/x/tools/cmd/deadcode@$(DEADCODE_VERSION)
+
+# Both load the packages, so both carry the CGO env `test` carries. Without it
+# the four CGO daemons do not load and the analyzer reports a build error
+# instead of a finding -- which analyzer-gate.sh fails on rather than filters.
+ANALYZER_ENV = CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" \
+	LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
+	PATH="$(shell pwd)/deps/go/go/bin:$$PATH" GOTOOLCHAIN=local
+
+lint: deps-lint
+	@$(ANALYZER_ENV) $(STATICCHECK) ./... | scripts/analyzer-gate.sh staticcheck
+
+deadcode: deps-lint
+	@$(ANALYZER_ENV) $(DEADCODE) -test ./... | scripts/analyzer-gate.sh deadcode
+
+# Every static gate in one command. Not `check`, because it is not the thing to
+# run before a commit: vuln reads the network and all three are slow.
+analyze: lint deadcode vuln
+
 # Run the tidy the sentinel makes possible. Not part of `test`: it rewrites
 # go.mod, and a build target that edits the module file is a surprise.
 # vendor/ is committed, so a tidy that drops a requirement must be followed by
@@ -128,6 +192,35 @@ test: fmt-check vet
 	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
 		$(GO) test -race -coverprofile=coverage.out ./internal/... ./cmd/...
 
+# t — run ONE package or ONE test with the toolchain env already wired. This is
+# the iteration target; `test` is the gate. Reach for it instead of pasting the
+# CGO_CFLAGS/CGO_LDFLAGS/LD_LIBRARY_PATH preamble by hand, which is how it was
+# done ~390 times across past sessions and is where the shell-quoting failures
+# came from -- the interactive shell here is zsh, and an unquoted `-run Test*`
+# or `--include=*.go` dies on "no matches found" before go ever starts.
+#
+#   make t                                     # whole tree (same scope as `test`)
+#   make t PKG=./internal/router/
+#   make t PKG=./cmd/mavend/ RUN=TestSimulator
+#   make t PKG=./internal/router/eval/ RUN='TestONNX' V=1
+#   make t PKG=./internal/store/ RACE=0        # drop -race when iterating hot
+#
+# -race is on by default so a green `make t` cannot turn red under `make test`.
+# -count=1 because a cached PASS from before your edit is worse than no answer.
+# MAVEN_ONNX_LIB is set for the same reason: the four TestONNX* measurements
+# self-skip when it is unset, so a targeted eval run would otherwise report the
+# deterministic hash ratchet and look like it scored the real embedder.
+PKG  ?= ./internal/... ./cmd/...
+RUN  ?=
+V    ?=
+RACE ?= 1
+
+t:
+	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
+	MAVEN_ONNX_LIB="$(MAVEN_ONNX_LIB)" \
+		$(GO) test $(if $(V),-v,) $(if $(filter-out 0,$(RACE)),-race,) -count=1 \
+		$(if $(RUN),-run '$(RUN)',) $(PKG)
+
 # eval-router — score the held-out RU routing fixture (internal/router/eval).
 # Verbose so the report tables land in the terminal. MAVEN_ONNX_LIB points the
 # prod-representative baseline at the vendored runtime; override it or set it
@@ -189,6 +282,16 @@ eval-models:
 # scores the fixtures against ggml-small and self-skips when the model is
 # absent, and TestGoldenFixturesAreCanonical, which checks the committed audio
 # and the manifest with no model at all.
+# audit — the repo inventory: LOC per package, open TODOs, real stubs, living-doc
+# staleness, test shape, packages with no test. Read-only, prints, writes nothing.
+# Run it instead of rebuilding the same greps by hand; past sessions spent 93 of
+# them on this before their first edit. SECTION=loc|todo|stubs|docs|tests|gaps
+# narrows it.
+SECTION ?= all
+
+audit:
+	@SECTION="$(SECTION)" ./scripts/audit.sh
+
 stt-fixtures:
 	./scripts/gen-stt-fixtures.sh
 

cmd/mavcaldav/main.go

@@ -50,10 +50,10 @@ func run(args []string) error {
 	socket := fs.String("socket", "", "core IPC socket path (required)")
 	url := fs.String("url", "", "CalDAV calendar URL, e.g. http://localhost:5232/kami/personal (required)")
 	user := fs.String("user", "", "CalDAV basic-auth username (required)")
-	pass := fs.String("pass", "", "CalDAV basic-auth password (required)")
+	passFile := fs.String("pass-file", "", "file holding the CalDAV basic-auth password (required — never passed as a flag value)")
 	renderURL := fs.String("render-url", "", "CalDAV collection maven publishes her own reminders to; empty disables rendering")
 	renderUser := fs.String("render-user", "", "basic-auth username for -render-url (defaults to -user)")
-	renderPass := fs.String("render-pass", "", "basic-auth password for -render-url (defaults to -pass)")
+	renderPassFile := fs.String("render-pass-file", "", "file holding the password for -render-url (defaults to -pass-file)")
 	renderDur := fs.Duration("render-duration", calendar.DefaultReminderDuration, "how long a rendered reminder occupies")
 	interval := fs.Duration("interval", 5*time.Minute, "poll cadence")
 	timeout := fs.Duration("timeout", 10*time.Second, "per-request HTTP timeout")
@@ -63,13 +63,22 @@ func run(args []string) error {
 	if *socket == "" {
 		return fmt.Errorf("-socket is required")
 	}
-	if *url == "" || *user == "" || *pass == "" {
-		return fmt.Errorf("-url, -user, -pass are required")
+	if *url == "" || *user == "" || *passFile == "" {
+		return fmt.Errorf("-url, -user, -pass-file are required")
 	}
 	if err := checkRenderTarget([]string{*url}, *renderURL); err != nil {
 		return err
 	}
 
+	// The password is read from a file, never taken as a flag value: an argv
+	// secret is visible in `ps` to every user on the box and lands in the compose
+	// file and the shell history. Same rule mavmaild and mavpoll follow. Read
+	// once at start, so a rotated password means a restart.
+	pass, err := readSecret(*passFile)
+	if err != nil {
+		return err
+	}
+
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 
@@ -85,17 +94,20 @@ func run(args []string) error {
 		http: hc,
 		url:  strings.TrimRight(*url, "/"),
 		user: *user,
-		pass: *pass,
+		pass: pass,
 	}
 
 	var rend *renderer
 	if *renderURL != "" {
-		ru, rp := *renderUser, *renderPass
+		ru, rp := *renderUser, pass
 		if ru == "" {
 			ru = *user
 		}
-		if rp == "" {
-			rp = *pass
+		if *renderPassFile != "" {
+			rp, err = readSecret(*renderPassFile)
+			if err != nil {
+				return err
+			}
 		}
 		rend = newRenderer(core, hc, *renderURL, ru, rp, *renderDur)
 		log.Printf("mavcaldav: rendering reminders to %s", *renderURL)
@@ -131,6 +143,21 @@ func run(args []string) error {
 // It takes the whole read set, not one URL. The guarantee in the package
 // comment is about every calendar maven reads, and a second read target added
 // later must not quietly fall outside the check.
+// readSecret reads one credential from a file and refuses an empty one. An
+// empty file is a deployment mistake, not a password, and CalDAV basic auth
+// would send it and get a 401 every poll.
+func readSecret(path string) (string, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("read password file: %w", err)
+	}
+	secret := strings.TrimSpace(string(raw))
+	if secret == "" {
+		return "", fmt.Errorf("password file %s is empty", path)
+	}
+	return secret, nil
+}
+
 func checkRenderTarget(readURLs []string, renderURL string) error {
 	if renderURL == "" {
 		return nil
@@ -188,6 +215,11 @@ func (p *poller) pollOnce(ctx context.Context) {
 	}
 }
 
+// maxResponseBody bounds every CalDAV response this daemon reads (the poller's
+// GET and the renderer's PROPFIND) — a misbehaving or malicious server gets a
+// truncated read, not an unbounded one.
+const maxResponseBody = 4 << 20
+
 // fetchEvents GETs the calendar URL and parses VEVENTs from the iCal response.
 func (p *poller) fetchEvents(ctx context.Context, now time.Time) ([]calendar.Event, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, p.url, nil)
@@ -203,7 +235,7 @@ func (p *poller) fetchEvents(ctx context.Context, now time.Time) ([]calendar.Eve
 	}
 	defer resp.Body.Close()
 
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBody))
 	if err != nil {
 		return nil, err
 	}

cmd/mavcaldav/main_test.go

@@ -5,12 +5,38 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
 	"testing"
 	"time"
 
 	"github.com/kami/maven/internal/ipc"
 )
 
+// The password comes from a file so it never reaches argv. An empty or missing
+// file must fail at start rather than authenticate as "" against his calendar.
+func TestReadSecret(t *testing.T) {
+	dir := t.TempDir()
+	good := filepath.Join(dir, "ok")
+	if err := os.WriteFile(good, []byte("  hunter2\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if got, err := readSecret(good); err != nil || got != "hunter2" {
+		t.Fatalf("readSecret(good) = %q, %v; want \"hunter2\", nil", got, err)
+	}
+
+	empty := filepath.Join(dir, "empty")
+	if err := os.WriteFile(empty, []byte("\n \n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readSecret(empty); err == nil {
+		t.Fatal("readSecret(empty) = nil error, want refusal")
+	}
+	if _, err := readSecret(filepath.Join(dir, "absent")); err == nil {
+		t.Fatal("readSecret(absent) = nil error, want refusal")
+	}
+}
+
 type fakeCore struct {
 	ipc.UnimplementedCoreAPI
 	facts    map[string]ipc.Fact // composite key "key|source" → Fact

cmd/mavcaldav/render.go

@@ -142,7 +142,7 @@ func (r *renderer) listPublished(ctx context.Context) ([]int64, error) {
 		return nil, err
 	}
 	defer resp.Body.Close()
-	raw, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	raw, err := io.ReadAll(io.LimitReader(resp.Body, maxResponseBody))
 	if err != nil {
 		return nil, err
 	}

cmd/mavenclient/main.go

@@ -31,15 +31,11 @@ import (
 	"errors"
 	"flag"
 	"fmt"
-	"io"
 	"log"
-	"net"
 	"os"
 	"os/signal"
 	"path/filepath"
-	"strconv"
 	"syscall"
-	"time"
 
 	"github.com/kami/maven/internal/audio"
 	"github.com/kami/maven/internal/voice"
@@ -155,9 +151,3 @@ func writeWAV(path string, a audio.Audio) error {
 // jsonUnmarshal — kept local rather than pulling encoding/json into main.go
 // top-level space.
 func jsonUnmarshal(b []byte, v any) error { return json.Unmarshal(b, v) }
-
-// keep strconv + io + net + time alive for future duration/size helpers.
-var _ = strconv.Atoi
-var _ io.Reader = (io.Reader)(nil)
-var _ = net.IPv4
-var _ = time.Second

cmd/mavend/actions_act.go

@@ -24,6 +24,14 @@ func (h *reactiveHandler) actionAct(ctx context.Context, dec router.Decision) st
 		}
 	}
 
+	// The board is Maven's own store, so a spoken status change is answered here
+	// and never offered to an ecosystem client (Vikunja #512). First, because
+	// task_status is on no allowlist and no capability registry: reaching either
+	// of them would answer a turn about his own task list with a gap.
+	if dec.Slots.Fn == router.TaskStatusFn {
+		return h.resolveTaskStatus(ctx, dec)
+	}
+
 	// Praxis ecosystem tools: intercept before the system command executor.
 	if h.ecosystem != nil && h.ecosystem.praxis != nil && dec.Slots.HasFn {
 		if reply := h.handlePraxisAct(ctx, dec); reply != "" {
@@ -52,6 +60,17 @@ func (h *reactiveHandler) actionAct(ctx context.Context, dec router.Decision) st
 			phrase := actPhrase(dec.Slots.Fn, dec.Slots.Args)
 			h.park(dec.Slots.Fn, dec.Slots.Args, phrase)
 			return phraser.A(phraser.ActConfirm, map[string]string{"name": phrase})
+		case errors.Is(err, tool.ErrUnknownTarget):
+			// The verb reached a tool and the tail did not reach a target, so
+			// nothing ran. Saying which word she could not place is the whole
+			// answer: he either renames it or gives the row an alias that
+			// carries the target, and both are one turn away (V-634).
+			word := ""
+			var unknown *tool.UnknownTargetError
+			if errors.As(err, &unknown) {
+				word = unknown.Target
+			}
+			return phraser.A(phraser.ActUnknownTarget, map[string]string{"name": word})
 		case errors.Is(err, tool.ErrNeedsAuthedSurface):
 			// Irreversible (internal/tool/risk.go). A confirm turn would not
 			// help: everything that proposed this act — the STT, the router,

cmd/mavend/actions_list.go

@@ -95,6 +95,12 @@ func (h *reactiveHandler) removeListItem(ctx context.Context, cap router.ListCap
 	return "", false
 }
 
+// listFloor — the keyword test behind topicList, in the shape turnIsAbout takes.
+func listFloor(u string) bool {
+	_, ok := router.ParseListQuery(u)
+	return ok
+}
+
 // queryList — "что в списке покупок?", "что мне купить?".
 //
 // A query source, so it sits in querySources and either claims the turn or
@@ -102,10 +108,15 @@ func (h *reactiveHandler) removeListItem(ctx context.Context, cap router.ListCap
 // source is: the notes pass would otherwise answer a list question with
 // whatever note is nearest.
 func (h *reactiveHandler) queryList(ctx context.Context, t *queryTurn) (string, bool) {
-	list, ok := router.ParseListQuery(t.dec.Utterance)
-	if !ok || h.dataStore == nil {
+	if h.dataStore == nil {
 		return "", false
 	}
+	// The seeds decide the subject and listQueryPrefixes is the floor behind
+	// them (V-522). Which list he named is a noun lookup either way.
+	if !h.turnIsAbout(ctx, t, topicList, listFloor) {
+		return "", false
+	}
+	list := router.ListNamedIn(t.dec.Utterance)
 	items, err := h.dataStore.ListItems(ctx, list, "")
 	if err != nil {
 		log.Printf("voice: list items: %v", err)

cmd/mavend/actions_note.go

@@ -9,9 +9,24 @@ import (
 	"github.com/kami/maven/internal/router"
 )
 
+// nothingToCorrectReply — what she says to a correction that points at
+// nothing. Filing it would put a sentence in his memory that reads as a fact.
+const nothingToCorrectReply = "не поняла, что поправить. скажи целиком, и я запишу."
+
 // actionNote handles router.IntentNote: embed the note, persist it, and
 // index it for recall.
+//
+// The stored body is dec.Utterance and nothing else (V-576). It is not
+// Slots.Text, not phraser output and not any other model string: a note is
+// durable, the embedder indexes it, and it comes back later as recall in his
+// own words. Phrasing belongs in the spoken confirmation.
 func (h *reactiveHandler) actionNote(ctx context.Context, dec router.Decision) string {
+	// A correction with no referent. Everything that could own one has already
+	// run by here: clarify, confirm and repair are all resolved before routing,
+	// so a fragment reaching the note path has nothing behind it (V-576).
+	if correctionFragment(dec.Utterance) {
+		return nothingToCorrectReply
+	}
 	// An utterance that explicitly files a task is work, not recall, and
 	// belongs in the task store (Vikunja #130). Checked before the embedding
 	// is paid for. Everything else is a note, exactly as before.

cmd/mavend/actions_query.go

@@ -11,7 +11,9 @@ import (
 	"unicode"
 
 	"github.com/kami/maven/internal/crawl"
+	"github.com/kami/maven/internal/decision"
 	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/kiwix"
 	"github.com/kami/maven/internal/memory"
 	"github.com/kami/maven/internal/morning"
 	"github.com/kami/maven/internal/phraser"
@@ -58,6 +60,35 @@ type querySource struct {
 	// sources search text with no notion of a day. When one of them grows a
 	// date parameter, flip its flag here.
 	dateAware bool
+
+	// dest — the destination this source serves, when the cascade named one
+	// (V-655). Several sources share a destination: the three recall passes and
+	// the fact-by-key lookup are all SourceRecall, because which of them lands
+	// the hit is an ordering detail no utterance can name. A source with no
+	// dest is reachable only by walking the chain.
+	dest router.Source
+
+	// guesses — this source decides whether the turn is its own by scoring the
+	// utterance against frozen seeds, rather than by looking something up and
+	// coming back empty.
+	//
+	// The distinction is the whole point of the field. A source that looks can
+	// be wrong about relevance and still harmless, because the miss shows up as
+	// no rows. A source that guesses answers whatever it claims: weather has no
+	// local table to miss against, so "что такое TCP?" became "для какого
+	// города?". So when the cascade names a destination, the guessers that were
+	// not named do not get to try. The lookups still run, because a named
+	// destination is evidence and not a promise.
+	guesses bool
+
+	// boundary — dropping this source widens what leaves the box, so only a
+	// literal pattern may do it (V-666, owner's call of 2026-08-09).
+	//
+	// Every other guesser costs an answer when it is wrongly taken off a turn.
+	// This one costs the rule that a question about him never reaches an
+	// upstream engine. A grammar read the words to name a destination. A model
+	// and a softmax both inferred one, and neither may spend that.
+	boundary bool
 }
 
 // querySources is the ordered chain actionQuery walks; first source to claim
@@ -66,79 +97,85 @@ type querySource struct {
 // gate was never the bug. Adding a source (Kiwix, RSS, crawler, email) is one
 // line here plus its method; where you put the line is the whole decision.
 var querySources = []querySource{
-	{name: "fact-by-key", answer: (*reactiveHandler).queryFactByKey},
+	{name: "fact-by-key", answer: (*reactiveHandler).queryFactByKey, dest: router.SourceRecall},
 	// Before "calendar" on purpose: both match "…на сегодня", and the plan is
 	// the more specific ask (its matcher requires a plan word), so the calendar
 	// listing would otherwise swallow it.
-	{name: "day-plan", answer: (*reactiveHandler).queryDayPlan},
+	{name: "day-plan", answer: (*reactiveHandler).queryDayPlan, dest: router.SourceCalendar},
 	// Also before "calendar": "что я обычно делаю по средам?" names a weekday,
 	// and the habit question is the more specific one. Its matcher requires a
 	// habit marker ("обычно", "каждый", …), so a question about this coming
 	// Wednesday still reaches the calendar.
-	{name: "habits", answer: (*reactiveHandler).queryHabits},
+	{name: "habits", answer: (*reactiveHandler).queryHabits, dest: router.SourceCalendar},
 	// Before "calendar" and before the recall sources: "что мне нужно
 	// сделать?" is a question about the task list, and the notes pass would
 	// otherwise answer it with whatever note happens to be nearest. Its
 	// matcher requires a task noun or an explicit "что … сделать", so a
 	// date-bearing question still reaches the calendar.
-	{name: "tasks", answer: (*reactiveHandler).queryTasks},
+	{name: "tasks", answer: (*reactiveHandler).queryTasks, dest: router.SourceTasks},
 	// Next to "tasks" and for the same reason: "что требует внимания?" is a
 	// question about the operational state Praxis holds, and it used to fall
 	// through every source to the web search (Vikunja #475). Its matcher needs
 	// an attention marker, and it falls through when Praxis is not configured.
-	{name: "attention", answer: (*reactiveHandler).queryAttention},
-	// Before the recall sources too: "сколько я потратил?" is a question about
-	// the money facts the poller wrote, and the notes pass would otherwise
-	// answer it from whatever he once said about spending. Its matcher needs a
-	// money noun plus an actual ask, so "я потратил весь день" is untouched.
+	{name: "attention", answer: (*reactiveHandler).queryAttention, dest: router.SourceAttention, guesses: true},
 	// Next to "tasks" and for the same reason: "что мне купить?" is a question
 	// about the shopping list, and the recall pass would otherwise answer it
 	// from an old note about the shop. Its matcher needs an explicit list
 	// marker, so "надо бы съездить в магазин" is untouched.
-	{name: "list", answer: (*reactiveHandler).queryList},
-	{name: "money", answer: (*reactiveHandler).queryMoney},
+	{name: "list", answer: (*reactiveHandler).queryList, dest: router.SourceList, guesses: true},
+	// Before the recall sources too: "сколько я потратил?" is a question about
+	// the money facts the poller wrote, and the notes pass would otherwise
+	// answer it from whatever he once said about spending. Its matcher needs a
+	// money noun plus an actual ask, so "я потратил весь день" is untouched.
+	{name: "money", answer: (*reactiveHandler).queryMoney, dest: router.SourceMoney},
 	// Also above the recall sources: "что я тебе говорил?" is a question about
 	// the facts he tapped in, and the notes pass would answer it with whatever
 	// note is nearest (Vikunja #456). Its matcher needs both halves of a
 	// history phrase and bails out when he names a topic, so "что я говорил
 	// про сервер" is still recall.
-	{name: "history", answer: (*reactiveHandler).queryHistory},
+	{name: "history", answer: (*reactiveHandler).queryHistory, dest: router.SourceRecall},
 	// Before the recall sources and before general knowledge: "что нового?" is
 	// a question about the feeds she reads, and general knowledge would answer
 	// it by inventing news. Its matcher needs a feed noun plus an ask, so
 	// "у меня новая лента в инстаграме" is untouched.
-	{name: "feeds", answer: (*reactiveHandler).queryFeeds},
+	{name: "feeds", answer: (*reactiveHandler).queryFeeds, dest: router.SourceFeeds, guesses: true},
 	// Before "calendar" and before the recall sources: "что включено дома?" is
 	// a question about the house, and the notes pass would otherwise answer it
 	// from whatever he once said about the lights. Its matcher needs a house
 	// marker plus an ask plus a device word, and it bails out on weather
 	// wording, so "какая температура на улице?" still reaches the weather
 	// source.
-	{name: "home", answer: (*reactiveHandler).queryHome},
+	{name: "home", answer: (*reactiveHandler).queryHome, dest: router.SourceHome, guesses: true},
 	// Next to "home" and for the same reason: "какие устройства в сети?" is a
 	// question about the LAN, and the recall pass would otherwise answer it
 	// from an old note about the router. Its matcher needs a network word plus
 	// an ask plus a device noun, so "интернет не работает" is untouched.
-	{name: "network", answer: (*reactiveHandler).queryNetwork},
-	{name: "calendar", answer: (*reactiveHandler).queryCalendar, dateAware: true},
-	{name: "weather", answer: (*reactiveHandler).queryWeather},
-	{name: "embed", answer: (*reactiveHandler).queryEmbed},
-	{name: "memory", answer: (*reactiveHandler).queryMemory},
-	{name: "notes", answer: (*reactiveHandler).queryNotes},
+	{name: "network", answer: (*reactiveHandler).queryNetwork, dest: router.SourceNetwork, guesses: true},
+	{name: "calendar", answer: (*reactiveHandler).queryCalendar, dateAware: true, dest: router.SourceCalendar},
+	{name: "weather", answer: (*reactiveHandler).queryWeather, dest: router.SourceWeather, guesses: true},
+	// A question about her, above the three sources that search his own data
+	// (Vikunja #555). It has no answer anywhere else: below the boundary
+	// SearXNG answers about somebody else's assistant, and above it his notes
+	// answer by proximity — "кто ты" came back from a note of his, measured on
+	// the box, because the recall index has no idea the subject is her.
+	{name: "self", answer: (*reactiveHandler).querySelf, dest: router.SourceSelf, guesses: true},
+	{name: "embed", answer: (*reactiveHandler).queryEmbed, dest: router.SourceRecall},
+	{name: "memory", answer: (*reactiveHandler).queryMemory, dest: router.SourceRecall},
+	{name: "notes", answer: (*reactiveHandler).queryNotes, dest: router.SourceRecall},
 	// THE BOUNDARY. Everything above answers from his own data; everything
 	// below answers from the world's. A question about him that got this far
 	// has no answer in his data, and no outside source can supply one, so this
 	// stops the walk rather than let the encyclopedia and the model guess.
-	{name: "personal", answer: (*reactiveHandler).queryPersonal},
+	{name: "personal", answer: (*reactiveHandler).queryPersonal, dest: router.SourceRecall, guesses: true, boundary: true},
 	// The world, read live. Owner's ruling of 2026-08-02: a metasearch hit beats
 	// a frozen ZIM, so SearXNG asks before Kiwix does. Nothing of his is at
 	// stake by this point — the boundary above already stopped every question
 	// about him, and only the query string leaves the box.
-	{name: "search", answer: (*reactiveHandler).querySearch},
+	{name: "search", answer: (*reactiveHandler).querySearch, dest: router.SourceWorld},
 	// The offline encyclopedia, now the fallback for when the line is down or
 	// the search comes back empty. It reads the way it always did; what changed
 	// is that it no longer gets first refusal on a world question.
-	{name: "kiwix", answer: (*reactiveHandler).queryKiwix},
+	{name: "kiwix", answer: (*reactiveHandler).queryKiwix, dest: router.SourceWorld},
 	// LAST before the model answers from memory, and that position is the whole
 	// design (Vikunja #259): everything of his, then the search, then the ZIMs,
 	// and only then a page he named. The model does NOT come first: it
@@ -146,14 +183,70 @@ var querySources = []querySource{
 	// a 1.7B guessing at a page it cannot read is how contents get invented.
 	// This source only claims a turn where he named a URL, so it never competes
 	// with a local answer.
-	{name: "web", answer: (*reactiveHandler).queryWeb},
-	{name: "general-knowledge", answer: (*reactiveHandler).queryGeneral},
+	{name: "web", answer: (*reactiveHandler).queryWeb, dest: router.SourceWorld},
+	{name: "general-knowledge", answer: (*reactiveHandler).queryGeneral, dest: router.SourceWorld},
+}
+
+// queryWalk narrows the chain for one turn against the destination the cascade
+// named, and says which sources were left out (V-655).
+//
+// It takes sources OUT and never moves one, which is the whole safety argument.
+// The table's order is load-bearing and every comment on it argues a reason
+// between two sources; none of those reasons is about this. Above all, the
+// order carries "his data first, then the world", and a destination named by a
+// model must not be able to reverse that. Naming SourceWorld does not send the
+// turn outside — it stops the guessers from claiming it on the way.
+//
+// What comes out is exactly the sources that guess. Those decide whether a turn
+// is theirs by scoring it against frozen seeds, and then answer whatever they
+// claimed, because they have no lookup that can come back empty. That is the
+// whole of the 2026-08-07 defect: weather claiming "что такое TCP?", the feed
+// claiming "какой у меня любимый язык?", the personal boundary claiming "кто
+// такой Линус Торвальдс?". The sources that look are all still asked, so a
+// wrong destination costs nothing but the guess it prevented.
+//
+// No destination named ⇒ the table exactly as written, which is what shipped
+// before the field existed. That is the floor. The classifier arm names
+// nothing, so a box whose model is down routes queries the way it always did.
+// The personal boundary is the one exception, and anchored is what buys it
+// (V-666). A grammar matched a literal pattern to name the destination. The
+// routing heads and the resident model inferred one, and an inferred SourceWorld
+// takes the boundary off a question about him. That widens what is asked
+// upstream rather than costing a local answer, so those two keep it.
+func queryWalk(dest router.Source, anchored bool) (walk, skipped []querySource) {
+	if dest == router.SourceUnknown {
+		return querySources, nil
+	}
+	for _, s := range querySources {
+		if s.guesses && s.dest != dest && (anchored || !s.boundary) {
+			skipped = append(skipped, s)
+			continue
+		}
+		walk = append(walk, s)
+	}
+	return walk, skipped
 }
 
 func (h *reactiveHandler) actionQuery(ctx context.Context, dec router.Decision) string {
 	t := &queryTurn{dec: dec}
-	for _, src := range querySources {
+	// The roster, so the record can say which sources were never reached rather
+	// than leaving them out and letting a reader assume they looked and passed
+	// (V-564). Finish names everyone below the winner.
+	decision.Expect(ctx, decision.StageQuery, querySourceNames())
+	rec := decision.From(ctx)
+	walk, skipped := queryWalk(dec.Source, dec.SourceAnchored)
+	for _, src := range skipped {
+		rec.Note(decision.Claim{
+			Stage: decision.StageQuery, Claimant: src.name, Outcome: decision.NeverAsked,
+			Reason: "it decides by similarity and the cascade named " + string(dec.Source),
+		})
+	}
+	for _, src := range walk {
 		if dec.Continued && !src.dateAware {
+			rec.Note(decision.Claim{
+				Stage: decision.StageQuery, Claimant: src.name, Outcome: decision.NeverAsked,
+				Reason: "a continuation turn only asks the date-aware sources",
+			})
 			continue
 		}
 		if reply, ok := src.answer(h, ctx, t); ok {
@@ -166,8 +259,16 @@ func (h *reactiveHandler) actionQuery(ctx context.Context, dec router.Decision)
 			// caller asked for one, so /chat can show it (V-539).
 			log.Printf("voice: query claimed by source %q", src.name)
 			noteQuerySource(ctx, src.name)
+			rec.Note(decision.Claim{
+				Stage: decision.StageQuery, Claimant: src.name,
+				Intent: string(dec.Intent), Outcome: decision.Won,
+			})
 			return reply
 		}
+		rec.Note(decision.Claim{
+			Stage: decision.StageQuery, Claimant: src.name, Outcome: decision.Declined,
+			Reason: "it had no answer for this turn",
+		})
 	}
 	if dec.Continued {
 		// The previous question cannot be re-asked for another day. Saying so
@@ -211,7 +312,13 @@ func (h *reactiveHandler) queryFactByKey(ctx context.Context, t *queryTurn) (str
 //
 // Read-only by construction — the plan is assembled and rendered core-side and
 // nothing here schedules or announces. "что дальше?" asks for the rest of the
-// day, so that phrasing trims what has already passed.
+// day, so that phrasing trims what has already passed and reads only the next
+// morning.NextSpoken entries. Trimming alone was not enough: asked early it cuts
+// nothing, and she read 43 entries aloud in one sentence (V-618).
+//
+// "что у меня сегодня?" is a different question and is not narrowed here — it
+// carries no plan word, so IsDayPlanQuery declines it and the calendar source
+// answers the whole day.
 //
 // What surface this belongs on is still open, tracked as Vikunja #431 ("Board
 // surface: Maven holds the work board, runs the intake form, never argues").
@@ -230,16 +337,23 @@ func (h *reactiveHandler) queryDayPlan(ctx context.Context, t *queryTurn) (strin
 	}
 	// Rebuild the pure plan so the rest-of-day rendering is the same code that
 	// rendered the whole day — one formatter, one persona.
-	p := morning.Plan{Date: plan.Date}
+	//
+	// The instants are put back in the asking clock's zone on the way in. They
+	// arrive carrying whatever zone the core read them in — a calendar fact's Ts
+	// and a reminder's FireTs are UTC out of the store — and FormatRU reads the
+	// hours in the plan's own frame, so setting that frame here is what makes
+	// the recital name his clock rather than the store's (V-614).
+	zone := h.now().Location()
+	p := morning.Plan{Date: plan.Date.In(zone)}
 	for _, it := range plan.Items {
 		p.Items = append(p.Items, morning.PlanEntry{
-			At:        it.At,
+			At:        it.At.In(zone),
 			Text:      it.Text,
 			Kind:      morning.PlanKind(it.Kind),
 			Uncertain: it.Uncertain,
 		})
 	}
-	return p.After(h.now()).FormatRU(), true
+	return p.Next(h.now(), morning.NextSpoken).FormatRU(), true
 }
 
 // habitFactWindow — how many recent SELF facts the behaviour profile is counted
@@ -292,6 +406,14 @@ const (
 	feedReadOut    = 3
 )
 
+// feedFloor — the keyword test behind topicFeed, in the one-string shape
+// turnIsAbout takes. router.ParseFeedQuery returns the category too, which the
+// gate has no use for; the caller reads it separately.
+func feedFloor(u string) bool {
+	_, ok := router.ParseFeedQuery(u)
+	return ok
+}
+
 // queryFeeds — "что нового в лентах?", "что нового по технологиям?"
 // (Vikunja #258).
 //
@@ -299,10 +421,13 @@ const (
 // never speaks; asking is the trigger. If that ever changes, the thing that
 // changed is "Maven is not a nag", not a detail of this file.
 func (h *reactiveHandler) queryFeeds(ctx context.Context, t *queryTurn) (string, bool) {
-	q, ok := router.ParseFeedQuery(t.dec.Utterance)
-	if !ok {
+	// The seeds decide the subject; router.ParseFeedQuery is the floor behind
+	// them (V-522). The category still comes from the utterance either way,
+	// because a topic is marked by a preposition and needs no recogniser.
+	if !h.turnIsAbout(ctx, t, topicFeed, feedFloor) {
 		return "", false
 	}
+	category := router.FeedCategoryOf(t.dec.Utterance)
 	if !h.feedsOn {
 		// Claim only when nothing below can read the world. The reason this
 		// source used to claim unconditionally was that general knowledge would
@@ -327,7 +452,7 @@ func (h *reactiveHandler) queryFeeds(ctx context.Context, t *queryTurn) (string,
 	}
 	var picked []string
 	for _, n := range notes {
-		if !router.CategoryMatches(rss.NoteCategory(n.Text), q.Category) {
+		if !router.CategoryMatches(rss.NoteCategory(n.Text), category) {
 			continue
 		}
 		// The note carries title, summary, category tag and link; she reads the
@@ -339,7 +464,7 @@ func (h *reactiveHandler) queryFeeds(ctx context.Context, t *queryTurn) (string,
 		}
 	}
 	if len(picked) == 0 {
-		if q.Category != "" {
+		if category != "" {
 			return phraser.Q(phraser.QueryFeedsTopic, nil), true
 		}
 		return phraser.Q(phraser.QueryFeedsEmpty, nil), true
@@ -360,6 +485,19 @@ func (h *reactiveHandler) queryCalendar(ctx context.Context, t *queryTurn) (stri
 	if isWeatherQuery(t.dec.Utterance) {
 		return "", false
 	}
+	// Weather was one instance of a wider class (Vikunja #552). Naming a day
+	// does not make a question his agenda: "какой сегодня курс доллара" and
+	// "во сколько закат сегодня" both answered "ничего нет", which reads as an
+	// answer about a subject she never looked at. All of them have an answer
+	// in search, and search sits below this source. So the question must ask
+	// about his schedule, not merely name a day.
+	//
+	// A continuation is exempt. "а завтра?" names no agenda and cannot: the
+	// subject was in the turn before it, and this is the only date-aware
+	// source there is.
+	if !t.dec.Continued && !router.IsAgendaQuestion(t.dec.Utterance) {
+		return "", false
+	}
 	date, ok := router.ParseCalendarDate(t.dec.Utterance, h.now())
 	if !ok {
 		return "", false
@@ -380,6 +518,10 @@ func (h *reactiveHandler) queryCalendar(ctx context.Context, t *queryTurn) (stri
 	return f.FormatEntries(entries, date), true
 }
 
+// homeTimeout — the whole house read. Longer than the weather call because the
+// hub is polled over the LAN and answers for every device at once.
+const homeTimeout = 10 * time.Second
+
 // queryHome answers a question about the house. Read-only by construction: it
 // calls States and nothing else, so there is no confirm turn here — the only
 // way to CHANGE something is an enabled allowlist row through tool.Executor.
@@ -396,7 +538,7 @@ func (h *reactiveHandler) queryHome(ctx context.Context, t *queryTurn) (string,
 		// unreachable case is different and homeSummary covers it.
 		return "", false
 	}
-	ctxH, cancel := context.WithTimeout(ctx, 10*time.Second)
+	ctxH, cancel := context.WithTimeout(ctx, homeTimeout)
 	defer cancel()
 	return h.home.homeSummary(ctxH)
 }
@@ -420,6 +562,10 @@ func (h *reactiveHandler) queryNetwork(ctx context.Context, t *queryTurn) (strin
 	return h.netscan.scanSummary(ctx)
 }
 
+// weatherTimeout — one geocode plus one forecast read. He asked a question with
+// a one-line answer, so a provider that is slower than this is a failure.
+const weatherTimeout = 5 * time.Second
+
 func (h *reactiveHandler) queryWeather(ctx context.Context, t *queryTurn) (string, bool) {
 	if !h.turnIsAbout(ctx, t, topicWeather, isWeatherQuery) {
 		return "", false
@@ -430,7 +576,7 @@ func (h *reactiveHandler) queryWeather(ctx context.Context, t *queryTurn) (strin
 		// so is the only honest answer; picking a city would be inventing one.
 		return phraser.Q(phraser.QueryWeatherWhere, nil), true
 	}
-	ctxWT, cancel := context.WithTimeout(ctx, 5*time.Second)
+	ctxWT, cancel := context.WithTimeout(ctx, weatherTimeout)
 	defer cancel()
 	w, err := h.weatherProvider.CurrentWeather(ctxWT, loc)
 	if errors.Is(err, weather.ErrNotConfigured) {
@@ -455,17 +601,53 @@ func (h *reactiveHandler) queryWeather(ctx context.Context, t *queryTurn) (strin
 
 // queryEmbed isn't an answer source — it's the shared cost the two recall
 // sources below both need, run once, in the position it always ran in. It
-// only claims the turn when the embedder fails.
+// never claims the turn.
+//
+// It used to claim on an embedder error, and that made a RAG hint a hard gate
+// over everything below it (V-568): one failing EmbedQuery and the memory, the
+// notes, the boundary, the search, the ZIMs, the named page and the model all
+// answered "не смогла ответить", including the questions search and Kiwix
+// would have answered without ever touching the embedder. A failed embed means
+// this source cannot claim, not that the turn is over — same shape as
+// turnVector in topics.go, which had it right.
 func (h *reactiveHandler) queryEmbed(ctx context.Context, t *queryTurn) (string, bool) {
+	// A topic source above already paid for this one; see turnVector.
+	if len(t.vec) > 0 {
+		return "", false
+	}
 	vec, err := router.EmbedQuery(ctx, h.recall.embedder, t.dec.Utterance)
 	if err != nil {
+		// Logged once, here, and the chain walks on. The two recall sources
+		// below read the empty vector and pass; the boundary drops to its
+		// offline floor.
 		log.Printf("voice: embed query: %v", err)
-		return phraser.Q(phraser.QueryFailAnswer, nil), true
+		return "", false
 	}
 	t.vec = vec
 	return "", false
 }
 
+// memoryRecallWidth and noteRecallWidth — how many candidates each recall pass
+// pulls before the gate reads them. Both are small on purpose: the gate wants a
+// best hit and its runner-up, and every further row is a margin the top match
+// has to beat.
+const (
+	memoryRecallWidth = 3
+	noteRecallWidth   = 5
+)
+
+// recallOnTopic — the topic veto both recall sources apply after the score gate
+// (#470). A memory about his slow network scored high enough to answer "почему
+// небо синее?", because the right-note and must-be-silent score ranges overlap
+// and no threshold sits between them.
+func recallOnTopic(utterance, text string) bool {
+	if memory.RecallAllowed(utterance, text) {
+		return true
+	}
+	log.Printf("voice: recall %q rejected for %q: a world question and no shared topic word", text, utterance)
+	return false
+}
+
 // queryMemory — long-term memory first: ONE search over everything Maven
 // remembers (notes and facts share this index) and ONE confidence gate, so
 // the memory that is clearly the best match answers — a note just as much as
@@ -480,7 +662,13 @@ func (h *reactiveHandler) queryMemory(ctx context.Context, t *queryTurn) (string
 	if h.recall.memStore == nil {
 		return "", false
 	}
-	hits, herr := h.recall.memStore.Search(ctx, t.vec, 3)
+	if len(t.vec) == 0 {
+		// No query vector: the embed above failed or there is no embedder.
+		// Searching on an empty vector is not a search, and its scores are not
+		// a "there is nothing" answer — pass rather than gate the chain.
+		return "", false
+	}
+	hits, herr := h.recall.memStore.Search(ctx, t.vec, memoryRecallWidth)
 	if herr != nil {
 		log.Printf("voice: memory search: %v", herr)
 		return "", false
@@ -490,12 +678,8 @@ func (h *reactiveHandler) queryMemory(ctx context.Context, t *queryTurn) (string
 		return "", false
 	}
 	text := hit.Meta["text"]
-	// The score cleared the gate and the topic still has to match (#470). A
-	// note about his slow network scored high enough to answer "почему небо
-	// синее?", because the right-note and must-be-silent score ranges overlap
-	// and no threshold sits between them.
-	if !memory.RecallAllowed(t.dec.Utterance, text) {
-		log.Printf("voice: recall %q rejected for %q: a world question and no shared topic word", text, t.dec.Utterance)
+	// The score cleared the gate and the topic still has to match.
+	if !recallOnTopic(t.dec.Utterance, text) {
 		return "", false
 	}
 	// A note is phrased in Maven's voice; a fact is read back as it was
@@ -526,10 +710,18 @@ func (h *reactiveHandler) queryMemory(ctx context.Context, t *queryTurn) (string
 // band. See memory.Confident. Failing the gate passes the turn on to general
 // knowledge, which is what "don't read back the runner-up" means here.
 func (h *reactiveHandler) queryNotes(ctx context.Context, t *queryTurn) (string, bool) {
-	notes, err := h.api.QueryNotes(ctx, t.vec, 5)
+	if len(t.vec) == 0 {
+		// Same reason as queryMemory above (V-568): with no query vector this
+		// source could not look, and could-not-look passes.
+		return "", false
+	}
+	notes, err := h.api.QueryNotes(ctx, t.vec, noteRecallWidth)
 	if err != nil {
+		// The store failed, so this source could not look either. It used to
+		// claim here, which stopped the search, the ZIMs and the model from
+		// answering a question that never needed a note (V-568).
 		log.Printf("voice: query notes: %v", err)
-		return phraser.Q(phraser.QueryFailAnswer, nil), true
+		return "", false
 	}
 	t.notes = notes
 	noteScores := make([]float64, len(notes))
@@ -539,10 +731,9 @@ func (h *reactiveHandler) queryNotes(ctx context.Context, t *queryTurn) (string,
 	if !memory.ConfidentScores(noteScores, h.recall.minScore, h.recall.minMargin) {
 		return "", false
 	}
-	// Same topic veto as queryMemory above: the best note must be about what
-	// he asked, not merely the nearest vector in the index.
-	if !memory.RecallAllowed(t.dec.Utterance, notes[0].Text) {
-		log.Printf("voice: note %q rejected for %q: a world question and no shared topic word", notes[0].Text, t.dec.Utterance)
+	// The best note must be about what he asked, not merely the nearest vector
+	// in the index.
+	if !recallOnTopic(t.dec.Utterance, notes[0].Text) {
 		return "", false
 	}
 	texts := make([]string, len(notes))
@@ -564,6 +755,23 @@ func (h *reactiveHandler) queryNotes(ctx context.Context, t *queryTurn) (string,
 // prompt, the persona block and the reply.
 const webPageContextRunes = 1500
 
+// webFetchTimeout — the whole named-page source. Longer than the other outside
+// sources because he named this page himself, so waiting for it is what he asked
+// for, and there is nothing below that can answer instead.
+const webFetchTimeout = 30 * time.Second
+
+// readBackRunes — how much of the evidence is read out when the phraser gave
+// nothing back. It is spoken aloud, so it is a couple of sentences and not a
+// page.
+const readBackRunes = 300
+
+// readBack — what an outside source says when the phraser gave nothing back.
+// The evidence is read out plainly rather than dropped, because the fetch did
+// happen and its result is a better answer than silence.
+func readBack(evidence string) string {
+	return phraser.Q(phraser.QueryFound, map[string]string{"text": crawl.TrimRunes(evidence, readBackRunes)})
+}
+
 // queryWeb — "посмотри https://example.org/x — что там?" (Vikunja #259).
 //
 // It claims a turn ONLY when he named a URL, which is what keeps a fallback from
@@ -582,7 +790,7 @@ func (h *reactiveHandler) queryWeb(ctx context.Context, t *queryTurn) (string, b
 		// guess dressed as an answer (Vikunja #479).
 		return phraser.Q(phraser.QueryPageOff, nil), true
 	}
-	ctxFetch, cancel := context.WithTimeout(ctx, 30*time.Second)
+	ctxFetch, cancel := context.WithTimeout(ctx, webFetchTimeout)
 	defer cancel()
 	page, err := h.crawler.Page(ctxFetch, link)
 	if err != nil {
@@ -603,7 +811,7 @@ func (h *reactiveHandler) queryWeb(ctx context.Context, t *queryTurn) (string, b
 	if reply == "" {
 		// No phraser (or it failed): read back the top of the page rather than
 		// pretend the fetch did not happen.
-		return phraser.Q(phraser.QueryPageText, map[string]string{"text": crawl.TrimRunes(page.Text, 300)}), true
+		return phraser.Q(phraser.QueryPageText, map[string]string{"text": crawl.TrimRunes(page.Text, readBackRunes)}), true
 	}
 	return reply, true
 }
@@ -669,7 +877,7 @@ func (h *reactiveHandler) querySearch(ctx context.Context, t *queryTurn) (string
 	if reply == "" {
 		// No phraser, or it failed. Read back the best evidence rather than
 		// pretend the search did not happen.
-		return phraser.Q(phraser.QueryFound, map[string]string{"text": crawl.TrimRunes(resp.Snippets()[0], 300)}), true
+		return readBack(resp.Snippets()[0]), true
 	}
 	return reply, true
 }
@@ -719,6 +927,28 @@ func (h *reactiveHandler) queryKiwix(ctx context.Context, t *queryTurn) (string,
 		}
 	}
 
+	// The topic, not the sentence (V-668). Kiwix ranks by keyword overlap, so
+	// the question words outrank the one word that names the article: measured
+	// on 2026-08-09, "что такое TCP" returns "Перехват TCP-соединения" and
+	// "TCP" returns TCP. Only the verbatim path needs this. The rewriter
+	// already reduces a question to English keywords, and reducing twice would
+	// take the topic off the input it reads.
+	if verbatim {
+		if topic := kiwix.Topic(pattern); topic != "" {
+			// The article named exactly, before any ranking runs. A ZIM is
+			// addressable by title and a wrong title is a 404, so this either
+			// answers or costs one request that says nothing.
+			for _, cand := range kiwix.TitleCandidates(topic) {
+				page, err := h.kiwix.client.Article(ctxK, kiwix.TitlePath(book, cand), h.kiwix.runes)
+				if err == nil && page.Text != "" {
+					log.Printf("voice: kiwix: %q in %q → title hit %q", topic, book, page.Title)
+					return h.kiwixReply(ctx, t, page.Title, page.Text)
+				}
+			}
+			pattern = topic
+		}
+	}
+
 	hits, err := h.kiwix.client.Search(ctxK, pattern, book, h.kiwix.max)
 	if err != nil {
 		log.Printf("voice: kiwix: search %q: %v", pattern, err)
@@ -751,14 +981,18 @@ func (h *reactiveHandler) queryKiwix(ctx context.Context, t *queryTurn) (string,
 		}
 		page = crawl.Page{Title: top.Title, Text: top.Snippet}
 	}
-	// Handed over the same way a note or a page is: context for the question he
-	// asked, not something to recite.
-	snippet := top.Title + "\n" + crawl.TrimRunes(page.Text, h.kiwix.runes)
+	return h.kiwixReply(ctx, t, top.Title, page.Text)
+}
+
+// kiwixReply hands one article over the same way a note or a page is handed
+// over: context for the question he asked, not something to recite.
+func (h *reactiveHandler) kiwixReply(ctx context.Context, t *queryTurn, title, text string) (string, bool) {
+	snippet := title + "\n" + crawl.TrimRunes(text, h.kiwix.runes)
 	reply := h.phraseSource(ctx, "kiwix", t.dec.Utterance, []string{snippet})
 	if reply == "" {
 		// No phraser, or it failed. Read back the best hit rather than pretend
 		// the search did not happen.
-		return phraser.Q(phraser.QueryFound, map[string]string{"text": crawl.TrimRunes(top.Title+" — "+page.Text, 300)}), true
+		return readBack(title + " — " + text), true
 	}
 	return reply, true
 }

cmd/mavend/actions_reminder.go

@@ -19,7 +19,10 @@ func (h *reactiveHandler) actionReminder(ctx context.Context, dec router.Decisio
 		// time wasn't parsed. Run the parser as a fallback.
 		if dec.Stage == 0 && h.timeParser != nil {
 			t, ok, err := h.timeParser.Parse(ctx, dec.Utterance, h.now())
-			if err == nil && ok {
+			// Same gate as the extractor (V-577, V-579, V-610): a request whose
+			// hour was not spoken, or was spoken and not read, gets asked about
+			// and is never completed from the clock.
+			if err == nil && ok && router.ResolvedTheHour(dec.Utterance, t) {
 				dec.Slots.Time = t
 				dec.Slots.HasTime = true
 			}

cmd/mavend/actions_task.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"log"
+	"strings"
 
 	"github.com/kami/maven/internal/dialogue"
 	"github.com/kami/maven/internal/ipc"
@@ -81,7 +82,95 @@ func (h *reactiveHandler) queryTasks(ctx context.Context, t *queryTurn) (string,
 		cands = append(cands, dialogue.Candidate{Kind: "task", Ref: r.ID, Label: r.Text})
 	}
 	h.offerCandidates(ctx, cands)
-	return tasks.FormatRU(ranked), true
+	reply := tasks.FormatRU(ranked)
+	// The counted shapes, after the list and only when there are any (V-512).
+	// They answer "what is going wrong with this list" without assessing any of
+	// it, and they are said here rather than announced: no tick rule reads them.
+	if stalls := tasks.StallsRU(tasks.Stalls(taskItems(live), h.now())); stalls != "" {
+		if !strings.HasSuffix(reply, ".") {
+			reply += "."
+		}
+		reply += " " + stalls
+	}
+	return reply, true
+}
+
+// resolveTaskStatus moves a task he named out loud (Vikunja #512).
+//
+// The position path already worked: resolveCandidate answers "первую сделал"
+// against the list she just read. This is the other half — naming the task
+// instead of its position, which reached no code at all before the stage-0 rule
+// in internal/router/taskstatus.go filled the fn slot.
+//
+// Three answers besides the move, and none of them guesses. No match says so. A
+// match on more than one asks which, because closing the wrong task is work he
+// never finished being marked done. No task named asks which too, since the
+// router claims the turn without the referent and the list lives here.
+func (h *reactiveHandler) resolveTaskStatus(ctx context.Context, dec router.Decision) string {
+	live, err := h.api.ListTasks(ctx, "live")
+	if err != nil {
+		log.Printf("voice: task status: list: %v", err)
+		return "не получилось посмотреть задачи."
+	}
+	if dec.Slots.Text == "" {
+		return "какую задачу?"
+	}
+	match := matchTaskText(live, dec.Slots.Text)
+	switch len(match) {
+	case 0:
+		return "не нашла такой задачи."
+	case 1:
+	default:
+		return "у тебя несколько подходящих — какую именно?"
+	}
+	pick := match[0]
+	status := dec.Slots.Value
+	// A candidate is work Maven proposed and he never confirmed, and the store
+	// refuses candidate → done: the legal move is to open it first. Saying it is
+	// done IS the confirmation, so both writes happen rather than the turn
+	// naming a gap about a distinction he did not make.
+	if pick.Status == store.TaskCandidate && status == store.TaskDone {
+		if err := h.api.SetTaskStatus(ctx, pick.ID, store.TaskOpen, h.now(), string(sourceVoice)); err != nil {
+			log.Printf("voice: task status: promote %d: %v", pick.ID, err)
+			return "не получилось изменить задачу."
+		}
+	}
+	if err := h.api.SetTaskStatus(ctx, pick.ID, status, h.now(), string(sourceVoice)); err != nil {
+		log.Printf("voice: task status: %d → %s: %v", pick.ID, status, err)
+		return "не получилось изменить задачу."
+	}
+	log.Printf("voice: task %d (%q) → %s", pick.ID, pick.Text, status)
+	if status == store.TaskDropped {
+		return "убрала: " + pick.Text
+	}
+	return "закрыла: " + pick.Text
+}
+
+// matchTaskText finds the live tasks he could have meant.
+//
+// Normalised containment, either direction, over store.NormalizeTaskText — the
+// same key capture dedupes on, so a task he can file twice is a task he can name
+// twice. Either direction because he shortens what he said ("молоко" for
+// "купить молоко") as often as he pads it.
+//
+// Deliberately not fuzzy. A ranked best guess would always return exactly one
+// answer, and the one thing this must be able to say is that it is not sure.
+func matchTaskText(live []ipc.Task, named string) []ipc.Task {
+	want := store.NormalizeTaskText(named)
+	if want == "" {
+		return nil
+	}
+	var out []ipc.Task
+	for _, t := range live {
+		have := store.NormalizeTaskText(t.Text)
+		if have == "" {
+			continue
+		}
+		if strings.Contains(have, want) || strings.Contains(want, have) {
+			out = append(out, t)
+		}
+	}
+	return out
 }
 
 // taskItems maps wire rows onto the ranker's input. Written here rather than in

cmd/mavend/actions_task_test.go

@@ -26,6 +26,9 @@ type taskAPI struct {
 	tasks   []ipc.Task
 	listArg string
 	listErr error
+
+	moved   []setStatusCall
+	moveErr error
 }
 
 func (a *taskAPI) CaptureTask(_ context.Context, req ipc.CaptureTaskReq) (ipc.CaptureTaskResp, error) {
@@ -253,3 +256,87 @@ func TestCaptureTaskFromNoteAcknowledgesAPromotion(t *testing.T) {
 		}
 	}
 }
+
+// setStatusCall — one SetTaskStatus the arm made, in order, so a candidate he
+// says is done can be shown to take both legal moves.
+type setStatusCall struct {
+	id     int64
+	status string
+	by     string
+}
+
+func (a *taskAPI) SetTaskStatus(_ context.Context, id int64, status string, _ time.Time, by string) error {
+	a.moved = append(a.moved, setStatusCall{id: id, status: status, by: by})
+	return a.moveErr
+}
+
+func TestResolveTaskStatusMovesTheNamedTask(t *testing.T) {
+	api := &taskAPI{tasks: []ipc.Task{
+		{ID: 7, Text: "купить молоко", Status: "open"},
+		{ID: 8, Text: "оплатить интернет", Status: "open"},
+	}}
+	h := taskHandler(api)
+	reply := h.resolveTaskStatus(context.Background(), router.Decision{
+		Intent: router.IntentAct,
+		Slots:  router.Slots{Fn: router.TaskStatusFn, HasFn: true, Value: "done", Text: "молоко"},
+	})
+	if api.listArg != "live" {
+		t.Errorf("listed %q, want live — a resolved task cannot be resolved again", api.listArg)
+	}
+	if len(api.moved) != 1 {
+		t.Fatalf("moved %d tasks, want 1: %+v", len(api.moved), api.moved)
+	}
+	if api.moved[0].id != 7 || api.moved[0].status != "done" {
+		t.Errorf("moved %+v, want id 7 → done", api.moved[0])
+	}
+	if !strings.Contains(reply, "купить молоко") {
+		t.Errorf("reply = %q, want the task named back", reply)
+	}
+}
+
+func TestResolveTaskStatusRefusesToGuess(t *testing.T) {
+	cases := []struct {
+		name  string
+		tasks []ipc.Task
+		named string
+		want  string
+	}{
+		{"no match", []ipc.Task{{ID: 7, Text: "купить молоко", Status: "open"}}, "позвонить маме", "не нашла"},
+		{"two matches", []ipc.Task{
+			{ID: 7, Text: "купить молоко", Status: "open"},
+			{ID: 8, Text: "купить молоко и хлеб", Status: "open"},
+		}, "купить молоко", "несколько"},
+		{"none named", []ipc.Task{{ID: 7, Text: "купить молоко", Status: "open"}}, "", "какую"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			api := &taskAPI{tasks: c.tasks}
+			h := taskHandler(api)
+			reply := h.resolveTaskStatus(context.Background(), router.Decision{
+				Slots: router.Slots{Fn: router.TaskStatusFn, HasFn: true, Value: "done", Text: c.named},
+			})
+			if len(api.moved) != 0 {
+				t.Errorf("moved %+v — closing the wrong task is the failure this arm exists to avoid", api.moved)
+			}
+			if !strings.Contains(reply, c.want) {
+				t.Errorf("reply = %q, want it to contain %q", reply, c.want)
+			}
+		})
+	}
+}
+
+func TestResolveTaskStatusOpensACandidateFirst(t *testing.T) {
+	// The store refuses candidate → done. Saying it is done is the confirmation
+	// the candidate was waiting for, so the arm makes both legal moves.
+	api := &taskAPI{tasks: []ipc.Task{{ID: 9, Text: "продлить домен", Status: "candidate"}}}
+	h := taskHandler(api)
+	h.resolveTaskStatus(context.Background(), router.Decision{
+		Slots: router.Slots{Fn: router.TaskStatusFn, HasFn: true, Value: "done", Text: "продлить домен"},
+	})
+	if len(api.moved) != 2 {
+		t.Fatalf("moved %+v, want open then done", api.moved)
+	}
+	if api.moved[0].status != "open" || api.moved[1].status != "done" {
+		t.Errorf("moved %+v, want open then done", api.moved)
+	}
+}

cmd/mavend/boot.go

@@ -0,0 +1,120 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"log"
+	"net"
+	"sync"
+	"time"
+
+	"github.com/kami/maven/internal/event"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/store"
+)
+
+// The two boot paths meet here. run() wires the daemon twice: once at boot
+// when a key is in the environment, and once inside UnlockFn after a passkey
+// assertion, minutes or days later. Listing the same wiring in both places is
+// what let them drift — seven workers started untracked on the unlock path and
+// two daemonAPI fields were never set there, silently, for as long as anyone
+// had been cold-starting (V-639).
+//
+// So both paths call newDaemonAPI and startBackground and nothing else. A
+// field or a worker added later reaches both paths or neither.
+
+// bootDeps is everything the two constructors below read. It is filled from
+// the same variables on both paths, by depsNow in run().
+type bootDeps struct {
+	coreFor    func() ipc.CoreAPI
+	tl         *tickLoop
+	evBus      *event.Bus
+	voiceW     *voiceWiring
+	st         *store.Store
+	factWorker *factEnrichmentWorker
+	evalWorker *memoryEvalWorker // nil ⇒ memory evaluation off (the default)
+	feedWkr    *feedWorker       // nil ⇒ no feed is read (the default)
+	crawlWkr   *crawlWorker      // nil ⇒ no page is watched (the default)
+}
+
+// newDaemonAPI builds the real CoreAPI, with every field set. The unlock path
+// used to leave nexus and getMCPServers nil, so after a cold start
+// ResolveEntity refused with a nexus block configured and /tools rendered
+// "not configured" with an mcp block configured. Empty is a wrong answer
+// there, not a degraded one.
+func newDaemonAPI(d bootDeps) *daemonAPI {
+	api := &daemonAPI{
+		CoreAPI:          d.coreFor(),
+		getTrace:         d.tl.trace,
+		getMorningStatus: func(ctx context.Context) []ipc.MorningRoutineStatus { return d.tl.morningStatus(ctx, time.Now()) },
+		getDayPlan:       func(ctx context.Context) ipc.DayPlan { return d.tl.dayPlan(ctx, time.Now()) },
+		getEvents:        intakeEventsFn(d.evBus),
+		getDecisions:     turnDecisionsFn(d.voiceW),
+		seedStore:        seedStoreIfAllowed(d.st),
+		nexus:            nexusOf(d.voiceW),
+	}
+	if d.voiceW != nil && d.voiceW.handler != nil {
+		api.chatFn = d.voiceW.handler.handleText
+		// And the reverse: the handler was wired with the bare store adapter,
+		// which cannot serve the day plan. See upgradeAPI.
+		d.voiceW.handler.upgradeAPI(api)
+	}
+	if d.voiceW != nil && d.voiceW.mcp != nil {
+		api.getMCPServers = d.voiceW.mcp.status
+	}
+	return api
+}
+
+// namedWorker is one long-running goroutine. The name exists so the set is
+// assertable from a test and readable in a log; nothing dispatches on it.
+type namedWorker struct {
+	name string
+	run  func(ctx context.Context)
+}
+
+// backgroundWorkers lists what this deployment runs. It is pure — it starts
+// nothing — so a test can compare the set the two paths would start without
+// standing a daemon up.
+func backgroundWorkers(d bootDeps) []namedWorker {
+	var ws []namedWorker
+	if d.voiceW != nil && d.voiceW.server != nil {
+		ws = append(ws, namedWorker{"voice", func(context.Context) {
+			if err := d.voiceW.server.Serve(); err != nil && !errors.Is(err, net.ErrClosed) {
+				log.Printf("voice serve: %v", err)
+			}
+		}})
+	}
+	ws = append(ws,
+		namedWorker{"tick", d.tl.run},
+		namedWorker{"fact-enrichment", d.factWorker.run},
+	)
+	if d.evalWorker != nil {
+		ws = append(ws, namedWorker{"memory-eval", d.evalWorker.run})
+	}
+	if d.feedWkr != nil {
+		ws = append(ws, namedWorker{"feed", d.feedWkr.run})
+	}
+	if d.crawlWkr != nil {
+		ws = append(ws, namedWorker{"crawl", d.crawlWkr.run})
+	}
+	if d.voiceW != nil && d.voiceW.mcp != nil {
+		ws = append(ws, namedWorker{"mcp", d.voiceW.mcp.run})
+	}
+	if d.voiceW != nil && d.voiceW.home != nil {
+		ws = append(ws, namedWorker{"home", d.voiceW.home.run})
+	}
+	return ws
+}
+
+// startBackground starts every worker through goWorker, so waitWorkers can
+// wait for it at shutdown. A worker started as a bare `go func()` is the
+// shutdown bug documented at the end of run(): run() never returns, the
+// deferred Close never seals the database, and the ciphertext goes stale.
+func startBackground(ctx context.Context, wg *sync.WaitGroup, d bootDeps) {
+	for _, w := range backgroundWorkers(d) {
+		goWorker(wg, func() { w.run(ctx) })
+	}
+	if d.voiceW != nil && d.voiceW.server != nil {
+		log.Printf("mavend: voice listening on %s", d.voiceW.server.Addr())
+	}
+}

cmd/mavend/boot_test.go

@@ -0,0 +1,96 @@
+package main
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/kami/maven/internal/decision"
+	"github.com/kami/maven/internal/event"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/store"
+	"github.com/kami/maven/internal/voice"
+)
+
+// fullDeps — a deployment with every optional piece present. Nothing here is
+// run: newDaemonAPI takes method values and backgroundWorkers is pure, so
+// zero-value wirings are enough to say what WOULD be started.
+func fullDeps() bootDeps {
+	h := &reactiveHandler{
+		ecosystem: &ecosystemWiring{nexus: &nexusClient{}},
+		decisions: decision.NewRing(),
+	}
+	return bootDeps{
+		coreFor:    func() ipc.CoreAPI { return ipc.UnimplementedCoreAPI{} },
+		tl:         &tickLoop{},
+		evBus:      event.NewBus(4),
+		st:         &store.Store{},
+		factWorker: &factEnrichmentWorker{},
+		evalWorker: &memoryEvalWorker{},
+		feedWkr:    &feedWorker{},
+		crawlWkr:   &crawlWorker{},
+		voiceW: &voiceWiring{
+			server:  &voice.Server{},
+			handler: h,
+			mcp:     &mcpWiring{},
+			home:    &homeWiring{},
+		},
+	}
+}
+
+// The unlock path used to build its own daemonAPI literal and leave nexus and
+// getMCPServers nil (V-639). Both paths call newDaemonAPI now, so the drift
+// that can still happen is a field added to the struct and not to the
+// constructor. This catches that one, by name.
+func TestNewDaemonAPISetsEveryField(t *testing.T) {
+	prev := allowSeedOnStart
+	allowSeedOnStart = true
+	defer func() { allowSeedOnStart = prev }()
+
+	api := newDaemonAPI(fullDeps())
+	v := reflect.ValueOf(*api)
+	for i := range v.NumField() {
+		if v.Field(i).IsZero() {
+			t.Errorf("newDaemonAPI left %s unset — a fully wired deployment must fill every field", v.Type().Field(i).Name)
+		}
+	}
+}
+
+// The handler is wired with the bare store adapter and cannot serve the day
+// plan until upgradeAPI hands it the real one. The unlocked path did that and
+// the unlock path did it too; keep it a property of the constructor.
+func TestNewDaemonAPIUpgradesTheHandler(t *testing.T) {
+	d := fullDeps()
+	api := newDaemonAPI(d)
+	if d.voiceW.handler.api != ipc.CoreAPI(api) {
+		t.Fatal("newDaemonAPI did not hand the handler the API it built")
+	}
+}
+
+// Every worker the daemon runs goes through startBackground, so shutdown can
+// wait for it. The unlock path used to start seven of these as bare
+// `go func()` under a shadowed WaitGroup.
+func TestBackgroundWorkersFullSet(t *testing.T) {
+	want := []string{"voice", "tick", "fact-enrichment", "memory-eval", "feed", "crawl", "mcp", "home"}
+	var got []string
+	for _, w := range backgroundWorkers(fullDeps()) {
+		got = append(got, w.name)
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("workers = %v, want %v", got, want)
+	}
+}
+
+// A default box configures none of the optional blocks. Two workers always run
+// and the rest stay dark, rather than a nil run being scheduled.
+func TestBackgroundWorkersFloor(t *testing.T) {
+	d := fullDeps()
+	d.evalWorker, d.feedWkr, d.crawlWkr, d.voiceW = nil, nil, nil, nil
+	want := []string{"tick", "fact-enrichment"}
+	var got []string
+	for _, w := range backgroundWorkers(d) {
+		got = append(got, w.name)
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("workers = %v, want %v", got, want)
+	}
+}

cmd/mavend/calendarq_test.go

@@ -0,0 +1,61 @@
+package main
+
+import (
+	"context"
+	"testing"
+
+	"github.com/kami/maven/internal/router"
+)
+
+// TestCalendarStepsAsideForTheWorld — the defect (Vikunja #552). Weather was
+// one instance of a wider class, and V-474 fixed only that instance. Every one
+// of these answered "на 05.08.2026 ничего нет" on the deployed daemon, and
+// every one of them has an answer in search, which sits below the calendar.
+func TestCalendarStepsAsideForTheWorld(t *testing.T) {
+	h, api := contQueryHandler()
+	for _, u := range []string{
+		"во сколько закат сегодня",
+		"какой сегодня курс доллара",
+		"какой сегодня праздник",
+		"что интересного произошло сегодня в мире",
+	} {
+		if reply, ok := h.queryCalendar(context.Background(), &queryTurn{
+			dec: router.Decision{Intent: router.IntentQuery, Utterance: u},
+		}); ok {
+			t.Errorf("the calendar claimed %q with %q", u, reply)
+		}
+	}
+	if api.events != 0 {
+		t.Errorf("CalendarEvents called %d times for world questions, want 0", api.events)
+	}
+}
+
+// The other half of the same narrowing: a question about his own day still
+// reaches the calendar, including the one that names no subject at all.
+func TestCalendarStillAnswersHisDay(t *testing.T) {
+	for _, u := range []string{
+		"что у меня сегодня",
+		"во сколько у меня встреча сегодня",
+		"какие встречи завтра",
+		"что в календаре на завтра",
+		"что сегодня?",
+	} {
+		h, _ := contQueryHandler()
+		if _, ok := h.queryCalendar(context.Background(), &queryTurn{
+			dec: router.Decision{Intent: router.IntentQuery, Utterance: u},
+		}); !ok {
+			t.Errorf("the calendar passed on %q", u)
+		}
+	}
+}
+
+// A continuation carries its subject in the turn before it, and the calendar
+// is the only date-aware source, so the narrowing must not reach it.
+func TestCalendarStillAnswersAContinuation(t *testing.T) {
+	h, _ := contQueryHandler()
+	if _, ok := h.queryCalendar(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "а завтра?", Continued: true},
+	}); !ok {
+		t.Error("the calendar passed on a continuation")
+	}
+}

cmd/mavend/chat_degrade_test.go

@@ -19,7 +19,7 @@ func TestChatAnswersWithNoLlamaServer(t *testing.T) {
 	dead := llm.New("http://127.0.0.1:1", 500*time.Millisecond)
 	emb := router.NewHashEmbedder(1024)
 	h.recall.embedder = emb
-	h.router = buildRouter(emb, h.matcher, 0.55, pickLLMRouter(true, dead))
+	h.router = buildRouter(emb, h.matcher, 0.55, pickLLMRouter(true, dead), nil)
 	h.replier = newLLMReplier(dead, nil)
 
 	ctx := withDialogueID(context.Background(), dialogueIDFor(sourceText, "web"))

cmd/mavend/clarify.go

@@ -6,6 +6,7 @@ import (
 	"math/rand"
 	"strings"
 	"time"
+	"unicode/utf8"
 
 	"github.com/kami/maven/internal/dialogue"
 	"github.com/kami/maven/internal/router"
@@ -65,8 +66,28 @@ var clarifyExpiredVariants = []string{
 	"Столько времени прошло, что я отпустила прошлую просьбу. Скажи заново, если она в силе.",
 }
 
-// clarifyExpiredLine picks one of them at random.
-func clarifyExpiredLine() string {
+// clarifyExpiredPluralVariants — the same notice when TWO parked requests died
+// together (Vikunja #561). Since a side query suspends the flow instead of
+// dropping it, the stack can hold both the flow and the thing he interrupted it
+// with, and TakeExpired drops the whole stack when the top times out. "Прошлую
+// просьбу" would then be a lie about the count: he loses two and hears about
+// one.
+//
+// Two phrasings only, against five for the singular. This fires when he walks
+// off in the middle of an interrupted exchange, which is rarer than walking off
+// in the middle of a plain one, so it repeats less and needs less variety.
+var clarifyExpiredPluralVariants = []string{
+	"Прости, я слишком долго ждала и отпустила обе прошлые просьбы. Если они ещё нужны, скажи заново.",
+	"Я не дождалась ответа и убрала обе прошлые просьбы. Повтори, если они всё ещё нужны.",
+}
+
+// clarifyExpiredLine picks one of them at random. n is how many requests died;
+// anything above one gets the plural wording, because the bound is two today and
+// a third would still be "обе" short of the truth only if MaxStackDepth grew.
+func clarifyExpiredLine(n int) string {
+	if n > 1 {
+		return clarifyExpiredPluralVariants[rand.Intn(len(clarifyExpiredPluralVariants))]
+	}
 	return clarifyExpiredVariants[rand.Intn(len(clarifyExpiredVariants))]
 }
 
@@ -74,23 +95,34 @@ func clarifyExpiredLine() string {
 // notice is glued in front of this turn's reply (see withNotice), so a caller
 // checking for it has to match a prefix, not the whole string.
 func isClarifyExpired(s string) bool {
-	for _, v := range clarifyExpiredVariants {
-		if strings.HasPrefix(s, v) {
-			return true
-		}
-	}
-	return false
+	_, ok := cutClarifyExpired(s)
+	return ok
 }
 
 // trimClarifyExpired strips a leading expiry notice, leaving this turn's actual
 // reply. "" ⇒ the notice was the whole thing.
 func trimClarifyExpired(s string) string {
-	for _, v := range clarifyExpiredVariants {
-		if strings.HasPrefix(s, v) {
-			return strings.TrimSpace(strings.TrimPrefix(s, v))
+	rest, ok := cutClarifyExpired(s)
+	if !ok {
+		return strings.TrimSpace(s)
+	}
+	return rest
+}
+
+// cutClarifyExpired matches either expiry deck as a prefix and returns what
+// follows it. Both decks, since V-561 added the plural line: a caller asking
+// "did she say a request timed out" means the fact, not which wording carried
+// it, and a helper that knew only the singular would read the two-request
+// notice as ordinary reply text.
+func cutClarifyExpired(s string) (string, bool) {
+	for _, deck := range [][]string{clarifyExpiredVariants, clarifyExpiredPluralVariants} {
+		for _, v := range deck {
+			if strings.HasPrefix(s, v) {
+				return strings.TrimSpace(strings.TrimPrefix(s, v)), true
+			}
 		}
 	}
-	return strings.TrimSpace(s)
+	return "", false
 }
 
 // clarifyExpiredNotice returns that line when a parked question had just timed
@@ -101,11 +133,12 @@ func (h *reactiveHandler) clarifyExpiredNotice(ctx context.Context) string {
 	if h.clarifyStore == nil {
 		return ""
 	}
-	if !h.clarifyStore.TakeExpired(dialogueIDOf(ctx), h.now()) {
+	n := h.clarifyStore.TakeExpired(dialogueIDOf(ctx), h.now())
+	if n == 0 {
 		return ""
 	}
-	log.Printf("voice: clarify — parked question expired, telling him and routing the words fresh")
-	return clarifyExpiredLine()
+	log.Printf("voice: clarify — %d parked question(s) expired, telling him and routing the words fresh", n)
+	return clarifyExpiredLine(n)
 }
 
 // withNotice glues the expiry notice in front of this turn's reply. One turn
@@ -121,10 +154,47 @@ func withNotice(notice, reply string) string {
 	return notice + " " + reply
 }
 
+// withResumed puts the resumed question on the END of this turn's reply, where
+// withNotice puts the expiry notice on the front (Vikunja #561).
+//
+// The order is the owner's: "в Риме сейчас ..., на какое время поставить
+// напоминание?" — answer first, then the open question. A question in front of
+// its own answer would read as ignoring what he asked.
+//
+// Two sentences, not one (V-654). This used to fold the answer's full stop into
+// a comma, on the strength of the owner having written it that way once. Spliced
+// onto a real answer it reads as one run-on thought — "вот что я нашла: вайфай
+// пароль лежит в ящике стола, на какое время поставить напоминание?" — and the
+// question disappears into the tail of a sentence about something else. A reply
+// with no terminator of its own is given one, so the join never depends on how
+// the phraser chose to end.
+//
+// A resume with no answer in front of it is just the question.
+func withResumed(reply, resumed string) string {
+	if resumed == "" {
+		return reply
+	}
+	reply = strings.TrimSpace(reply)
+	if reply == "" {
+		return resumed
+	}
+	if !endsSentence(reply) {
+		reply += "."
+	}
+	return reply + " " + resumed
+}
+
+// endsSentence reports whether s already closes itself. The ellipsis counts: a
+// trailing "…" is a deliberate end, and a full stop after it reads as a typo.
+func endsSentence(s string) bool {
+	r, _ := utf8.DecodeLastRuneInString(s)
+	return strings.ContainsRune(".!?…", r)
+}
+
 // missingFor returns the slots a decision still needs, most important first.
 // Empty ⇒ there is nothing identifiable to ask about.
 func missingFor(dec router.Decision) []dialogue.Slot {
-	return dialogue.StillMissing(wantedSlots[dec.Intent], toDialogueSlots(dec.Slots))
+	return stillMissingFor(dec.Intent, dec.Utterance, toDialogueSlots(dec.Slots))
 }
 
 // clarifyQuestion picks the one question to ask for a clarify decision. Returns
@@ -133,18 +203,32 @@ func missingFor(dec router.Decision) []dialogue.Slot {
 // One question about one thing: if two slots are missing she asks about the
 // first only. Two questions in one breath is an interrogation. The second gap
 // is picked up on the turn after the first one is answered (askRemainingGap).
-func clarifyQuestion(dec router.Decision) (dialogue.Slot, string, bool) {
+func (h *reactiveHandler) clarifyQuestion(dec router.Decision) (dialogue.Slot, string, bool) {
 	missing := missingFor(dec)
 	if len(missing) == 0 {
 		return "", "", false
 	}
-	q, ok := clarifyQuestionFor(missing[0], 1)
+	q, ok := h.questionFor(missing[0], 1, dec.Utterance, toDialogueSlots(dec.Slots), "")
 	if !ok {
 		return "", "", false
 	}
 	return missing[0], q, true
 }
 
+// questionFor picks the wording for one gap. Every slot but the reminder's time
+// reads its deck by attempt; the time asks about whichever of the hour, the half
+// of the day and the day he has not said, and states the clock while it does
+// (V-579).
+//
+// taken is the acknowledgement of what his last turn added, empty when it added
+// nothing and empty for a first ask, which has no turn behind it (V-593).
+func (h *reactiveHandler) questionFor(slot dialogue.Slot, attempt int, utterance string, s dialogue.Slots, taken string) (string, bool) {
+	if slot != dialogue.SlotTime {
+		return clarifyQuestionFor(slot, attempt)
+	}
+	return whenQuestion(whenGapOf(utterance, s.HasTime), attempt, h.now(), taken)
+}
+
 // askClarify parks the request and returns the question to ask instead of the
 // canned "не поняла". Returns ("", false) when there is nothing to ask about, so
 // the caller falls back to the canned reply.
@@ -152,11 +236,16 @@ func (h *reactiveHandler) askClarify(ctx context.Context, dec router.Decision) (
 	if h.clarifyStore == nil {
 		return "", false
 	}
-	slot, question, ok := clarifyQuestion(dec)
+	slot, question, ok := h.clarifyQuestion(dec)
 	if !ok {
 		return "", false
 	}
-	h.clarifyStore.Put(dialogueIDOf(ctx), &dialogue.PendingQuestion{
+	// An act she could not resolve is a refusal, not a question (Vikunja #556).
+	if slot == dialogue.SlotFn {
+		log.Printf("voice: clarify — act %q matched no capability; saying so instead of asking", dec.Utterance)
+		return actNotRecognized, true
+	}
+	q := &dialogue.PendingQuestion{
 		Intent:      dialogue.Intent(dec.Intent),
 		Slots:       toDialogueSlots(dec.Slots),
 		Missing:     []dialogue.Slot{slot},
@@ -165,19 +254,69 @@ func (h *reactiveHandler) askClarify(ctx context.Context, dec router.Decision) (
 		TTL:         clarifyTTL,
 		Attempts:    1, // this ask
 		MaxAttempts: h.clarifyMaxAttempts,
-	})
+	}
+	// Push, not Put, when this turn suspended a flow (Vikunja #561): the side
+	// query needs clarifying of ITS own, and Put would replace the top of the
+	// stack — which is the very question the side query was allowed to interrupt
+	// rather than kill. Push keeps both.
+	//
+	// Push returns whatever the depth bound forced out, and that one has to be
+	// spoken: MaxStackDepth is a promise that every level she keeps is a level
+	// she can name when it dies. It is glued in front, like every other notice
+	// about something let go.
+	rt := turnRouteFrom(ctx)
+	if rt != nil && rt.suspended {
+		if evicted := h.clarifyStore.Push(dialogueIDOf(ctx), q); evicted != nil {
+			log.Printf("voice: clarify — stack full at %d, letting go of the request behind %q", dialogue.MaxStackDepth, evicted.Utterance)
+			rt.dropped = withNotice(rt.dropped, clarifyDropped)
+		}
+		// One question per breath still holds. The side query turned out to need
+		// a question of its own, so THAT is the one she asks; resuming as well
+		// would put two questions in one reply, which is the interrogation
+		// askRemainingGap already refuses to run. The suspended flow keeps its
+		// place underneath and is not lost — if it is never reached it dies on
+		// the TTL, and the expiry notice (now plural-aware) says so.
+		rt.resume = ""
+		log.Printf("voice: clarify — asked about %s for intent=%s, stacked on a suspended flow", slot, dec.Intent)
+		return question, true
+	}
+	h.clarifyStore.Put(dialogueIDOf(ctx), q)
 	log.Printf("voice: clarify — asked about %s for intent=%s", slot, dec.Intent)
 	return question, true
 }
 
-// resolveClarifyAnswer reads an utterance as the answer to a parked question.
-// Returns ("", false) when no live question is parked (or it expired), so the
-// caller routes the utterance normally as a fresh request. Sibling of
-// resolveConfirm and checked in the same place.
+// clarifyCancelled — he called the half-built request off. Said out loud, like
+// every other way it can end: a silent drop reads as "done". Feminine
+// self-reference ("отменила"), as everywhere.
+const clarifyCancelled = "Хорошо, отменила."
+
+// clarifyDropped — he asked for something ELSE instead, so the parked request
+// is gone. Glued in front of the answer to what he actually asked, because
+// nothing may be dropped in silence.
 //
-// The answer is parsed with the same extractor the router uses, for the intent
-// she parked — no second parser. If it still does not fill the gap she asks
-// again, up to MaxAttempts; after that she says out loud that she did not
+// Only new_request and cancel reach this since V-561. A side query used to as
+// well, and the owner rejected it on sight: he asks about the weather in the
+// middle of setting a reminder, and hearing "прошлую просьбу отпускаю" tells him
+// a thing he did not ask to lose has been lost. It had not been — there was
+// simply nowhere to put it. Now there is (ClarifyStore's stack), so a side query
+// suspends and resumes, and apologising for a drop that did not happen is worse
+// than saying nothing.
+const clarifyDropped = "Прошлую просьбу отпускаю."
+
+// resolveClarifyAnswer reads an utterance against the parked question and
+// decides what it IS before deciding what to do with it. Returns ("", false)
+// when the turn is not this resolver's — nothing parked, or the utterance turned
+// out to be a request of its own — so the caller dispatches it normally.
+//
+// The order is the point (Vikunja #560). The utterance is ROUTED first, and the
+// role is read off that decision: a routed decision that stands on its own is
+// not an answer, whatever the extractor found inside it. Before this the
+// extractor decided, so "какая сейчас погода в Риме?" became the time of a
+// reminder on the strength of the word "сейчас".
+//
+// The answer itself is parsed with the same extractor the router uses, for the
+// intent she parked — no second parser. If it still does not fill the gap she
+// asks again, up to MaxAttempts; after that she says out loud that she did not
 // understand. She never drops the request in silence.
 func (h *reactiveHandler) resolveClarifyAnswer(ctx context.Context, text string) (string, bool) {
 	if h.clarifyStore == nil {
@@ -185,19 +324,100 @@ func (h *reactiveHandler) resolveClarifyAnswer(ctx context.Context, text string)
 	}
 	q := h.clarifyStore.Get(dialogueIDOf(ctx), h.now())
 	if q == nil {
-		return "", false
+		return "", false // not_applicable: nothing is pending
 	}
 
 	intent := router.Intent(q.Intent)
 	answer := h.extractor.Extract(ctx, intent, text, h.now())
+
+	var (
+		routed   router.Decision
+		routedOK bool
+	)
+	if needsRoute(text) {
+		routed, routedOK = h.routeForRole(ctx, text)
+	}
+	role := classifyTurnRole(q, text, toDialogueSlots(answer), routed, routedOK)
+	log.Printf("voice: clarify — %q is a %s against %s (routed=%v)", text, role, dialogue.CapabilityFor(q.Intent), routedOK)
+
+	switch role {
+	case roleCancel:
+		h.clarifyStore.Delete(dialogueIDOf(ctx))
+		return clarifyCancelled, true
+	case roleSideQuery:
+		// He asked something of his own WITHOUT leaving the flow. The question
+		// stays exactly where it is — same slot, same attempt, same parked
+		// utterance — and these words go on to be answered as themselves. The
+		// resumed question is then glued onto the back of that answer, so one
+		// reply carries both acts (Vikunja #561).
+		//
+		// No attempt is spent. He answered the side query, not the parked
+		// question, and charging a retry for a turn that was never an answer is
+		// the V-554 shape.
+		h.noteSuspended(ctx, q)
+		return "", false
+	case roleAside:
+		// He stated something in the middle of the flow. Same machinery as a
+		// side query and for the same reason: the words are answered as
+		// themselves, so the note or the fact is stored, and the question comes
+		// back on the end of the same reply (V-577 shape 2). Storing it in
+		// silence and dropping it in silence are both wrong, and dropping it is
+		// what she did.
+		h.noteSuspended(ctx, q)
+		return "", false
+	case roleNewRequest:
+		// He moved on. A parked question used to swallow whatever came next, so
+		// one act she could not fulfil ate the following three turns (Vikunja
+		// #554) and a world question set a reminder for a time nobody asked for
+		// (#558). Drop the question, say so, and let these words be themselves.
+		h.clarifyStore.Delete(dialogueIDOf(ctx))
+		h.noteDropped(ctx)
+		return "", false
+	}
+
+	// He is answering, so the run of step-asides is over (V-654). Reset here
+	// rather than where a gap is FILLED: "позвонить маме" against a question
+	// about the time gives her nothing she asked for and still means he is in
+	// the exchange, and the retry it costs is bound enough on its own. The
+	// counter is for the case the bounds miss — he asked for other things and
+	// never came back.
+	q.Suspends = 0
+
 	merged := q.Answer(text, toDialogueSlots(answer))
 	// Fold a newly answered subject into the raw utterance. Downstream actions
 	// phrase from Utterance, not from the text slot — actionReminder stores it
 	// as the reminder payload — so a reminder clarified out of a bare "напомни"
 	// would fire at 11:00 saying "напомни" and nothing else.
 	q.Utterance = foldAnswerIntoUtterance(q.Utterance, merged.Text)
-	if len(dialogue.StillMissing(q.Missing, merged)) > 0 {
-		return h.reaskOrGiveUp(ctx, q, merged, text), true
+	// A fact answers with a key and a value and fills no Text slot at all, so
+	// the fold above leaves the utterance at the bare "запиши" — and that is
+	// what the confirmation now reads back to him (V-592). His raw words are the
+	// only record of what he said, so they are what is folded. Never for a time
+	// question: what he says about when is kept apart in WhenText on purpose,
+	// or the reminder would read the day back at him when it fires.
+	if merged.Text == "" && !asksAboutTime(q.Missing) {
+		q.Utterance = foldAnswerIntoUtterance(q.Utterance, text)
+	}
+	// An answer about the time joins everything else he has said about the time,
+	// and the whole of it is re-read as one request (V-579). "завтра" names the
+	// day of an hour she is already holding, and read alone it names no hour at
+	// all, so the parser would have nothing and she would ask for ever.
+	// What he had already said about the time, read BEFORE this answer joins it.
+	// A re-ask that cannot tell the two apart is the one that repeats itself
+	// byte for byte (V-593).
+	var taken string
+	if asksAboutTime(q.Missing) {
+		before := whenKnownOf(whenTextOf(q), q.Slots.HasTime)
+		q.WhenText = strings.TrimSpace(q.WhenText + " " + text)
+		if t, ok := h.readWhen(ctx, intent, q, text); ok {
+			merged.Time, merged.HasTime = t, true
+		}
+		if before.movedForward(whenKnownOf(whenTextOf(q), merged.HasTime)) {
+			taken = whenTakenLine(text)
+		}
+	}
+	if stillOpen(q.Missing, whenTextOf(q), merged) {
+		return h.reaskOrGiveUp(ctx, q, merged, text, taken), true
 	}
 	h.clarifyStore.Delete(dialogueIDOf(ctx))
 
@@ -226,6 +446,64 @@ func (h *reactiveHandler) resolveClarifyAnswer(ctx context.Context, text string)
 	return h.finishClarified(ctx, dec), true
 }
 
+// noteDropped records that the parked request was let go this turn, so runTurn
+// can say it in front of whatever these words are answered with. Nothing to
+// record outside runTurn — a unit test calling one resolver has no turn to glue
+// a notice onto.
+func (h *reactiveHandler) noteDropped(ctx context.Context) {
+	if rt := turnRouteFrom(ctx); rt != nil {
+		rt.dropped = clarifyDropped
+	}
+}
+
+// noteSuspended keeps the parked question alive across a side query and records
+// the words that bring it back, so runTurn can put them after this turn's answer
+// (Vikunja #561).
+//
+// Two things happen to the question and neither is an attempt. Its clock is
+// restarted, because she is about to ask it again and the 90s TTL measures the
+// pause since she last spoke it — leaving Asked at the original ask would let a
+// flow he is actively working through die of a wait he did not take. And the
+// stack is left exactly as it is: the question is already on top, so suspending
+// it is not a write.
+//
+// A slot with no resumed wording (clarifyResumedFor says so) resumes nothing and
+// says nothing. She must not claim to be holding a question she cannot re-ask.
+//
+// Suspension is bounded, since V-654. Neither of the two things above is a
+// limit: no attempt is spent, and restarting the clock means the TTL cannot
+// arrive while he keeps talking. So the count is the only thing that ends it,
+// and past MaxSuspends she lets the request go and says so with the same line
+// every other drop uses. The rule is unchanged — a question ends by being
+// answered or by being let go out loud — this only recognises three unrelated
+// requests in a row as the second of those.
+func (h *reactiveHandler) noteSuspended(ctx context.Context, q *dialogue.PendingQuestion) {
+	rt := turnRouteFrom(ctx)
+	if rt == nil || len(q.Missing) == 0 {
+		return
+	}
+	question, ok := clarifyResumedFor(q.Missing[0])
+	if !ok {
+		return
+	}
+	if !q.CanResume() {
+		h.clarifyStore.Delete(dialogueIDOf(ctx))
+		h.noteDropped(ctx)
+		log.Printf("voice: clarify — letting the question about %s go: %d asides in a row, %d rides in all", q.Missing[0], q.Suspends, q.Rides)
+		return
+	}
+	q.Suspends++
+	// Rides is the same event counted without the reset (V-663). Incremented
+	// beside Suspends and never anywhere else, so the two cannot disagree about
+	// what happened, only about how much of it they remember.
+	q.Rides++
+	q.Asked = h.now()
+	h.clarifyStore.Put(dialogueIDOf(ctx), q)
+	rt.resume = question
+	rt.suspended = true
+	log.Printf("voice: clarify — is its own request; suspending the question about %s and resuming it in the same reply (suspend %d of %d, ride %d of %d)", q.Missing[0], q.Suspends, dialogue.MaxSuspends, q.Rides, dialogue.MaxRides)
+}
+
 // foldAnswerIntoUtterance appends an answered subject to the original words,
 // unless they already carry it. "напомни" + "позвонить маме" reads as the
 // request he would have made in one breath. Nothing is appended when the
@@ -253,25 +531,35 @@ func foldAnswerIntoUtterance(utterance, subject string) string {
 // costs a question exactly like a second try at the first one does, so the cap
 // still bounds how many times she can speak before acting or letting go.
 func (h *reactiveHandler) askRemainingGap(ctx context.Context, q *dialogue.PendingQuestion, intent router.Intent, merged dialogue.Slots) (string, bool) {
-	remaining := dialogue.StillMissing(wantedSlots[intent], merged)
+	remaining := stillMissingFor(intent, whenTextOf(q), merged)
 	if len(remaining) == 0 {
 		return "", false
 	}
 	// Attempts+1 is the question she is about to ask, and the budget is shared
 	// with the re-ask path, so the second gap is worded like a second try.
-	question, ok := clarifyQuestionFor(remaining[0], q.Attempts+1)
+	question, ok := h.questionFor(remaining[0], q.Attempts+1, whenTextOf(q), merged, "")
 	if !ok || !q.CanAsk() {
 		return "", false
 	}
+	// Suspends is not carried, and by this point it is already zero: the answer
+	// path resets it (V-654). Left off the literal so the zero is stated where
+	// the struct is built, rather than inherited from a field nobody names.
+	//
+	// Rides IS carried, and that is the whole point of it (V-663). This is the
+	// same request under a second question, not a new one, so the turns it has
+	// already ridden still count against it. Dropping the field here is exactly
+	// the re-basing that let one question ride twenty-six replies.
 	h.clarifyStore.Put(dialogueIDOf(ctx), &dialogue.PendingQuestion{
 		Intent:      q.Intent,
 		Slots:       merged,
 		Missing:     []dialogue.Slot{remaining[0]},
 		Utterance:   q.Utterance,
+		WhenText:    q.WhenText,
 		Asked:       h.now(),
 		TTL:         clarifyTTL,
 		Attempts:    q.Attempts + 1,
 		MaxAttempts: q.MaxAttempts,
+		Rides:       q.Rides,
 	})
 	log.Printf("voice: clarify — one gap filled, still missing %s for intent=%s, asking again (attempt %d)", remaining[0], intent, q.Attempts+1)
 	return question, true
@@ -280,10 +568,12 @@ func (h *reactiveHandler) askRemainingGap(ctx context.Context, q *dialogue.Pendi
 // reaskOrGiveUp handles an answer that left the gap open: ask the same question
 // again while she has attempts left, otherwise say she did not understand and
 // let the request go. Never returns "" — a mute give-up reads as "done".
-func (h *reactiveHandler) reaskOrGiveUp(ctx context.Context, q *dialogue.PendingQuestion, merged dialogue.Slots, text string) string {
+// taken is the acknowledgement of what this answer DID give, empty when it gave
+// nothing (V-593). The give-up line never carries it: it is not another ask.
+func (h *reactiveHandler) reaskOrGiveUp(ctx context.Context, q *dialogue.PendingQuestion, merged dialogue.Slots, text, taken string) string {
 	question := ""
 	if len(q.Missing) > 0 {
-		question, _ = clarifyQuestionFor(q.Missing[0], q.Attempts+1)
+		question, _ = h.questionFor(q.Missing[0], q.Attempts+1, whenTextOf(q), merged, taken)
 	}
 	if question == "" || !q.CanAsk() {
 		h.clarifyStore.Delete(dialogueIDOf(ctx))
@@ -311,7 +601,7 @@ func (h *reactiveHandler) finishClarified(ctx context.Context, dec router.Decisi
 	}
 	reply := h.applyAction(ctx, dec)
 	if reply == "" {
-		reply = h.replier.Reply(dec)
+		reply = h.replier.Reply(ctx, dec)
 	}
 	if reply == "" {
 		// Belt: an empty reply here would be a silent drop.
@@ -320,20 +610,22 @@ func (h *reactiveHandler) finishClarified(ctx context.Context, dec router.Decisi
 	return reply
 }
 
+// maxCarriedHistory — how many turns of PRIOR history (beyond the immediate
+// last turn) rememberTurn carries forward. The session ends up holding this
+// many plus the one just-finished turn, so callers describing the total
+// depth (chatHistory's doc comment, this one) say "up to 4".
+const maxCarriedHistory = 3
+
 // rememberTurn stores this turn as the dialogue session the next follow-up
 // inherits from, carrying up to 4 prior turns of history for anaphora. Capped so
 // one long conversation can't grow the session unboundedly.
 func (h *reactiveHandler) rememberTurn(ctx context.Context, prev *dialogue.Session, dec router.Decision, now time.Time) {
 	var history []dialogue.Turn
 	if prev != nil {
-		history = append(history, dialogue.Turn{
-			Intent: prev.Intent,
-			Slots:  prev.Slots,
-			Text:   prev.Slots.Text,
-		})
+		history = append(history, sessionAsTurn(prev))
 		maxHist := len(prev.History)
-		if maxHist > 3 {
-			maxHist = 3
+		if maxHist > maxCarriedHistory {
+			maxHist = maxCarriedHistory
 		}
 		history = append(history, prev.History[:maxHist]...)
 	}

cmd/mavend/clarify_test.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/kami/maven/internal/dialogue"
 	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/memory"
 	"github.com/kami/maven/internal/phraser/eval"
 	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/store"
@@ -57,18 +58,26 @@ func TestClarifyQuestionForMissingSlot(t *testing.T) {
 		want  string
 		asked bool
 	}{
-		{"reminder without a time", clarifyDec(router.IntentReminder, router.Slots{Text: "напомни позвонить маме"}, "напомни позвонить маме"), "Когда?", true},
+		{"reminder without a time", clarifyDec(router.IntentReminder, router.Slots{Text: "напомни позвонить маме"}, "напомни позвонить маме"), "Сейчас 09:00. Когда?", true},
 		{"fact without a key", clarifyDec(router.IntentFact, router.Slots{Text: "запиши"}, "запиши"), "Что записать?", true},
 		{"act without a fn", clarifyDec(router.IntentAct, router.Slots{Text: "сделай это"}, "сделай это"), "Что сделать?", true},
 		// A time with nothing to say at that time is still half a reminder, so
 		// the subject is what she asks about — not silence.
 		{"reminder that has a time but no subject", clarifyDec(router.IntentReminder, router.Slots{HasTime: true}, "напомни в 11"), "О чём напомнить?", true},
-		{"reminder that has both", clarifyDec(router.IntentReminder, router.Slots{Text: "позвонить маме", HasTime: true}, "напомни в 11 позвонить маме"), "", false},
+		// A bare hour is half of a day away from being an answer, and she asks
+		// which half rather than picking one (V-579).
+		{"reminder whose hour could be either half of the day", clarifyDec(router.IntentReminder, router.Slots{Text: "позвонить маме", HasTime: true}, "напомни в 11 позвонить маме"), "Сейчас 09:00. Это утра или вечера?", true},
+		{"reminder that has all three", clarifyDec(router.IntentReminder, router.Slots{Text: "позвонить маме", HasTime: true}, "напомни завтра в 15:00 позвонить маме"), "", false},
+		// The owner's own two, confirmed 2026-08-06: an unambiguous time and a
+		// relative one are both complete and are never asked about.
+		{"an interval names the instant by itself", clarifyDec(router.IntentReminder, router.Slots{Text: "позвонить маме", HasTime: true}, "напомни через час позвонить маме"), "", false},
+		{"half an hour is an interval too", clarifyDec(router.IntentReminder, router.Slots{Text: "выключить духовку", HasTime: true}, "напомни через полчаса выключить духовку"), "", false},
 		{"chat is never worth a question", clarifyDec(router.IntentChat, router.Slots{Text: "мгм"}, "мгм"), "", false},
 		{"query is never worth a question", clarifyDec(router.IntentQuery, router.Slots{Text: "а"}, "а"), "", false},
 	}
+	h, _, _ := newClarifyHandler(t)
 	for _, tc := range cases {
-		_, got, asked := clarifyQuestion(tc.dec)
+		_, got, asked := h.clarifyQuestion(tc.dec)
 		if asked != tc.asked || got != tc.want {
 			t.Errorf("%s: got (%q, %v), want (%q, %v)", tc.name, got, asked, tc.want, tc.asked)
 		}
@@ -82,11 +91,13 @@ func TestClarifyReminderCompletesOnAnswer(t *testing.T) {
 	h, st, _ := newClarifyHandler(t)
 
 	question, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder, router.Slots{Text: "напомни позвонить маме"}, "напомни позвонить маме"))
-	if !asked || question != "Когда?" {
+	if !asked || question != "Сейчас 09:00. Когда?" {
 		t.Fatalf("expected the time question, got %q asked=%v", question, asked)
 	}
 
-	reply, handled := h.resolveClarifyAnswer(ctx, "в 11:00")
+	// The answer names the day as well as the hour. A reminder commits on what,
+	// what time and what day, and a dayless hour is asked about (V-579).
+	reply, handled := h.resolveClarifyAnswer(ctx, "сегодня в 11:00")
 	if !handled {
 		t.Fatal("the answer to an open question must be consumed as an answer")
 	}
@@ -158,11 +169,11 @@ func TestClarifyAsksThreeTimesThenSaysSo(t *testing.T) {
 		}
 		// The wording changes with the attempt (Vikunja #457): repeating a
 		// question he already failed to answer is the worst way to ask it.
-		want, _ := clarifyQuestionFor(dialogue.SlotTime, i)
+		want, _ := whenQuestion(whenNoHour, i, h.now(), "")
 		if reply != want {
 			t.Fatalf("attempt %d should ask again as %q, got %q", i, want, reply)
 		}
-		if first, _ := clarifyQuestionFor(dialogue.SlotTime, 1); reply == first {
+		if first, _ := whenQuestion(whenNoHour, 1, h.now(), ""); reply == first {
 			t.Fatalf("attempt %d repeated the first wording: %q", i, reply)
 		}
 		if h.clarifyStore.Get(voiceDialogueID, h.now()) == nil {
@@ -215,10 +226,11 @@ func TestClarifyRestatedAnswerWins(t *testing.T) {
 	if q == nil {
 		t.Fatal("expected an armed question")
 	}
-	first := h.extractor.Extract(ctx, router.IntentReminder, "в 11:00", h.now())
-	q.Slots = q.Answer("в 11:00", toDialogueSlots(first))
+	first := h.extractor.Extract(ctx, router.IntentReminder, "сегодня в 11:00", h.now())
+	q.Slots = q.Answer("сегодня в 11:00", toDialogueSlots(first))
+	q.WhenText = "сегодня в 11:00"
 
-	if reply, handled := h.resolveClarifyAnswer(ctx, "нет, в 15:00"); !handled || reply == clarifyGaveUp {
+	if reply, handled := h.resolveClarifyAnswer(ctx, "нет, сегодня в 15:00"); !handled || reply == clarifyGaveUp {
 		t.Fatalf("the restated answer should complete the request, handled=%v reply=%q", handled, reply)
 	}
 	reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour))
@@ -231,34 +243,35 @@ func TestClarifyRestatedAnswerWins(t *testing.T) {
 	}
 }
 
-// TestClarifiedActOffAllowlistIsStillRefused — clarification fills in an
-// argument, it never grants authority.
-func TestClarifiedActOffAllowlistIsStillRefused(t *testing.T) {
+// TestActOffAllowlistIsStillRefused — naming a capability is not being granted
+// one. Since Vikunja #556 an unresolved act no longer parks a question, so this
+// goes through applyAction, which is the only way an act runs.
+func TestActOffAllowlistIsStillRefused(t *testing.T) {
 	ctx := context.Background()
 	h, st, _ := newClarifyHandler(t)
 	marker := filepath.Join(t.TempDir(), "not-allowed-ran")
+	if err := st.EnableTool(ctx, "uptime", []string{"true"}, false, "test", h.now()); err != nil {
+		t.Fatal(err)
+	}
 
-	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentAct, router.Slots{Text: "сделай это"}, "сделай это")); !asked {
-		t.Fatal("an act with no fn should be asked about")
-	}
-	reply, handled := h.resolveClarifyAnswer(ctx, "rm "+marker)
-	if !handled {
-		t.Fatal("the answer should be consumed")
-	}
+	reply := h.applyAction(ctx, router.Decision{
+		Utterance: "rm " + marker,
+		Intent:    router.IntentAct,
+		Slots:     router.Slots{Fn: "rm " + marker, HasFn: true},
+	})
 	if strings.Contains(reply, "готово") {
 		t.Fatalf("an act that is not on the allowlist must not report success: %q", reply)
 	}
 	if _, err := os.Stat(marker); !os.IsNotExist(err) {
 		t.Fatalf("a clarified act off the allowlist ran anyway: %v", err)
 	}
-	if tools, err := st.ListTools(ctx, "enabled"); err != nil || len(tools) != 0 {
-		t.Fatalf("clarify must not enable a tool: tools=%+v err=%v", tools, err)
+	if tools, err := st.ListTools(ctx, "enabled"); err != nil || len(tools) != 1 {
+		t.Fatalf("an act must not enable a tool: tools=%+v err=%v", tools, err)
 	}
 }
 
-// TestClarifiedDestructiveActStillNeedsConfirm — the confirm gate survives the
-// clarify path.
-func TestClarifiedDestructiveActStillNeedsConfirm(t *testing.T) {
+// TestDestructiveActStillNeedsConfirm — the confirm gate stands on the act path.
+func TestDestructiveActStillNeedsConfirm(t *testing.T) {
 	ctx := context.Background()
 	h, st, _ := newClarifyHandler(t)
 	marker := filepath.Join(t.TempDir(), "destructive-ran")
@@ -266,18 +279,16 @@ func TestClarifiedDestructiveActStillNeedsConfirm(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentAct, router.Slots{Text: "сделай это"}, "сделай это")); !asked {
-		t.Fatal("expected a question")
-	}
-	reply, handled := h.resolveClarifyAnswer(ctx, "delete_backups")
-	if !handled {
-		t.Fatal("the answer should be consumed")
-	}
+	reply := h.applyAction(ctx, router.Decision{
+		Utterance: "delete_backups",
+		Intent:    router.IntentAct,
+		Slots:     router.Slots{Fn: "delete_backups", HasFn: true},
+	})
 	if !strings.Contains(reply, "да") || h.pending == nil {
-		t.Fatalf("a clarified destructive act must still park a confirm: reply=%q pending=%+v", reply, h.pending)
+		t.Fatalf("a destructive act must park a confirm: reply=%q pending=%+v", reply, h.pending)
 	}
 	if _, err := os.Stat(marker); !os.IsNotExist(err) {
-		t.Fatalf("a clarified destructive act ran before confirmation: %v", err)
+		t.Fatalf("a destructive act ran before confirmation: %v", err)
 	}
 }
 
@@ -306,7 +317,7 @@ func TestClarifyExpiryIsAnnouncedAndWordsStillRoute(t *testing.T) {
 	h, _, now := newClarifyHandler(t)
 	emb := router.NewHashEmbedder(1024)
 	h.recall.embedder = emb
-	h.router = buildRouter(emb, h.matcher, 0.55, nil)
+	h.router = buildRouter(emb, h.matcher, 0.55, nil, nil)
 
 	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder, router.Slots{Text: "напомни"}, "напомни")); !asked {
 		t.Fatal("expected a question")
@@ -357,7 +368,7 @@ func TestClarifyAsksAboutTheSecondGapToo(t *testing.T) {
 	}
 	// Second gap, second attempt, so it is the second wording of the time
 	// question — the attempt budget is shared between the two paths.
-	want, _ := clarifyQuestionFor(dialogue.SlotTime, 2)
+	want, _ := whenQuestion(whenNoHour, 2, h.now(), "")
 	if reply != want {
 		t.Fatalf("a filled subject with no time must ask about the time as %q, got %q", want, reply)
 	}
@@ -369,7 +380,7 @@ func TestClarifyAsksAboutTheSecondGapToo(t *testing.T) {
 		t.Fatalf("the re-parked question lost the answered subject: %+v", q.Slots)
 	}
 
-	if reply, handled := h.resolveClarifyAnswer(ctx, "в 11:00"); !handled || reply == clarifyGaveUp {
+	if reply, handled := h.resolveClarifyAnswer(ctx, "сегодня в 11:00"); !handled || reply == clarifyGaveUp {
 		t.Fatalf("the time answer must complete the reminder, handled=%v reply=%q", handled, reply)
 	}
 	reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour))
@@ -419,7 +430,7 @@ func TestClarifyProseHoldsThePersona(t *testing.T) {
 		eval.CheckAddress:   true,
 		eval.CheckCringe:    true,
 	}
-	lines := append([]string{clarifyGaveUp}, clarifyExpiredVariants...)
+	lines := append([]string{clarifyGaveUp, clarifyCancelled, clarifyDropped}, clarifyExpiredVariants...)
 	lines = append(lines, clarifyMissedVariants...)
 	for _, variants := range clarifyQuestionVariants {
 		lines = append(lines, variants...)
@@ -487,7 +498,7 @@ func TestClarifySubjectAnswerFillsRatherThanClobbers(t *testing.T) {
 	at := h.now().Add(2 * time.Hour)
 
 	question, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder,
-		router.Slots{Time: at, HasTime: true}, "напомни в 11"))
+		router.Slots{Time: at, HasTime: true}, "напомни сегодня в 11 утра"))
 	if !asked || question != "О чём напомнить?" {
 		t.Fatalf("expected the subject question, got %q asked=%v", question, asked)
 	}
@@ -564,3 +575,218 @@ func TestARestartExpiresTheParkedQuestion(t *testing.T) {
 		t.Fatalf("notice = %q, want silence: nothing survived to expire", notice)
 	}
 }
+
+// TestClarifyStepsAsideForItsOwnRequest — Vikunja #554. An act she could not
+// fulfil parked "Что сделать?", and the three turns after it were scored as
+// answers to that question: a world question, then "как дела", then the give-up
+// line. None of them was ever an answer.
+func TestClarifyStepsAsideForItsOwnRequest(t *testing.T) {
+	ctx := context.Background()
+	h, _, _ := newClarifyHandler(t)
+
+	// A reminder, not the act this bug was found on: since Vikunja #556 an act
+	// no longer parks anything, so it can no longer eat the turn after it.
+	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder, router.Slots{Text: "напомни позвонить маме"}, "напомни позвонить маме")); !asked {
+		t.Fatal("a reminder with no time should be asked about")
+	}
+	if reply, handled := h.resolveClarifyAnswer(ctx, "кто изобрёл телефон"); handled {
+		t.Fatalf("a world question must route as itself, got %q", reply)
+	}
+	// Not eating the turn is `handled == false` above, and that is the whole of
+	// #554. Since V-561 the question also SURVIVES it: a side query suspends the
+	// flow rather than ending it, so the reminder is still there and still on the
+	// attempt it was parked with.
+	q := h.clarifyStore.Get(voiceDialogueID, h.now())
+	if q == nil {
+		t.Fatal("a side query must suspend the parked question, not drop it")
+	}
+	if q.Attempts != 1 {
+		t.Errorf("a turn that was never an answer spent an attempt: %d, want 1", q.Attempts)
+	}
+}
+
+// TestClarifyStillRetriesOnAnAnswerThatMissed — the other half of #554, and the
+// reason the test above is narrow. A bare noun answers nothing either, but it
+// carries no request of its own, so she asks again as before.
+func TestClarifyStillRetriesOnAnAnswerThatMissed(t *testing.T) {
+	ctx := context.Background()
+	h, _, _ := newClarifyHandler(t)
+
+	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder, router.Slots{Text: "напомни позвонить маме"}, "напомни позвонить маме")); !asked {
+		t.Fatal("expected the time question")
+	}
+	reply, handled := h.resolveClarifyAnswer(ctx, "ага")
+	if !handled || reply == "" {
+		t.Fatalf("a missed answer must still be re-asked, handled=%v reply=%q", handled, reply)
+	}
+	if h.clarifyStore.Get(voiceDialogueID, h.now()) == nil {
+		t.Error("the question must survive a missed answer")
+	}
+}
+
+// TestClarifyQuestionShapedAnswerThatFillsTheGapStillLands — the guard runs only
+// where nothing was filled. "во сколько?" is question-shaped and is also how a
+// time gets said back, so an answer that closes the gap wins whatever its shape.
+func TestClarifyQuestionShapedAnswerThatFillsTheGapStillLands(t *testing.T) {
+	ctx := context.Background()
+	h, st, _ := newClarifyHandler(t)
+
+	if _, asked := h.askClarify(ctx, clarifyDec(router.IntentReminder, router.Slots{Text: "напомни позвонить маме"}, "напомни позвонить маме")); !asked {
+		t.Fatal("expected the time question")
+	}
+	if reply, handled := h.resolveClarifyAnswer(ctx, "а что если сегодня в 11:00"); !handled || reply == clarifyGaveUp {
+		t.Fatalf("an answer that fills the gap must land, handled=%v reply=%q", handled, reply)
+	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 1 {
+		t.Fatalf("reminder was not created: reminders=%v err=%v", reminders, err)
+	}
+}
+
+// TestUnresolvedActSaysItDoesNotKnowTheCommand — Vikunja #556. "Что сделать?"
+// has no answer he can give, so an act that matched no capability is refused in
+// one line and nothing is parked. It does not recite what she can do instead.
+func TestUnresolvedActSaysItDoesNotKnowTheCommand(t *testing.T) {
+	ctx := context.Background()
+	h, st, _ := newClarifyHandler(t)
+	// Enabled tools change nothing here: this act matched none of them.
+	if err := st.EnableTool(ctx, "uptime", []string{"true"}, false, "test", h.now()); err != nil {
+		t.Fatal(err)
+	}
+
+	reply, spoken := h.askClarify(ctx, clarifyDec(router.IntentAct, router.Slots{Text: "выключи свет"}, "выключи свет"))
+	if !spoken || reply != actNotRecognized {
+		t.Fatalf("reply = %q spoken=%v, want %q", reply, spoken, actNotRecognized)
+	}
+	if strings.Contains(reply, "uptime") {
+		t.Errorf("reply = %q, want no list of capabilities he did not ask about", reply)
+	}
+	if h.clarifyStore.Get(voiceDialogueID, h.now()) != nil {
+		t.Error("nothing to ask about, so nothing may be parked")
+	}
+}
+
+// newRoutingClarifyHandler wires the real cascade (hash embedder, no model) onto
+// the clarify handler, so a test can drive handleText end to end and see which
+// gate claimed the turn.
+func newRoutingClarifyHandler(t *testing.T) (*reactiveHandler, *store.Store) {
+	t.Helper()
+	h, st, _ := newClarifyHandler(t)
+	h.router = buildRouter(router.NewHashEmbedder(1024), h.matcher, 0.55, nil, nil)
+	h.recall = recallWiring{embedder: router.NewHashEmbedder(1024), memStore: memory.NewInMemoryStore()}
+	return h, st
+}
+
+// TestIncompleteReminderAsksInsteadOfFailing — Vikunja #557. "напомни позвонить"
+// is routed confidently and is still half a request. It used to reach applyAction,
+// fail on the missing time and park nothing, so the "в семь вечера" that followed
+// was routed as a world question and web-searched.
+func TestIncompleteReminderAsksInsteadOfFailing(t *testing.T) {
+	ctx := context.Background()
+	h, st := newRoutingClarifyHandler(t)
+
+	reply := h.handleText(ctx, "web", "напомни позвонить маме")
+	want, _ := whenQuestion(whenNoHour, 1, h.now(), "")
+	if reply != want {
+		t.Fatalf("reply = %q, want the time question %q", reply, want)
+	}
+	if h.clarifyStore.Get(dialogueIDFor(sourceText, "web"), h.now()) == nil {
+		t.Fatal("the request must be parked, or the answer has nowhere to land")
+	}
+	if reply := h.handleText(ctx, "web", "сегодня в семь вечера"); strings.Contains(reply, "нашла") {
+		t.Fatalf("the answer to her own question must not be looked up: %q", reply)
+	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 1 {
+		t.Fatalf("the answer did not complete the reminder: reminders=%v err=%v", reminders, err)
+	}
+}
+
+// TestBareCaptureVerbAsksWhatToRecord — the other half of #557. A bare "запиши"
+// went to the resident model as chat, which agreed to a wording change nobody
+// asked for. It is a fact with no key, and that gap has a question.
+func TestBareCaptureVerbAsksWhatToRecord(t *testing.T) {
+	ctx := context.Background()
+	h, _ := newRoutingClarifyHandler(t)
+
+	reply := h.handleText(ctx, "web", "запиши")
+	want, _ := clarifyQuestionFor(dialogue.SlotKey, 1)
+	if reply != want {
+		t.Fatalf("reply = %q, want %q", reply, want)
+	}
+	if h.clarifyStore.Get(dialogueIDFor(sourceText, "web"), h.now()) == nil {
+		t.Fatal("the request must be parked so the next utterance completes it")
+	}
+}
+
+// TestACompleteTurnStillDoesNotAsk — the gate reads a missing slot, not any
+// slot, so a request she can act on must never turn into a question. Checked on
+// the decision rather than through the cascade: what is at stake is the gate's
+// condition, and driving it through the hash embedder would measure routing.
+func TestACompleteTurnStillDoesNotAsk(t *testing.T) {
+	ctx := context.Background()
+	h, _, _ := newClarifyHandler(t)
+
+	complete := []router.Decision{
+		{Intent: router.IntentReminder, Slots: router.Slots{Text: "позвонить маме", HasTime: true}, Utterance: "напомни завтра в 11 утра позвонить маме"},
+		{Intent: router.IntentFact, Slots: router.Slots{Key: "water", Value: "выпил", HasKey: true}, Utterance: "я выпил воды"},
+		{Intent: router.IntentNote, Slots: router.Slots{Text: "купить хлеб"}, Utterance: "запиши купить хлеб"},
+		{Intent: router.IntentQuery, Slots: router.Slots{Text: "что у меня сегодня"}, Utterance: "что у меня сегодня"},
+	}
+	for _, dec := range complete {
+		if gaps := missingFor(dec); len(gaps) > 0 {
+			t.Errorf("%q reads as incomplete: %v", dec.Utterance, gaps)
+		}
+		if reply, asked := h.askClarify(ctx, dec); asked {
+			t.Errorf("%q was answered with a question: %q", dec.Utterance, reply)
+		}
+	}
+}
+
+// TestTheResumedQuestionIsItsOwnSentence — V-654. The re-ask used to be spliced
+// onto the answer with a comma, so a real answer and an unrelated open question
+// read as one run-on thought and the question vanished into its tail.
+func TestTheResumedQuestionIsItsOwnSentence(t *testing.T) {
+	const resumed = "На какое время поставить напоминание?"
+	cases := []struct {
+		name  string
+		reply string
+		want  string
+	}{
+		{
+			// The measured line, shortened. Two sentences, and the question keeps
+			// its capital.
+			name:  "a statement keeps its full stop",
+			reply: "Вайфай пароль лежит в ящике стола.",
+			want:  "Вайфай пароль лежит в ящике стола. " + resumed,
+		},
+		{
+			name:  "a reply with no terminator is given one",
+			reply: "Вайфай пароль лежит в ящике стола",
+			want:  "Вайфай пароль лежит в ящике стола. " + resumed,
+		},
+		{
+			// She sometimes answers a side query by asking him to say it again.
+			// Two questions, and neither may swallow the other.
+			name:  "a question keeps its mark",
+			reply: "Можешь переформулировать?",
+			want:  "Можешь переформулировать? " + resumed,
+		},
+		{
+			name:  "an ellipsis is already an ending",
+			reply: "Не уверена…",
+			want:  "Не уверена… " + resumed,
+		},
+		{
+			name:  "a resume with no answer in front of it is just the question",
+			reply: "",
+			want:  resumed,
+		},
+	}
+	for _, tc := range cases {
+		if got := withResumed(tc.reply, resumed); got != tc.want {
+			t.Errorf("%s: withResumed(%q) = %q, want %q", tc.name, tc.reply, got, tc.want)
+		}
+	}
+	if got := withResumed("Готово.", ""); got != "Готово." {
+		t.Errorf("nothing to resume must leave the reply alone, got %q", got)
+	}
+}

cmd/mavend/clarifytemplates.go

@@ -40,6 +40,9 @@ var clarifyQuestionVariants = map[dialogue.Slot][]string{
 		"Что именно отметить?",
 		"Назови, что записать — например, «выпил воды».",
 	},
+	// Not spoken since Vikunja #556: askClarify answers actNotRecognized for a
+	// missing capability rather than asking. Kept because clarifyQuestion still
+	// reports the gap, and a re-ask deck with a hole in it is harder to read.
 	dialogue.SlotFn: {
 		"Что сделать?",
 		"Какое действие выполнить?",
@@ -47,6 +50,49 @@ var clarifyQuestionVariants = map[dialogue.Slot][]string{
 	},
 }
 
+// clarifyResumedVariants — the wording for a question coming BACK after a side
+// query took the turn away from it (Vikunja #561).
+//
+// It is not the first question again. "Когда?" works in the same breath as
+// "напомни позвонить маме", because the thing it is about was just said. After
+// a turn about the weather in Rome it does not: he has been thinking about
+// something else, and a bare "Когда?" asks him to remember what she is holding.
+// So the resumed form names the request — "напоминание", "заметка" — and the
+// first form stays short.
+//
+// One wording per slot, not a rotation and not an attempt ladder. A resume does
+// not spend an attempt (that is the point of suspending rather than re-asking),
+// so there is no attempt number to vary on, and this line is heard once per
+// interruption rather than repeatedly.
+//
+// Persona holds: infinitive, so no gender agreement, "ты" nowhere needed, no pet
+// names.
+var clarifyResumedVariants = map[dialogue.Slot]string{
+	dialogue.SlotTime: "На какое время поставить напоминание?",
+	dialogue.SlotText: "Так о чём напомнить?",
+	dialogue.SlotKey:  "Так что записать?",
+	dialogue.SlotFn:   "Так какое действие выполнить?",
+}
+
+// clarifyResumedFor gives the resumed wording for a slot. ("", false) when the
+// slot has none, and the caller then resumes nothing rather than inventing a
+// question — a flow it cannot re-ask is one it must not claim to be holding.
+func clarifyResumedFor(slot dialogue.Slot) (string, bool) {
+	q, ok := clarifyResumedVariants[slot]
+	return q, ok
+}
+
+// actNotRecognized is what an act she cannot run gets (Vikunja #556).
+//
+// The deck used to ask "Что сделать?" instead. That question has no answer he
+// can give: he already said what he wanted, and nothing he repeats will match a
+// capability that is not there. So she asked, failed, asked again and gave up —
+// three turns spent on one refusal. She says it once now, and parks nothing.
+//
+// It does not recite the allowlist. A list of names he did not ask about is not
+// an answer to the thing he did ask about.
+const actNotRecognized = "Такую команду я не знаю."
+
 // clarifyQuestionFor picks the wording for this attempt. attempt is 1-based, as
 // PendingQuestion.Attempts counts it; anything past the list uses the last and
 // most explicit phrasing rather than wrapping round to the short one, because

cmd/mavend/confirm.go

@@ -3,9 +3,13 @@ package main
 import (
 	"context"
 	"log"
+	"slices"
+	"sort"
 	"strings"
 	"time"
+	"unicode"
 
+	"github.com/kami/maven/internal/lexicon"
 	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/router"
 )
@@ -20,6 +24,14 @@ type pendingHexisExec struct {
 	entityID     string
 	displayName  string
 	expiry       time.Time
+
+	// correlationID — the id the proposing turn minted for this action. A
+	// confirm arrives on a later turn with a context of its own, so without
+	// carrying it here the execution recorded a fresh id and no causation at
+	// all, and the resolve, the discovery and the thing they authorised sat in
+	// the trace as unrelated calls. The contract mints one id per action, and
+	// the action began when she asked.
+	correlationID string
 }
 
 // pendingRoutineConfirm — a proposed routine awaiting a spoken y/n to become
@@ -57,10 +69,18 @@ func (h *reactiveHandler) park(fn string, args []string, phrase string) {
 // resolveConfirm interprets an utterance as the answer to a parked destructive
 // act OR a parked routine proposal. Returns (reply, true) when it consumed the
 // utterance as a y/n answer; ("", false) when there's nothing pending (or the
-// parked act expired), so the caller routes the utterance normally. An
-// unrecognised answer cancels the pending and routes normally — a confirm that
-// can't be answered clearly is safer abandoned than left armed.
+// parked act expired), so the caller routes the utterance normally.
+//
+// An utterance that is not clearly yes or no is not an answer at all, so it is
+// handed straight back and the pending stays parked until it expires (V-567).
+// This resolver runs before routing and holds the most dangerous trigger on the
+// box; it may only claim a turn it is certain about.
 func (h *reactiveHandler) resolveConfirm(ctx context.Context, text string) (string, bool) {
+	verdict := classifyConfirm(text)
+	if verdict == confirmUnknown {
+		return "", false
+	}
+
 	h.mu.Lock()
 	defer h.mu.Unlock()
 
@@ -68,16 +88,12 @@ func (h *reactiveHandler) resolveConfirm(ctx context.Context, text string) (stri
 		if !r.claim() {
 			continue
 		}
-		// The slot is already cleared by claim(): every branch below drops the
-		// pending, including the unclear one — a confirm that can't be
-		// answered clearly is safer abandoned than left armed.
-		switch classifyConfirm(text) {
+		// The slot is already cleared by claim().
+		switch verdict {
 		case confirmYes:
 			return r.yes(), true
-		case confirmNo:
-			return r.no(), true
 		default:
-			return "", false
+			return r.no(), true
 		}
 	}
 	return "", false
@@ -136,7 +152,11 @@ func (h *reactiveHandler) confirmResolvers(ctx context.Context) []confirmResolve
 				return hx != nil && !h.now().After(hx.expiry)
 			},
 			yes: func() string {
-				return h.execHexis(ctx, hx.capabilityID, hx.capName, hx.entityID, hx.displayName)
+				execCtx := ctx
+				if hx.correlationID != "" {
+					execCtx = withCorrelationID(execCtx, hx.correlationID)
+				}
+				return h.execHexis(execCtx, hx.capabilityID, hx.capName, hx.entityID, hx.displayName)
 			},
 			no: func() string { return phraser.C(phraser.ConfirmCancelled, nil) },
 		},
@@ -194,23 +214,92 @@ const (
 	confirmNo
 )
 
-// classifyConfirm reads a short ru/en yes-or-no answer. Substring match on the
-// stems so inflections/fillers ("да, давай", "нет, отмени") still land.
+// confirmWords are the two closed sets, tokenized once and ordered
+// longest-first so "не надо" is read before "нет" could claim any of it.
+var (
+	confirmYesPhrases = confirmPhrases(lexicon.ConfirmYes())
+	confirmNoPhrases  = confirmPhrases(lexicon.ConfirmNo())
+)
+
+// confirmPhrases splits each lexicon member into tokens and sorts the result
+// longest-first, so a walk that tries them in order matches the longest member
+// that fits.
+func confirmPhrases(words []string) [][]string {
+	out := make([][]string, 0, len(words))
+	for _, w := range words {
+		if toks := confirmTokens(w); len(toks) > 0 {
+			out = append(out, toks)
+		}
+	}
+	sort.SliceStable(out, func(i, j int) bool { return len(out[i]) > len(out[j]) })
+	return out
+}
+
+// confirmTokens splits an utterance into lowercase word tokens. Punctuation and
+// spacing are separators; an apostrophe is not, because "don't" is one word.
+func confirmTokens(text string) []string {
+	return strings.FieldsFunc(strings.ToLower(text), func(r rune) bool {
+		if r == '\'' || r == '’' {
+			return false
+		}
+		return !unicode.IsLetter(r) && !unicode.IsDigit(r)
+	})
+}
+
+// classifyConfirm reads a short ru/en yes-or-no answer to a parked confirm.
+//
+// The whole utterance must consist of confirmation words and filler, matched as
+// whole tokens against the closed lexicon sets. Anything else is
+// confirmUnknown, which leaves the confirm parked and routes the turn — see
+// resolveConfirm. Both halves of that are the fix for V-567: this used to be a
+// substring test over bare stems, so "погода", "дальше", "надо" and "давление"
+// all read as "да", and "покажи" and "около" read as "ок". A parked destructive
+// act fired on a question about the weather.
+//
+// Requiring the WHOLE utterance is the second half. A leading confirm word does
+// not make a sentence an answer: "давай посмотрим погоду" opens a request, and
+// the only safe reading of a sentence that carries its own subject is that he
+// moved on. Guessing wrong here executes something; guessing wrong the other way
+// asks again.
 func classifyConfirm(text string) confirmVerdict {
-	t := strings.ToLower(strings.TrimSpace(text))
-	// negatives first — "не надо" contains no "да", but check no-stems before
-	// yes so a leading "нет" isn't shadowed.
-	for _, no := range []string{"нет", "не надо", "отмен", "стоп", "no", "cancel", "stop", "don't"} {
-		if strings.Contains(t, no) {
+	tokens := confirmTokens(text)
+	if len(tokens) == 0 {
+		return confirmUnknown
+	}
+	verdict := confirmUnknown
+	for i := 0; i < len(tokens); {
+		// Negatives first: "не надо" and "не хочу" open with a token that is
+		// not itself an answer, and a yes hit must never shadow them.
+		if n := matchConfirm(confirmNoPhrases, tokens[i:]); n > 0 {
 			return confirmNo
 		}
+		if n := matchConfirm(confirmYesPhrases, tokens[i:]); n > 0 {
+			verdict, i = confirmYes, i+n
+			continue
+		}
+		if lexicon.IsFillerParticle(tokens[i]) {
+			i++
+			continue
+		}
+		// A word that is neither an answer nor filler carries a subject of its
+		// own, so this utterance is not an answer to her question.
+		return confirmUnknown
 	}
-	for _, yes := range []string{"да", "ага", "давай", "подтвер", "конечно", "yes", "yeah", "yep", "confirm", "ок", "okay", "ok"} {
-		if strings.Contains(t, yes) {
-			return confirmYes
+	return verdict
+}
+
+// matchConfirm reports the length of the longest phrase matching at the head of
+// tokens, or 0.
+func matchConfirm(phrases [][]string, tokens []string) int {
+	for _, p := range phrases {
+		if len(p) > len(tokens) {
+			continue
+		}
+		if slices.Equal(p, tokens[:len(p)]) {
+			return len(p)
 		}
 	}
-	return confirmUnknown
+	return 0
 }
 
 // actPhrase renders "fn arg1 arg2" for the confirm prompt.

cmd/mavend/confirm_test.go

@@ -0,0 +1,103 @@
+package main
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/tool"
+)
+
+// TestClassifyConfirmRejectsSubstrings — V-567. The old matcher tested bare
+// stems with strings.Contains, so every word below answered a question she had
+// asked about something else: "погода", "дальше", "надо" and "давление" carry
+// "да"; "покажи", "около" and "окно" carry "ок". A parked destructive act fired
+// on a question about the weather.
+func TestClassifyConfirmRejectsSubstrings(t *testing.T) {
+	for _, text := range []string{
+		"погода",
+		"какая погода",
+		"что дальше",
+		"надо ещё",
+		"покажи заметки",
+		"около окна",
+		"давление",
+		"давай посмотрим погоду",
+		"не забудь купить хлеб",
+		"окно открыто",
+		"стоит ли брать зонт",
+		"",
+	} {
+		if got := classifyConfirm(text); got != confirmUnknown {
+			t.Errorf("classifyConfirm(%q) = %v, want confirmUnknown", text, got)
+		}
+	}
+}
+
+// TestClassifyConfirmAcceptsAnswers keeps every genuine answer the substring
+// matcher accepted, and pins the pair the fix could most easily get wrong:
+// "надо" is not an answer and "не надо" is the opposite of one.
+func TestClassifyConfirmAcceptsAnswers(t *testing.T) {
+	yes := []string{"да", "Да!", "ага", "давай", "да, давай", "конечно", "подтверждаю", "ну да", "yes", "yeah", "ok", "okay", "confirm"}
+	no := []string{"нет", "Нет.", "не надо", "не нужно", "не сейчас", "отмена", "отмени", "стоп", "нет, отмени", "no", "nope", "cancel", "stop", "don't"}
+
+	for _, text := range yes {
+		if got := classifyConfirm(text); got != confirmYes {
+			t.Errorf("classifyConfirm(%q) = %v, want confirmYes", text, got)
+		}
+	}
+	for _, text := range no {
+		if got := classifyConfirm(text); got != confirmNo {
+			t.Errorf("classifyConfirm(%q) = %v, want confirmNo", text, got)
+		}
+	}
+}
+
+// TestUnrelatedTurnLeavesConfirmParked — the whole point of V-567. An utterance
+// that is not an answer must not execute the parked act, must not consume the
+// turn, and must not disarm the confirm either: the answer he has not given yet
+// is still answerable until it expires.
+func TestUnrelatedTurnLeavesConfirmParked(t *testing.T) {
+	ctx := context.Background()
+	st := newTestStore(t)
+	api := ipc.NewStoreAPI(st)
+	now := time.Date(2026, 8, 6, 9, 0, 0, 0, time.UTC)
+	h := &reactiveHandler{
+		api:       api,
+		dataStore: st,
+		now:       func() time.Time { return now },
+		tools:     tool.NewExecutor(api, time.Second),
+	}
+
+	marker := filepath.Join(t.TempDir(), "destructive-tool-ran")
+	if err := st.EnableTool(ctx, "delete_backups", []string{"touch", marker}, true, "test", h.now()); err != nil {
+		t.Fatal(err)
+	}
+	h.park("delete_backups", nil, "delete_backups")
+
+	if reply, handled := h.resolveConfirm(ctx, "какая погода"); handled {
+		t.Fatalf("the weather question was consumed as a confirm: %q", reply)
+	}
+	if _, err := os.Stat(marker); !os.IsNotExist(err) {
+		t.Fatalf("the parked destructive command ran on an unrelated turn: %v", err)
+	}
+	if h.pending == nil {
+		t.Fatal("the confirm was disarmed by a turn that did not answer it")
+	}
+
+	// It is still answerable, and answering it still runs the act.
+	reply, handled := h.resolveConfirm(ctx, "да")
+	if !handled || !strings.Contains(reply, "готово") {
+		t.Fatalf("the still-parked confirm did not resolve: handled=%v reply=%q", handled, reply)
+	}
+	if _, err := os.Stat(marker); err != nil {
+		t.Fatalf("confirmed destructive command did not run: %v", err)
+	}
+	if h.pending != nil {
+		t.Fatal("the confirm stayed parked after being answered")
+	}
+}

cmd/mavend/crawls.go

@@ -173,6 +173,13 @@ func (a *crawlFetcher) Get(ctx context.Context, u string) (*crawl.Response, erro
 		case errors.Is(err, webfetch.ErrBlocked), errors.Is(err, webfetch.ErrPrivate), errors.Is(err, webfetch.ErrScheme):
 			return nil, fmt.Errorf("%w: %v", crawl.ErrFetchRefused, err)
 		case errors.Is(err, webfetch.ErrStatus):
+			// Carry the code across the seam. The crawler needs to tell a 5xx
+			// from a 404 to decide what a failed robots.txt means, and it must
+			// not learn that by reading this sentence.
+			var se *webfetch.StatusError
+			if errors.As(err, &se) {
+				return nil, &crawl.StatusError{Code: se.Code}
+			}
 			return nil, fmt.Errorf("%w: %v", crawl.ErrFetchStatus, err)
 		}
 		return nil, err

cmd/mavend/dayplan_test.go

@@ -4,12 +4,14 @@ import (
 	"context"
 	"database/sql"
 	"errors"
+	"fmt"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/kami/maven/internal/calendar"
 	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/morning"
 	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/store"
@@ -111,6 +113,88 @@ func TestQueryDayPlanRestOfDayWhenNothingIsLeft(t *testing.T) {
 	}
 }
 
+// "что дальше?" rebuilds the plan off the wire and renders it here, and the
+// instants on it carry the zone the core read them in — a calendar fact's Ts
+// and a reminder's FireTs are UTC out of the store. Read raw, the recital named
+// the store's clock instead of his (V-614). The asking clock is three hours off
+// whatever this machine runs in, so the assertion holds under TZ=UTC too.
+func TestQueryDayPlanRestOfDayReadsHisClock(t *testing.T) {
+	_, off := time.Now().Zone()
+	away := time.FixedZone("away", off+3*60*60)
+	stored := time.Date(2026, 8, 3, 8, 0, 0, 0, time.UTC)
+
+	h := &reactiveHandler{
+		api: &planAPI{plan: ipc.DayPlan{
+			Date:  time.Date(2026, 8, 3, 0, 0, 0, 0, time.UTC),
+			Items: []ipc.DayPlanItem{{At: stored, Text: "позвонить маме", Kind: "reminder"}},
+		}},
+		now: func() time.Time { return time.Date(2026, 8, 3, 9, 0, 0, 0, away) },
+	}
+	reply, ok := h.queryDayPlan(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "что дальше?"},
+	})
+	if !ok {
+		t.Fatal("expected the plan source to claim it")
+	}
+	if want := stored.In(away).Format("15:04"); !strings.Contains(reply, want) {
+		t.Errorf("the reminder is not read in his clock (%s): %q", want, reply)
+	}
+	if bad := stored.Format("15:04"); strings.Contains(reply, bad) {
+		t.Errorf("the reminder is read in the store's zone (%s): %q", bad, reply)
+	}
+}
+
+// The defect V-618 fixes, at the handler: asked at 04:45 the trim removes
+// nothing, because the whole day is still ahead. She read 43 entries aloud as
+// one sentence. The zone is three hours off UTC so the test also fails under
+// TZ=UTC if the rendering ever slips zones.
+func TestQueryDayPlanCapsWhatItReadsAloud(t *testing.T) {
+	zone := time.FixedZone("MSK", 3*60*60)
+	mid := time.Date(2026, 8, 3, 0, 0, 0, 0, zone)
+	plan := ipc.DayPlan{Date: mid, Spoken: "план на 03.08.2026: …"}
+	for i := 0; i < 43; i++ {
+		plan.Items = append(plan.Items, ipc.DayPlanItem{
+			At:   mid.Add(time.Duration(345+i*20) * time.Minute), // 05:45 onward
+			Text: fmt.Sprintf("пункт %d", i),
+			Kind: "event",
+		})
+	}
+	h := &reactiveHandler{api: &planAPI{plan: plan}, now: func() time.Time {
+		return time.Date(2026, 8, 3, 4, 45, 0, 0, zone)
+	}}
+	reply, ok := h.queryDayPlan(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "что дальше?"},
+	})
+	if !ok {
+		t.Fatal("expected the plan source to claim it")
+	}
+	if n := strings.Count(reply, "пункт "); n != morning.NextSpoken {
+		t.Errorf("read %d entries aloud, want %d: %q", n, morning.NextSpoken, reply)
+	}
+	if !strings.HasPrefix(reply, "дальше: 05:45 — пункт 0;") {
+		t.Errorf("the next thing is not first: %q", reply)
+	}
+	// The rest is counted, not silently dropped.
+	if !strings.Contains(reply, "и ещё 40 дел до конца дня.") {
+		t.Errorf("the sentence hides that the day goes on: %q", reply)
+	}
+}
+
+// "что у меня сегодня?" is the whole day and is not narrowed. It carries no
+// plan word, so the plan source declines it and the calendar listing answers —
+// asserted here beside the cap so the two questions cannot drift together.
+func TestWholeDayQuestionIsNotTheRestOfTheDay(t *testing.T) {
+	if router.IsDayPlanQuery("что у меня сегодня?") {
+		t.Error("the plan source claims the whole-day question")
+	}
+	if !router.IsDayPlanQuery("что дальше?") {
+		t.Error("the plan source stopped claiming the rest-of-day question")
+	}
+	if router.IsRestOfDayQuery("какие планы на сегодня?") {
+		t.Error("the whole-day plan question got narrowed to the rest of the day")
+	}
+}
+
 // A question that is not about the plan must fall through, or the plan buries
 // the calendar listing and the weather behind it.
 func TestQueryDayPlanPassesOnEverythingElse(t *testing.T) {

cmd/mavend/decisiontrace.go

@@ -0,0 +1,133 @@
+// mavend/decisiontrace.go — the daemon's half of the per-turn decision record.
+//
+// V-564. The router says what the cascade did (internal/router/decisiontrace.go);
+// this file covers the two claimant sets that live in the daemon: the stateful
+// resolvers that run BEFORE routing and pre-empt it unconditionally, and the
+// query source chain that runs after. Those two are where the arbitration is
+// least visible, because both are a hardcoded order of functions that each
+// answer "is this mine?" alone and none of which answers "is this more mine
+// than yours?" (V-558).
+//
+// Recording changes no route. Every helper here is a no-op on a context with no
+// record, which is what every test that does not ask for one gets.
+package main
+
+import (
+	"context"
+
+	"github.com/kami/maven/internal/decision"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/router"
+)
+
+// preRouteLadder — the resolvers runTurn offers the utterance to before the
+// router sees it, in the order they get their say. Kept here as a roster rather
+// than derived from the code, so a resolver that returns early and skips the
+// rest still leaves the rest NAMED in the record: a claimant that never looked
+// and one that looked and passed are the distinction the ordering hides, and
+// they are the difference between a bug in the ladder and a bug in a resolver.
+//
+// Adding a step to runTurn means adding its name here. Nothing enforces that,
+// and nothing should: a missing name costs one line of the record, while a
+// check that walks the ladder would have to run the ladder.
+var preRouteLadder = []string{
+	"confirm", "clarify-answer", "quiet-toggle", "snooze", "ack", "repair",
+	"repair-negative", "ordinal",
+}
+
+// notePreRoute records one rung of that ladder and passes its verdict through
+// unchanged, so the call site stays the single `if handled` it already was.
+func notePreRoute(ctx context.Context, name string, handled bool) bool {
+	rec := decision.From(ctx)
+	if rec == nil {
+		return handled
+	}
+	if handled {
+		rec.Note(decision.Claim{
+			Stage: decision.StagePreRoute, Claimant: name, Outcome: decision.Won,
+			Reason: "it pre-empted routing, so the router never saw this turn",
+		})
+		return handled
+	}
+	rec.Note(decision.Claim{
+		Stage: decision.StagePreRoute, Claimant: name, Outcome: decision.Declined,
+		Reason: "nothing of its own was pending",
+	})
+	return handled
+}
+
+// noteTerminal records whoever actually produced the reply, but only if the
+// turn is still unclaimed. A route decides the intent; it does not answer, and
+// on a thinned route or a plain act nothing downstream keeps a scoreboard. So
+// the record would otherwise close with an empty winner, which reads as a lost
+// turn instead of an asked question.
+func noteTerminal(ctx context.Context, claimant string, intent router.Intent, reason string) {
+	decision.From(ctx).NoteIfUnclaimed(decision.Claim{
+		Stage: decision.StageAction, Claimant: claimant,
+		Intent: string(intent), Reason: reason,
+	})
+}
+
+// noteMerge records the follow-up merge, which is the one claimant that edits
+// the winning decision instead of taking the turn from it. It is compared on
+// the four slots the merge can fill, because a Decision holds a slice and is
+// not comparable.
+func noteMerge(ctx context.Context, before, after router.Decision) {
+	rec := decision.From(ctx)
+	if rec == nil {
+		return
+	}
+	changed := before.Slots.HasTime != after.Slots.HasTime ||
+		before.Slots.HasKey != after.Slots.HasKey ||
+		before.Slots.HasFn != after.Slots.HasFn ||
+		before.Slots.Text != after.Slots.Text ||
+		before.Intent != after.Intent
+	if !changed {
+		rec.Note(decision.Claim{
+			Stage: decision.StageMerge, Claimant: "follow-up-merge", Outcome: decision.Declined,
+			Reason: "no slot of this turn was left for a previous one to fill",
+		})
+		return
+	}
+	rec.Note(decision.Claim{
+		Stage: decision.StageMerge, Claimant: "follow-up-merge", Intent: string(after.Intent),
+		Outcome: decision.Merged, Reason: "filled this turn's gaps from the previous turn",
+	})
+}
+
+// turnDecisionsFn — the reader mavweb gets, or nil when voice was never wired.
+// Same shape as intakeEventsFn: the daemon holds the ring, the IPC layer only
+// converts it.
+func turnDecisionsFn(w *voiceWiring) func(int) []ipc.TurnDecision {
+	if w == nil || w.handler == nil || w.handler.decisions == nil {
+		return nil
+	}
+	ring := w.handler.decisions
+	return func(n int) []ipc.TurnDecision {
+		recs := ring.Recent(n)
+		out := make([]ipc.TurnDecision, 0, len(recs))
+		for _, rec := range recs {
+			claims := make([]ipc.TurnClaim, 0, len(rec.Claims))
+			for _, c := range rec.Claims {
+				claims = append(claims, ipc.TurnClaim{
+					Stage: c.Stage, Claimant: c.Claimant, Intent: c.Intent,
+					Score: c.Score, HasScore: c.HasScore,
+					Outcome: c.Outcome, Reason: c.Reason,
+				})
+			}
+			out = append(out, ipc.TurnDecision{
+				Ts: rec.Ts, Utterance: rec.Utterance, Winner: rec.Winner, Claims: claims,
+			})
+		}
+		return out
+	}
+}
+
+// querySourceNames — the query chain's roster, in chain order.
+func querySourceNames() []string {
+	names := make([]string, len(querySources))
+	for i, src := range querySources {
+		names[i] = src.name
+	}
+	return names
+}

cmd/mavend/decisiontrace_test.go

@@ -0,0 +1,163 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/decision"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/memory"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/tool"
+	"github.com/kami/maven/internal/voice"
+)
+
+// traceHandler — a handler with the decision ring wired, the same shape the
+// daemon builds in wireVoice.
+func traceHandler(t *testing.T, ring *decision.Ring) *reactiveHandler {
+	t.Helper()
+	st := newTestStore(t)
+	api := ipc.NewStoreAPI(st)
+	now := time.Now()
+	emb := router.NewHashEmbedder(1024)
+	return &reactiveHandler{
+		api:       api,
+		recall:    recallWiring{embedder: emb, memStore: memory.NewInMemoryStore()},
+		router:    buildRouter(emb, tool.NewMatcher(api), 0.55, nil, nil),
+		replier:   voice.NewStubReplier(),
+		now:       func() time.Time { return now },
+		dataStore: st,
+		decisions: ring,
+	}
+}
+
+// findClaim — the first claim for a claimant, or nil.
+func findClaim(rec *decision.Record, claimant string) *decision.Claim {
+	for i := range rec.Claims {
+		if rec.Claims[i].Claimant == claimant {
+			return &rec.Claims[i]
+		}
+	}
+	return nil
+}
+
+// TestTurnRecordNamesWinnerAndLosers — the point of V-564. A turn a stage-0
+// grammar claims must leave a record naming that grammar as the winner, naming
+// a pre-route resolver that declined, and naming the routing engines that were
+// never reached at all. The last of those is the fact the hardcoded ordering
+// hides: "classifier" absent from the record and "classifier" never asked read
+// the same to a human, and only one of them is the truth.
+func TestTurnRecordNamesWinnerAndLosers(t *testing.T) {
+	ring := decision.NewRing()
+	h := traceHandler(t, ring)
+
+	reply := h.handleText(context.Background(), "web", "сколько сейчас времени")
+	if reply == "" {
+		t.Fatal("turn produced no reply")
+	}
+
+	recs := ring.Recent(5)
+	if len(recs) != 1 {
+		t.Fatalf("want 1 record, got %d", len(recs))
+	}
+	rec := recs[0]
+	if rec.Utterance != "сколько сейчас времени" {
+		t.Errorf("utterance = %q", rec.Utterance)
+	}
+	if !strings.HasPrefix(rec.Winner, "stage0:") {
+		t.Errorf("want a stage-0 grammar as the winner, got %q", rec.Winner)
+	}
+
+	// A loser that examined the turn: the confirm resolver ran first and had
+	// nothing pending.
+	confirm := findClaim(rec, "confirm")
+	if confirm == nil || confirm.Outcome != decision.Declined {
+		t.Errorf("confirm claim = %+v, want a decline", confirm)
+	}
+
+	// A loser that never looked: stage 0 answered, so neither routing engine
+	// was reached.
+	for _, name := range []string{"llm-router", "classifier"} {
+		c := findClaim(rec, name)
+		if c != nil && c.Outcome == decision.Won {
+			t.Errorf("%s cannot have won a stage-0 turn: %+v", name, c)
+		}
+	}
+
+	// And every rung of the ladder below the winner is named, not omitted.
+	for _, name := range preRouteLadder {
+		if findClaim(rec, name) == nil {
+			t.Errorf("ladder rung %q is missing from the record", name)
+		}
+	}
+}
+
+// TestRecordingDoesNotChangeTheReply — instrumentation, so a turn with the ring
+// wired and the same turn without it must answer identically. If this ever
+// fails, a claim site is doing more than noting.
+func TestRecordingDoesNotChangeTheReply(t *testing.T) {
+	for _, utt := range []string{
+		"сколько сейчас времени",
+		"запиши что я пил воду",
+		"что у меня сегодня",
+	} {
+		withRing := traceHandler(t, decision.NewRing()).handleText(context.Background(), "web", utt)
+		without := traceHandler(t, nil).handleText(context.Background(), "web", utt)
+		if withRing != without {
+			t.Errorf("%q: recorded reply %q != unrecorded %q", utt, withRing, without)
+		}
+	}
+}
+
+// TestQueryChainRecordsWhoWasNeverAsked — a query source below the claimant is
+// never consulted, and the record must say so rather than leave it out. This is
+// the arm that would have explained the Rome misroute in one read.
+func TestQueryChainRecordsWhoWasNeverAsked(t *testing.T) {
+	ring := decision.NewRing()
+	h := traceHandler(t, ring)
+	h.handleText(context.Background(), "web", "что у меня сегодня")
+
+	rec := ring.Recent(1)[0]
+	var asked, never int
+	for _, c := range rec.Claims {
+		if c.Stage != decision.StageQuery {
+			continue
+		}
+		if c.Outcome == decision.NeverAsked {
+			never++
+		} else {
+			asked++
+		}
+	}
+	if asked == 0 {
+		t.Fatal("no query source reported at all")
+	}
+	if never == 0 {
+		t.Fatal("no query source was recorded as never asked; the chain cannot have run to the end")
+	}
+	if got := len(querySourceNames()); asked+never != got {
+		t.Errorf("record covers %d of %d query sources", asked+never, got)
+	}
+}
+
+// TestTurnDecisionsFnConvertsTheRing — the IPC read path. Nil when voice was
+// never wired, because a box with no turns is an empty page and not an error.
+func TestTurnDecisionsFnConvertsTheRing(t *testing.T) {
+	if fn := turnDecisionsFn(nil); fn != nil {
+		t.Error("no wiring should mean no reader")
+	}
+	ring := decision.NewRing()
+	h := traceHandler(t, ring)
+	h.handleText(context.Background(), "web", "сколько сейчас времени")
+
+	fn := turnDecisionsFn(&voiceWiring{handler: h})
+	if fn == nil {
+		t.Fatal("wired handler produced no reader")
+	}
+	out := fn(10)
+	if len(out) != 1 || out[0].Winner == "" || len(out[0].Claims) == 0 {
+		t.Fatalf("conversion lost the record: %+v", out)
+	}
+}

cmd/mavend/dialogue_contract_test.go

@@ -0,0 +1,807 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"log"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/memory"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/store"
+)
+
+// Dialogue contract tests (V-563, child of V-558).
+//
+// Every other clarify test is single-shot: one ask, one answer, one assertion.
+// Three bugs of the same family shipped in two days that way — V-554 (a parked
+// question ate the three turns after it), V-557 (a confidently routed but
+// incomplete reminder parked nothing, so the answer was web-searched) and the
+// Rome case in V-558 (a side question was eaten as the time answer). None of
+// them is visible in one turn. The dialogue path is a state machine, so it can
+// be enumerated instead: whole traces, each with a per-turn expectation and an
+// expected END state — what was written to the store, and what is still parked.
+//
+// Two rules for the rows below.
+//
+// Where today's behaviour is correct, it is asserted. Where it is WRONG, the row
+// carries the CORRECT expectation and is skipped with the Vikunja id that will
+// unskip it. A weakened expectation would be worse than no row: it would pin the
+// bug as the contract.
+//
+// Everything runs on the offline floor — hash embedder, no llama-server, no
+// ONNX, StubDateTimeParser. That has one consequence worth knowing before
+// reading a fire time here: the stub reads "в 11:00" and "через час" and does
+// not read "на 9" or "на завтра", so a trace that needs those is noted where it
+// sits.
+
+// claim — which claimant consumed an utterance. Not asserted: it is derived from
+// the log lines the daemon already emits and printed on every failure, because
+// "the reply differed" does not distinguish a wrong claimant from wrong copy,
+// and that distinction is the whole point of V-558.
+type claim struct {
+	utterance string
+	steps     []string
+}
+
+func (c claim) String() string { return c.utterance + " ⇒ " + strings.Join(c.steps, " → ") }
+
+// claimMarkers — log fragment to claimant name, in the order runTurn checks
+// them. The fragments are the daemon's own words (clarify.go, repair.go,
+// voice.go); a rename there shows up here as an "unclaimed" step rather than a
+// silent mislabel.
+var claimMarkers = []struct{ fragment, name string }{
+	{"parked question expired", "clarify:expired"},
+	{"is its own request", "clarify:stepped-aside"},
+	{"gave up on", "clarify:gave-up"},
+	{"did not fill", "clarify:re-ask"},
+	{"one gap filled", "clarify:ask-second-gap"},
+	{"asked about", "clarify:ask"},
+	{"repair —", "repair"},
+	{"route result: intent=", "route"},
+}
+
+// claimsOf reads the turn's log output and names the claimants that touched it.
+func claimsOf(utterance, logged string) claim {
+	c := claim{utterance: utterance}
+	for _, line := range strings.Split(logged, "\n") {
+		for _, m := range claimMarkers {
+			if strings.Contains(line, m.fragment) {
+				name := m.name
+				if m.name == "route" {
+					name = "route:" + intentInLine(line)
+				}
+				c.steps = append(c.steps, name)
+				break
+			}
+		}
+	}
+	if len(c.steps) == 0 {
+		c.steps = []string{"unclaimed"}
+	}
+	return c
+}
+
+func intentInLine(line string) string {
+	_, rest, ok := strings.Cut(line, "intent=")
+	if !ok {
+		return "?"
+	}
+	intent, _, _ := strings.Cut(rest, " ")
+	return intent
+}
+
+// parkedWant — the question that must be armed after a turn. Attempt matters:
+// a claimant that spends a retry on an utterance that was never an answer is
+// exactly the V-554 shape, and the count is the only place it shows.
+type parkedWant struct {
+	slot    dialogue.Slot
+	attempt int
+	// carries — a substring the parked utterance must still hold, so a re-park
+	// that lost the answered subject fails here rather than three turns later.
+	carries string
+}
+
+// turn — one utterance and everything that must be true right after it.
+type turn struct {
+	say string
+	// wait — the clock moves this far BEFORE the utterance. The only way to
+	// reach the TTL without sleeping.
+	wait time.Duration
+	// question — the reply must be exactly this clarify question, worded for
+	// this attempt. Zero slot ⇒ not checked.
+	question dialogue.Slot
+	attempt  int
+	// gap — which part of the time she is asking about, for a SlotTime question
+	// (V-579). Zero value is the missing hour, which is what she asks first.
+	gap whenGap
+	// took — the words of the PREVIOUS turn that this ask must acknowledge
+	// before asking again (V-593). Empty ⇒ the ask carries no acknowledgement,
+	// which is right for a first ask and for an answer that moved nothing.
+	took string
+	// differs — this reply must not be byte-identical to the one before it. Set
+	// on a re-ask whose turn moved the request forward (V-593).
+	differs    bool
+	contains   []string
+	notContain []string
+	// noQuestion — the reply must not be any clarify question. Used where the
+	// correct behaviour is known but her wording for it is not written yet: a
+	// cancel must not be answered with another question, whatever it does say.
+	noQuestion bool
+	expired    bool // the reply must open with the TTL notice
+	// parked — what is armed after the turn. nil ⇒ nothing may be armed.
+	parked *parkedWant
+}
+
+// endState — what the store holds once the trace is over. Counts and
+// substrings, not rows: a trace is about who claimed what, and a payload
+// substring is enough to catch a request landing under the wrong words.
+type endState struct {
+	reminders []reminderWant
+	factKeys  []string
+	notes     int
+	tasks     []string
+}
+
+type reminderWant struct {
+	payload string // substring of the stored payload
+	fireAt  string // "2006-01-02 15:04" in UTC, "" ⇒ not checked
+}
+
+// trace — a named conversation, its turns, and the end state.
+type trace struct {
+	name  string
+	skip  string // non-empty ⇒ t.Skip: today's behaviour is wrong, this names the fix
+	turns []turn
+	end   endState
+}
+
+// newDialogueHandler — the offline floor with the real cascade and a movable
+// clock: newClarifyHandler's wiring (stub date parser, real fact parser, tool
+// matcher) plus the router newRoutingClarifyHandler builds, and the `now`
+// pointer so a turn can carry a wait.
+func newDialogueHandler(t *testing.T) (*reactiveHandler, *store.Store, *time.Time) {
+	t.Helper()
+	h, st, now := newClarifyHandler(t)
+	// A minute no trace ever says, so "fires at the current clock" is a defect
+	// and never a coincidence (V-577, V-579). checkEnd refuses any reminder
+	// landing on it, and at 09:00 the row that answers "на 9" would trip that.
+	*now = time.Date(2026, 7, 31, 9, 17, 0, 0, time.UTC)
+	h.router = buildRouter(router.NewHashEmbedder(1024), h.matcher, 0.55, nil, nil)
+	h.recall = recallWiring{embedder: router.NewHashEmbedder(1024), memStore: memory.NewInMemoryStore()}
+	return h, st, now
+}
+
+// wantedQuestion builds the question a turn must be answered with, from the
+// same code the daemon asks through. A time question is built from the gap,
+// because she names the clock and asks about the part he left out (V-579).
+func wantedQuestion(tn turn, now time.Time) (string, bool) {
+	if tn.question == dialogue.SlotTime {
+		gap := tn.gap
+		if gap == whenComplete {
+			gap = whenNoHour
+		}
+		return whenQuestion(gap, tn.attempt, now, whenTakenLine(tn.took))
+	}
+	return clarifyQuestionFor(tn.question, tn.attempt)
+}
+
+// runTrace drives one trace through handleText and checks every turn, then the
+// end state. Every failure carries the decision trace so far, so a wrong
+// claimant reads differently from wrong copy.
+func runTrace(t *testing.T, tr trace) {
+	t.Helper()
+	// MAVEN_DIALOGUE_NO_SKIP=1 runs the rows that fail today. That is how
+	// whoever lands V-560, V-561 or V-562 sees their row go green before
+	// deleting its skip, and it is also the check that a skip is still earned:
+	// a row that passes with the skip in place is a fix nobody noticed.
+	if tr.skip != "" && os.Getenv("MAVEN_DIALOGUE_NO_SKIP") == "" {
+		t.Skip(tr.skip)
+	}
+	ctx := context.Background()
+	h, st, now := newDialogueHandler(t)
+	const conversation = "web"
+	id := dialogueIDFor(sourceText, conversation)
+
+	var claims []claim
+	var previous string
+	fail := func(turnIdx int, format string, args ...any) {
+		t.Helper()
+		lines := make([]string, 0, len(claims))
+		for _, c := range claims {
+			lines = append(lines, "    "+c.String())
+		}
+		t.Fatalf("turn %d: "+format+"\n  who claimed what:\n%s",
+			append([]any{turnIdx}, append(args, strings.Join(lines, "\n"))...)...)
+	}
+
+	for i, tn := range tr.turns {
+		if tn.wait > 0 {
+			*now = now.Add(tn.wait)
+		}
+		var logged bytes.Buffer
+		prev := log.Writer()
+		log.SetOutput(&logged)
+		reply := h.handleText(ctx, conversation, tn.say)
+		log.SetOutput(prev)
+		claims = append(claims, claimsOf(tn.say, logged.String()))
+
+		body := reply
+		if tn.expired {
+			if !isClarifyExpired(reply) {
+				fail(i, "reply %q must open with the expiry notice", reply)
+			}
+			body = trimClarifyExpired(reply)
+			// The notice is glued in front of this turn's reply, and both halves
+			// have to survive: the words he just said are routed fresh, and
+			// answering only "I let the old one go" drops them.
+			if body == "" {
+				fail(i, "the notice was the whole reply; the fresh words were never answered")
+			}
+		} else if isClarifyExpired(reply) {
+			fail(i, "reply %q announced an expiry nothing asked for", reply)
+		}
+		if tn.question != "" {
+			want, ok := wantedQuestion(tn, h.now())
+			if !ok {
+				fail(i, "no question exists for slot %s attempt %d", tn.question, tn.attempt)
+			}
+			if body != want {
+				fail(i, "reply %q, want the %s question worded for attempt %d, %q", body, tn.question, tn.attempt, want)
+			}
+		}
+		if tn.noQuestion && isAnyClarifyQuestion(body) {
+			fail(i, "reply %q is another question; this turn is not something to ask about", body)
+		}
+		for _, want := range tn.contains {
+			if !strings.Contains(body, want) {
+				fail(i, "reply %q does not carry %q", body, want)
+			}
+		}
+		for _, unwanted := range tn.notContain {
+			if strings.Contains(body, unwanted) {
+				fail(i, "reply %q carries %q and must not", body, unwanted)
+			}
+		}
+		if tn.differs && reply == previous {
+			fail(i, "reply %q is byte-identical to the one before it, and his turn between them answered part of the gap", reply)
+		}
+		previous = reply
+		checkParked(t, fail, i, h.clarifyStore.Get(id, h.now()), tn.parked)
+	}
+	checkEnd(t, ctx, st, h, tr.end, claims)
+}
+
+// isAnyClarifyQuestion — is this reply one of her clarify questions, at any
+// attempt wording? Reads the templates rather than a list of its own.
+func isAnyClarifyQuestion(reply string) bool {
+	for _, variants := range clarifyQuestionVariants {
+		for _, v := range variants {
+			// HasSuffix, not equality: a question about the time opens with the
+			// clock she is reasoning from (V-579).
+			if strings.HasSuffix(reply, v) {
+				return true
+			}
+		}
+	}
+	// The two questions with no deck behind them, asked when the hour is said
+	// and its half of the day or its day is not.
+	return strings.HasSuffix(reply, "утра или вечера?") || strings.HasSuffix(reply, "В какой день?")
+}
+
+func checkParked(t *testing.T, fail func(int, string, ...any), i int, got *dialogue.PendingQuestion, want *parkedWant) {
+	t.Helper()
+	if want == nil {
+		if got != nil {
+			fail(i, "a question about %v is still armed and nothing should be: %+v", got.Missing, got.Slots)
+		}
+		return
+	}
+	if got == nil {
+		fail(i, "nothing is armed, want a question about %s (attempt %d)", want.slot, want.attempt)
+		return
+	}
+	if len(got.Missing) != 1 || got.Missing[0] != want.slot {
+		fail(i, "armed question is about %v, want %s", got.Missing, want.slot)
+	}
+	if got.Attempts != want.attempt {
+		fail(i, "armed question is on attempt %d, want %d — a retry spent on something that was never an answer is the V-554 shape", got.Attempts, want.attempt)
+	}
+	if want.carries != "" && !strings.Contains(got.Utterance, want.carries) {
+		fail(i, "the parked request no longer carries %q: %q", want.carries, got.Utterance)
+	}
+}
+
+func checkEnd(t *testing.T, ctx context.Context, st *store.Store, h *reactiveHandler, want endState, claims []claim) {
+	t.Helper()
+	lines := make([]string, 0, len(claims))
+	for _, c := range claims {
+		lines = append(lines, "    "+c.String())
+	}
+	trace := "\n  who claimed what:\n" + strings.Join(lines, "\n")
+
+	reminders, err := st.DueReminders(ctx, h.now().Add(14*24*time.Hour))
+	if err != nil {
+		t.Fatalf("DueReminders: %v", err)
+	}
+	if len(reminders) != len(want.reminders) {
+		t.Fatalf("end state: %d reminder(s), want %d: %+v%s", len(reminders), len(want.reminders), reminders, trace)
+	}
+	// No trace may leave a reminder at the current clock, whatever else it
+	// asserts (V-577, V-579). Twice on the box a sentence naming a day and no
+	// hour was completed from time.Now(): "что у меня сегодня?" became 01:28 and
+	// "на завтра" became 01:38. Neither minute was ever spoken, and a row that
+	// only checked the payload would have passed both.
+	for _, r := range reminders {
+		if r.FireTs.In(h.now().Location()).Format("15:04") == h.now().Format("15:04") {
+			t.Fatalf("end state: reminder %q fires at %s, which is the clock — a time slot naming no hour is asked about, never filled from now()%s",
+				r.Payload, r.FireTs.Format("15:04"), trace)
+		}
+	}
+	for i, w := range want.reminders {
+		if !strings.Contains(reminders[i].Payload, w.payload) {
+			t.Fatalf("end state: reminder %d payload %q does not carry %q%s", i, reminders[i].Payload, w.payload, trace)
+		}
+		if w.fireAt != "" {
+			if got := reminders[i].FireTs.UTC().Format("2006-01-02 15:04"); got != w.fireAt {
+				t.Fatalf("end state: reminder %d fires at %s, want %s%s", i, got, w.fireAt, trace)
+			}
+		}
+	}
+
+	facts, err := st.RecentFacts(ctx, 20)
+	if err != nil {
+		t.Fatalf("RecentFacts: %v", err)
+	}
+	if len(facts) != len(want.factKeys) {
+		t.Fatalf("end state: %d fact(s), want %d: %+v%s", len(facts), len(want.factKeys), facts, trace)
+	}
+	for i, key := range want.factKeys {
+		if facts[i].Key != key {
+			t.Fatalf("end state: fact %d is %q, want %q%s", i, facts[i].Key, key, trace)
+		}
+	}
+
+	notes, err := st.RecentNotes(ctx, 20)
+	if err != nil {
+		t.Fatalf("RecentNotes: %v", err)
+	}
+	if len(notes) != want.notes {
+		t.Fatalf("end state: %d note(s), want %d%s", len(notes), want.notes, trace)
+	}
+
+	tasks, err := st.ListTasks(ctx, store.TaskOpen)
+	if err != nil {
+		t.Fatalf("ListTasks: %v", err)
+	}
+	if len(tasks) != len(want.tasks) {
+		t.Fatalf("end state: %d open task(s), want %d: %+v%s", len(tasks), len(want.tasks), tasks, trace)
+	}
+	for i, text := range want.tasks {
+		if !strings.Contains(tasks[i].Text, text) {
+			t.Fatalf("end state: task %d is %q, want it to carry %q%s", i, tasks[i].Text, text, trace)
+		}
+	}
+}
+
+func TestDialogueTraces(t *testing.T) {
+	for _, tr := range dialogueTraces() {
+		tr := tr
+		t.Run(tr.name, func(t *testing.T) { runTrace(t, tr) })
+	}
+}
+
+// dialogueTraces — the fixture. Order is the order the shapes were found, not a
+// dependency: each trace builds its own handler and store.
+func dialogueTraces() []trace {
+	return []trace{
+		// The plain two-turn shape, and the one every other row is a deviation
+		// from: she asks for the time, he gives it, the reminder lands with the
+		// subject he said in the FIRST turn.
+		{
+			// Three turns since V-579, not two. An hour with no day named is
+			// not an answer she can act on: 11:00 today has passed as often as
+			// not, and picking one for him is the invention the whole rule is
+			// against. So she says the clock she is reasoning from and asks
+			// which day.
+			name: "reminder completed over three turns",
+			turns: []turn{
+				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "маме"}},
+				{say: "в 11:00", question: dialogue.SlotTime, attempt: 2, gap: whenNoDay, took: "в 11:00",
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 2, carries: "маме"}},
+				{say: "сегодня", contains: []string{"11:00"}, notContain: []string{"?"}},
+			},
+			end: endState{reminders: []reminderWant{{payload: "позвонить маме", fireAt: "2026-07-31 11:00"}}},
+		},
+		// The same shape on the fact path, where the answer carries both halves
+		// of what was missing — the key and the value — in one breath.
+		{
+			name: "fact completed over two turns",
+			turns: []turn{
+				{say: "запиши", question: dialogue.SlotKey, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotKey, attempt: 1}},
+				// His words back, not the key the parser filed them under
+				// (V-592). "water" is machine vocabulary and he never said it.
+				{say: "пил воду", contains: []string{"пил воду"}},
+			},
+			end: endState{factKeys: []string{"water"}},
+		},
+		// An answer past the TTL is a new request, not an answer (V-385). She
+		// says the old one is gone and routes the words fresh. A bare time on
+		// its own carries no request, so the fresh routing lands on the canned
+		// reply — the point of the row is that NOTHING is created: a reminder
+		// here would fire with the subject of a request she had already let go.
+		{
+			name: "answer arrives after the TTL",
+			turns: []turn{
+				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1}},
+				{say: "в 11:00", wait: clarifyTTL + time.Second, expired: true},
+			},
+			end: endState{},
+		},
+		// Three questions is the budget, and running out is SPOKEN: a mute
+		// give-up reads as "done" and he would wait for a reminder that was
+		// never set. The wording changes with the attempt (V-457).
+		{
+			name: "three unclear answers then the give-up line",
+			turns: []turn{
+				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1}},
+				{say: "ну не знаю", question: dialogue.SlotTime, attempt: 2,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 2}},
+				{say: "ну не знаю", question: dialogue.SlotTime, attempt: 3,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 3}},
+				{say: "ну не знаю", contains: []string{clarifyGaveUp}, noQuestion: true},
+			},
+			end: endState{},
+		},
+		// A correction points at the previous ACTED turn (repair.go): she redoes
+		// it under the intent he names and says so out loud, because a
+		// correction he cannot see is indistinguishable from one that was
+		// dropped. The task she filed first stays filed — repair redoes, it does
+		// not retract, and V-455 decided that deliberately.
+		//
+		// The corrected-to intent has to differ from the one she used, or repair
+		// declines: teaching the classifier the label it already produced is
+		// worse than doing nothing.
+		{
+			name: "correction of the previous turn",
+			turns: []turn{
+				{say: "добавь в задачи купить молоко", contains: []string{"купить молоко"}},
+				{say: "нет, это был вопрос", contains: []string{"поняла, это вопрос"}},
+			},
+			end: endState{tasks: []string{"купить молоко"}},
+		},
+		// He walks away from his own request: a question is parked, the next
+		// utterance is an unrelated request of its own, and nothing follows.
+		// V-554's fix is what makes this row pass — the question steps aside
+		// rather than scoring "добавь в задачи" as the time. The reminder is
+		// dropped in silence and that is the decision: if he meant it he says it
+		// again, and a question left armed eats the turn after next.
+		{
+			name: "abandoned flow: parked, then an unrelated request",
+			turns: []turn{
+				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1}},
+				{say: "добавь в задачи купить молоко", contains: []string{"купить молоко"}},
+				{say: "спасибо"},
+			},
+			end: endState{tasks: []string{"купить молоко"}},
+		},
+
+		// V-577 shape 1, the worst of the nine claimants measured on 2026-08-06.
+		// Every token of "что у меня сегодня?" is frame — an interrogative, a
+		// preposition, a particle and a day word — so the role classifier never
+		// looked at the route, the parked reminder read "сегодня" as its time,
+		// and the hour came from the clock. He got a reminder he never asked for
+		// at a minute he never said, and his question was answered nowhere.
+		//
+		// Two claims: the calendar answers, and nothing is written. The flow
+		// survives underneath, because a question of his own is not a request to
+		// abandon the one he was making.
+		{
+			name: "an agenda question mid-flow is answered, not eaten",
+			turns: []turn{
+				{say: "напомни забрать посылку", question: dialogue.SlotTime, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "посылку"}},
+				{say: "что у меня сегодня?", contains: []string{"31.07.2026"},
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "посылку"}},
+			},
+			end: endState{},
+		},
+		// V-577 shape 2. He states something in the middle of the flow. It is
+		// neither a slot value nor a cancel, and it was scored as a failed
+		// answer and dropped in silence: alone the same sentence is stored.
+		// Silence is the one option that is wrong, so it is stored, no retry is
+		// spent, and the question comes back on the end of the same reply.
+		//
+		// The words are a fact and not the owner's note, because the fact parser
+		// is deterministic and the offline floor marks every classifier route
+		// Clarify. The row below carries his own sentence and needs the model.
+		//
+		// What this floor can prove is the arbitration: no retry is spent, the
+		// flow survives on the same attempt, and the words are answered as
+		// themselves with the question coming back after them. Whether the fact
+		// is then WRITTEN is the routing engine's business — the hash embedder
+		// is unsure of every sentence it sees, and an unsure fact has never been
+		// stored.
+		{
+			name: "a fact stated mid-flow steps aside without spending a retry",
+			turns: []turn{
+				{say: "напомни позвонить врачу", question: dialogue.SlotTime, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "врачу"}},
+				// Nothing she says about it may be a word he did not say
+				// (V-592). On the box this sentence came back as "Проверила, что
+				// ты выпел стакан воды": a non-word for the verb, a glass copied
+				// out of the example in ReplySystemPrompt, and a claim to have
+				// checked something. The store held key=water value="drank"
+				// throughout, so all of it was generated from two tokens.
+				//
+				// The positive half of the contract — the confirmation IS his
+				// sentence — is asserted by "fact completed over two turns"
+				// above. It cannot be asserted here: the hash embedder marks
+				// this route Clarify, and an unsure fact is answered with the
+				// canned line rather than a confirmation of anything.
+				{say: "я выпил воды", contains: []string{"напоминание?"},
+					notContain: []string{"стакан", "выпел", "Проверила", "water"},
+					parked:     &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "врачу"}},
+			},
+			end: endState{},
+		},
+		// V-593: two asks about the same half of the day, with a turn between
+		// them that answered the DAY. Asking again is right and asking in the
+		// same bytes is not — from his side it is indistinguishable from not
+		// having been heard, which is what the whole V-558 family is about.
+		//
+		// The clock still opens every ask (the owner's rule, V-579); the
+		// acknowledgement goes after it and before the question.
+		{
+			name: "a re-ask names what the answer before it gave her",
+			turns: []turn{
+				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1}},
+				{say: "на 9", question: dialogue.SlotTime, attempt: 2, gap: whenAmbiguousHour, took: "на 9",
+					contains: []string{"Сейчас "},
+					parked:   &parkedWant{slot: dialogue.SlotTime, attempt: 2}},
+				{say: "на завтра", question: dialogue.SlotTime, attempt: 3, gap: whenAmbiguousHour, took: "на завтра",
+					contains: []string{"Сейчас ", "завтра"}, differs: true,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 3}},
+			},
+			end: endState{},
+		},
+		// V-579 turn 3: the preposition decided whether the hour was read. "в 9"
+		// set the reminder and "на 9" was not read at all, on the same build and
+		// with the same cardinal.
+		{
+			// It is read, and being read is not the same as being enough: nine is
+			// either half of the day, so she asks which and then which day
+			// (V-579). Both answers are frame words and neither carries an hour
+			// of its own, so this row is also the proof that an answer is read
+			// against the whole request rather than alone.
+			name: "на 9 answers the time question like в 9",
+			turns: []turn{
+				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1}},
+				{say: "на 9", question: dialogue.SlotTime, attempt: 2, gap: whenAmbiguousHour, took: "на 9",
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 2}},
+				{say: "утра", question: dialogue.SlotTime, attempt: 3, gap: whenNoDay, took: "утра",
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 3}},
+				{say: "завтра", contains: []string{"09:00"}},
+			},
+			end: endState{reminders: []reminderWant{{payload: "позвонить маме", fireAt: "2026-08-01 09:00"}}},
+		},
+		// The owner's own four, ruled 2026-08-06 (V-579). A reminder commits
+		// when what, what time and what day are all answered, and every ask
+		// states the clock she is reasoning from.
+		{
+			name: "his first example: a bare 3 is asked about",
+			turns: []turn{
+				{say: "напомни завтра в 3 заказать цветы",
+					question: dialogue.SlotTime, attempt: 1, gap: whenAmbiguousHour,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "цветы"}},
+			},
+			end: endState{},
+		},
+		{
+			// The hour is unambiguous and the day is still missing, so she asks.
+			// Today being a valid reading is not the same as him saying it.
+			name: "his second example: nine in the evening of which day",
+			turns: []turn{
+				{say: "напомни в 9 вечера разгрузить стиралку",
+					question: dialogue.SlotTime, attempt: 1, gap: whenNoDay,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "стиралку"}},
+				{say: "завтра", contains: []string{"21:00"}},
+			},
+			end: endState{reminders: []reminderWant{{payload: "стиралку", fireAt: "2026-08-01 21:00"}}},
+		},
+		{
+			// All three answered in one breath, so she does not ask at all.
+			name: "his third example: a full time commits",
+			turns: []turn{
+				{say: "напомни завтра в 15:00 заказать цветы", notContain: []string{"?"}},
+			},
+			end: endState{reminders: []reminderWant{{payload: "цветы", fireAt: "2026-08-01 15:00"}}},
+		},
+		{
+			// An interval is one instant, so it answers the hour and the day
+			// together. Confirmed by the owner: "через час is fine as is".
+			name: "an interval commits without a question",
+			turns: []turn{
+				{say: "напомни через час позвонить маме", notContain: []string{"?"}},
+			},
+			end: endState{reminders: []reminderWant{{payload: "маме", fireAt: "2026-07-31 10:17"}}},
+		},
+		// V-579 turn 4: he named a day and no hour, and got the day at the
+		// current minute. She has to ask instead, and the global check in
+		// checkEnd refuses the invented minute for every row at once.
+		{
+			name: "a day with no hour is asked about, not taken from the clock",
+			turns: []turn{
+				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1}},
+				{say: "на завтра", question: dialogue.SlotTime, attempt: 2,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 2}},
+			},
+			end: endState{},
+		},
+
+		// ---- rows below carry the CORRECT expectation and fail today ----
+
+		// The owner's own sentence from V-577 shape 2, in his words. It needs
+		// an engine that can route it: the hash embedder marks it note with
+		// Clarify set, and a route she is not sure of is not evidence that he
+		// stated anything. The row above is the same contract in words the
+		// floor's deterministic fact parser reads.
+		{
+			name: "a note stated mid-flow is stored, not dropped",
+			skip: "the offline floor cannot route «у меня новый ноутбук» confidently; needs the resident model",
+			turns: []turn{
+				{say: "напомни позвонить врачу", question: dialogue.SlotTime, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "врачу"}},
+				{say: "у меня новый ноутбук",
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "врачу"}},
+			},
+			end: endState{notes: 1},
+		},
+
+		// The owner's target transcript, V-561. He asks for a reminder, she asks
+		// when, he asks something else entirely, and then comes back to her
+		// question. On the box this created a reminder at 00:12 and never
+		// answered Rome; on the offline floor the side question is recognised as
+		// its own request and the flow is dropped instead, so the wrong reminder
+		// is not made and the right one is not either.
+		//
+		// Both are the same defect: there is no suspend and resume. The correct
+		// shape is the middle turn answered on its own and the parked question
+		// still standing, on the same attempt — a side query is not a failed
+		// answer and must not spend a retry.
+		//
+		// The skip came off with V-579. What held it was the parser, not the
+		// arbitration: neither the stub nor the production one read "на 9",
+		// because only "в" framed a spoken hour, and "на завтра" was completed
+		// from the clock.
+		//
+		// Turn 3 now closes the flow, where the transcript has one more exchange
+		// in it. That is the 12-hour question — the owner's turn 4 answers "на
+		// 9" with "сейчас 15:23, на 9 сегодня вечером?" — and it is a decision of
+		// its own, not one to invent here. Nine o'clock is read as nine and, at
+		// 09:17, as tomorrow's, which is where the transcript ends up anyway.
+		// Turn 4 then has nothing to answer and must not write anything.
+		{
+			name: "the owner's transcript from V-561",
+			turns: []turn{
+				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1}},
+				{say: "какая сейчас погода в Риме?",
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "маме"}},
+				// His words, unchanged. What changed under V-579 is that "на 9"
+				// is a question and not a commit: nine could be either half of
+				// the day, so she says the clock she is reading from and asks.
+				// "на завтра." then answers the day and leaves the half open, so
+				// she asks that one again.
+				// Each ask names what the turn before it gave her (V-593). The
+				// two asks about the half of the day are the same question and
+				// must not be the same sentence: he answered between them, and a
+				// reply with no trace of that reads as not having been heard.
+				{say: "а, да, прости - на 9.", question: dialogue.SlotTime, attempt: 2, gap: whenAmbiguousHour, took: "а, да, прости - на 9.",
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 2}},
+				{say: "на завтра.", question: dialogue.SlotTime, attempt: 3, gap: whenAmbiguousHour, took: "на завтра.",
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 3}},
+			},
+			end: endState{},
+		},
+		// The same shape said in words StubDateTimeParser reads. GREEN since
+		// V-561. Same three claims: Rome is answered, the question survives the
+		// side query on the same attempt, and the answer after it completes the
+		// reminder he actually asked for.
+		//
+		// It sits under the "fail today" header because the row above it still
+		// does. Do not re-skip it to tidy that up: this is the owner's
+		// acceptance test in the only words the offline floor can read.
+		{
+			name: "nested question: a parked question, then one of his own",
+			turns: []turn{
+				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1}},
+				{say: "какая сейчас погода в Риме?",
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "маме"}},
+				{say: "в 11:00", question: dialogue.SlotTime, attempt: 2, gap: whenNoDay, took: "в 11:00",
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 2, carries: "маме"}},
+				{say: "сегодня", contains: []string{"11:00"}},
+			},
+			end: endState{reminders: []reminderWant{{payload: "позвонить маме", fireAt: "2026-07-31 11:00"}}},
+		},
+		// A cancel is one of the five turn roles V-560 names, and today it is
+		// none of them: "неважно" fills no slot and carries no request of its
+		// own, so it reads as a failed answer and spends a retry. Two turns
+		// later she is still asking about a reminder he called off.
+		//
+		// The row asserts what is knowable — nothing armed, nothing written, and
+		// not another question — rather than her wording for it, which is not
+		// written yet and is not this task's to invent.
+		{
+			name: "cancel: a parked question, then never mind",
+			skip: "V-560: a cancel is scored as a failed answer, not as a cancel",
+			turns: []turn{
+				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1}},
+				{say: "неважно", noQuestion: true},
+			},
+			end: endState{},
+		},
+		// Order in runTurn is the whole arbitration (V-558), and this is what it
+		// costs: the clarify answer is checked at step 3 and the repair marker at
+		// step 4d, so while a question is parked no correction can be made. She
+		// scores "нет, это была заметка" as a bad time answer and asks again.
+		{
+			name: "correction while a question is parked",
+			skip: "V-560: clarify pre-empts the repair marker, so a correction cannot be spoken mid-flow",
+			turns: []turn{
+				{say: "добавь в задачи купить молоко", contains: []string{"купить молоко"}},
+				{say: "напомни позвонить маме", question: dialogue.SlotTime, attempt: 1,
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1}},
+				{say: "нет, это был вопрос", contains: []string{"поняла, это вопрос"},
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1, carries: "маме"}},
+			},
+			end: endState{tasks: []string{"купить молоко"}},
+		},
+		// A reminder said whole, in one breath, with the hour in it — and she
+		// asks when. ReminderGrammar (stage0.go) builds its slots by hand and
+		// never runs the extractor, so a stage-0 reminder carries no time
+		// whatever the sentence says, and the clarify gate reads the gap as
+		// real. It costs a turn on the commonest reminder shape there is.
+		//
+		// Hermetic despite the date parser: stage 0 calls no parser at all, so
+		// this fails the same way with or without python dateparser installed.
+		{
+			name: "a reminder said whole is not asked about",
+			skip: "V-562: a stage-0 decision never meets the extractor, so its slots are never validated",
+			turns: []turn{
+				{say: "напомни в 11:00 позвонить маме", contains: []string{"11:00"}, noQuestion: true},
+			},
+			end: endState{reminders: []reminderWant{{payload: "позвонить маме", fireAt: "2026-07-31 11:00"}}},
+		},
+		// The same gap on the repair path. A correction redoes the request
+		// through finishClarified, which goes straight to applyAction — it never
+		// passes the clarify gate — so a redo that lands short answers with the
+		// parse error V-557 removed from the routing path: "не поняла, на когда
+		// напомнить." She should ask, exactly as she does for a fresh reminder
+		// with no time.
+		{
+			name: "a correction that lands short asks rather than failing",
+			skip: "V-562: finishClarified skips the clarify gate, so a repaired decision is never checked for gaps",
+			turns: []turn{
+				{say: "добавь в задачи купить молоко", contains: []string{"купить молоко"}},
+				{say: "нет, это было напоминание", contains: []string{"поняла, это напоминание"},
+					parked: &parkedWant{slot: dialogue.SlotTime, attempt: 1}},
+			},
+			end: endState{tasks: []string{"купить молоко"}},
+		},
+	}
+}

cmd/mavend/ecosystem.go

@@ -12,6 +12,7 @@ import (
 	"log"
 	"net/http"
 	"net/url"
+	"strings"
 	"time"
 
 	hexisclient "github.com/kami/hexis/pkg/client"
@@ -42,28 +43,100 @@ const ecosystemAPIVersion = "v1"
 // anonymous HTTP client.
 const mavenRequester = "maven"
 
-// setEcosystemHeaders stamps the version, requester, auth and correlation
-// headers common to every outgoing ecosystem request. token may be empty,
-// which means the transport itself is trusted (loopback or unix socket).
+// ecosystemHTTP is the JSON transport every ecosystem client shares: one base
+// URL, one bearer token, and the header set the contract requires on each
+// request. Nexus and Praxis differ only in the service name and the version
+// header, so both embed this rather than repeating build, send and classify.
+type ecosystemHTTP struct {
+	service       string // "nexus", "praxis" — the name errors and traces carry
+	versionHeader string
+	baseURL       string
+	token         string
+	httpClient    *http.Client
+}
+
+func newEcosystemHTTP(service, versionHeader, baseURL string) ecosystemHTTP {
+	return ecosystemHTTP{
+		service:       service,
+		versionHeader: versionHeader,
+		baseURL:       baseURL,
+		httpClient:    &http.Client{Timeout: 10 * time.Second},
+	}
+}
+
+// setHeaders stamps the version, requester, auth and correlation headers common
+// to every outgoing ecosystem request. The token may be empty, which means the
+// transport itself is trusted (loopback or unix socket).
 //
-// The correlation ID is read from the context and never minted here. Minting
-// one per request sent the far side an ID that existed nowhere on this side,
-// and gave a single multi-hop action as many unrelated IDs as it made calls.
-// Callers that start an action assign the ID once (handleHexisAct,
+// The correlation ID is read from the request's own context and never minted
+// here. Minting one per request sent the far side an ID that existed nowhere on
+// this side, and gave a single multi-hop action as many unrelated IDs as it
+// made calls. Callers that start an action assign the ID once (handleHexisAct,
 // handlePraxisAct, resolveEntityReference) and every hop inherits it.
-func setEcosystemHeaders(req *http.Request, ctx context.Context, versionHeader, token string) {
+func (t *ecosystemHTTP) setHeaders(req *http.Request) {
 	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set(versionHeader, ecosystemAPIVersion)
+	req.Header.Set(t.versionHeader, ecosystemAPIVersion)
 	req.Header.Set("Accept", "application/json")
 	req.Header.Set("X-Requested-By", mavenRequester)
-	if token != "" {
-		req.Header.Set("Authorization", "Bearer "+token)
+	if t.token != "" {
+		req.Header.Set("Authorization", "Bearer "+t.token)
 	}
-	if id := correlationIDFromCtx(ctx); id != "" {
+	if id := correlationIDFromCtx(req.Context()); id != "" {
 		req.Header.Set("X-Correlation-ID", id)
 	}
 }
 
+// call sends one request and decodes the JSON answer into out, which may be nil
+// when the body carries nothing worth reading. op is the logical operation name
+// for errors and traces: the path carries the query string, and after entity
+// scoping that means an entity id in every log line built from the error, next
+// to a trace that redacts far less than that.
+//
+// Every failure is an *ecosystemError, including the transport and decode ones.
+// Some of these paths mutate remote state, and the question worth answering
+// afterwards is whether the call never left or was refused.
+func (t *ecosystemHTTP) call(ctx context.Context, method, op, path string, payload, out any) error {
+	var body io.Reader
+	if payload != nil {
+		data, err := json.Marshal(payload)
+		if err != nil {
+			return &ecosystemError{Service: t.service, Op: op, Err: err}
+		}
+		body = bytes.NewReader(data)
+	}
+	req, err := http.NewRequestWithContext(ctx, method, t.baseURL+path, body)
+	if err != nil {
+		return &ecosystemError{Service: t.service, Op: op, Err: err}
+	}
+	t.setHeaders(req)
+
+	resp, err := t.httpClient.Do(req)
+	if err != nil {
+		return &ecosystemError{Service: t.service, Op: op, Err: err}
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != 200 {
+		return httpError(t.service, op, resp.StatusCode)
+	}
+	if out == nil {
+		return nil
+	}
+	if err := json.NewDecoder(resp.Body).Decode(out); err != nil {
+		return &ecosystemError{Service: t.service, Op: op, Status: resp.StatusCode, Err: err}
+	}
+	return nil
+}
+
+// getJSON performs a GET and decodes the JSON body into out.
+func (t *ecosystemHTTP) getJSON(ctx context.Context, op, path string, out any) error {
+	return t.call(ctx, http.MethodGet, op, path, nil, out)
+}
+
+// postJSON posts a JSON payload and decodes the JSON answer into out.
+func (t *ecosystemHTTP) postJSON(ctx context.Context, op, path string, payload, out any) error {
+	return t.call(ctx, http.MethodPost, op, path, payload, out)
+}
+
 // ecosystemError is the typed failure every ecosystem client returns, so
 // callers can tell a transport failure from a refusal from a contract
 // mismatch without matching on message text. The distinction matters:
@@ -107,17 +180,60 @@ func httpError(service, op string, status int) *ecosystemError {
 	}
 }
 
+// hexisStatusTexts maps the http.StatusText spelling back to its code, for the
+// failure statuses a Hexis call can plausibly answer with. It is the inverse of
+// what the vendored client threw away.
+var hexisStatusTexts = func() map[string]int {
+	codes := []int{
+		http.StatusBadRequest, http.StatusUnauthorized, http.StatusForbidden,
+		http.StatusNotFound, http.StatusMethodNotAllowed, http.StatusNotAcceptable,
+		http.StatusRequestTimeout, http.StatusConflict, http.StatusGone,
+		http.StatusUnprocessableEntity, http.StatusUpgradeRequired,
+		http.StatusTooManyRequests, http.StatusInternalServerError,
+		http.StatusNotImplemented, http.StatusBadGateway,
+		http.StatusServiceUnavailable, http.StatusGatewayTimeout,
+	}
+	m := make(map[string]int, len(codes))
+	for _, c := range codes {
+		m[http.StatusText(c)] = c
+	}
+	return m
+}()
+
+// hexisError re-wraps an error from the vendored Hexis client as an
+// *ecosystemError, so a Hexis failure classifies the same way a Nexus or Praxis
+// one does and ecosystemGap can tell a refused credential from an outage.
+//
+// This is a boundary adapter and it is not the fix anyone would choose. The
+// Hexis client lives in another repository and returns
+// fmt.Errorf("%s: %s", http.StatusText(status), body) for every status at or
+// above 400, so the status text is the only signal that survives — the correct
+// fix is a typed error carrying the code, and Maven cannot land it unilaterally
+// (Vikunja #587, docs/plans/20-two-artifacts-and-neither-is-spring.md). Parsing
+// here is bounded: the message's first colon-delimited segment is the status
+// text verbatim, no status text contains a colon, and anything unrecognised —
+// "do request: ...", "create request: ..." — is a transport failure and is left
+// at status 0, which is exactly what Unreachable() means.
+func hexisError(op string, err error) error {
+	if err == nil {
+		return nil
+	}
+	var ee *ecosystemError
+	if errors.As(err, &ee) {
+		return err
+	}
+	head, _, _ := strings.Cut(err.Error(), ": ")
+	return &ecosystemError{
+		Service: "hexis", Op: op, Status: hexisStatusTexts[head], Err: err,
+	}
+}
+
 type nexusClient struct {
-	baseURL    string
-	token      string
-	httpClient *http.Client
+	ecosystemHTTP
 }
 
 func newNexusClient(url string) *nexusClient {
-	return &nexusClient{
-		baseURL:    url,
-		httpClient: &http.Client{Timeout: 10 * time.Second},
-	}
+	return &nexusClient{newEcosystemHTTP("nexus", "X-Nexus-Version", url)}
 }
 
 // withToken sets the bearer token sent on every request. Returns the client so
@@ -176,62 +292,26 @@ func (c *nexusClient) Resolve(ctx context.Context, query string, types []string)
 		body["types"] = types
 	}
 
-	data, _ := json.Marshal(body)
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+"/api/v1/resolve", bytes.NewReader(data))
-	if err != nil {
-		return nil, fmt.Errorf("create request: %w", err)
-	}
-	setEcosystemHeaders(req, ctx, "X-Nexus-Version", c.token)
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return nil, &ecosystemError{Service: "nexus", Op: "resolve", Err: err}
-	}
-	defer resp.Body.Close()
-
-	bodyBytes, _ := io.ReadAll(resp.Body)
-	if resp.StatusCode != 200 {
-		return nil, httpError("nexus", "resolve", resp.StatusCode)
-	}
-
 	var result nexusResolveResult
-	if err := json.Unmarshal(bodyBytes, &result); err != nil {
-		return nil, &ecosystemError{Service: "nexus", Op: "resolve", Status: resp.StatusCode, Err: err}
+	if err := c.postJSON(ctx, "resolve", "/api/v1/resolve", body, &result); err != nil {
+		return nil, err
 	}
 	return &result, nil
 }
 
 func (c *nexusClient) Health(ctx context.Context) error {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+"/health", nil)
-	if err != nil {
-		return &ecosystemError{Service: "nexus", Op: "health", Err: err}
-	}
-	setEcosystemHeaders(req, ctx, "X-Nexus-Version", c.token)
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return &ecosystemError{Service: "nexus", Op: "health", Err: err}
-	}
-	resp.Body.Close()
-	if resp.StatusCode != 200 {
-		return httpError("nexus", "health", resp.StatusCode)
-	}
-	return nil
+	return c.getJSON(ctx, "health", "/health", nil)
 }
 
 // praxisClient talks to the Praxis HTTP tools API. Maven must not open Praxis's
 // SQLite store directly (ecosystem invariant: no component reads another's DB),
 // so attention/changes/lifecycle all go over this HTTP contract against praxisd.
 type praxisClient struct {
-	baseURL    string
-	token      string
-	httpClient *http.Client
+	ecosystemHTTP
 }
 
 func newPraxisClient(url string) *praxisClient {
-	return &praxisClient{
-		baseURL:    url,
-		httpClient: &http.Client{Timeout: 10 * time.Second},
-	}
+	return &praxisClient{newEcosystemHTTP("praxis", "X-Praxis-Version", url)}
 }
 
 func (c *praxisClient) withToken(token string) *praxisClient {
@@ -239,30 +319,6 @@ func (c *praxisClient) withToken(token string) *praxisClient {
 	return c
 }
 
-// getJSON performs a GET and decodes the JSON body into out. op is the logical
-// operation name for errors and traces: the path carries the query string, and
-// after entity scoping that means an entity id in every log line built from the
-// error, next to a trace that redacts far less than that.
-func (c *praxisClient) getJSON(ctx context.Context, op, path string, out any) error {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, c.baseURL+path, nil)
-	if err != nil {
-		return err
-	}
-	setEcosystemHeaders(req, ctx, "X-Praxis-Version", c.token)
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return &ecosystemError{Service: "praxis", Op: op, Err: err}
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != 200 {
-		return httpError("praxis", op, resp.StatusCode)
-	}
-	if err := json.NewDecoder(resp.Body).Decode(out); err != nil {
-		return &ecosystemError{Service: "praxis", Op: op, Status: resp.StatusCode, Err: err}
-	}
-	return nil
-}
-
 // praxisAttention — an attention response in either of the two shapes Praxis
 // may send (Vikunja #540).
 //
@@ -376,31 +432,14 @@ type praxisItem struct {
 // postItemAction posts {"item_id": id} to a Praxis tools lifecycle endpoint
 // and decodes the resulting item. Shared by Surface/Acknowledge/Resolve/Ignore.
 func (c *praxisClient) postItemAction(ctx context.Context, op, path, itemID string) (*praxisItem, error) {
-	return c.postJSON(ctx, op, path, map[string]any{"item_id": itemID})
+	return c.postItem(ctx, op, path, map[string]any{"item_id": itemID})
 }
 
-// postJSON posts a body to a Praxis lifecycle endpoint and decodes the item.
-// Every failure is a *ecosystemError, including the transport and decode ones:
-// these are the paths that mutate remote state, and the question worth
-// answering afterwards is whether the call never left or was refused.
-func (c *praxisClient) postJSON(ctx context.Context, op, path string, payload map[string]any) (*praxisItem, error) {
-	body, _ := json.Marshal(payload)
-	req, err := http.NewRequestWithContext(ctx, http.MethodPost, c.baseURL+path, bytes.NewReader(body))
-	if err != nil {
-		return nil, &ecosystemError{Service: "praxis", Op: op, Err: err}
-	}
-	setEcosystemHeaders(req, ctx, "X-Praxis-Version", c.token)
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return nil, &ecosystemError{Service: "praxis", Op: op, Err: err}
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != 200 {
-		return nil, httpError("praxis", op, resp.StatusCode)
-	}
+// postItem posts a body to a Praxis lifecycle endpoint and decodes the item.
+func (c *praxisClient) postItem(ctx context.Context, op, path string, payload map[string]any) (*praxisItem, error) {
 	var out praxisItem
-	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
-		return nil, &ecosystemError{Service: "praxis", Op: op, Status: resp.StatusCode, Err: err}
+	if err := c.postJSON(ctx, op, path, payload, &out); err != nil {
+		return nil, err
 	}
 	return &out, nil
 }
@@ -425,7 +464,7 @@ func (c *praxisClient) Ignore(ctx context.Context, itemID string) (*praxisItem,
 }
 
 func (c *praxisClient) Pin(ctx context.Context, itemID string, pinned bool) (*praxisItem, error) {
-	return c.postJSON(ctx, "pin", "/api/v1/tools/pin", map[string]any{"item_id": itemID, "pinned": pinned})
+	return c.postItem(ctx, "pin", "/api/v1/tools/pin", map[string]any{"item_id": itemID, "pinned": pinned})
 }
 
 func (c *praxisClient) GetItem(ctx context.Context, itemID string) (*praxisItem, error) {
@@ -540,6 +579,7 @@ func (w *ecosystemWiring) discoverCapabilities(ctx context.Context, entityID str
 	}
 	caps, err := w.hexis.Capabilities(ctx, entityID)
 	if err != nil {
+		err = hexisError("capabilities", err)
 		log.Printf("ecosystem: hexis capabilities error: %v", err)
 		return nil, err
 	}
@@ -567,7 +607,10 @@ func (w *ecosystemWiring) executeCapability(ctx context.Context, capabilityID, t
 
 	exec, err := w.hexis.Execute(ctx, req)
 	if err != nil {
-		return correlationID, fmt.Errorf("execute: %w", err)
+		// A classified dependency failure. The two returns below are NOT: an
+		// execution that ran and failed is the command failing, not Hexis
+		// degrading, and it keeps its plain error so the caller says so.
+		return correlationID, hexisError("execute", err)
 	}
 	if exec.Status == "succeeded" {
 		return correlationID, nil

cmd/mavend/ecosystem_acts.go

@@ -22,13 +22,25 @@ import (
 // already knows which one it was talking to — it records the same name in the
 // trace (Vikunja #521).
 const (
-	serviceNexus = "Nexus"
-	serviceHexis = "Hexis"
+	serviceNexus  = "Nexus"
+	servicePraxis = "Praxis"
+	serviceHexis  = "Hexis"
 )
 
 // serviceVars — the one-key map the eco_down and eco_denied lines take.
 func serviceVars(name string) map[string]string { return map[string]string{"name": name} }
 
+// ecosystemGap names the service that failed. A rejected credential gets its
+// own line, because a wrong token looks exactly like an outage to him and
+// "try again" is advice that will never work. Every degrade path reads through
+// here, so all of them name the service and none of them guesses instead.
+func ecosystemGap(service string, err error) string {
+	if unauthorizedEcosystemError(err) {
+		return phraser.A(phraser.EcoDenied, serviceVars(service))
+	}
+	return phraser.A(phraser.EcoDown, serviceVars(service))
+}
+
 // praxisCapability is one arm of the Praxis act dispatch. This is an interface
 // rather than a map[string]func because each arm carries its own state: the
 // verb aliases it answers to, the trace name it records, and its own reply
@@ -127,10 +139,16 @@ func (h *reactiveHandler) handlePraxisAct(ctx context.Context, dec router.Decisi
 // praxisItemAction is the shared shape of the item-lifecycle capabilities: take
 // an item id from the value slot, call one Praxis endpoint, trace the result.
 type praxisItemAction struct {
-	verbs   []string
-	ask     string // reply when no item id was given
-	op      string // trace + log name of the operation
-	failure string // reply when the Praxis call errors
+	verbs []string
+	ask   string // reply when no item id was given
+	op    string // trace + log name of the operation
+	// failure is the first half of the reply when the Praxis call errors: which
+	// operation did not happen. ecosystemGap supplies the second half, which
+	// names Praxis and splits a refused token from an outage — those two used to
+	// produce the identical sentence and neither said "Praxis" (Vikunja #588).
+	// The verb is kept alongside the service name because the trace is the only
+	// other place it exists, and he is not reading the trace.
+	failure string
 	success string
 	call    func(ctx context.Context, px *praxisClient, id string) error
 }
@@ -147,7 +165,7 @@ func (a praxisItemAction) handle(ctx context.Context, h *reactiveHandler, px *pr
 		log.Printf("ecosystem: praxis %s %s: %v", a.op, id, err)
 		h.recordEcosystemTrace(ctx, "praxis", a.op, traceStatusForError(err), started,
 			mergeFields(traceErrorFields(err), map[string]any{"item_id": id}))
-		return a.failure
+		return a.failure + " " + ecosystemGap(servicePraxis, err)
 	}
 	h.recordPraxisTrace(ctx, a.op, started, map[string]any{"item_id": id})
 	return a.success
@@ -199,16 +217,10 @@ func (listAttentionCapability) handle(ctx context.Context, h *reactiveHandler, p
 		}
 		parts = append(parts, s)
 
-		// Speaking an item surfaces it, it does not acknowledge it
-		// (ECOSYSTEM-SPEC.md §2.3: surfaced != acknowledged). Best-effort:
-		// a failed surface call must not block delivering the digest.
-		if id, ok := item["id"].(string); ok && id != "" {
-			// Recorded in the order she says them, and only for items she could
-			// say: an item skipped above has no position in what he heard (#516).
+		// Recorded in the order she says them, and only for items she could
+		// say: an item skipped above has no position in what he heard (#516).
+		if id := surfaceSpoken(ctx, px, item); id != "" {
 			spoken = append(spoken, id)
-			if _, err := px.Surface(ctx, id); err != nil {
-				log.Printf("ecosystem: praxis surface %s: %v", id, err)
-			}
 		}
 	}
 	h.rememberSurfaced(spoken)
@@ -298,12 +310,7 @@ func (entityAttentionCapability) handle(ctx context.Context, h *reactiveHandler,
 		// trace gets. A trace that stores a rune count next to a log line
 		// storing the runes is not redacted at all.
 		log.Printf("ecosystem: entity attention resolve %s: %v", redactSubject(subject), err)
-		h.recordEcosystemTrace(ctx, "nexus", "resolve", traceStatusForError(err), started,
-			mergeFields(traceErrorFields(err), map[string]any{"subject": redactSubject(subject)}))
-		if unauthorizedEcosystemError(err) {
-			return phraser.A(phraser.EcoDenied, serviceVars(serviceNexus))
-		}
-		return phraser.A(phraser.EcoDown, serviceVars(serviceNexus))
+		return h.nexusResolveFailed(ctx, subject, started, err)
 	}
 	if len(ambiguous) > 0 {
 		return phraser.A(phraser.EcoAmbiguous, map[string]string{"items": strings.Join(ambiguous, ", ")})
@@ -339,19 +346,24 @@ func (entityAttentionCapability) handle(ctx context.Context, h *reactiveHandler,
 	})
 
 	var parts []string
+	var spoken []string
 	for _, item := range items {
 		title, _ := item["title"].(string)
 		if title == "" {
 			continue
 		}
 		parts = append(parts, title)
-		// Same surfaced != acknowledged rule as the unscoped digest.
-		if id, ok := item["id"].(string); ok && id != "" {
-			if _, err := px.Surface(ctx, id); err != nil {
-				log.Printf("ecosystem: praxis surface %s: %v", id, err)
-			}
+		if id := surfaceSpoken(ctx, px, item); id != "" {
+			spoken = append(spoken, id)
 		}
 	}
+	// The scoped digest is a list she read out, so it replaces the positional
+	// memory exactly as the unscoped one does. It used to surface these items
+	// and remember none of them, which left the previous digest live: "отметь
+	// второй как сделанное" then indexed into a list he had not just heard and
+	// transitioned somebody else's item (docs/ecosystem.md — a wrong guess here
+	// transitions the wrong item).
+	h.rememberSurfaced(spoken)
 	if known := h.localFactsForEntity(ctx, entityID); known != "" {
 		parts = append(parts, known)
 	}
@@ -366,6 +378,22 @@ func (entityAttentionCapability) handle(ctx context.Context, h *reactiveHandler,
 	return phraser.A(phraser.AttentionListEntity, map[string]string{"name": displayName, "items": strings.Join(parts, "; ")})
 }
 
+// surfaceSpoken marks an item she just read out as surfaced. Speaking an item
+// surfaces it, it does not acknowledge it (ECOSYSTEM-SPEC.md §2.3: surfaced !=
+// acknowledged), so this calls Surface and nothing else. Best effort: a failed
+// surface call must not block delivering the digest. Returns the item id, or ""
+// when the item carried none.
+func surfaceSpoken(ctx context.Context, px *praxisClient, item map[string]any) string {
+	id, _ := item["id"].(string)
+	if id == "" {
+		return ""
+	}
+	if _, err := px.Surface(ctx, id); err != nil {
+		log.Printf("ecosystem: praxis surface %s: %v", id, err)
+	}
+	return id
+}
+
 // scopedToEntity drops items that carry an entity_id other than the one asked
 // about, and reports whether the response can be trusted as scoped at all. An
 // item without an entity_id is kept only when at least one sibling carries the
@@ -474,6 +502,14 @@ func traceStatusForError(err error) string {
 	return traceFailed
 }
 
+// nexusResolveFailed records a resolve that failed and returns the named gap.
+// The subject is his words, so the trace keeps a rune count and not the runes.
+func (h *reactiveHandler) nexusResolveFailed(ctx context.Context, subject string, started time.Time, err error) string {
+	h.recordEcosystemTrace(ctx, "nexus", "resolve", traceStatusForError(err), started,
+		mergeFields(traceErrorFields(err), map[string]any{"subject": redactSubject(subject)}))
+	return ecosystemGap(serviceNexus, err)
+}
+
 // redactSubject reduces a user utterance to something safe to persist in a
 // trace: its length only. Traces are diagnostics, and his words are not
 // diagnostics — the correlation ID is what ties a trace to the turn.
@@ -532,26 +568,31 @@ func unauthorizedEcosystemError(err error) bool {
 	return errors.As(err, &ee) && ee.Unauthorized()
 }
 
+// isEcosystemError reports a failure that belongs to the service rather than to
+// what was asked of it: a call that never landed, or one the far side refused.
+// It separates "Hexis is down" from "the restart failed".
+func isEcosystemError(err error) bool {
+	var ee *ecosystemError
+	return errors.As(err, &ee)
+}
+
 // traceErrorFields describes an ecosystemError for a trace without leaking the
 // payload: the HTTP status and the failure class, nothing else.
 func traceErrorFields(err error) map[string]any {
-	fields := map[string]any{}
+	fields := map[string]any{"class": "error"}
 	var ee *ecosystemError
-	if errors.As(err, &ee) {
-		fields["http_status"] = ee.Status
-		switch {
-		case ee.Unauthorized():
-			fields["class"] = "unauthorized"
-		case ee.ContractMismatch():
-			fields["class"] = "contract_mismatch"
-		case ee.Unreachable():
-			fields["class"] = "unreachable"
-		default:
-			fields["class"] = "error"
-		}
+	if !errors.As(err, &ee) {
 		return fields
 	}
-	fields["class"] = "error"
+	fields["http_status"] = ee.Status
+	switch {
+	case ee.Unauthorized():
+		fields["class"] = "unauthorized"
+	case ee.ContractMismatch():
+		fields["class"] = "contract_mismatch"
+	case ee.Unreachable():
+		fields["class"] = "unreachable"
+	}
 	return fields
 }
 
@@ -636,16 +677,11 @@ func (h *reactiveHandler) handleHexisAct(ctx context.Context, dec router.Decisio
 	res := h.resolveEntityCandidates(ctx, entityReferences(dec))
 	subject, entityID, displayName, ambiguous, err := res.subject, res.entityID, res.displayName, res.ambiguous, res.err
 	if err != nil {
-		h.recordEcosystemTrace(ctx, "nexus", "resolve", traceStatusForError(err), started,
-			mergeFields(traceErrorFields(err), map[string]any{"subject": redactSubject(subject)}))
-		if unauthorizedEcosystemError(err) {
-			return phraser.A(phraser.EcoDenied, serviceVars(serviceNexus))
-		}
 		// A genuine Nexus dependency failure, not "no such entity" — stop here
 		// and report degradation rather than silently falling through to the
 		// local command executor (ECOSYSTEM-SPEC.md: services degrade
 		// independently, never a silent all-clear).
-		return phraser.A(phraser.EcoDown, serviceVars(serviceNexus))
+		return h.nexusResolveFailed(ctx, subject, started, err)
 	}
 	if len(ambiguous) > 0 {
 		h.recordEcosystemTrace(ctx, "nexus", "resolve", traceAmbig, started,
@@ -668,10 +704,7 @@ func (h *reactiveHandler) handleHexisAct(ctx context.Context, dec router.Decisio
 	if err != nil {
 		h.recordEcosystemTrace(ctx, "hexis", "capabilities", traceStatusForError(err), discovered,
 			mergeFields(traceErrorFields(err), map[string]any{"entity_id": entityID}))
-		if unauthorizedEcosystemError(err) {
-			return phraser.A(phraser.EcoDenied, serviceVars(serviceHexis))
-		}
-		return phraser.A(phraser.EcoDown, serviceVars(serviceHexis))
+		return ecosystemGap(serviceHexis, err)
 	}
 	h.recordEcosystemTrace(ctx, "hexis", "capabilities", traceOK, discovered,
 		map[string]any{"entity_id": entityID, "count": len(caps)})
@@ -745,6 +778,9 @@ func (h *reactiveHandler) handleHexisAct(ctx context.Context, dec router.Decisio
 			entityID:     entityID,
 			displayName:  displayName,
 			expiry:       h.now().Add(confirmTTL),
+			// This action's id, so the execution the confirm authorises is
+			// joined to the resolve and the discovery that proposed it.
+			correlationID: correlationIDFromCtx(ctx),
 		}
 		h.mu.Unlock()
 		h.recordEcosystemTrace(ctx, "hexis", "confirmation", tracePending, started,
@@ -769,6 +805,14 @@ func (h *reactiveHandler) execHexis(ctx context.Context, capID, capName, entityI
 			mergeFields(traceErrorFields(err), map[string]any{
 				"entity_id": entityID, "capability": capName, "causation_id": causationID,
 			}))
+		// Hexis never answering, or answering "no", is a gap in Hexis and is
+		// named as one — a refused token said "не получилось выполнить команду"
+		// here and sent him to debug a capability that was never reached
+		// (Vikunja #587). An execution that genuinely ran and failed is not an
+		// ecosystemError and keeps the command-level line.
+		if isEcosystemError(err) {
+			return ecosystemGap(serviceHexis, err)
+		}
 		return phraser.A(phraser.ActFailEntity, map[string]string{"name": displayName})
 	}
 	// One record per hop: the second write this used to make said the same

cmd/mavend/ecosystem_gap_test.go

@@ -0,0 +1,159 @@
+package main
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/phraser"
+)
+
+// A refused credential and an outage are different answers, and on the Hexis
+// path only one of them used to be said. These tests pin the difference at both
+// Hexis sites: the discovery hop and the execute hop (Vikunja #587). The Praxis
+// half of the same defect is in praxis_gap_test.go.
+//
+// unreachableURL is a port nothing listens on, which is what "the service is
+// down" looks like from inside a call: the connection is refused, no HTTP
+// answer is ever produced, and ecosystemError.Unreachable() is true.
+const unreachableURL = "http://127.0.0.1:1"
+
+func denied(service, reply string) bool {
+	return phraser.IsA(phraser.EcoDenied, serviceVars(service), reply)
+}
+
+func down(service, reply string) bool {
+	return phraser.IsA(phraser.EcoDown, serviceVars(service), reply)
+}
+
+// hexisGapHandler wires a handler whose Nexus resolves cleanly and whose Hexis
+// is the caller's to break. hexisURL is taken separately so a test can point it
+// at a dead port.
+func hexisGapHandler(t *testing.T, nexusURL, hexisURL string) *reactiveHandler {
+	t.Helper()
+	st := newTestStore(t)
+	now := time.Now()
+	return &reactiveHandler{
+		api:       ipc.NewStoreAPI(st),
+		dataStore: st,
+		now:       func() time.Time { return now },
+		ecosystem: stubEcosystem(nexusURL, hexisURL),
+	}
+}
+
+// TestHexisDiscovery401IsDeniedNotDown — the discovery hop.
+//
+// The vendored Hexis client returns a plain fmt.Errorf for every status at or
+// above 400, so errors.As for *ecosystemError never matched and every failure
+// fell through to the outage line. "Hexis is down" for a rejected token sends
+// him to inspect a service that is running fine.
+func TestHexisDiscovery401IsDeniedNotDown(t *testing.T) {
+	ctx := context.Background()
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_muzick", muzickIndexer, "service"))
+	caps := fixtureHexisCapabilities(map[string]any{"id": "cap_restart", "name": "restart", "read_only": true})
+	hexis := newFakeHexis(t, caps, fixtureHexisExecuted("exec_1", "succeeded"))
+	h := hexisGapHandler(t, nexus.URL, hexis.URL)
+
+	hexis.SetFault(401)
+	reply := h.handleHexisAct(ctx, actDec("muzick indexer"))
+	if !denied(serviceHexis, reply) {
+		t.Fatalf("401 from hexis discovery: got %q, want the denied line naming Hexis", reply)
+	}
+	if !strings.Contains(reply, serviceHexis) {
+		t.Errorf("reply does not name Hexis: %q", reply)
+	}
+}
+
+// TestHexisDiscoveryOutageIsDownNotDenied — the other half of the same fork.
+// Without this the fix could pass by calling everything a refused credential.
+func TestHexisDiscoveryOutageIsDownNotDenied(t *testing.T) {
+	ctx := context.Background()
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_muzick", muzickIndexer, "service"))
+	h := hexisGapHandler(t, nexus.URL, unreachableURL)
+
+	reply := h.handleHexisAct(ctx, actDec("muzick indexer"))
+	if !down(serviceHexis, reply) {
+		t.Fatalf("connection refused from hexis: got %q, want the outage line naming Hexis", reply)
+	}
+	if denied(serviceHexis, reply) {
+		t.Error("an outage must not be reported as a refused credential")
+	}
+}
+
+// TestHexisExecute401IsDeniedNotCommandFailure — the execute hop, which did not
+// consult ecosystemGap at all and named neither the service nor the cause.
+func TestHexisExecute401IsDeniedNotCommandFailure(t *testing.T) {
+	ctx := context.Background()
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_muzick", muzickIndexer, "service"))
+	caps := fixtureHexisCapabilities(map[string]any{"id": "cap_restart", "name": "restart", "read_only": true})
+	hexis := newFakeHexis(t, caps, fixtureHexisExecuted("exec_1", "succeeded"))
+	h := hexisGapHandler(t, nexus.URL, hexis.URL)
+
+	// Discovery stays healthy; only the execute endpoint refuses. A blanket
+	// fault would never reach the site under test.
+	hexis.SetRouteFault("/api/v1/execute", 401)
+	reply := h.handleHexisAct(ctx, actDec("muzick indexer"))
+	if !denied(serviceHexis, reply) {
+		t.Fatalf("401 from hexis execute: got %q, want the denied line naming Hexis", reply)
+	}
+}
+
+// TestHexisExecuteOutageIsDown — same site, the other classification.
+//
+// Discovery and execution share one base URL, so the outage has to be scoped to
+// the execute endpoint rather than to the server: it answers capabilities
+// normally and drops the connection on execute, which is what the client sees
+// when the far side dies mid-call. That produces no HTTP status at all, which is
+// what Unreachable() means.
+func TestHexisExecuteOutageIsDown(t *testing.T) {
+	ctx := context.Background()
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_muzick", muzickIndexer, "service"))
+	caps := fixtureHexisCapabilities(map[string]any{"id": "cap_restart", "name": "restart", "read_only": true})
+	hexis := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/v1/execute" {
+			conn, _, err := w.(http.Hijacker).Hijack()
+			if err != nil {
+				t.Errorf("hijack: %v", err)
+				return
+			}
+			conn.Close()
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(caps))
+	}))
+	t.Cleanup(hexis.Close)
+	h := hexisGapHandler(t, nexus.URL, hexis.URL)
+
+	reply := h.handleHexisAct(ctx, actDec("muzick indexer"))
+	if !down(serviceHexis, reply) {
+		t.Fatalf("dropped connection on hexis execute: got %q, want the outage line", reply)
+	}
+	if denied(serviceHexis, reply) {
+		t.Error("an outage must not be reported as a refused credential")
+	}
+}
+
+// TestHexisExecutionFailedStaysCommandFailure — the boundary of the fix. Hexis
+// answering 200 with a failed execution is the command failing, not Hexis
+// degrading, and it must keep the command-level line rather than accusing a
+// healthy service of being down.
+func TestHexisExecutionFailedStaysCommandFailure(t *testing.T) {
+	ctx := context.Background()
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_muzick", muzickIndexer, "service"))
+	caps := fixtureHexisCapabilities(map[string]any{"id": "cap_restart", "name": "restart", "read_only": true})
+	hexis := newFakeHexis(t, caps, fixtureHexisExecutionFailed("exec_1", "unit refused to start"))
+	h := hexisGapHandler(t, nexus.URL, hexis.URL)
+
+	reply := h.handleHexisAct(ctx, actDec("muzick indexer"))
+	if down(serviceHexis, reply) || denied(serviceHexis, reply) {
+		t.Fatalf("a failed execution must not be reported as an ecosystem gap, got %q", reply)
+	}
+	if !phraser.IsA(phraser.ActFailEntity, map[string]string{"name": muzickIndexer}, reply) {
+		t.Fatalf("want the command-failure line, got %q", reply)
+	}
+}

cmd/mavend/ecosystem_harness_test.go

@@ -115,3 +115,83 @@ func TestFakeNexus_FaultInjectionThenRecovery(t *testing.T) {
 		t.Fatalf("expected success once nexus recovers, got %q", reply)
 	}
 }
+
+// TestPraxisEntityAttention_RemembersWhatItReadOut: the scoped digest is a list
+// she read out, so a positional follow-up must land on one of ITS items. It
+// surfaced them and remembered none, which left the previous digest live and
+// sent "отметь второй" at somebody else's item.
+func TestPraxisEntityAttention_RemembersWhatItReadOut(t *testing.T) {
+	ctx := context.Background()
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_muzick", "Muzick indexer", "service"))
+	scoped := fixturePraxisAttentionScoped("ent_muzick",
+		map[string]any{"id": "item_scoped_1", "title": "indexer wedged"})
+	praxis := newFakePraxis(t, scoped)
+	h := ecoHandler(t, nexus, praxis, nil)
+
+	// A digest from an earlier turn, still the positional memory.
+	h.rememberSurfaced([]string{"item_stale"})
+
+	reply := h.handlePraxisAct(ctx, router.Decision{
+		Intent: router.IntentAct,
+		Slots:  router.Slots{Fn: "entity_attention", HasFn: true, Value: "muzick indexer"},
+	})
+	if !strings.Contains(reply, "indexer wedged") {
+		t.Fatalf("expected the scoped item to be read out, got %q", reply)
+	}
+
+	h.mu.Lock()
+	surfaced := append([]string(nil), h.surfacedItems...)
+	h.mu.Unlock()
+	if len(surfaced) != 1 || surfaced[0] != "item_scoped_1" {
+		t.Fatalf("scoped digest must replace the positional memory, got %v", surfaced)
+	}
+
+	// The follow-up resolves against what he just heard, not the stale list.
+	if reply := h.handlePraxisAct(ctx, praxisItemDec("resolve_item", "last")); reply == "" {
+		t.Fatal("positional follow-up should have been claimed by praxis")
+	}
+	var body string
+	for _, r := range praxis.Requests() {
+		if r.Method == "POST" && r.Path == "/api/v1/tools/resolve" {
+			body = string(r.Body)
+		}
+	}
+	if !strings.Contains(body, "item_scoped_1") {
+		t.Fatalf("resolve must transition the item she read out, posted %q", body)
+	}
+	if strings.Contains(body, "item_stale") {
+		t.Fatal("resolve transitioned an item from a previous digest")
+	}
+}
+
+// TestHexisConfirm_KeepsOneCorrelationIDPerAction: the confirm arrives on a
+// later turn with a context of its own. The contract mints one id per action,
+// so the execution it authorises must still be joinable to the resolve and the
+// discovery that proposed it — it recorded a fresh id and no causation at all.
+func TestHexisConfirm_KeepsOneCorrelationIDPerAction(t *testing.T) {
+	ctx := context.Background()
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_muzick", "Muzick indexer", "service"))
+	caps := fixtureHexisCapabilities(map[string]any{"id": "cap_restart", "name": "restart", "read_only": false})
+	hexis := newFakeHexis(t, caps, fixtureHexisExecuted("exec_1", "succeeded"))
+	h := ecoHandler(t, nexus, nil, hexis)
+
+	if reply := h.handleHexisAct(ctx, actDec("restart")); !strings.Contains(reply, "да") {
+		t.Fatalf("mutating capability must ask for confirmation, got %q", reply)
+	}
+	resolve := findTrace(t, h, "nexus", "resolve")
+	if resolve == nil || resolve.CorrelationID == "" {
+		t.Fatalf("expected a nexus resolve trace carrying a correlation id, got %+v", resolve)
+	}
+
+	if _, handled := h.resolveConfirm(ctx, "да"); !handled {
+		t.Fatal("confirm should have been claimed")
+	}
+	exec := findTrace(t, h, "hexis", "execute")
+	if exec == nil {
+		t.Fatal("expected a hexis execute trace")
+	}
+	if exec.CausationID != resolve.CorrelationID {
+		t.Fatalf("confirmed execution must cite the action that proposed it: causation %q, action %q",
+			exec.CausationID, resolve.CorrelationID)
+	}
+}

cmd/mavend/fact_subject_test.go

@@ -24,7 +24,7 @@ func TestApplyAction_FactCapture_QueuesEntityResolution(t *testing.T) {
 
 	emb := router.NewHashEmbedder(1024)
 	matcher := tool.NewMatcher(api)
-	rtr := buildRouter(emb, matcher, 0.55, nil)
+	rtr := buildRouter(emb, matcher, 0.55, nil, nil)
 
 	h := &reactiveHandler{
 		api:       api,

cmd/mavend/factenrichment.go

@@ -37,8 +37,8 @@ type factEnrichmentWorker struct {
 	nextTry map[int64]time.Time // fact id → earliest retry
 }
 
-// enrichmentScanLimit bounds how deep a single tick (or status report) walks
-// the pending queue looking for facts whose backoff has elapsed. The queue is
+// enrichmentScanLimit bounds how deep a single tick walks the pending queue
+// looking for facts whose backoff has elapsed. The queue is
 // ordered by id, so without a scan the oldest facts hold every batch slot
 // whether or not they are eligible, and one permanently failing fact stalls
 // every younger one behind it.
@@ -75,8 +75,8 @@ func newFactEnrichmentWorker(st *store.Store, eco *ecosystemWiring, interval tim
 // has been down all day must be visible as a backlog, not as facts that
 // silently never got tagged.
 //
-// All three numbers describe the same set of rows, the first
-// enrichmentScanLimit pending facts. Counting Pending over a thousand rows
+// All three numbers describe the same set of rows, whatever is still pending
+// out of the first enrichmentScanLimit facts. Counting Pending over a thousand rows
 // while counting InBackoff over the twenty that reached the head of a batch
 // described two different populations under one struct.
 type enrichmentStatus struct {
@@ -86,13 +86,22 @@ type enrichmentStatus struct {
 	Scanned     int // rows the other three counts were taken over
 }
 
+// status reads the queue and counts over it. For a caller with no batch in
+// hand — anything asking the worker how it is doing from outside the tick.
 func (w *factEnrichmentWorker) status(ctx context.Context) enrichmentStatus {
-	var st enrichmentStatus
 	pending, err := w.store.PendingFactResolutions(ctx, enrichmentScanLimit)
 	if err != nil {
 		log.Printf("factenrichment: status: %v", err)
-		return st
+		return enrichmentStatus{}
 	}
+	return w.statusOf(pending)
+}
+
+// statusOf counts over a batch the caller already has. The batch is the query
+// the tick already ran, so reporting the backlog costs no second read of the
+// scan limit — up to a thousand rows, on a database that serialises them.
+func (w *factEnrichmentWorker) statusOf(pending []store.Fact) enrichmentStatus {
+	var st enrichmentStatus
 	st.Pending = len(pending)
 	st.Scanned = len(pending)
 	w.mu.Lock()
@@ -144,17 +153,24 @@ func (w *factEnrichmentWorker) tick(ctx context.Context) {
 	}
 	w.forgetDeparted(pending)
 	skipped, failed, attempted := 0, 0, 0
+	// A resolved fact leaves the pending queue, so the batch in hand overstates
+	// the backlog by however many succeeded. Drop them here rather than
+	// re-reading the queue to find out.
+	remaining := make([]store.Fact, 0, len(pending))
 	for _, f := range pending {
 		if attempted >= w.batch {
-			break
+			remaining = append(remaining, f)
+			continue
 		}
 		if !w.due(f.ID) {
 			skipped++
+			remaining = append(remaining, f)
 			continue
 		}
 		attempted++
 		if !w.resolveOne(ctx, f) {
 			failed++
+			remaining = append(remaining, f)
 		}
 	}
 	if failed > 0 {
@@ -164,7 +180,7 @@ func (w *factEnrichmentWorker) tick(ctx context.Context) {
 	// Report the backlog every tick, not only when something failed: the
 	// stalled state worth seeing is the one where nothing failed because
 	// nothing was attempted.
-	if st := w.status(ctx); st.Pending > 0 {
+	if st := w.statusOf(remaining); st.Pending > 0 {
 		log.Printf("factenrichment: %d facts pending entity resolution, %d in backoff, worst attempt %d (scanned %d)",
 			st.Pending, st.InBackoff, st.MaxAttempts, st.Scanned)
 	}

cmd/mavend/factgate_test.go

@@ -20,7 +20,7 @@ func newFactGateHandler(t *testing.T, now time.Time) (*reactiveHandler, ipc.Core
 	h := &reactiveHandler{
 		api:       api,
 		recall:    recallWiring{embedder: emb, memStore: memory.NewInMemoryStore()},
-		router:    buildRouter(emb, tool.NewMatcher(api), 0.55, nil),
+		router:    buildRouter(emb, tool.NewMatcher(api), 0.55, nil, nil),
 		replier:   voice.NewStubReplier(),
 		now:       func() time.Time { return now },
 		dataStore: st,

cmd/mavend/historyq.go

@@ -54,30 +54,56 @@ var historyMarkersEn = [][2]string{
 // answers a topic far better than a list of the last five facts does.
 var historyRecall = []string{" про ", " об ", " о ", " about "}
 
+// historySide — whose turn the question asks about. The rows read are the same
+// either way, because a tapped fact is one act seen from two sides, but the
+// sentence is not: answering "что ты записала сегодня?" with "ты говорил…"
+// hands the question back instead of answering it (Vikunja #456).
+type historySide int
+
+const (
+	historyAskedHim historySide = iota // "что я тебе говорил"
+	historyAskedHer                    // "что ты записала сегодня"
+)
+
 // isHistoryQuery reports whether he is asking what he told her.
 func isHistoryQuery(u string) bool {
+	_, ok := historyAsks(u)
+	return ok
+}
+
+// historyAsks reports whether this is a history question, and whose turn it is
+// about.
+func historyAsks(u string) (historySide, bool) {
 	s := " " + strings.ToLower(strings.TrimSpace(u)) + " "
 	if s == "  " {
-		return false
+		return historyAskedHim, false
 	}
 	for _, r := range historyRecall {
 		if strings.Contains(s, r) {
-			return false
+			return historyAskedHim, false
 		}
 	}
 	for _, pair := range historyMarkersEn {
 		if strings.Contains(s, pair[0]) && strings.Contains(s, pair[1]) {
-			return true
+			if strings.Contains(pair[0], "you") {
+				return historyAskedHer, true
+			}
+			return historyAskedHim, true
 		}
 	}
 	toks := historyTokens(s)
 	if !hasAny(toks, "что", "чего") {
-		return false
+		return historyAskedHim, false
 	}
+	// His side is tested first: "отмечать" is on both verb lists, so "что я
+	// отметил" must not read as a question about her.
 	if hasAny(toks, firstPersonSubjects...) && hasVerbForm(toks, historySpokenVerbs) {
-		return true
+		return historyAskedHim, true
 	}
-	return hasAny(toks, secondPersonSubjects...) && hasVerbForm(toks, historyRecordedVerbs)
+	if hasAny(toks, secondPersonSubjects...) && hasVerbForm(toks, historyRecordedVerbs) {
+		return historyAskedHer, true
+	}
+	return historyAskedHim, false
 }
 
 // historyTokens splits an utterance into bare words. The punctuation goes
@@ -142,7 +168,8 @@ const historyWindow = 24 * time.Hour
 // pass: the notes pass would otherwise answer this from whatever note happens
 // to be nearest, which reads as an answer and is not one.
 func (h *reactiveHandler) queryHistory(ctx context.Context, t *queryTurn) (string, bool) {
-	if !isHistoryQuery(t.dec.Utterance) {
+	side, ok := historyAsks(t.dec.Utterance)
+	if !ok {
 		return "", false
 	}
 	facts, err := h.api.RecentFacts(ctx, historyScan)
@@ -164,8 +191,14 @@ func (h *reactiveHandler) queryHistory(ctx context.Context, t *queryTurn) (strin
 	if len(said) == 0 {
 		// Claim the turn rather than fall through. "ничего не говорил" is the
 		// true answer, and recall would answer it with an old note instead.
+		if side == historyAskedHer {
+			return "за последние сутки я ничего с твоих слов не записывала.", true
+		}
 		return "за последние сутки ты мне ничего такого не говорил.", true
 	}
+	if side == historyAskedHer {
+		return "я записала: " + strings.Join(said, "; "), true
+	}
 	return "ты говорил: " + strings.Join(said, "; "), true
 }
 

cmd/mavend/historyq_test.go

@@ -89,6 +89,33 @@ func TestHistoryReadsOnlyWhatHeSaid(t *testing.T) {
 	}
 }
 
+// The rows are the same either way, because a tapped fact is one act seen from
+// two sides. The sentence is not: "что ты записала" answered with "ты говорил"
+// hands the question back (Vikunja #456).
+func TestHistoryAnswersTheSideItWasAsked(t *testing.T) {
+	now := time.Date(2026, 8, 4, 20, 0, 0, 0, time.UTC)
+	h, _ := historyHandler(now, ipc.Fact{Key: "water", Value: "выпил", Source: "tap:voice", Ts: now.Add(-time.Hour)})
+
+	his, ok := askHistory(h, "что я тебе говорил?")
+	if !ok || !strings.HasPrefix(his, "ты говорил") {
+		t.Errorf("reply = %q, ok = %v, want his side", his, ok)
+	}
+	hers, ok := askHistory(h, "что ты записала сегодня?")
+	if !ok || !strings.HasPrefix(hers, "я записала") {
+		t.Errorf("reply = %q, ok = %v, want her side", hers, ok)
+	}
+	// "отмечать" is on both verb lists, so his subject has to win.
+	if side, ok := historyAsks("что я отметил?"); !ok || side != historyAskedHim {
+		t.Errorf("historyAsks(что я отметил) = %v, %v", side, ok)
+	}
+
+	empty, _ := historyHandler(now)
+	none, ok := askHistory(empty, "что ты записала сегодня?")
+	if !ok || !strings.Contains(none, "не записывала") {
+		t.Errorf("empty reply = %q, ok = %v, want her side", none, ok)
+	}
+}
+
 // Nothing said is an answer of its own. Falling through would hand the question
 // to recall, which answers it with an old note.
 func TestHistorySaysWhenThereIsNothing(t *testing.T) {

cmd/mavend/main.go

@@ -68,6 +68,11 @@ import (
 	"github.com/kami/maven/internal/webauthn"
 )
 
+// stepUpTTL is how long one passkey assertion keeps the session stepped up.
+// Long enough for the unlock call that follows it, short enough that a walked
+// away laptop does not stay authorized.
+const stepUpTTL = 5 * time.Minute
+
 var errLocked = errors.New("mavend: daemon locked — complete passkey assertion first")
 
 // daemonLock tracks whether the daemon is in locked (pre-unlock) mode, and
@@ -128,6 +133,8 @@ func run(args []string) error {
 	wrappedKeyPath := flag.String("wrapped-key-file", "", "path to wrapped encryption key blob (enables cold-start unlock)")
 	reembed := flag.Bool("reembed", false, "re-embed every stored note and fact with the configured embedder, then serve normally (run once after an embedder swap; the daemon does not answer until it finishes)")
 	allowSeed := flag.Bool("allow-seed", false, "enable the backdated seed_event write path (QA only: it lets a caller place a fact in the past and mint a routine the tick loop will then act on; off means the method has nothing to write with)")
+	wipe := flag.Bool("wipe", false, "print every table and its row count, then exit without serving; add -confirm-wipe to delete all of it")
+	confirmWipe := flag.Bool("confirm-wipe", false, "with -wipe, actually remove every piece of personal data (facts, notes, vectors, events, tasks, sessions, traces, voiceprints). config, models, passkeys and the encryption key are files and survive")
 	flag.CommandLine.Parse(args)
 	reembedOnStart = *reembed
 	allowSeedOnStart = *allowSeed
@@ -210,6 +217,14 @@ func run(args []string) error {
 		}()
 	}
 
+	// ----- wipe: never serves, exits when it is done (Vikunja #494) -----
+	if *wipe {
+		if locked {
+			return fmt.Errorf("wipe: the store is locked and there is no key to open it with")
+		}
+		return runWipe(ctx, st, os.Stdout, *confirmWipe)
+	}
+
 	// ----- daemon components (only wired when unlocked) -----
 	// Pre-declare so the unlock path can wire them later.
 	var (
@@ -237,44 +252,31 @@ func run(args []string) error {
 	// envelope per successful intake write.
 	coreFor := func() ipc.CoreAPI { return newIntakeAPI(ipc.NewStoreAPI(st), evBus, time.Now) }
 
+	// depsNow reads whatever the current path has wired. Both boot paths build
+	// the CoreAPI and start the workers from this one value, so neither can
+	// hold a field the other misses. See cmd/mavend/boot.go.
+	depsNow := func() bootDeps {
+		return bootDeps{
+			coreFor:    coreFor,
+			tl:         tl,
+			evBus:      evBus,
+			voiceW:     voiceW,
+			st:         st,
+			factWorker: factWorker,
+			evalWorker: evalWorker,
+			feedWkr:    feedWkr,
+			crawlWkr:   crawlWkr,
+		}
+	}
+
 	if !locked {
 		rules = wireRules(cfg)
-		gatherer = loop.NewGatherer(st, rules)
-		if cfg.QuietHours != nil {
-			gatherer.SetQuietHours(cfg.QuietHours.Start, cfg.QuietHours.End)
-		}
+		gatherer = wireGatherer(st, cfg, rules)
 
 		// phraser
-		phr = phraser.NewStub()
-		if cfg.Phraser != nil {
-			pc := phraser.Config{
-				ModelPath:    cfg.Phraser.ModelPath,
-				BinPath:      cfg.Phraser.BinPath,
-				Listen:       cfg.Phraser.Listen,
-				NGpuLayers:   cfg.Phraser.NGpuLayers,
-				NCtx:         cfg.Phraser.NCtx,
-				CacheRAMMiB:  cacheRAMMiB(cfg.Phraser.CacheRAMMiB),
-				Timeout:      time.Duration(cfg.Phraser.Timeout),
-				LLMNudges:    cfg.Phraser.LLMNudges,
-				ContextBlock: contextBlockFn(cfg, time.Now),
-			}
-			if pc.BinPath == "" {
-				pc.BinPath = "llama-server"
-			}
-			if pc.Listen == "" {
-				pc.Listen = "127.0.0.1:0"
-			}
-			if pc.NCtx <= 0 {
-				pc.NCtx = 2048
-			}
-			if pc.Timeout <= 0 {
-				pc.Timeout = 30 * time.Second
-			}
-			var err error
-			phr, err = phraser.NewLLMPhraser(ctx, pc)
-			if err != nil {
-				return fmt.Errorf("phraser: %w", err)
-			}
+		phr, err = wirePhraser(ctx, cfg)
+		if err != nil {
+			return fmt.Errorf("phraser: %w", err)
 		}
 
 		// ecosystem — nexus + hexis + praxis (all over HTTP; no direct DB access)
@@ -287,71 +289,19 @@ func run(args []string) error {
 		}
 
 		// delivery
-		var ntfy delivery.Sink
-		if cfg.Ntfy != nil {
-			s, err := ntfysink.New(*cfg.Ntfy)
-			if err != nil {
-				return fmt.Errorf("wire ntfy sink: %w", err)
-			}
-			ntfy = s
+		dispatcher, err = wireDispatcher(st, cfg, voiceW)
+		if err != nil {
+			return err
 		}
-		var telegram delivery.Sink
-		if cfg.Telegram != nil {
-			s, err := telegramsink.New(*cfg.Telegram)
-			if err != nil {
-				return fmt.Errorf("wire telegram sink: %w", err)
-			}
-			telegram = s
-		}
-		var voiceSink delivery.Sink
-		if voiceW != nil {
-			voiceSink = voiceW.voiceSink
-		}
-		// A crashed prior run may have left "pending" delivery attempts (send
-		// may have landed externally, then the process died before recording
-		// it) — reconcile them to "unknown" before the tick loop resumes
-		// sending, so nothing auto-resends into that ambiguity.
-		if _, err := st.ReconcileStaleDeliveryAttempts(context.Background(), time.Now()); err != nil {
-			log.Printf("delivery outbox reconcile: %v", err)
-		}
-		dispatcher = delivery.NewDispatcher(delivery.Config{
-			Ntfy:      ntfy,
-			Telegram:  telegram,
-			Voice:     voiceSink,
-			Ack:       st,
-			Nudges:    st,
-			Reminders: st,
-			Outbox:    st,
-		})
 
 		// tick loop
-		tickInterval := time.Duration(cfg.TickInterval)
-		repeatInterval := time.Duration(cfg.RepeatInterval)
-		autotuneInterval := time.Duration(cfg.AutotuneInterval)
-		tl = newTickLoop(st, gatherer, dispatcher, phr, rules, tickInterval, repeatInterval, autotuneInterval, cfg.Digest, routinesFromConfig(cfg.Routines), config.MorningRoutinesFromConfig(cfg.MorningRoutines), cfg.PatternProposals)
+		tl = wireTickLoop(st, gatherer, dispatcher, phr, rules, cfg)
 		factWorker = newFactEnrichmentWorker(st, eco, time.Duration(cfg.FactEnrichmentInterval))
 		evalWorker = newMemoryEvalWorker(st, phr, cfg)
 		feedWkr = newFeedWorker(coreFor(), embedderOf(voiceW), cfg)
 		crawlWkr = newCrawlWorker(newCrawler(cfg), coreFor(), embedderOf(voiceW), cfg)
 
-		coreAPI = &daemonAPI{
-			CoreAPI:          coreFor(),
-			getTrace:         tl.trace,
-			getMorningStatus: func(ctx context.Context) []ipc.MorningRoutineStatus { return tl.morningStatus(ctx, time.Now()) },
-			getDayPlan:       func(ctx context.Context) ipc.DayPlan { return tl.dayPlan(ctx, time.Now()) },
-			getEvents:        intakeEventsFn(evBus),
-			seedStore:        seedStoreIfAllowed(st),
-		}
-		if voiceW != nil && voiceW.handler != nil {
-			api := coreAPI.(*daemonAPI)
-			api.chatFn = voiceW.handler.handleText
-			// And the reverse: the handler was wired with the bare store
-			// adapter, which cannot serve the day plan. See upgradeAPI.
-			voiceW.handler.upgradeAPI(api)
-		}
-		if voiceW != nil && voiceW.mcp != nil {
-			coreAPI.(*daemonAPI).getMCPServers = voiceW.mcp.status
-		}
+		coreAPI = newDaemonAPI(depsNow())
 	} else {
 		// locked mode: no real store yet, so there's no meaningful CoreAPI to
 		// serve. srv.Check below is the actual guard — every CoreAPI call is
@@ -368,7 +318,7 @@ func run(args []string) error {
 		return fmt.Errorf("ipc listen: %w", err)
 	}
 
-	passkeySess := webauthn.NewPasskeySession(5 * time.Minute)
+	passkeySess := webauthn.NewPasskeySession(stepUpTTL)
 
 	// Set Server.Check — the single authorization guard, run once by
 	// Server.dispatch before any CoreAPI method is called (see
@@ -412,6 +362,9 @@ func run(args []string) error {
 	if !locked {
 		wireMailIntake(srv, st, phr, cfg, evBus)
 		wireModelSwap(srv, phr, cfg)
+		// Inbound telegram (V-637). Dark unless the telegram block says intake,
+		// and it reads one chat.
+		wireTelegramIntake(ctx, &wg, coreAPI, cfg)
 		// Vision + the media blob store (Vikunja #252). Both stay dark without a
 		// media block; MethodDescribeImage answers ErrUnknownMethod then.
 		keeper := wireVision(ctx, &wg, srv, st, embedderOf(voiceW), cfg)
@@ -516,40 +469,11 @@ func run(args []string) error {
 
 			// Wire everything.
 			rules = wireRules(cfg)
-			gatherer = loop.NewGatherer(st, rules)
-			if cfg.QuietHours != nil {
-				gatherer.SetQuietHours(cfg.QuietHours.Start, cfg.QuietHours.End)
-			}
+			gatherer = wireGatherer(st, cfg, rules)
 
-			phr = phraser.NewStub()
-			if cfg.Phraser != nil {
-				pc := phraser.Config{
-					ModelPath:    cfg.Phraser.ModelPath,
-					BinPath:      cfg.Phraser.BinPath,
-					Listen:       cfg.Phraser.Listen,
-					NGpuLayers:   cfg.Phraser.NGpuLayers,
-					NCtx:         cfg.Phraser.NCtx,
-					CacheRAMMiB:  cacheRAMMiB(cfg.Phraser.CacheRAMMiB),
-					Timeout:      time.Duration(cfg.Phraser.Timeout),
-					LLMNudges:    cfg.Phraser.LLMNudges,
-					ContextBlock: contextBlockFn(cfg, time.Now),
-				}
-				if pc.BinPath == "" {
-					pc.BinPath = "llama-server"
-				}
-				if pc.Listen == "" {
-					pc.Listen = "127.0.0.1:0"
-				}
-				if pc.NCtx <= 0 {
-					pc.NCtx = 2048
-				}
-				if pc.Timeout <= 0 {
-					pc.Timeout = 30 * time.Second
-				}
-				phr, err = phraser.NewLLMPhraser(ctx, pc)
-				if err != nil {
-					return fmt.Errorf("phraser: %w", err)
-				}
+			phr, err = wirePhraser(ctx, cfg)
+			if err != nil {
+				return fmt.Errorf("phraser: %w", err)
 			}
 
 			eco = wireEcosystem(cfg)
@@ -559,65 +483,26 @@ func run(args []string) error {
 				return fmt.Errorf("wire voice: %w", err)
 			}
 
-			var ntfy delivery.Sink
-			if cfg.Ntfy != nil {
-				s, err := ntfysink.New(*cfg.Ntfy)
-				if err != nil {
-					return fmt.Errorf("wire ntfy sink: %w", err)
-				}
-				ntfy = s
+			dispatcher, err = wireDispatcher(st, cfg, voiceW)
+			if err != nil {
+				return err
 			}
-			var telegram delivery.Sink
-			if cfg.Telegram != nil {
-				s, err := telegramsink.New(*cfg.Telegram)
-				if err != nil {
-					return fmt.Errorf("wire telegram sink: %w", err)
-				}
-				telegram = s
-			}
-			var voiceSink delivery.Sink
-			if voiceW != nil {
-				voiceSink = voiceW.voiceSink
-			}
-			if _, err := st.ReconcileStaleDeliveryAttempts(context.Background(), time.Now()); err != nil {
-				log.Printf("delivery outbox reconcile: %v", err)
-			}
-			dispatcher = delivery.NewDispatcher(delivery.Config{
-				Ntfy:      ntfy,
-				Telegram:  telegram,
-				Voice:     voiceSink,
-				Ack:       st,
-				Nudges:    st,
-				Reminders: st,
-				Outbox:    st,
-			})
 
-			tickInterval := time.Duration(cfg.TickInterval)
-			repeatInterval := time.Duration(cfg.RepeatInterval)
-			autotuneInterval := time.Duration(cfg.AutotuneInterval)
-			tl = newTickLoop(st, gatherer, dispatcher, phr, rules, tickInterval, repeatInterval, autotuneInterval, cfg.Digest, routinesFromConfig(cfg.Routines), config.MorningRoutinesFromConfig(cfg.MorningRoutines), cfg.PatternProposals)
+			tl = wireTickLoop(st, gatherer, dispatcher, phr, rules, cfg)
 			factWorker = newFactEnrichmentWorker(st, eco, time.Duration(cfg.FactEnrichmentInterval))
 			evalWorker = newMemoryEvalWorker(st, phr, cfg)
 			feedWkr = newFeedWorker(coreFor(), embedderOf(voiceW), cfg)
 			crawlWkr = newCrawlWorker(newCrawler(cfg), coreFor(), embedderOf(voiceW), cfg)
 
 			// Swap the CoreAPI from the locked placeholder to the real store adapter.
-			newAPI := &daemonAPI{
-				CoreAPI:          coreFor(),
-				getTrace:         tl.trace,
-				getMorningStatus: func(ctx context.Context) []ipc.MorningRoutineStatus { return tl.morningStatus(ctx, time.Now()) },
-				getDayPlan:       func(ctx context.Context) ipc.DayPlan { return tl.dayPlan(ctx, time.Now()) },
-				getEvents:        intakeEventsFn(evBus),
-				seedStore:        seedStoreIfAllowed(st),
-			}
-			if voiceW != nil && voiceW.handler != nil {
-				newAPI.chatFn = voiceW.handler.handleText
-				voiceW.handler.upgradeAPI(newAPI)
-			}
+			newAPI := newDaemonAPI(depsNow())
 			srv.SetAPI(newAPI)
 			srv.Check = (&auth.Gate{Enrollment: auth.NewFloorEnrollment(), Session: passkeySess}).Check
 			wireMailIntake(srv, st, phr, cfg, evBus)
 			wireModelSwap(srv, phr, cfg)
+			// Same on the unlock path, with the API that has just replaced the
+			// locked placeholder (V-637).
+			wireTelegramIntake(ctx, &wg, newAPI, cfg)
 			keeper := wireVision(ctx, &wg, srv, st, embedderOf(voiceW), cfg)
 			wireCapture(ctx, &wg, srv, keeper, st, voiceW, phr, cfg)
 			// Voice identification (Vikunja #255). Enrolment plumbing only until a
@@ -625,59 +510,10 @@ func run(args []string) error {
 			// block, so no wire path takes a voiceprint on a default box.
 			wireSpeaker(srv, st, cfg)
 
-			// Start voice server.
-			if voiceW != nil {
-				var wg sync.WaitGroup
-				wg.Add(1)
-				go func() {
-					defer wg.Done()
-					if err := voiceW.server.Serve(); err != nil && !errors.Is(err, net.ErrClosed) {
-						log.Printf("voice serve: %v", err)
-					}
-				}()
-				log.Printf("mavend: voice listening on %s", voiceW.server.Addr())
-			}
-
-			// Start tick loop.
-			go func() {
-				tl.run(ctx)
-			}()
-
-			// Start fact-entity enrichment worker.
-			go func() {
-				factWorker.run(ctx)
-			}()
-
-			// Start background memory evaluation (nil unless configured).
-			if evalWorker != nil {
-				go func() {
-					evalWorker.run(ctx)
-				}()
-			}
-
-			// Start feed reading (nil unless configured).
-			if feedWkr != nil {
-				go func() {
-					feedWkr.run(ctx)
-				}()
-			}
-
-			// Start the watched-page crawls (nil unless configured).
-			if crawlWkr != nil {
-				go func() {
-					crawlWkr.run(ctx)
-				}()
-			}
-
-			// Keep MCP connections alive (nil unless configured).
-			if voiceW != nil && voiceW.mcp != nil {
-				go voiceW.mcp.run(ctx)
-			}
-
-			// Re-enumerate the house for new devices (nil unless configured).
-			if voiceW != nil && voiceW.home != nil {
-				go voiceW.home.run(ctx)
-			}
+			// The voice server and every background worker, on the outer wg
+			// so shutdown waits for them. This used to be nine bare
+			// `go func()` calls and a shadowed WaitGroup (V-639).
+			startBackground(ctx, &wg, depsNow())
 
 			dl.unlock(st)
 			log.Printf("mavend: unlocked via passkey assertion")
@@ -685,72 +521,15 @@ func run(args []string) error {
 		}
 	}
 
-	wg.Add(1)
-	go func() {
-		defer wg.Done()
+	goWorker(&wg, func() {
 		if err := srv.Serve(); err != nil && !errors.Is(err, net.ErrClosed) {
 			log.Printf("ipc serve: %v", err)
 		}
-	}()
+	})
 	log.Printf("mavend: ipc listening on %s", srv.Path())
 
-	if !locked && voiceW != nil {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			if err := voiceW.server.Serve(); err != nil && !errors.Is(err, net.ErrClosed) {
-				log.Printf("voice serve: %v", err)
-			}
-		}()
-		log.Printf("mavend: voice listening on %s", voiceW.server.Addr())
-	}
-
 	if !locked {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			tl.run(ctx)
-		}()
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			factWorker.run(ctx)
-		}()
-		if evalWorker != nil {
-			wg.Add(1)
-			go func() {
-				defer wg.Done()
-				evalWorker.run(ctx)
-			}()
-		}
-		if feedWkr != nil {
-			wg.Add(1)
-			go func() {
-				defer wg.Done()
-				feedWkr.run(ctx)
-			}()
-		}
-		if crawlWkr != nil {
-			wg.Add(1)
-			go func() {
-				defer wg.Done()
-				crawlWkr.run(ctx)
-			}()
-		}
-		if voiceW != nil && voiceW.mcp != nil {
-			wg.Add(1)
-			go func() {
-				defer wg.Done()
-				voiceW.mcp.run(ctx)
-			}()
-		}
-		if voiceW != nil && voiceW.home != nil {
-			wg.Add(1)
-			go func() {
-				defer wg.Done()
-				voiceW.home.run(ctx)
-			}()
-		}
+		startBackground(ctx, &wg, depsNow())
 	}
 
 	<-ctx.Done()
@@ -837,6 +616,125 @@ func waitWorkers(wg *sync.WaitGroup, d time.Duration) bool {
 	}
 }
 
+// Phraser defaults, applied when the config block leaves a field unset. They
+// are the daemon's, not the library's: phraser.Config carries no defaults of
+// its own, so an empty field here would reach llama-server as an empty flag.
+const (
+	defaultLlamaBin       = "llama-server"
+	defaultPhraserListen  = "127.0.0.1:0"
+	defaultPhraserNCtx    = 2048
+	defaultPhraserTimeout = 30 * time.Second
+)
+
+// wirePhraser builds the phrasing seam. No phraser block means the
+// deterministic stub, which is the floor and not an error: the daemon answers
+// without a model, in fixed words.
+func wirePhraser(ctx context.Context, cfg *config.Config) (phraser.Phraser, error) {
+	if cfg.Phraser == nil {
+		return phraser.NewStub(), nil
+	}
+	pc := phraser.Config{
+		ModelPath:    cfg.Phraser.ModelPath,
+		BinPath:      cfg.Phraser.BinPath,
+		Listen:       cfg.Phraser.Listen,
+		NGpuLayers:   cfg.Phraser.NGpuLayers,
+		NCtx:         cfg.Phraser.NCtx,
+		CacheRAMMiB:  cacheRAMMiB(cfg.Phraser.CacheRAMMiB),
+		Timeout:      time.Duration(cfg.Phraser.Timeout),
+		LLMNudges:    cfg.Phraser.LLMNudges,
+		ContextBlock: contextBlockFn(cfg, time.Now),
+	}
+	if pc.BinPath == "" {
+		pc.BinPath = defaultLlamaBin
+	}
+	if pc.Listen == "" {
+		pc.Listen = defaultPhraserListen
+	}
+	if pc.NCtx <= 0 {
+		pc.NCtx = defaultPhraserNCtx
+	}
+	if pc.Timeout <= 0 {
+		pc.Timeout = defaultPhraserTimeout
+	}
+	return phraser.NewLLMPhraser(ctx, pc)
+}
+
+// wireGatherer builds the nudge gatherer over the given rule set and applies
+// the configured quiet hours.
+func wireGatherer(st *store.Store, cfg *config.Config, rules []loop.Rule) *loop.Gatherer {
+	g := loop.NewGatherer(st, rules)
+	if cfg.QuietHours != nil {
+		g.SetQuietHours(cfg.QuietHours.Start, cfg.QuietHours.End)
+	}
+	return g
+}
+
+// wireDispatcher builds the delivery fan-out. Each sink stays nil unless its
+// config block is present, and a sink that fails to build fails the boot
+// rather than going quiet.
+//
+// A crashed prior run may have left "pending" delivery attempts (send may have
+// landed externally, then the process died before recording it). They are
+// reconciled to "unknown" here, before the tick loop resumes sending, so
+// nothing auto-resends into that ambiguity.
+func wireDispatcher(st *store.Store, cfg *config.Config, voiceW *voiceWiring) (*delivery.Dispatcher, error) {
+	var ntfy delivery.Sink
+	if cfg.Ntfy != nil {
+		s, err := ntfysink.New(*cfg.Ntfy)
+		if err != nil {
+			return nil, fmt.Errorf("wire ntfy sink: %w", err)
+		}
+		ntfy = s
+	}
+	var telegram delivery.Sink
+	if cfg.Telegram != nil {
+		s, err := telegramsink.New(*cfg.Telegram)
+		if err != nil {
+			return nil, fmt.Errorf("wire telegram sink: %w", err)
+		}
+		telegram = s
+	}
+	var voiceSink delivery.Sink
+	if voiceW != nil {
+		voiceSink = voiceW.voiceSink
+	}
+	if _, err := st.ReconcileStaleDeliveryAttempts(context.Background(), time.Now()); err != nil {
+		log.Printf("delivery outbox reconcile: %v", err)
+	}
+	return delivery.NewDispatcher(delivery.Config{
+		Ntfy:      ntfy,
+		Telegram:  telegram,
+		Voice:     voiceSink,
+		Ack:       st,
+		Nudges:    st,
+		Reminders: st,
+		Outbox:    st,
+	}), nil
+}
+
+// wireTickLoop reads the loop's three intervals and its schedules out of the
+// config, so the two boot paths cannot disagree about them.
+func wireTickLoop(st *store.Store, gatherer *loop.Gatherer, dispatcher *delivery.Dispatcher, phr phraser.Phraser, rules []loop.Rule, cfg *config.Config) *tickLoop {
+	return newTickLoop(st, gatherer, dispatcher, phr, rules,
+		time.Duration(cfg.TickInterval),
+		time.Duration(cfg.RepeatInterval),
+		time.Duration(cfg.AutotuneInterval),
+		cfg.Digest,
+		routinesFromConfig(cfg.Routines),
+		config.MorningRoutinesFromConfig(cfg.MorningRoutines),
+		cfg.PatternProposals)
+}
+
+// goWorker starts run on its own goroutine and registers it with wg, so
+// shutdown can wait for it inside workerGrace.
+func goWorker(wg *sync.WaitGroup, run func()) {
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		run()
+	}()
+}
+
 // wireRules builds the nudge rule set, minus anything config turned off. The
 // drop is logged because a rule vanishing silently is indistinguishable from a
 // rule that is broken, and the next person to wonder why she stopped nudging

cmd/mavend/notefragment.go

@@ -0,0 +1,58 @@
+package main
+
+import (
+	"strings"
+
+	"github.com/kami/maven/internal/lexicon"
+	"github.com/kami/maven/internal/morph"
+)
+
+// correctionFragment reports that an utterance replaces a referent and states
+// nothing of its own: "нет, не маме, а папе" (V-576).
+//
+// Measured on the box 2026-08-06, that fragment routed to note and was filed.
+// It is not a repair either, because it names no intent, so parseRepair
+// declines it and repair.go is the wrong place to catch it. This is the note
+// path saying it has nothing to store.
+//
+// Three offline tests, all of them narrow on purpose. The sentence opens with a
+// refusal word from the lexicon, it carries the contrastive "а" that names the
+// replacement, and no token in it is a verb form. The verb test is what keeps
+// the rule off real notes: "нет, я не поеду, а останусь" says something, and a
+// Russian verb carries its own subject and tense.
+func correctionFragment(utterance string) bool {
+	toks := repairTokens(strings.ToLower(strings.TrimSpace(utterance)))
+	if len(toks) < 3 {
+		return false
+	}
+	if !refusalWord(toks[0]) {
+		return false
+	}
+	var negated, contrasted bool
+	for _, tok := range toks[1:] {
+		switch tok {
+		case "не", "not":
+			negated = true
+		case "а", "but":
+			contrasted = true
+		}
+		if morph.IsVerbForm(tok) {
+			return false
+		}
+	}
+	return negated && contrasted
+}
+
+// refusalWord reports that a token is a one-word refusal. The lexicon set holds
+// phrases too ("не надо"), and those are not what opens a correction.
+func refusalWord(tok string) bool {
+	for _, w := range lexicon.ConfirmNo() {
+		if strings.ContainsRune(w, ' ') {
+			continue
+		}
+		if w == tok {
+			return true
+		}
+	}
+	return false
+}

cmd/mavend/notefragment_test.go

@@ -0,0 +1,117 @@
+package main
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/memory"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/store"
+	"github.com/kami/maven/internal/tool"
+	"github.com/kami/maven/internal/voice"
+)
+
+func TestCorrectionFragment(t *testing.T) {
+	cases := []struct {
+		utterance string
+		want      bool
+	}{
+		{"нет, не маме, а папе", true},
+		{"Нет, не маме — а папе", true},
+		{"no, not mom, but dad", true},
+		// States something of its own, so it is his to keep.
+		{"нет, я не поеду, а останусь дома", false},
+		{"нет", false},
+		{"не маме, а папе", false},  // no refusal word opening it
+		{"нет, маме и папе", false}, // nothing negated
+		{"нет, не маме", false},     // nothing put in its place
+		{"запомни что кофе закончился", false},
+	}
+	for _, c := range cases {
+		if got := correctionFragment(c.utterance); got != c.want {
+			t.Errorf("correctionFragment(%q) = %v, want %v", c.utterance, got, c.want)
+		}
+	}
+}
+
+func newNoteHandler(t *testing.T) (*reactiveHandler, *store.Store) {
+	t.Helper()
+	st := newTestStore(t)
+	api := ipc.NewStoreAPI(st)
+	now := time.Now()
+	emb := router.NewHashEmbedder(1024)
+	h := &reactiveHandler{
+		api:       api,
+		recall:    recallWiring{embedder: emb, memStore: memory.NewInMemoryStore()},
+		router:    buildRouter(emb, tool.NewMatcher(api), 0.55, nil, nil),
+		replier:   voice.NewStubReplier(),
+		now:       func() time.Time { return now },
+		dataStore: st,
+	}
+	return h, st
+}
+
+// TestNoteBodyIsTheUtterance — the stored body comes from the utterance, never
+// from Slots.Text, which the LLM router is free to write anything into (V-576).
+func TestNoteBodyIsTheUtterance(t *testing.T) {
+	ctx := context.Background()
+	h, st := newNoteHandler(t)
+
+	dec := router.Decision{
+		Intent:    router.IntentNote,
+		Utterance: "купил хлеб и молоко",
+		Slots:     router.Slots{Text: "ты поедешь на дачу"},
+	}
+	if reply := h.applyAction(ctx, dec); reply != "" {
+		t.Fatalf("applyAction = %q, want empty", reply)
+	}
+	notes, err := st.RecentNotes(ctx, 10)
+	if err != nil {
+		t.Fatalf("RecentNotes: %v", err)
+	}
+	if len(notes) != 1 || notes[0].Text != dec.Utterance {
+		t.Fatalf("stored note = %+v, want body %q", notes, dec.Utterance)
+	}
+}
+
+// TestNoteBodyIsStable — the same utterance twice stores the same text.
+func TestNoteBodyIsStable(t *testing.T) {
+	ctx := context.Background()
+	h, st := newNoteHandler(t)
+
+	dec := router.Decision{Intent: router.IntentNote, Utterance: "кофе закончился"}
+	h.applyAction(ctx, dec)
+	h.applyAction(ctx, dec)
+
+	notes, err := st.RecentNotes(ctx, 10)
+	if err != nil {
+		t.Fatalf("RecentNotes: %v", err)
+	}
+	if len(notes) != 2 {
+		t.Fatalf("notes = %d, want 2", len(notes))
+	}
+	if notes[0].Text != notes[1].Text || notes[0].Text != dec.Utterance {
+		t.Fatalf("bodies differ: %q vs %q", notes[0].Text, notes[1].Text)
+	}
+}
+
+// TestCorrectionFragmentWritesNoNote — a correction with nothing behind it is
+// not a note, and she says so instead of filing it (V-576).
+func TestCorrectionFragmentWritesNoNote(t *testing.T) {
+	ctx := context.Background()
+	h, st := newNoteHandler(t)
+
+	dec := router.Decision{Intent: router.IntentNote, Utterance: "нет, не маме, а папе"}
+	if reply := h.applyAction(ctx, dec); reply != nothingToCorrectReply {
+		t.Fatalf("reply = %q, want %q", reply, nothingToCorrectReply)
+	}
+	notes, err := st.RecentNotes(ctx, 10)
+	if err != nil {
+		t.Fatalf("RecentNotes: %v", err)
+	}
+	if len(notes) != 0 {
+		t.Fatalf("notes = %+v, want none", notes)
+	}
+}

cmd/mavend/ordinal.go

@@ -8,6 +8,7 @@ import (
 	"unicode"
 
 	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/lexicon"
 	"github.com/kami/maven/internal/store"
 )
 
@@ -26,44 +27,41 @@ import (
 // does not say what to do with it. Acting on the bare word would guess, and a
 // wrong guess here closes work he never finished.
 
-// candidateOrdinals — the words that pick a position, by index. Prefix match,
-// because Russian declines them: "первый", "первую", "первое".
-var candidateOrdinals = []struct {
-	word string
-	nth  int
-}{
-	{"перв", 1}, {"втор", 2}, {"трет", 3}, {"четв", 4}, {"пят", 5},
-	{"first", 1}, {"second", 2}, {"third", 3},
-}
+// The position words come from the lexicon, which lists every form with its
+// position and "последний" as -1 (V-522). They used to be stem prefixes here —
+// {"перв", 1}, {"втор", 2} — which is the shape that sweep removed: a stem
+// decides meaning by guessing where a word ends, and "трет" also opens
+// "third-party". The lexicon runs to twelve rather than five, so he can pick
+// past the fifth of a longer list; resolveCandidate already answers a position
+// she did not read.
 
 // candidateDigits — "второй" said as a number. Matched whole, never by prefix:
-// "15" starts with "1" and is a time, not a position.
+// "15" starts with "1" and is a time, not a position. Digits are not a Russian
+// word list, so they stay here rather than in the lexicon.
 var candidateDigits = map[string]int{"1": 1, "2": 2, "3": 3, "4": 4, "5": 5}
 
-// candidateLast — "последний" picks the end of the list whatever its length.
-var candidateLast = []string{"последн", "last"}
-
 // parseOrdinal reads which position he named. 0 and false when he named none.
 // A negative result means the last one.
 func parseOrdinal(text string) (int, bool) {
 	// Token by token, not substring: " 1" would otherwise match inside
 	// "напомни в 15:00" and turn a reminder into a selection.
-	for _, tok := range strings.FieldsFunc(strings.ToLower(text), func(r rune) bool {
+	toks := strings.FieldsFunc(strings.ToLower(text), func(r rune) bool {
 		return !unicode.IsLetter(r) && !unicode.IsDigit(r)
-	}) {
-		for _, w := range candidateLast {
-			if strings.HasPrefix(tok, w) {
-				return -1, true
-			}
-		}
+	})
+	for i, tok := range toks {
 		if n, ok := candidateDigits[tok]; ok {
 			return n, true
 		}
-		for _, o := range candidateOrdinals {
-			// Prefix, because Russian declines them: "первый", "первую".
-			if strings.HasPrefix(tok, o.word) {
-				return o.nth, true
-			}
+		// A spoken half hour names the hour it is entering with the same
+		// genitive ordinal: "в половине восьмого" is 07:30, not the eighth
+		// thing she read out. She reads a list and he answers with a time
+		// often enough that this has to be declined here, or the reminder
+		// becomes a selection.
+		if i > 0 && lexicon.IsHalfHour(toks[i-1]) {
+			continue
+		}
+		if n, ok := lexicon.Ordinal(tok); ok {
+			return n, true
 		}
 	}
 	return 0, false

cmd/mavend/ordinal_test.go

@@ -27,6 +27,16 @@ func TestParseOrdinalReadsThePosition(t *testing.T) {
 		{"", 0, false},
 		// A digit inside a time is not a position.
 		{"напомни в 15:00", 0, false},
+		// Forms the stem list used to miss, and positions past its fifth.
+		{"вторым", 2, true},
+		{"седьмую", 7, true},
+		{"одиннадцатый", 11, true},
+		// A spoken half hour names its hour with the same genitive ordinal, so
+		// this is 07:30 and not the eighth thing she read out (V-522).
+		{"напомни в половине восьмого", 0, false},
+		{"полвосьмого", 0, false},
+		// The ordinal still wins when the half word is not in front of it.
+		{"восьмую сделал", 8, true},
 	}
 	for _, c := range cases {
 		got, ok := parseOrdinal(c.text)

cmd/mavend/personalboundary.go

@@ -77,6 +77,32 @@ var worldSeeds = []string{
 	"что мне почитать про историю",
 	"что я должен знать про питон",
 	"what can i watch tonight",
+	// A third shape that looks personal and is not: asking when something
+	// happens (Vikunja #553). "во сколько закат сегодня" scored personal,
+	// because "что у меня сегодня" and "когда моя встреча" put that frame on
+	// the personal side and nothing here answered it. The sunset is the one
+	// thing on his list that is the same for everybody standing outside.
+	// "сегодня" is carried on purpose. Without it these caught nothing: the
+	// day word is most of what pulls the frame personal, because "что у меня
+	// сегодня" is a personal seed and the day word is the half it shares.
+	"во сколько сегодня открывается магазин",
+	"когда сегодня начинается матч",
+	"во сколько сегодня восход солнца",
+	// The other frame a day word carries, and the same story: "что у меня
+	// сегодня" is a personal seed, so "какой сегодня праздник" and "что
+	// интересного произошло сегодня в мире" were refused as his after the
+	// topic seeds had already let them past the weather source.
+	"какой сегодня курс валют",
+	"что сегодня происходит в мире",
+	// The narrative shape (Vikunja #554). "расскажи про Байкал" was refused as
+	// his by 0.0052, and nothing here was phrased as an order rather than a
+	// question: every world seed above opens with an interrogative. So a world
+	// question that names its subject and asks for prose landed nearer "я тебе
+	// рассказывал об этом?", which is the same verb about his own words.
+	"расскажи про байкал",
+	"расскажи про древний рим",
+	"объясни как работает двигатель",
+	"tell me about the roman empire",
 }
 
 // personalBoundary holds the embedded seeds. Zero value is usable and means

cmd/mavend/personalboundary_test.go

@@ -68,6 +68,27 @@ func TestONNXPersonalBoundary(t *testing.T) {
 		{"я хочу узнать про рим", false},
 		{"кто такой гагарин", false},
 		{"how do i boil an egg", false},
+		// Asking when a public thing happens (Vikunja #553). "во сколько закат
+		// сегодня" was answered "не знаю — не нашла у тебя такой записи",
+		// because the frame lived only on the personal side. The pair above it
+		// is the control: "во сколько у меня встреча" is the same frame about
+		// something that IS his, and it has to stay personal.
+		{"во сколько закат сегодня", false},
+		{"когда сегодня заканчивается концерт", false},
+		{"во сколько завтра открывается аптека", false},
+		// The "какой сегодня X" frame. These clear the weather topic after the
+		// V-553 seeds and were then refused here, which is the same defect one
+		// source further down the chain.
+		{"какой сегодня праздник", false},
+		{"что интересного произошло сегодня в мире", false},
+		{"кто выиграл вчера матч", false},
+		// The narrative shape, held out from the seeds above (Vikunja #554).
+		// The control is the row after them: the same verb about his own words
+		// is still his.
+		{"расскажи про эверест", false},
+		{"расскажи про войну 1812 года", false},
+		{"объясни что такое инфляция", false},
+		{"я рассказывал тебе про байкал?", true},
 	}
 
 	h := &reactiveHandler{recall: recallWiring{embedder: emb}}

cmd/mavend/praxis_gap_test.go

@@ -0,0 +1,54 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/kami/maven/internal/phraser"
+)
+
+// A Praxis lifecycle failure used to return a hardcoded constant that named the
+// verb and never the service, so an outage, a refused token and a contract
+// mismatch all produced the identical sentence (Vikunja #588). The helpers and
+// the Hexis half of the same defect are in ecosystem_gap_test.go.
+
+func TestPraxisLifecycle401NamesPraxis(t *testing.T) {
+	ctx := context.Background()
+	praxis := newFakePraxis(t, fixturePraxisAttentionItems())
+	h := newPraxisTestHandler(t, praxis)
+
+	praxis.SetFault(401)
+	reply := h.handlePraxisAct(ctx, praxisItemDec("resolve_item", "item_1"))
+	if !strings.Contains(reply, servicePraxis) {
+		t.Fatalf("praxis failure does not name Praxis: %q", reply)
+	}
+	if !strings.Contains(reply, phraser.A(phraser.EcoDenied, serviceVars(servicePraxis))) {
+		t.Fatalf("401 from praxis: got %q, want the denied line", reply)
+	}
+	// The verb that did not happen is still said: the trace is the only other
+	// place it exists and he is not reading the trace.
+	if !strings.Contains(reply, "не получилось отметить сделанным.") {
+		t.Errorf("reply dropped the operation that failed: %q", reply)
+	}
+}
+
+// TestPraxisLifecycleOutageDiffersFrom401 — the identity that was the bug.
+func TestPraxisLifecycleOutageDiffersFrom401(t *testing.T) {
+	ctx := context.Background()
+	praxis := newFakePraxis(t, fixturePraxisAttentionItems())
+	h := newPraxisTestHandler(t, praxis)
+
+	praxis.SetFault(401)
+	refused := h.handlePraxisAct(ctx, praxisItemDec("acknowledge_item", "item_1"))
+
+	h.ecosystem = &ecosystemWiring{praxis: newPraxisClient(unreachableURL)}
+	outage := h.handlePraxisAct(ctx, praxisItemDec("acknowledge_item", "item_1"))
+
+	if refused == outage {
+		t.Fatalf("a refused token and an outage still say the same thing: %q", refused)
+	}
+	if !strings.Contains(outage, phraser.A(phraser.EcoDown, serviceVars(servicePraxis))) {
+		t.Fatalf("praxis outage: got %q, want the outage line naming Praxis", outage)
+	}
+}

cmd/mavend/query_recall_test.go

@@ -2,8 +2,11 @@ package main
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"math"
+	"net/http"
+	"strings"
 	"testing"
 	"time"
 
@@ -31,6 +34,57 @@ func (f *fixedEmbedder) Embed(_ context.Context, text string) ([]float32, error)
 	return v, nil
 }
 
+// brokenEmbedder fails every call, which is what an ONNX session error looks
+// like from the query chain's side.
+type brokenEmbedder struct{}
+
+func (brokenEmbedder) Dim() int     { return 4 }
+func (brokenEmbedder) Close() error { return nil }
+func (brokenEmbedder) Embed(context.Context, string) ([]float32, error) {
+	return nil, errors.New("onnx: session failed")
+}
+
+// TestQueryEmbedFailureDoesNotStopTheChain — V-568. The embed source used to
+// claim the turn on an embedder error, so one failing EmbedQuery answered every
+// question below it with "не смогла ответить", including the ones the search
+// answers without an embedder at all. A source that could not look must pass.
+func TestQueryEmbedFailureDoesNotStopTheChain(t *testing.T) {
+	const q = "почему небо голубое"
+
+	h, _ := searchHandler(t, searchBody, http.StatusOK)
+	h.api = ipc.NewStoreAPI(newTestStore(t))
+	h.recall = recallWiring{embedder: brokenEmbedder{}, minScore: 0.55, minMargin: 0.008}
+	h.now = time.Now
+
+	// The embed source itself passes rather than claiming.
+	turn := &queryTurn{dec: router.Decision{Intent: router.IntentQuery, Utterance: q}}
+	if reply, ok := h.queryEmbed(context.Background(), turn); ok {
+		t.Fatalf("queryEmbed claimed the turn on an embedder error: %q", reply)
+	}
+
+	// And the whole chain still reaches the search below it.
+	reply := askQuery(t, h, q)
+	if !strings.Contains(reply, "рэлеевского рассеяния") {
+		t.Fatalf("reply = %q, want the search answer", reply)
+	}
+}
+
+// The recall sources read the empty vector the failed embed left behind, and
+// neither of them may turn that into an answer: no vector means they could not
+// look, which is not the same as looking and finding nothing.
+func TestQueryRecallPassesWithoutAVector(t *testing.T) {
+	h, _ := buildRecallHandler(t, "где молоко", []recallCase{
+		{text: "молоко стоит в холодильнике", score: 0.90, kind: "note"},
+	})
+	turn := &queryTurn{dec: router.Decision{Intent: router.IntentQuery, Utterance: "где молоко"}}
+	if reply, ok := h.queryMemory(context.Background(), turn); ok {
+		t.Errorf("queryMemory claimed with no vector: %q", reply)
+	}
+	if reply, ok := h.queryNotes(context.Background(), turn); ok {
+		t.Errorf("queryNotes claimed with no vector: %q", reply)
+	}
+}
+
 // scoreVec builds a unit vector whose cosine against the query vector
 // (1,0,0,0) is exactly score.
 func scoreVec(score float64) []float32 {

cmd/mavend/querywalk_test.go

@@ -0,0 +1,137 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/kami/maven/internal/router"
+)
+
+// The floor, and it is the reason a destination is safe to add at all: a box
+// whose model is down names nothing, and naming nothing has to walk the chain
+// the way it walked before the field existed.
+func TestNoDestinationWalksTheWholeChain(t *testing.T) {
+	walk, skipped := queryWalk(router.SourceUnknown, false)
+	if len(skipped) != 0 {
+		t.Errorf("skipped %d sources with no destination named, want none", len(skipped))
+	}
+	if len(walk) != len(querySources) {
+		t.Fatalf("walk has %d sources, want the whole table of %d", len(walk), len(querySources))
+	}
+	for i := range walk {
+		if walk[i].name != querySources[i].name {
+			t.Fatalf("position %d is %q, want %q", i, walk[i].name, querySources[i].name)
+		}
+	}
+}
+
+// The 2026-08-07 defects, one per line. Each is a source that decides by seed
+// similarity claiming a turn that was never its own, and then answering it
+// because it has no lookup that could come back empty.
+func TestANamedDestinationSilencesTheOtherGuessers(t *testing.T) {
+	cases := []struct {
+		dest      router.Source
+		utterance string
+		silenced  string
+		anchored  bool // a stage 0 grammar named the destination
+	}{
+		{router.SourceWorld, "что такое TCP?", "weather", true},
+		{router.SourceWorld, "сколько будет 17 на 23?", "weather", true},
+		{router.SourceWorld, "кто такой Линус Торвальдс?", "personal", true},
+		{router.SourceRecall, "какой у меня любимый язык?", "feeds", false},
+		{router.SourceCalendar, "что в календаре на завтра?", "weather", true},
+	}
+	for _, c := range cases {
+		walk, skipped := queryWalk(c.dest, c.anchored)
+		if inWalk(walk, c.silenced) {
+			t.Errorf("%q named %q: %q is still asked", c.utterance, c.dest, c.silenced)
+		}
+		if !inWalk(skipped, c.silenced) {
+			t.Errorf("%q named %q: %q is missing from the record of who was skipped",
+				c.utterance, c.dest, c.silenced)
+		}
+	}
+}
+
+// Naming the world must not send the turn outside. His notes, his facts and the
+// boundary in front of them are the invariant CLAUDE.md states as "the owner's
+// data first, then the world", and a destination a model wrote must not be able
+// to reverse it.
+func TestNamingTheWorldStillReadsHisDataFirst(t *testing.T) {
+	walk, _ := queryWalk(router.SourceWorld, true)
+	for _, look := range []string{"fact-by-key", "embed", "memory", "notes"} {
+		if !inWalk(walk, look) {
+			t.Errorf("%q was dropped; only the sources that guess may be dropped", look)
+		}
+	}
+	if posOf(walk, "notes") > posOf(walk, "search") {
+		t.Error("search is asked before his notes are")
+	}
+	if posOf(walk, "search") < 0 {
+		t.Fatal("search is not in the walk at all")
+	}
+}
+
+// The boundary belongs to his data, so naming recall keeps it. That is what
+// makes "какой у меня любимый язык?" answer "не нашла у тебя такой записи"
+// rather than reaching SearXNG once nothing local had it.
+func TestNamingRecallKeepsTheBoundary(t *testing.T) {
+	walk, _ := queryWalk(router.SourceRecall, true)
+	if !inWalk(walk, "personal") {
+		t.Fatal("the personal boundary was skipped on a turn named for his own data")
+	}
+	if posOf(walk, "personal") > posOf(walk, "search") {
+		t.Error("the boundary no longer sits in front of the world")
+	}
+}
+
+// The owner's call of 2026-08-09 (V-666): only a stage 0 grammar may take the
+// personal boundary off a turn. The routing heads and the resident model both
+// name a destination by inference, and an inferred SourceWorld would send a
+// question about him upstream. Every other guesser still goes.
+func TestOnlyAGrammarMayDropTheBoundary(t *testing.T) {
+	walk, skipped := queryWalk(router.SourceWorld, false)
+	if !inWalk(walk, "personal") {
+		t.Error("an inferred destination took the boundary off the turn")
+	}
+	if !inWalk(skipped, "weather") {
+		t.Error("weather is still asked; the rule covers the boundary alone")
+	}
+	if posOf(walk, "personal") > posOf(walk, "search") {
+		t.Error("the boundary no longer sits in front of the world")
+	}
+	if anchored, _ := queryWalk(router.SourceWorld, true); inWalk(anchored, "personal") {
+		t.Error(`a grammar named the world and the boundary stayed: ` +
+			`"кто такой Линус Торвальдс?" is answered "не нашла у тебя такой записи" again`)
+	}
+}
+
+// Whatever the destination, the walk is a subsequence of the table. Every
+// comment on that table argues an order between two sources, and none of those
+// reasons is about this field.
+func TestTheWalkNeverReordersTheTable(t *testing.T) {
+	for _, dest := range append([]router.Source{router.SourceUnknown}, router.Sources...) {
+		walk, skipped := queryWalk(dest, true)
+		if len(walk)+len(skipped) != len(querySources) {
+			t.Errorf("%q: %d walked + %d skipped, want %d", dest, len(walk), len(skipped), len(querySources))
+		}
+		last := -1
+		for _, s := range walk {
+			at := posOf(querySources, s.name)
+			if at <= last {
+				t.Errorf("%q: %q is out of table order", dest, s.name)
+			}
+			last = at
+		}
+	}
+}
+
+func inWalk(list []querySource, name string) bool { return posOf(list, name) >= 0 }
+
+func posOf(list []querySource, name string) int {
+	for i, s := range list {
+		if s.name == name {
+			return i
+		}
+	}
+	return -1
+}

cmd/mavend/reactive_notes_test.go

@@ -22,7 +22,7 @@ func TestReactiveNotesReminders(t *testing.T) {
 
 	emb := router.NewHashEmbedder(1024)
 	matcher := tool.NewMatcher(api)
-	rtr := buildRouter(emb, matcher, 0.55, nil)
+	rtr := buildRouter(emb, matcher, 0.55, nil, nil)
 
 	h := &reactiveHandler{
 		api:       api,
@@ -104,7 +104,7 @@ func TestSpokenTaskCaptureFilesATask(t *testing.T) {
 	h := &reactiveHandler{
 		api:       api,
 		recall:    recallWiring{embedder: emb, memStore: memory.NewInMemoryStore()},
-		router:    buildRouter(emb, matcher, 0.55, nil),
+		router:    buildRouter(emb, matcher, 0.55, nil, nil),
 		replier:   voice.NewStubReplier(),
 		now:       func() time.Time { return now },
 		dataStore: st,

cmd/mavend/reminderwhen.go

@@ -0,0 +1,209 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/router"
+)
+
+// A reminder commits only when three things are answered: what to say, what
+// time to say it, and what day (owner's rule, 2026-08-06, V-579). Anything
+// missing is asked about, and nothing missing is filled from the clock.
+//
+// "напомни завтра в 3 заказать цветы" has the what and the day and an hour that
+// could be either half of the day, so she asks which 3. "напомни в 9 вечера
+// разгрузить стиралку" has the what and an unambiguous hour and no day, so she
+// asks which day. Today being a valid reading is not the same as him saying it.
+//
+// Two things are already whole and are not asked about. A time that admits one
+// reading is not queried for its half of the day, so "завтра в 15:00" commits.
+// And an interval is an instant, so "через час" carries all three by itself.
+type whenGap string
+
+const (
+	whenComplete      whenGap = ""
+	whenNoHour        whenGap = "hour"
+	whenAmbiguousHour whenGap = "part_of_day"
+	whenNoDay         whenGap = "day"
+)
+
+// whenGapOf reads the request and names the first thing about its time that he
+// has not said. hasTime is whether a parser could read an instant out of it,
+// which is necessary and not sufficient: the parser answers a dayless "в 9"
+// with a day it picked.
+func whenGapOf(text string, hasTime bool) whenGap {
+	if !router.NamesAnHour(text) {
+		return whenNoHour
+	}
+	if router.NamesAnInterval(text) {
+		return whenComplete
+	}
+	if !hasTime {
+		return whenNoHour
+	}
+	if router.HourIsAmbiguous(text) {
+		return whenAmbiguousHour
+	}
+	if !router.NamesADay(text) {
+		return whenNoDay
+	}
+	return whenComplete
+}
+
+// whenQuestion is what she asks for each gap. Every one of them opens with the
+// current time, because she is reasoning from it and he cannot check that
+// reasoning unless he hears it. The hour deck varies with the attempt, like
+// every other slot; the other two say one thing and there is only one way to
+// say it.
+//
+// taken is what his last turn added, in his own words, and it goes between the
+// clock and the question (V-593). It is empty whenever his turn moved nothing
+// forward, which is the case where repeating the question verbatim is honest.
+func whenQuestion(gap whenGap, attempt int, now time.Time, taken string) (string, bool) {
+	clock := fmt.Sprintf("Сейчас %s.", now.Format("15:04"))
+	if taken != "" {
+		clock += " " + taken
+	}
+	switch gap {
+	case whenNoHour:
+		q, ok := clarifyQuestionFor(dialogue.SlotTime, attempt)
+		if !ok {
+			return "", false
+		}
+		return clock + " " + q, true
+	case whenAmbiguousHour:
+		return clock + " Это утра или вечера?", true
+	case whenNoDay:
+		return clock + " В какой день?", true
+	}
+	return "", false
+}
+
+// whenKnown — the three things he has to say about the time, and whether the
+// words so far say them. Read off the same predicates whenGapOf reads, so the
+// two cannot disagree about what is still open.
+type whenKnown struct{ hour, part, day bool }
+
+func whenKnownOf(text string, hasTime bool) whenKnown {
+	if !router.NamesAnHour(text) {
+		return whenKnown{}
+	}
+	if router.NamesAnInterval(text) {
+		return whenKnown{hour: true, part: true, day: true}
+	}
+	if !hasTime {
+		return whenKnown{}
+	}
+	return whenKnown{
+		hour: true,
+		part: !router.HourIsAmbiguous(text),
+		day:  router.NamesADay(text),
+	}
+}
+
+// movedForward reports whether b says something a did not.
+func (a whenKnown) movedForward(b whenKnown) bool {
+	return (!a.hour && b.hour) || (!a.part && b.part) || (!a.day && b.day)
+}
+
+// whenTakenLine — the acknowledgement in front of a re-ask, in the words he
+// just used (V-593).
+//
+// It is an echo and never a restatement, for the same reason the fact
+// confirmation is (V-592): a 1.7B asked to say a Russian sentence back invents.
+// Its only job is evidence that the turn between two asks was heard, so after
+// "на 9" and then "на завтра" she does not ask "утра или вечера?" twice
+// byte-identically while he wonders whether the microphone is on.
+func whenTakenLine(text string) string {
+	text = strings.TrimSpace(text)
+	text = strings.TrimRight(text, " \t.,!?;:")
+	if text == "" {
+		return ""
+	}
+	return "Поняла: " + text + "."
+}
+
+// whenTextOf is everything he has said about when, the original request plus
+// every answer he has given to a question about it.
+//
+// The answers are kept apart from the utterance on purpose. The utterance is
+// the reminder's payload, so folding "завтра" into it would have her read the
+// day back to him at the time she says it. And a time answer has to be read
+// against the request rather than alone: "завтра" names no hour, and the hour
+// it belongs to is the one she is already holding.
+func whenTextOf(q *dialogue.PendingQuestion) string {
+	if q.WhenText == "" {
+		return q.Utterance
+	}
+	return strings.TrimSpace(q.Utterance + " " + q.WhenText)
+}
+
+// slotStillMissing reports whether a slot is still open. Every slot but the
+// reminder's time is open when it is empty; the time is open until all three of
+// what he must say about it are said.
+func slotStillMissing(slot dialogue.Slot, utterance string, s dialogue.Slots) bool {
+	if len(dialogue.StillMissing([]dialogue.Slot{slot}, s)) > 0 {
+		return true
+	}
+	return slot == dialogue.SlotTime && whenGapOf(utterance, s.HasTime) != whenComplete
+}
+
+// readWhen reads the instant out of what he has said about the time, newest
+// statement first.
+//
+// The request plus his latest answer is tried before the whole history, and
+// that order is what makes a correction win: "нет, сегодня в 15:00" after "в
+// 11:00" must land on 15:00, and a parser reading left to right off the joined
+// history would find the 11 he just took back. The history is the fallback,
+// because an answer often completes an earlier one rather than replacing it -
+// "вечера" says which 9, and alone it names no hour at all.
+func (h *reactiveHandler) readWhen(ctx context.Context, intent router.Intent, q *dialogue.PendingQuestion, text string) (time.Time, bool) {
+	latest := strings.TrimSpace(q.Utterance + " " + text)
+	if router.NamesAnHour(text) {
+		if w := h.extractor.Extract(ctx, intent, latest, h.now()); w.HasTime {
+			return w.Time, true
+		}
+	}
+	if w := h.extractor.Extract(ctx, intent, whenTextOf(q), h.now()); w.HasTime {
+		return w.Time, true
+	}
+	return time.Time{}, false
+}
+
+// asksAboutTime reports whether the parked question is one about when.
+func asksAboutTime(missing []dialogue.Slot) bool {
+	for _, s := range missing {
+		if s == dialogue.SlotTime {
+			return true
+		}
+	}
+	return false
+}
+
+// stillOpen reports whether any of the slots she asked about is still unsaid.
+func stillOpen(missing []dialogue.Slot, utterance string, s dialogue.Slots) bool {
+	for _, slot := range missing {
+		if slotStillMissing(slot, utterance, s) {
+			return true
+		}
+	}
+	return false
+}
+
+// stillMissingFor is missingFor's engine, in wantedSlots order. It reads the
+// utterance as well as the slots, which plain StillMissing cannot: whether an
+// hour is ambiguous is a fact about the words, not about the instant they
+// parsed to.
+func stillMissingFor(intent router.Intent, utterance string, s dialogue.Slots) []dialogue.Slot {
+	var out []dialogue.Slot
+	for _, want := range wantedSlots[intent] {
+		if slotStillMissing(want, utterance, s) {
+			out = append(out, want)
+		}
+	}
+	return out
+}

cmd/mavend/repair.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/kami/maven/internal/lexicon"
 	"github.com/kami/maven/internal/morph"
+	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/router"
 )
 
@@ -35,6 +36,11 @@ type routedTurn struct {
 	utterance string
 	intent    router.Intent
 	at        time.Time
+	// traceID — the persisted trace of this turn, stamped after the fact by
+	// stampLastTurn. 0 when nothing persisted, and then a spoken correction
+	// still teaches the classifier: the durable label is the half that needs a
+	// row to point at (V-636).
+	traceID int64
 }
 
 // repairWindow — how long a turn stays correctable. Long enough that he can
@@ -54,6 +60,13 @@ const repairWindow = 5 * time.Minute
 // said. The set's note in lexicon_ru_v1.json carries the same reasoning.
 var repairMarkers = lexicon.RepairMarkers()
 
+// repairNegatives — "she got it wrong" with no target. Matched against the whole
+// utterance, because these are complete sentences and the markers above are
+// fragments: "это не" needs an intent word after it, "не так поняла" does not.
+// Substring matching here would claim "не так" out of any sentence containing it
+// (V-636).
+var repairNegatives = lexicon.RepairNegatives()
+
 // repairIntents — the words he uses for each intent, as dictionary forms. They
 // used to be prefixes ("заметк"), which is what a prefix list costs: "команд"
 // also matched "командировка", and "факт" matched "фактически". morph.SameWord
@@ -147,6 +160,18 @@ func (h *reactiveHandler) recordTurn(utterance string, intent router.Intent) {
 	h.lastRouted = &routedTurn{utterance: utterance, intent: intent, at: h.now()}
 }
 
+// stampLastTurn attaches the trace id to the turn a correction would point at.
+// It cannot be done in recordTurn: the trace is written when the turn ends, and
+// recordTurn runs in the middle of it.
+func (h *reactiveHandler) stampLastTurn(utterance string, traceID int64) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.lastRouted == nil || h.lastRouted.utterance != utterance {
+		return
+	}
+	h.lastRouted.traceID = traceID
+}
+
 func (h *reactiveHandler) takeLastTurn() *routedTurn {
 	h.mu.Lock()
 	defer h.mu.Unlock()
@@ -157,6 +182,56 @@ func (h *reactiveHandler) takeLastTurn() *routedTurn {
 	return last
 }
 
+// resolveUntargetedRepair handles the cheap half of a spoken correction: he says
+// she got it wrong and does not say what it should have been (V-636).
+//
+// It is worth having on its own. V-630 made the target optional on the web for
+// the same reason: a turn marked wrong with no target is a usable negative, and
+// requiring the target would cost the correction he was willing to give. Voice
+// needs it more than the web does — naming an intent aloud means saying
+// "заметка" or "факт", which is Maven's vocabulary and not his.
+//
+// Nothing is redone and the classifier is not taught. There is no target, so
+// there is nothing to redo it as and nothing to teach. Only the label is written,
+// and she says so, because a correction he cannot see reads as one that was
+// dropped.
+func (h *reactiveHandler) resolveUntargetedRepair(ctx context.Context, text string) (string, bool) {
+	if !isRepairNegative(text) {
+		return "", false
+	}
+	last := h.takeLastTurn()
+	if last == nil || h.now().Sub(last.at) > repairWindow {
+		return "", false
+	}
+	if last.traceID == 0 {
+		// No row to point at, so there is no label to write and nothing this
+		// resolver can do. Routing the words normally is the honest outcome.
+		return "", false
+	}
+	h.labelCorrection(ctx, last, "")
+	log.Printf("voice: repair — %q marked wrong, no target given", last.utterance)
+	return phraser.A(phraser.RepairNoted, nil), true
+}
+
+// isRepairNegative matches the whole utterance, minus a leading "нет" and any
+// trailing punctuation. "нет, не так" is the shortest one he says.
+func isRepairNegative(utterance string) bool {
+	s := strings.ToLower(strings.TrimSpace(utterance))
+	s = strings.TrimRight(s, " .!?")
+	for _, p := range []string{"нет,", "нет", "no,", "no"} {
+		if rest := strings.TrimSpace(strings.TrimPrefix(s, p)); rest != s && rest != "" {
+			s = rest
+			break
+		}
+	}
+	for _, n := range repairNegatives {
+		if s == n {
+			return true
+		}
+	}
+	return false
+}
+
 // resolveRepair handles a spoken correction of the previous turn: teach the
 // classifier, redo the request under the corrected intent, and say so.
 func (h *reactiveHandler) resolveRepair(ctx context.Context, text string) (string, bool) {
@@ -182,6 +257,7 @@ func (h *reactiveHandler) resolveRepair(ctx context.Context, text string) (strin
 		learned = false
 	}
 	log.Printf("voice: repair — %q was %s, corrected to %s (learned=%v)", last.utterance, last.intent, corrected, learned)
+	h.labelCorrection(ctx, last, string(corrected))
 
 	dec := router.Decision{
 		Utterance: last.utterance,
@@ -207,3 +283,24 @@ func repairLine(say string, learned bool) string {
 	}
 	return "поняла, это " + say + " — запомнила."
 }
+
+// labelCorrection promotes a spoken correction into routing_labels, the same
+// table the /chat gesture writes (V-630, V-636).
+//
+// Two sinks and not one, because they keep different things. CorrectMisroute
+// appends a classifier seed, which is what makes the NEXT turn better today.
+// The label is what a fitted head trains on later, it survives the 14-day
+// transcript, and until now only the web produced any. A sample that only ever
+// held typed turns would skew to whatever he happens to be at a keyboard for,
+// and voice is where the hard cases are.
+//
+// Best-effort and silent. He has already been told the correction landed, and a
+// second sink failing is not his problem to hear about.
+func (h *reactiveHandler) labelCorrection(ctx context.Context, last *routedTurn, shouldBe string) {
+	if h.api == nil || last == nil || last.traceID == 0 {
+		return
+	}
+	if err := h.api.CorrectTurn(ctx, last.traceID, shouldBe); err != nil {
+		log.Printf("voice: repair: could not label trace %d: %v", last.traceID, err)
+	}
+}

cmd/mavend/repair_test.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/store"
 )
 
 func TestParseRepairReadsTheCorrectedIntent(t *testing.T) {
@@ -149,3 +150,95 @@ func TestRepairIntentWordCollisions(t *testing.T) {
 		}
 	}
 }
+
+// V-636. A spoken correction lands in the same table the /chat gesture writes,
+// so the sample is not limited to the turns he happened to type.
+func TestSpokenCorrectionWritesTheLabel(t *testing.T) {
+	h, st, _ := newClarifyHandler(t)
+	emb := router.NewHashEmbedder(256)
+	h.recall.embedder = emb
+	h.router = router.New(router.Config{Classifier: router.NewClassifier(emb), Extractor: h.extractor})
+	ctx := context.Background()
+
+	id, err := st.WriteRoutingTrace(ctx, store.RoutingTrace{
+		Ts: h.now(), Utterance: "купить хлеб", Intent: "fact", Source: "tap:voice",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	h.recordTurn("купить хлеб", router.IntentFact)
+	h.stampLastTurn("купить хлеб", id)
+
+	if _, handled := h.resolveRepair(ctx, "нет, это заметка"); !handled {
+		t.Fatal("the correction was not handled")
+	}
+	labels, err := st.RoutingLabels(ctx, 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(labels) != 1 || labels[0].Was != "fact" || labels[0].ShouldBe != "note" {
+		t.Fatalf("labels %+v: the spoken correction did not land as a pair", labels)
+	}
+}
+
+// The cheap half, which voice needs more than the web does: naming an intent
+// aloud means saying "заметка", which is her vocabulary and not his.
+func TestUntargetedSpokenCorrection(t *testing.T) {
+	h, st, now := newClarifyHandler(t)
+	ctx := context.Background()
+	seed := func(utterance string) int64 {
+		id, err := st.WriteRoutingTrace(ctx, store.RoutingTrace{
+			Ts: h.now(), Utterance: utterance, Intent: "query", Source: "tap:voice",
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		h.recordTurn(utterance, router.IntentQuery)
+		h.stampLastTurn(utterance, id)
+		return id
+	}
+
+	seed("поужинал")
+	reply, handled := h.resolveUntargetedRepair(ctx, "нет, не так")
+	if !handled {
+		t.Fatal("«нет, не так» was not read as a correction")
+	}
+	if reply == "" {
+		t.Error("a correction he cannot hear reads as one that was dropped")
+	}
+	labels, err := st.RoutingLabels(ctx, 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(labels) != 1 || labels[0].ShouldBe != "" || labels[0].Was != "query" {
+		t.Fatalf("labels %+v: want one untargeted negative naming what she chose", labels)
+	}
+
+	// Outside the window it is a fresh sentence, not a verdict.
+	seed("поужинал ещё раз")
+	*now = now.Add(repairWindow + time.Minute)
+	if _, handled := h.resolveUntargetedRepair(ctx, "не так"); handled {
+		t.Error("a correction outside the window was handled")
+	}
+}
+
+// Whole-utterance, never a substring. This is the difference between the
+// negatives and the markers, and getting it wrong would claim any sentence with
+// "не так" in it.
+func TestRepairNegativeIsTheWholeUtterance(t *testing.T) {
+	for _, s := range []string{
+		"не так поняла", "нет, не так", "ты ошиблась", "неправильно", "wrong", "no, that was wrong",
+	} {
+		if !isRepairNegative(s) {
+			t.Errorf("%q is not read as a correction", s)
+		}
+	}
+	for _, s := range []string{
+		"это не важно", "напомни не так поздно", "а не завтра", "не так, а вот так — это заметка",
+		"", "нет",
+	} {
+		if isRepairNegative(s) {
+			t.Errorf("%q was read as a correction", s)
+		}
+	}
+}

cmd/mavend/replier_llm.go

@@ -22,7 +22,7 @@ func newLLMReplier(c phraser.Completer, block func() string) *llmReplier {
 
 // Reply never fails: a clarify, a model error and an unusable generation all
 // answer from the stub, which is what keeps a turn from breaking on the model.
-func (r *llmReplier) Reply(d router.Decision) string {
+func (r *llmReplier) Reply(ctx context.Context, d router.Decision) string {
 	if d.Clarify {
 		// The deck, not the stub's single sentence: a clarify she cannot turn
 		// into a question is the line he hears most often when she misses him,
@@ -31,14 +31,22 @@ func (r *llmReplier) Reply(d router.Decision) string {
 		// a generation to say something this small.
 		return clarifyMissedLine(d)
 	}
-	out, err := r.p.PhraseReply(context.Background(), d)
+	if d.Intent == router.IntentFact {
+		// A captured fact is confirmed by echoing him, and the model is not
+		// asked (V-592). It has nothing to phrase FROM: replyContext hands it
+		// "записала факт: water \"drank\"", so every Russian word in the reply
+		// was the model's own invention, and on 2026-08-06 that was "Проверила,
+		// что ты выпел стакан воды" for "я выпил воды".
+		return phraser.FactAck(d.Utterance)
+	}
+	out, err := r.p.PhraseReply(ctx, d)
 	if err != nil || out == "" {
-		return r.stub.Reply(d)
+		return r.stub.Reply(ctx, d)
 	}
 	// The persona checks, on the live path (personaguard.go). A reply that
 	// leaks reasoning or calls him "вы" is worse than a flat one.
 	if _, ok := guardSpoken("reply", out); !ok {
-		return r.stub.Reply(d)
+		return r.stub.Reply(ctx, d)
 	}
 	return out
 }

cmd/mavend/replier_llm_test.go

@@ -22,7 +22,7 @@ func (s stubCompleter) Complete(_ context.Context, _ llm.Req) (string, error) {
 
 func TestLLMReplierPassesTheModelReplyThrough(t *testing.T) {
 	r := newLLMReplier(stubCompleter{out: `{"response":"записала, кофе закончился","mood":"neutral"}`}, nil)
-	got := r.Reply(router.Decision{Intent: router.IntentNote, Slots: router.Slots{Text: "кофе закончился"}})
+	got := r.Reply(context.Background(), router.Decision{Intent: router.IntentNote, Slots: router.Slots{Text: "кофе закончился"}})
 	if got != "записала, кофе закончился" {
 		t.Errorf("got %q, want %q", got, "записала, кофе закончился")
 	}
@@ -42,7 +42,7 @@ func TestLLMReplierFallsBackToStubOnEmpty(t *testing.T) {
 // the clarify deck rather than the stub's single sentence.
 func TestLLMReplierClarifyReadsTheDeck(t *testing.T) {
 	r := newLLMReplier(stubCompleter{out: "я всё поняла"}, nil)
-	got := r.Reply(router.Decision{Clarify: true, Utterance: "мгм"})
+	got := r.Reply(context.Background(), router.Decision{Clarify: true, Utterance: "мгм"})
 	if got == "я всё поняла" {
 		t.Fatal("a clarify must not be phrased by the model")
 	}
@@ -50,7 +50,7 @@ func TestLLMReplierClarifyReadsTheDeck(t *testing.T) {
 		t.Errorf("on clarify: got %q, want %q", got, want)
 	}
 	// Two different misses do not sound identical.
-	if same := r.Reply(router.Decision{Clarify: true, Utterance: "а"}); same == got {
+	if same := r.Reply(context.Background(), router.Decision{Clarify: true, Utterance: "а"}); same == got {
 		t.Log("two utterances hashed to the same line, which is allowed but should be rare")
 	}
 }
@@ -60,14 +60,14 @@ func TestLLMReplierClarifyReadsTheDeck(t *testing.T) {
 // produce, which is the same claim without pinning one wording.
 func assertAck(t *testing.T, r *llmReplier, d router.Decision, key, what string) {
 	t.Helper()
-	if got := r.Reply(d); !phraser.IsAck(key, nil, got) {
+	if got := r.Reply(context.Background(), d); !phraser.IsAck(key, nil, got) {
 		t.Errorf("on %s: got %q, want a %q line", what, got, key)
 	}
 }
 
 func assertStub(t *testing.T, r *llmReplier, d router.Decision, what string) {
 	t.Helper()
-	got, want := r.Reply(d), voice.NewStubReplier().Reply(d)
+	got, want := r.Reply(context.Background(), d), voice.NewStubReplier().Reply(context.Background(), d)
 	if got != want {
 		t.Errorf("on %s: got %q, want stub %q", what, got, want)
 	}

cmd/mavend/routingtrace.go

@@ -0,0 +1,178 @@
+// mavend/routingtrace.go — persisting the per-turn decision record (V-629).
+//
+// internal/decision keeps a 25-turn in-memory ring and persisted nothing, on the
+// argument that a turn record is read minutes later or never. The owner reversed
+// that on 06-08-2026, because the routing heads (V-546) cannot be fitted or
+// calibrated without real utterances and there is no other source of them. The
+// reversal is written down in docs/plans/21-persisting-the-routing-trace.md.
+//
+// The ring stays. It is what /trace reads, it is fast, and it is what a test that
+// wired no store still gets. This file is the second sink beside it, and it is
+// nil unless the daemon has a database — no store, no trace, no error.
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/kami/maven/internal/decision"
+	"github.com/kami/maven/internal/store"
+)
+
+// traceWriter is the seam the handler persists through. store.Store satisfies
+// it. nil ⇒ the ring is the only sink, which is the pre-V-629 behaviour exactly.
+type traceWriter interface {
+	WriteRoutingTrace(ctx context.Context, tr store.RoutingTrace) (int64, error)
+}
+
+// traceSink wraps the store, or returns nil when there is none. A typed nil
+// pointer assigned straight into the interface would be non-nil and would panic
+// on the first turn, which is the classic shape of this bug.
+func traceSink(s *store.Store) traceWriter {
+	if s == nil {
+		return nil
+	}
+	return s
+}
+
+// The trace id rides the context, the same seam querysource.go uses and for the
+// same reason: handleText answers every reach through one string, and threading
+// a second value through the whole action dispatch would change a signature the
+// mic, telegram and the web all share. A caller that wants the id asks for a
+// sink; the mic path does not, and pays nothing.
+type traceIDKey struct{}
+
+type traceIDSink struct {
+	mu sync.Mutex
+	id int64
+}
+
+func (s *traceIDSink) note(id int64) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.id = id
+}
+
+// ID is the persisted trace for the turn, or 0 when nothing was persisted.
+func (s *traceIDSink) ID() int64 {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.id
+}
+
+// withTraceIDSink returns a context that collects the persisted trace id, and
+// the sink to read after the turn has answered.
+func withTraceIDSink(ctx context.Context) (context.Context, *traceIDSink) {
+	sink := &traceIDSink{}
+	return context.WithValue(ctx, traceIDKey{}, sink), sink
+}
+
+func noteTraceID(ctx context.Context, id int64) {
+	if sink, ok := ctx.Value(traceIDKey{}).(*traceIDSink); ok {
+		sink.note(id)
+	}
+}
+
+// pruneTracesOnStart enforces retention once at wiring time. Pruning on write
+// alone is not enough: a box that goes quiet for a month keeps every row until
+// the next sixty-fourth turn, and "kept for fourteen days" would then be true
+// only of a box in daily use. Called for its effect and never blocks a start.
+func pruneTracesOnStart(s *store.Store, now time.Time) {
+	if s == nil {
+		return
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if err := s.PruneRoutingTraces(ctx, now.Add(-store.RoutingTraceRetention)); err != nil {
+		log.Printf("routing trace: prune on start: %v", err)
+	}
+}
+
+// persistDecision writes one finished record. It takes the same *decision.Record
+// the ring takes, so the two sinks cannot disagree about what the turn did.
+//
+// Errors are logged and swallowed. A trace is diagnostic and training data, and
+// a failed insert must never change what the owner hears.
+func (h *reactiveHandler) persistDecision(turnCtx context.Context, rec *decision.Record, src turnSource) {
+	ctx := turnCtx
+	if h.traces == nil || rec == nil || strings.TrimSpace(rec.Utterance) == "" {
+		return
+	}
+	// Detached from the turn's context, and bounded on its own. Two reasons, and
+	// the first is the one that matters: the turn is over by the time this runs,
+	// so a caller that hung up or timed out would cancel the insert, and the turn
+	// he abandoned halfway is exactly the one worth having. The second is that a
+	// write must not hold the reply, so it gets a second and no more.
+	ctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), time.Second)
+	defer cancel()
+	claims, err := json.Marshal(rec.Claims)
+	if err != nil {
+		log.Printf("routing trace: marshal claims: %v", err)
+		return
+	}
+	tr := store.RoutingTrace{
+		Ts:                rec.Ts,
+		Utterance:         rec.Utterance,
+		Source:            string(src),
+		Winner:            rec.Winner,
+		Intent:            wonIntent(rec),
+		ClaimedBeforeHead: claimedBeforeHead(rec),
+		EncoderID:         h.encoderID,
+		Outcome:           wonAt(rec, decision.StageAction),
+		Claims:            claims,
+	}
+	id, err := h.traces.WriteRoutingTrace(ctx, tr)
+	if err != nil {
+		log.Printf("routing trace: write: %v", err)
+		return
+	}
+	// The id goes back to whoever asked for it, so /chat can offer a correction
+	// on the turn it is already showing (V-630). Noted on the ORIGINAL context,
+	// not the detached one above: the sink belongs to the caller's turn.
+	noteTraceID(turnCtx, id)
+	// And the spoken path, which has no reply to hang a badge on: a correction
+	// said out loud points at the previous turn, so it needs that turn's row
+	// (V-636, repair.go).
+	h.stampLastTurn(rec.Utterance, id)
+}
+
+// wonIntent — what the winning claimant made the turn. Read from the claim
+// rather than from the route, because a pre-route resolver wins without routing
+// and its intent is the honest answer to "what was this turn".
+func wonIntent(rec *decision.Record) string {
+	for _, c := range rec.Claims {
+		if c.Outcome == decision.Won && c.Intent != "" {
+			return c.Intent
+		}
+	}
+	return ""
+}
+
+// wonAt — the claimant that won at one stage. The action stage is what actually
+// produced the reply, which is a different question from what was routed: a
+// route that reached a gap and a route that ran are not the same turn.
+func wonAt(rec *decision.Record, stage string) string {
+	for _, c := range rec.Claims {
+		if c.Stage == stage && c.Outcome == decision.Won {
+			return c.Claimant
+		}
+	}
+	return ""
+}
+
+// claimedBeforeHead — a pre-route resolver or a stage-0 grammar answered, so the
+// turn teaches nothing about the classifier. Those are a large share of real
+// traffic, and fitting a head on them would fit it to the grammars rather than
+// to him. Recorded per turn rather than filtered on write, because which share
+// that is happens to be the number V-632 needs to know.
+func claimedBeforeHead(rec *decision.Record) bool {
+	stage, _, ok := strings.Cut(rec.Winner, ":")
+	if !ok {
+		return false
+	}
+	return stage == decision.StagePreRoute || stage == decision.StageZero
+}

cmd/mavend/routingtrace_test.go

@@ -0,0 +1,125 @@
+package main
+
+import (
+	"context"
+	"testing"
+
+	"github.com/kami/maven/internal/decision"
+	"github.com/kami/maven/internal/store"
+)
+
+// A real turn leaves a persisted trace, not only a ring entry. This is the whole
+// of V-629: without one there is nothing to fit the routing heads from.
+func TestTurnPersistsTrace(t *testing.T) {
+	ring := decision.NewRing()
+	h := traceHandler(t, ring)
+	h.traces = traceSink(h.dataStore)
+	h.encoderID = "hash-1024"
+
+	if reply := h.handleText(context.Background(), "web", "сколько сейчас времени"); reply == "" {
+		t.Fatal("turn produced no reply")
+	}
+	got, err := h.dataStore.RecentRoutingTraces(context.Background(), 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 {
+		t.Fatalf("persisted %d traces, want 1", len(got))
+	}
+	tr := got[0]
+	if tr.Utterance != "сколько сейчас времени" {
+		t.Errorf("utterance %q", tr.Utterance)
+	}
+	if tr.Source != string(sourceText) {
+		t.Errorf("source %q, want %q", tr.Source, sourceText)
+	}
+	// A stage-0 clock rule answers this one, so the turn teaches the classifier
+	// nothing and the trace has to say so.
+	if !tr.ClaimedBeforeHead {
+		t.Errorf("claimed_before_head false on winner %q", tr.Winner)
+	}
+	if tr.EncoderID != "hash-1024" {
+		t.Errorf("encoder_id %q", tr.EncoderID)
+	}
+	if len(tr.Claims) < 3 {
+		t.Errorf("claims %s: the losers and the never-asked are the point", tr.Claims)
+	}
+}
+
+// No store, no trace, and no panic. A typed nil pointer in the interface would
+// pass the nil check and die on the first turn.
+func TestNoStoreNoTrace(t *testing.T) {
+	ring := decision.NewRing()
+	h := traceHandler(t, ring)
+	h.traces = traceSink(nil)
+
+	if reply := h.handleText(context.Background(), "web", "сколько сейчас времени"); reply == "" {
+		t.Fatal("turn produced no reply")
+	}
+	if len(ring.Recent(5)) != 1 {
+		t.Error("the ring is still the first sink and must still hold the turn")
+	}
+}
+
+// An empty utterance writes nothing. A blank row carries no label and no
+// diagnosis, and it is his words the retention bound exists for.
+func TestEmptyUtteranceIsNotPersisted(t *testing.T) {
+	h := traceHandler(t, decision.NewRing())
+	h.traces = traceSink(h.dataStore)
+	h.persistDecision(context.Background(), &decision.Record{Utterance: "  "}, sourceText)
+	got, err := h.dataStore.RecentRoutingTraces(context.Background(), 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("persisted %d traces for a blank utterance", len(got))
+	}
+}
+
+var _ traceWriter = (*store.Store)(nil)
+
+// The trace id rides back to the caller, which is what makes a correction one
+// gesture: /chat already has the id, so saying "that was wrong" costs a button
+// and no lookup (V-630).
+func TestTurnHandsBackItsTraceID(t *testing.T) {
+	h := traceHandler(t, decision.NewRing())
+	h.traces = traceSink(h.dataStore)
+
+	ctx, sink := withTraceIDSink(context.Background())
+	if reply := h.handleText(ctx, "web", "сколько сейчас времени"); reply == "" {
+		t.Fatal("turn produced no reply")
+	}
+	id := sink.ID()
+	if id == 0 {
+		t.Fatal("no trace id came back, so /chat can offer no correction")
+	}
+	// And it names the turn that just ran, so the correction lands on the right
+	// utterance.
+	if err := h.dataStore.CorrectTurn(context.Background(), id, "query", h.now()); err != nil {
+		t.Fatal(err)
+	}
+	labels, err := h.dataStore.RoutingLabels(context.Background(), 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(labels) != 1 || labels[0].Utterance != "сколько сейчас времени" {
+		t.Fatalf("labels %+v, want the turn that just ran", labels)
+	}
+}
+
+// A turn nobody asked the id of costs nothing, which is the mic path.
+func TestTurnWithNoSinkStillPersists(t *testing.T) {
+	h := traceHandler(t, decision.NewRing())
+	h.traces = traceSink(h.dataStore)
+
+	if reply := h.handleText(context.Background(), "web", "сколько сейчас времени"); reply == "" {
+		t.Fatal("turn produced no reply")
+	}
+	got, err := h.dataStore.RecentRoutingTraces(context.Background(), 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 {
+		t.Fatalf("persisted %d traces, want 1", len(got))
+	}
+}

cmd/mavend/ruwords.go

@@ -17,6 +17,7 @@ import (
 	"time"
 
 	"github.com/kami/maven/internal/lexicon"
+	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/say"
 )
 
@@ -73,22 +74,26 @@ func mentionsUnknownPlace(u string) bool {
 // date for a day she did not understand.
 const onlyNearDaysReply = "я считаю только сегодня, завтра, послезавтра и вчера — про другие дни пока не скажу."
 
-// dayWords — day references the calendar parser cannot resolve. A weekday name
-// or a "через …" phrase means he asked about a specific other day.
-var dayWords = []string{
-	"понедельник", "вторник", "сред", "четверг", "пятниц", "суббот", "воскресен",
-	"через", "monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday",
-}
-
 // mentionsUnknownDay reports whether the question names a day the calendar
 // parser could not resolve. Mirror of mentionsUnknownPlace: it exists only to
 // pick an honest reply over a confidently wrong one.
 //
 // Only called after ParseCalendarDate has already failed, so "завтра" and the
 // other words it does know never reach here.
+//
+// The weekday half was a list of STEMS matched with strings.Contains until
+// V-581 — "сред", "пятниц", "суббот". That is the hand-written Russian pattern
+// the sweep of 2026-08-04 took out, and it was wrong in the way such a pattern
+// always is: "среди", "средство" and "средний" all contain "сред", so a question
+// carrying any of them was answered with onlyNearDaysReply instead of the date.
+// Whole tokens now, and the weekday itself is router.WeekdayIndex, which reads
+// the lexicon and asks the dictionary about the case.
 func mentionsUnknownDay(u string) bool {
-	for _, w := range dayWords {
-		if strings.Contains(u, w) {
+	for _, tok := range quietTokens(u) {
+		if tok == "через" {
+			return true
+		}
+		if _, ok := router.WeekdayIndex(tok); ok {
 			return true
 		}
 	}
@@ -149,6 +154,11 @@ func hasDurationWords(u string) bool {
 // Used by the query handler when answering "когда я это сделал?"-style questions.
 func formatTime(t time.Time) string {
 	now := time.Now()
+	// The argument is a fact's Ts, which the store hands back as UTC. Only the
+	// last branch names a wall clock, and it named the store's until V-614: an
+	// answer to "когда я это сделал?" read hours off, in the same sentence
+	// shape the plan reads a day in.
+	t = t.Local()
 	if t.After(now.Add(-2*time.Minute)) && t.Before(now.Add(2*time.Minute)) {
 		return "только что"
 	}

cmd/mavend/ruwords_test.go

@@ -0,0 +1,57 @@
+package main
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// "когда я это сделал?" answers off a fact's Ts, which the store hands back as
+// UTC, and the branch that names a wall clock printed it in whatever zone it
+// arrived in (V-614). The instant here is built three hours off this machine's
+// zone, so the assertion holds under TZ=UTC as well.
+func TestFormatTimeReadsHisClock(t *testing.T) {
+	_, off := time.Now().Zone()
+	away := time.FixedZone("away", off+3*60*60)
+	stored := time.Now().Add(-72 * time.Hour).In(away)
+
+	got := formatTime(stored)
+	if want := stored.Local().Format("15:04"); !strings.Contains(got, want) {
+		t.Errorf("formatTime = %q, want the hour on his clock (%s)", got, want)
+	}
+	if bad := stored.Format("15:04"); strings.Contains(got, bad) {
+		t.Errorf("formatTime = %q reads the zone the fact arrived in (%s)", got, bad)
+	}
+}
+
+// TestMentionsUnknownDayReadsWordsNotStems — the defect V-581 found. The
+// weekday half of this guard was a list of stems matched with strings.Contains,
+// so "среди", "средство" and "средний" all read as Wednesday and the question
+// was answered with onlyNearDaysReply instead of a date.
+//
+// The other half of the fix is coverage: a stem list stops at the forms whoever
+// wrote it thought of, and "воскресеньях" was not one of them.
+func TestMentionsUnknownDayReadsWordsNotStems(t *testing.T) {
+	for _, u := range []string{
+		"какое число в понедельник",
+		"какое число в среду",
+		"какое число в среде",
+		"что там по воскресеньям",
+		"what is the date on friday",
+		"какое число через неделю",
+	} {
+		if !mentionsUnknownDay(u) {
+			t.Errorf("mentionsUnknownDay(%q) = false, want true", u)
+		}
+	}
+	for _, u := range []string{
+		"какое число в среднем",
+		"сколько это в среднем",
+		"какое сегодня средство",
+		"какое число",
+	} {
+		if mentionsUnknownDay(u) {
+			t.Errorf("mentionsUnknownDay(%q) = true; it names no day", u)
+		}
+	}
+}

cmd/mavend/self.go

@@ -0,0 +1,116 @@
+package main
+
+import (
+	"context"
+	"log"
+	"regexp"
+
+	"github.com/kami/maven/internal/phraser"
+)
+
+// A question about her — "что ты умеешь", "кто ты" — used to have no answer at
+// all (Vikunja #555). It reached the personal boundary, which claimed it as his
+// and said "не знаю — не нашла у тебя такой записи", because the boundary knows
+// two sides and this is neither: her own description is not his data and it is
+// not the world's either. Letting it past the boundary is no better, because
+// then SearXNG answers about somebody else's assistant.
+//
+// The description does NOT live in the note store. Notes are his. A note about
+// her sitting in his index would come back for "что я записал", would be fed to
+// the digestion worker as something he said, and would be recalled by vector
+// proximity for questions that are not about her at all. It is her own text, so
+// it lives here, in one place, and it is the only copy.
+//
+// This source sits ABOVE the boundary, because a question about her never had
+// an answer below it.
+
+// selfDescription — what she is and what this box actually does. Frozen text,
+// and the one rule for editing it: name only what is really wired. Anything
+// that depends on config — the house, the LAN, the feeds, telegram, search — is
+// named as depending on what he allowed, never claimed outright. Inventing a
+// capability here is the same defect as inventing a fact, and it is worse than
+// silence because he would plan around it.
+//
+// Written in her own voice, feminine, addressing him informally, because it is
+// handed to the phraser as the evidence for the answer and the phraser will
+// keep the words it is given.
+const selfDescription = `Я Мэйвен, твоя помощница. Я живу на твоём сервере, ` +
+	`и наружу уходит только поисковый запрос — больше ничего.
+
+Что я делаю сама: запоминаю, что ты мне говоришь, и потом отвечаю на вопросы ` +
+	`об этом; веду заметки; ставлю напоминания; читаю твой календарь и задачи; ` +
+	`отвечаю на вопросы о мире — сначала поиском, а если сети нет, то по ` +
+	`офлайновой энциклопедии.
+
+Что зависит от того, что ты мне разрешил: дом, локальная сеть, ленты, ` +
+	`список покупок, погода, телеграм. Если что-то из этого не настроено, я ` +
+	`скажу об этом прямо, а не буду выдумывать ответ.
+
+Говорю по-русски и по-английски.`
+
+// selfSeeds — the questions this source claims. Scoring data like every other
+// topic set: editing one moves the recogniser and has to be re-measured against
+// TestONNXTopics.
+//
+// All of them are about HER — what she is, what she can do, who made her. The
+// neighbouring set is topicAttend, "что требует внимания", which asks about the
+// state of his things; the two share almost nothing but the second person.
+var selfSeeds = []string{
+	"что ты умеешь",
+	"что ты можешь делать",
+	"кто ты такая",
+	"расскажи о себе",
+	"какие у тебя возможности",
+	// Added after measuring: it won self by 0.0002, under the margin, and the
+	// floor does not carry it — "способна" names no verb the floor matches.
+	"на что ты способна",
+	"чем ты можешь помочь",
+	"what can you do",
+	"who are you",
+}
+
+// selfFloor — the offline floor, for a handler with no embedder or a turn whose
+// vector never got computed. Narrow on purpose, like every other floor here: it
+// answers only when the seeds cannot, and a broad guess made blind is worse
+// than a narrow one.
+//
+// Go's \b is ASCII-only and never fires next to a Cyrillic letter, so the
+// Russian patterns spell the boundary out.
+var selfPatterns = []*regexp.Regexp{
+	regexp.MustCompile(`(?i)(^|[^\p{L}\p{N}])ты\s+(умеешь|можешь)([^\p{L}\p{N}]|$)`),
+	regexp.MustCompile(`(?i)(^|[^\p{L}\p{N}])кто\s+ты([^\p{L}\p{N}]|$)`),
+	regexp.MustCompile(`(?i)(^|[^\p{L}\p{N}])(расскажи|поведай)\s+о\s+себе([^\p{L}\p{N}]|$)`),
+	regexp.MustCompile(`(?i)\bwhat\s+can\s+you\s+do\b`),
+	regexp.MustCompile(`(?i)\bwho\s+are\s+you\b`),
+}
+
+func selfFloor(utterance string) bool {
+	for _, re := range selfPatterns {
+		if re.MatchString(utterance) {
+			return true
+		}
+	}
+	return false
+}
+
+// querySelf answers a question about her from selfDescription. The description
+// goes through the phraser as evidence so the answer is shaped to what he
+// asked — "что ты умеешь" and "кто ты" want different halves of it — and falls
+// back to the text itself, which is already readable, if the model is down.
+func (h *reactiveHandler) querySelf(ctx context.Context, t *queryTurn) (string, bool) {
+	if !h.turnIsAbout(ctx, t, topicSelf, selfFloor) {
+		return "", false
+	}
+	var reply string
+	if h.phraser != nil {
+		var err error
+		reply, err = h.phraser.PhraseSelf(ctx, t.dec.Utterance, selfDescription)
+		if err != nil {
+			log.Printf("voice: phrase self: %v", err)
+		}
+	}
+	if reply == "" {
+		reply = phraser.Q(phraser.QueryFound, map[string]string{"text": selfDescription})
+	}
+	return reply, true
+}

cmd/mavend/self_test.go

@@ -0,0 +1,96 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/kami/maven/internal/router"
+)
+
+// TestSelfFloorClaimsAQuestionAboutHerAndNothingElse — the offline floor, which
+// is what answers with no embedder. Narrow on purpose, so the rows that must
+// NOT match are the point.
+func TestSelfFloorClaimsAQuestionAboutHerAndNothingElse(t *testing.T) {
+	claimed := []string{
+		"что ты умеешь",
+		"что ты можешь",
+		"а что ты умеешь?",
+		"кто ты",
+		"кто ты такая?",
+		"расскажи о себе",
+		"what can you do",
+		"who are you",
+	}
+	for _, u := range claimed {
+		if !selfFloor(u) {
+			t.Errorf("%q is a question about her and the floor missed it", u)
+		}
+	}
+	declined := []string{
+		"что у меня сегодня",
+		"расскажи про байкал",
+		"кто изобрёл телефон",
+		"что требует внимания",
+		"запиши что я пил воду",
+		// The floor spells its own word boundaries out, because Go's \b never
+		// fires next to a Cyrillic letter. Without that these would match.
+		"кто тыкал в розетку",
+		"расскажи о себестоимости",
+	}
+	for _, u := range declined {
+		if selfFloor(u) {
+			t.Errorf("%q is not about her and the floor claimed it", u)
+		}
+	}
+}
+
+// TestSelfSourceAnswersFromTheDescription — with no embedder the source falls
+// to the floor, and the answer has to be the description rather than silence.
+func TestSelfSourceAnswersFromTheDescription(t *testing.T) {
+	h := personalHandler()
+	reply, claimed := h.querySelf(context.Background(), &queryTurn{
+		dec: router.Decision{Utterance: "что ты умеешь"},
+	})
+	if !claimed {
+		t.Fatal("a question about her must be claimed above the boundary")
+	}
+	if !strings.Contains(reply, "напоминания") {
+		t.Errorf("the answer must come from the description: %q", reply)
+	}
+	if _, claimed := h.querySelf(context.Background(), &queryTurn{
+		dec: router.Decision{Utterance: "почему небо синее"},
+	}); claimed {
+		t.Error("a world question must pass this source")
+	}
+}
+
+// TestSelfDescriptionHoldsThePersona — it is her own text and she reads it out,
+// so the same rules the phrasing eval enforces apply to it. Feminine
+// self-reference, informal address, no pet names.
+func TestSelfDescriptionHoldsThePersona(t *testing.T) {
+	lower := strings.ToLower(selfDescription)
+	for _, bad := range []string{"я рад ", "я готов ", "вы ", "ваш", "милый", "дорогой"} {
+		if strings.Contains(lower, bad) {
+			t.Errorf("the description breaks the persona on %q", bad)
+		}
+	}
+	for _, want := range []string{"тво", "ты"} {
+		if !strings.Contains(lower, want) {
+			t.Errorf("the description must address him directly, missing %q", want)
+		}
+	}
+}
+
+// TestSelfDescriptionClaimsNothingUnconditionally — the constraint that makes
+// this text safe to read out. Every capability that depends on config has to be
+// named as depending on it, and inventing one here is the same defect as
+// inventing a fact.
+func TestSelfDescriptionClaimsNothingUnconditionally(t *testing.T) {
+	conditional := selfDescription[strings.Index(selfDescription, "Что зависит"):]
+	for _, cap := range []string{"дом", "локальная сеть", "ленты", "список покупок", "погода", "телеграм"} {
+		if !strings.Contains(conditional, cap) {
+			t.Errorf("%q is configured, not wired — it must sit under the conditional half", cap)
+		}
+	}
+}

cmd/mavend/simulator_test.go

@@ -347,6 +347,55 @@ func (s *scriptedLLM) Complete(_ context.Context, r llm.Req) (string, error) {
 		map[bool]string{true: "route", false: "reply"}[routing], truncateRunes(r.User, 60))
 }
 
+// scriptedPhraser answers the chat path from the same script the router reads.
+//
+// It exists because actionChat calls h.phraser.PhraseChat, and the production
+// implementation posts raw HTTP to /v1/chat/completions rather than going
+// through the llm client scriptedLLM stands in for. So until this, no scenario
+// could script what she SAYS on a chat turn: the simulator wired phraser.NewStub()
+// and every chat reply came back as a pick from fallbacks_ru_v1.json, four
+// variants deep, which varied between two runs of one scenario (V-542 item 4).
+//
+// Everything except PhraseChat is the Stub's, by embedding. A nudge and a
+// reminder are phrased by the tick loop, which has its own phraser and its own
+// assertions; this seam is only about the conversation.
+type scriptedPhraser struct {
+	*phraser.Stub
+	entries []scriptEntry
+}
+
+// PhraseChat returns the scripted reply for the utterance, or an error when the
+// scenario scripted none. The error rather than a fallback is deliberate and
+// matches scriptedLLM: actionChat logs it and falls back to ChatFallback(), so a
+// scenario that never meant to assert on a chat reply behaves exactly as it did
+// before, and one that DID means to is told its script has a hole.
+func (p *scriptedPhraser) PhraseChat(_ context.Context, utterance string, _ []dialogue.Turn) (string, error) {
+	for _, e := range p.entries {
+		if e.Reply == "" {
+			continue
+		}
+		if e.Match != "" && !strings.Contains(strings.ToLower(utterance), strings.ToLower(e.Match)) {
+			continue
+		}
+		return chatReplyText(e.Reply), nil
+	}
+	return "", fmt.Errorf("simulator: no scripted chat reply for %q", truncateRunes(utterance, 60))
+}
+
+// chatReplyText reads a scripted reply in either shape the phrasing contract
+// allows: the {"response","mood"} object the model emits, or plain text.
+// LLMPhraser does this parse itself, so a scenario writes one thing and both
+// paths understand it.
+func chatReplyText(reply string) string {
+	var out struct {
+		Response string `json:"response"`
+	}
+	if err := json.Unmarshal([]byte(reply), &out); err == nil && out.Response != "" {
+		return out.Response
+	}
+	return reply
+}
+
 // ---------------------------------------------------------------------------
 // Building the world
 // ---------------------------------------------------------------------------
@@ -425,7 +474,7 @@ func newSimWorld(t *testing.T, sc scenario) *simWorld {
 	// used to be built on a nil API, which meant any scenario that produced an
 	// act panicked the moment the matcher was consulted.
 	matcher := tool.NewMatcher(api)
-	rtr := buildRouter(emb, matcher, config.DefaultRouterThreshold, router.NewLLMRouter(scripted))
+	rtr := buildRouter(emb, matcher, config.DefaultRouterThreshold, router.NewLLMRouter(scripted), nil)
 
 	w.handler = &reactiveHandler{
 		stt:    simTranscriber{},
@@ -440,7 +489,7 @@ func newSimWorld(t *testing.T, sc scenario) *simWorld {
 		api:                api,
 		matcher:            matcher,
 		tools:              tool.NewExecutor(api, 5*time.Second),
-		phraser:            phraser.NewStub(),
+		phraser:            &scriptedPhraser{Stub: phraser.NewStub(), entries: sc.Script},
 		replier:            newLLMReplier(scripted, nil),
 		now:                clock.Now,
 		dataStore:          st,

cmd/mavend/sttseam_test.go

@@ -0,0 +1,43 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/stt"
+)
+
+// A box with no workstation.stt block transcribes exactly as it did before the
+// seam existed: the floor is handed back untouched, and nothing probes.
+func TestSttSeamWithNoBlockIsTheFloor(t *testing.T) {
+	floor := stt.NewStub()
+	got, pair := sttSeam(&config.Config{}, floor)
+	if pair != nil {
+		t.Fatal("no block must build no pair")
+	}
+	if got != stt.Transcriber(floor) {
+		t.Fatal("no block must hand back the floor itself")
+	}
+}
+
+func TestSttSeamPrefersTheWorkstation(t *testing.T) {
+	cfg := &config.Config{Workstation: &config.WorkstationConfig{
+		URL: "http://127.0.0.1:1",
+		Stt: &config.WorkstationSttConfig{
+			URL:    "http://127.0.0.1:2/transcribe",
+			Health: "http://127.0.0.1:2/health",
+		},
+	}}
+	got, pair := sttSeam(cfg, stt.NewStub())
+	if pair == nil {
+		t.Fatal("a configured block must build a pair")
+	}
+	defer pair.Stop()
+	if got != stt.Transcriber(pair) {
+		t.Fatal("the pair is what callers must transcribe through")
+	}
+	// Nothing answers on port 2, so the seam is the floor until it does.
+	if pair.Available() {
+		t.Fatal("an unreachable workstation must not be available")
+	}
+}

cmd/mavend/telegramintake.go

@@ -0,0 +1,59 @@
+// mavend/telegramintake.go — wiring the inbound telegram poller (V-637).
+//
+// The poller reaches the daemon through ipc.CoreAPI and nothing else, so a
+// telegram turn takes exactly the path the web's POST /api/chat takes: Chat
+// returns the reply and the persisted trace id, and CorrectTurn writes the
+// label. Nothing in internal/delivery knows what a handler is.
+package main
+
+import (
+	"context"
+	"log"
+	"sync"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/delivery/telegramsink"
+	"github.com/kami/maven/internal/ipc"
+)
+
+// wireTelegramIntake starts the poller, or returns having done nothing. It is
+// nil-safe in every argument, because it is called from both boot paths — the
+// unlocked start and the passkey unlock — and telegram must behave the same on
+// either.
+//
+// A sink that will not build is logged rather than fatal here. The push half
+// already failed the boot in wireDispatcher for the same config, so a second
+// hard failure would only lose that message.
+func wireTelegramIntake(ctx context.Context, wg *sync.WaitGroup, api ipc.CoreAPI, cfg *config.Config) {
+	if cfg == nil || cfg.Telegram == nil || !cfg.Telegram.Intake || api == nil {
+		return
+	}
+	sink, err := telegramsink.New(*cfg.Telegram)
+	if err != nil {
+		log.Printf("telegram intake: %v", err)
+		return
+	}
+	poller, err := telegramsink.NewPoller(sink, chatTurnFn(api), api.CorrectTurn)
+	if err != nil {
+		log.Printf("telegram intake: %v", err)
+		return
+	}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		poller.Run(ctx)
+	}()
+}
+
+// chatTurnFn adapts ipc.Chat to the poller's Turn. The trace id comes back on
+// the reply because the daemon's Chat collects it off the context (V-630), so
+// the chat can offer the same correction the web does without a second op.
+func chatTurnFn(api ipc.CoreAPI) telegramsink.Turn {
+	return func(ctx context.Context, conversation, text string) (string, int64, error) {
+		reply, err := api.Chat(ctx, conversation, text)
+		if err != nil {
+			return "", 0, err
+		}
+		return reply.Reply, reply.TraceID, nil
+	}
+}

cmd/mavend/testdata/scenarios/conversation_anaphora.json

@@ -0,0 +1,79 @@
+{
+  "schema_version": 1,
+  "name": "conversation_anaphora",
+  "description": "Five consecutive Russian turns about one object, replayed from the run that found V-542 on the box on 05-08-2026. He names a monitor, then asks four questions that all say \"он\" and never name it again.\n\nThis scenario exists because the shape had nowhere to fail. The routing fixture scores one utterance at a time, so a conversation that breaks on its second turn cannot lose a point there, and V-44 step 2 could only be verified by hand. That is item 3 of V-542.\n\nFour of the five replies below are WRONG, and the assertions pin them anyway. Read them as the recorded defect rather than the contract: she has the last four turns in front of her and never once names the thing he is asking about. Every wrong assertion is marked in its step note with what it must become. When V-542 lands, those flip and the ones marked correct do not move.\n\nWhat the four assert is that the reply LACKS \"монитор\". Absence is the defect itself: she is answering a question about a thing she wrote down two minutes ago and cannot name it. It also survives the fallback picker, which matters on the three query turns — they refuse from internal/phraser/fallbacks_ru_v1.json, four variants deep, and the same scenario returned \"тут я пас.\" one run and \"не знаю, честно.\" the next, so a string assertion there would pin the picker rather than the daemon.\n\nTurn 4 asserts its text as well, because that turn goes through the chat path and the chat path is now scriptable. scriptedPhraser in simulator_test.go answers PhraseChat from the same script entries the router reads (V-542 item 4); before it, the simulator wired phraser.NewStub() and no scenario could say what she SAYS on a chat turn at all.\n\nThe routes are scripted exactly as the box produced them, because the failure is not the model's. Turn 1 went to fact despite \"давай поболтаем\", every question after it went to query, and turn 4 went to chat. A scripted route is what lets this scenario pin the daemon's half without a llama-server in the loop.",
+  "start": "2026-08-05T14:00:00+03:00",
+  "script": [
+    {
+      "match": "купил новый монитор",
+      "route": "[{\"intent\":\"fact\",\"key\":\"purchase\",\"value\":\"новый монитор\"}]",
+      "reply": "{\"response\":\"записала: новый монитор.\",\"mood\":\"neutral\"}"
+    },
+    {
+      "match": "он большой",
+      "route": "[{\"intent\":\"query\",\"text\":\"а он большой?\"}]"
+    },
+    {
+      "match": "сколько он примерно стоит",
+      "route": "[{\"intent\":\"query\",\"text\":\"сколько он примерно стоит по-твоему?\"}]"
+    },
+    {
+      "match": "переплатил",
+      "route": "[{\"intent\":\"chat\",\"text\":\"мне кажется я переплатил\"}]",
+      "reply": "{\"response\":\"я не знаю, о каком именно устройстве ты говоришь.\",\"mood\":\"neutral\"}"
+    },
+    {
+      "match": "стоит его вернуть",
+      "route": "[{\"intent\":\"query\",\"text\":\"стоит его вернуть?\"}]"
+    },
+    {
+      "match": "",
+      "route": "[{\"intent\":\"chat\",\"text\":\"\"}]",
+      "reply": "{\"response\":\"я рада тебя слышать.\",\"mood\":\"happy\"}"
+    }
+  ],
+  "steps": [
+    {
+      "at": "14:00",
+      "note": "CORRECT, and it is the first half of the defect. \"давай поболтаем\" is an explicit request to converse and the turn is filed as a fact anyway. Storing what he said is not wrong on its own — he did buy a monitor — but the object then lives in the fact store and never enters the transcript PhraseChat reads. That is V-542 decision 2: either the marker claims the turn at stage 0, or it means nothing and comes out of the fixture.",
+      "say": "давай поболтаем: я вчера купил новый монитор",
+      "expect_events": ["purchase"],
+      "expect_no_send": true
+    },
+    {
+      "at": "14:01",
+      "note": "WRONG. \"он\" is the monitor from one turn ago, and she says she has no record of it. followUpMerge inherits prev.Slots.Key, and a query turn asking about a pronoun has no key to merge, so the question reaches the query sources naked and the notes source answers the only way it can. Must become: an answer about the monitor, or a route to chat where the transcript is.",
+      "say": "а он большой?",
+      "expect_reply_lacks": ["монитор"],
+      "expect_no_send": true
+    },
+    {
+      "at": "14:02",
+      "note": "WRONG, and it rules out one explanation. This is not the previous turn failing to stick — it is the same wall a second time, two turns from where the monitor was named. Nothing accumulates across query turns.",
+      "say": "сколько он примерно стоит по-твоему?",
+      "expect_reply_lacks": ["монитор"],
+      "expect_no_send": true
+    },
+    {
+      "at": "14:03",
+      "note": "WRONG, and it is the same wall from the other side. This turn routed chat, so it HAD the history that Session.History holds, and it asks which device he means anyway — because turn 1's object went to the fact store rather than the transcript. So a source reading the conversation is not sufficient on its own; decision 1 has to say which store the referent comes from. This is the one step whose text is pinned: the reply is scripted and reaches PhraseChat, so it is the box's own words rather than a fallback pick. Must become: a reply that names the monitor.",
+      "say": "мне кажется я переплатил",
+      "expect_reply_contains": ["о каком именно устройстве"],
+      "expect_reply_lacks": ["монитор"],
+      "expect_no_send": true
+    },
+    {
+      "at": "14:04",
+      "note": "WRONG. The fifth turn is the one that shows the cost. A returns question about a purchase two minutes old is answered with \"не нашла у тебя такой записи\", which is wrong in kind rather than merely unhelpful: the record exists, she wrote it herself at 14:00 under the key purchase.",
+      "say": "стоит его вернуть?",
+      "expect_reply_lacks": ["монитор"],
+      "expect_no_send": true
+    },
+    {
+      "at": "14:05",
+      "note": "CORRECT, and it is the control. Nothing in five conversational turns was sent at him unprompted, and a tick with him mid-conversation stays silent. Whatever V-542 changes must not change this.",
+      "tick": true,
+      "expect_no_send": true
+    }
+  ]
+}

cmd/mavend/testdata/scenarios/evening_degraded.json

@@ -24,8 +24,8 @@
       "at": "21:00",
       "note": "he speaks. The whole voice path runs: push-to-talk, the STT seam parked with the golden transcript, the real router, the real store write, the phrasing contract.",
       "audio": "ru_fact",
-      "expect_reply_contains": ["записала"],
-      "expect_reply_lacks": ["записал ", "записал,", "записал.", "милый", "ваш"],
+      "expect_reply_contains": ["записала", "выпил воды"],
+      "expect_reply_lacks": ["записал ", "записал,", "записал.", "милый", "ваш", "стакан"],
       "expect_events": ["water"]
     },
     {

cmd/mavend/testdata/scenarios/morning_missed.json

@@ -74,17 +74,17 @@
     },
     {
       "at": "08:50",
-      "note": "he asks. The query path answers from local recall only: nothing stored clears the score gate, so she refuses rather than inventing a morning summary, and the replier is never reached. That refusal is the no-hallucination floor and this step pins it. Note what the persona check here is and is not: the reply is a constant in the Go source, so expect_reply_lacks pins that constant, not anything the model wrote. The step below is the one that reads model output.",
+      "note": "he asks what he missed, and Praxis holds one unresolved item — the morning medicine — so she reads that back. This step pinned \"не знаю\" until 05-08-2026, and that was the keyword floor's blind spot rather than a rule: isAttentionQuery does not match \"что я пропустил\", while the topicAttend seeds carry \"что важное я пропустил\" almost verbatim. The seeds only started deciding when turnVector fixed the empty query vector every topic source was reading (V-547). Reading a surfaced item aloud is not inventing a morning summary, so the no-hallucination floor still holds; what moved is which source answers. Note what the persona check here is and is not: the reply is a constant in the Go source, so expect_reply_lacks pins that constant, not anything the model wrote. The step below is the one that reads model output.",
       "say": "что я пропустил?",
-      "expect_reply_contains": ["не знаю"],
+      "expect_reply_contains": ["требует внимания", "morning_medicine"],
       "expect_reply_lacks": ["рад ", "милый", "ваш"]
     },
     {
       "at": "08:55",
-      "note": "stating a fact writes it and says so, in the feminine. This reply comes back through the replier from the scripted model, so the persona check is against generated text rather than a constant. The masculine forms are listed with their following character — \"записал \" and \"записал,\" — because \"записала\" contains \"записал\", and the earlier check on the comma alone passed on \"записал что ты выпил воды\".",
+      "note": "stating a fact writes it and says so, in the feminine, and in his own words. The reply no longer comes from the model at all (V-592): a 1.7B asked to restate «я выпил воды» answered «Проверила, что ты выпел стакан воды», so the confirmation is now a deck frame with his sentence in it. The masculine forms are listed with their following character — \"записал \" and \"записал,\" — because \"записала\" contains \"записал\".",
       "say": "я выпил воды",
-      "expect_reply_contains": ["записала"],
-      "expect_reply_lacks": ["записал ", "записал,", "записал.", "милый"],
+      "expect_reply_contains": ["записала", "я выпил воды"],
+      "expect_reply_lacks": ["записал ", "записал,", "записал.", "милый", "стакан"],
       "expect_events": ["water"]
     },
     {

cmd/mavend/tick.go

@@ -319,10 +319,7 @@ func (t *tickLoop) stopFinishedAlarms(ctx context.Context, keys []string, state
 	if len(keys) == 0 {
 		return nil
 	}
-	byName := make(map[string]loop.Rule, len(t.rules))
-	for _, r := range t.rules {
-		byName[r.Name] = r
-	}
+	byName := t.rulesByName()
 	live := keys[:0:0]
 	for _, key := range keys {
 		outcome := ""
@@ -381,19 +378,27 @@ func (t *tickLoop) repeatableRules(keys []string) []string {
 	if len(keys) == 0 {
 		return nil
 	}
-	wired := make(map[string]bool, len(t.rules))
-	for _, r := range t.rules {
-		wired[r.Name] = true
-	}
+	wired := t.rulesByName()
 	out := keys[:0:0]
 	for _, k := range keys {
-		if wired[k] {
+		if _, ok := wired[k]; ok {
 			out = append(out, k)
 		}
 	}
 	return out
 }
 
+// rulesByName indexes the wired rule set by name, for the two lookups above
+// that only care whether a key is still wired (repeatableRules) or need the
+// rule itself (stopFinishedAlarms).
+func (t *tickLoop) rulesByName() map[string]loop.Rule {
+	byName := make(map[string]loop.Rule, len(t.rules))
+	for _, r := range t.rules {
+		byName[r.Name] = r
+	}
+	return byName
+}
+
 // cachePhrase keeps the latest phrased nudge per rule for the sev4-repeat
 // path. writing under a mutex; the repeat path reads under the same. the
 // cache is bounded by the rule count (≤ ~30 per spec) so eviction is not a

cmd/mavend/tick_api.go

@@ -23,6 +23,12 @@ type daemonAPI struct {
 	chatFn           func(ctx context.Context, conversation, text string) string
 	getMCPServers    func() []ipc.MCPServerStatus
 	getEvents        func(n int) []ipc.IntakeEvent
+	getDecisions     func(n int) []ipc.TurnDecision
+	// nexus — the identity client, nil when no nexus block is configured. It
+	// is what makes ResolveEntity answerable at all; without it the store
+	// adapter's refusal stands, and a surface that wanted an entity id says so
+	// instead of storing a name.
+	nexus *nexusClient
 	// seedStore — non-nil ONLY when mavend was started with -allow-seed. It is
 	// the whole off-switch for the backdated write path (Vikunja #518), and it
 	// is a store rather than a bool so that leaving the flag off means the
@@ -41,6 +47,48 @@ func (d *daemonAPI) RecentEvents(ctx context.Context, n int) ([]ipc.IntakeEvent,
 	return d.getEvents(n), nil
 }
 
+// nexusOf — the identity client the voice wiring built, or nil. Same shape as
+// embedderOf: a wiring that is absent and a wiring with no nexus block are one
+// answer here.
+func nexusOf(w *voiceWiring) *nexusClient {
+	if w == nil || w.handler == nil || w.handler.ecosystem == nil {
+		return nil
+	}
+	return w.handler.ecosystem.nexus
+}
+
+// ResolveEntity asks Nexus for the canonical id behind a name (Vikunja #511).
+//
+// Three outcomes, kept apart on purpose. No nexus block is ErrNotImplemented,
+// so a surface can say "identity is not configured here" rather than invent an
+// id. A miss is ipc.ErrNoEntity. A match against several entities comes back
+// Ambiguous with the names, because picking one is how a task ends up blocked
+// on the wrong person and nobody can see it happened.
+func (d *daemonAPI) ResolveEntity(ctx context.Context, query string, types []string) (ipc.EntityRef, error) {
+	if d.nexus == nil {
+		return ipc.EntityRef{}, ipc.ErrNotImplemented
+	}
+	res, err := d.nexus.Resolve(ctx, query, types)
+	if err != nil {
+		return ipc.EntityRef{}, err
+	}
+	if len(res.Candidates) > 1 {
+		names := make([]string, 0, len(res.Candidates))
+		for _, c := range res.Candidates {
+			names = append(names, c.DisplayName)
+		}
+		return ipc.EntityRef{Ambiguous: true, Candidates: names}, nil
+	}
+	if res.Entity == nil || res.Entity.ID == "" {
+		return ipc.EntityRef{}, ipc.ErrNoEntity
+	}
+	return ipc.EntityRef{
+		ID:          res.Entity.ID,
+		Type:        res.Entity.Type,
+		DisplayName: res.Entity.DisplayName,
+	}, nil
+}
+
 // Chat runs one text turn and reports which query source claimed it. The sink
 // rides the context so handleText keeps the one string signature the mic,
 // telegram and the web all call it through (V-539).
@@ -49,10 +97,19 @@ func (d *daemonAPI) Chat(ctx context.Context, conversation, text string) (ipc.Ch
 		return ipc.ChatReply{}, errors.New("mavend: chat not available")
 	}
 	ctx, sink := withQuerySourceSink(ctx)
+	// The trace id rides back the same way (V-630), so /chat can offer a
+	// correction on the turn it is already showing. 0 when nothing persisted.
+	ctx, traces := withTraceIDSink(ctx)
 	reply := d.chatFn(ctx, conversation, text)
-	return ipc.ChatReply{Reply: reply, Source: sink.Name()}, nil
+	return ipc.ChatReply{Reply: reply, Source: sink.Name(), TraceID: traces.ID()}, nil
 }
 
+// CorrectTurn is NOT overridden here, and that is deliberate (V-630). Every other
+// diagnostic on this type exists because the daemon holds something the store
+// cannot answer from a table. A correction is a table, so the embedded store
+// adapter is already the right answer and a second implementation here would be
+// a second place for it to drift.
+
 // MCPServers — the configured MCP servers and their health (Vikunja #251).
 // Empty, not an error, when the mcp block is absent: "not configured" is the
 // default state and the web surface renders it as such.
@@ -71,6 +128,17 @@ func (d *daemonAPI) TickTrace(ctx context.Context) (ipc.TickTrace, error) {
 	return toIPCTickTrace(*trace), nil
 }
 
+// TurnDecisions — the arbitration records of the last few turns (V-564). Nil
+// getter means voice was never wired, and that is an empty list rather than an
+// error: a box with no voice path has had no turns to arbitrate, which is not a
+// fault and renders as an empty table.
+func (d *daemonAPI) TurnDecisions(ctx context.Context, n int) ([]ipc.TurnDecision, error) {
+	if d.getDecisions == nil {
+		return nil, nil
+	}
+	return d.getDecisions(n), nil
+}
+
 func (d *daemonAPI) MorningStatus(ctx context.Context) ([]ipc.MorningRoutineStatus, error) {
 	if d.getMorningStatus == nil {
 		return nil, errors.New("mavend: morning status not available")

cmd/mavend/topics.go

@@ -9,7 +9,7 @@ import (
 )
 
 // Which subject is this question about — the weather, the house, the LAN, what
-// needs looking at, or none of them. Third of the three mechanisms replacing hand-written Russian
+// needs looking at, his feeds, or none of them. Third of the three mechanisms replacing hand-written Russian
 // patterns (Vikunja #522, owner's call 2026-08-04). internal/lexicon holds the
 // sets that can be finished and internal/morph answers the grammar questions;
 // this is for the sets that can never be finished, because "is this about the
@@ -37,6 +37,11 @@ import (
 // внимания", which is Praxis's operational state and reached the web search
 // before the source existed (Vikunja #475).
 //
+// A fifth joined on 05-08-2026: the feeds, "что нового в лентах". Its word lists
+// were the last pair of hand-written Russian stem lists in the router (V-522),
+// and they carried the same admission in their own comments — vagueNouns exists
+// because "что нового?" is a greeting that matched a feed noun.
+//
 // The regexes stay as the offline floor, unchanged, for a handler with no
 // embedder or a turn whose vector never got computed. They are allowed to remain
 // narrow now precisely because they are no longer the only answer.
@@ -52,6 +57,9 @@ const (
 	topicHome    topicLabel = "home"
 	topicNetwork topicLabel = "network"
 	topicAttend  topicLabel = "attention"
+	topicFeed    topicLabel = "feeds"
+	topicList    topicLabel = "list"
+	topicSelf    topicLabel = "self"
 	topicOther   topicLabel = "other"
 )
 
@@ -117,7 +125,56 @@ var topicSeedSets = map[topicLabel][]string{
 		"what needs attention",
 		"what needs looking at right now",
 	},
+	topicFeed: {
+		"что нового в лентах",
+		"какие новости",
+		"что нового по технологиям",
+		"почитай заголовки",
+		// Two seeds carrying a day word beside the headlines. Without them
+		// "какие сегодня заголовки" read as weather, because "какая сегодня
+		// погода" is the nearest thing in the whole set with "сегодня" in it.
+		"заголовки за сегодня",
+		"какие главные новости за день",
+		"покажи новости за сегодня",
+		"что пишут в новостях",
+		"что нового про политику",
+		"расскажи что нового в ленте",
+		"what is new in the feeds",
+		"any news headlines today",
+	},
+	// Reading a standing list back, and only that. Adding to one and clearing
+	// one stay on the phrase tables in internal/router/list.go — see its header
+	// for why a span and a delete are not seed-shaped work.
+	topicList: {
+		"что в списке покупок",
+		"что мне нужно купить",
+		"прочитай список покупок",
+		"покажи что в списке",
+		"что осталось купить в магазине",
+		"что мне нужно в аптеке",
+		"какой у меня список покупок",
+		"what is on my shopping list",
+		"read me the grocery list",
+	},
+	// Questions about her (Vikunja #555). The set lives in self.go beside the
+	// description it unlocks, so the two are edited together — a seed claiming
+	// a question the description does not answer is the failure mode.
+	//
+	// "что ты умеешь" was a topicOther seed until this existed, put there so an
+	// attention question had something to lose to. It is a self seed now, and
+	// it cannot be both: a phrasing on two sides never clears the margin.
+	topicSelf: selfSeeds,
 	topicOther: {
+		// A task question is not a list read-back. They collide on "что у меня",
+		// and the list has its own table to lose to as well.
+		"какие у меня задачи",
+		"что у меня в делах",
+		// The bare newness opener, which is a greeting and not a request for
+		// headlines. It sits here on purpose: it is close enough to the feed
+		// seeds that it will not clear topicMargin, and a thin call goes to
+		// ParseFeedQuery, which declines a vague noun with no topic beside it.
+		"что нового",
+		"как дела",
 		// Complaints, which are not requests to scan or to read the house.
 		// isNetworkQuery's comment names this one: a scan she runs unasked is
 		// the noisy behaviour the bounds exist to prevent.
@@ -137,9 +194,40 @@ var topicSeedSets = map[topicLabel][]string{
 		"что я говорил про бэкапы",
 		"что у меня сегодня по календарю",
 		"напомни мне позвонить маме",
-		// An attention question is about the state of his things; this is not.
-		"что ты умеешь",
 		"what did i say about backups",
+		// World questions that name a day (Vikunja #553). Weather was the only
+		// topic whose seeds carry a day word — four of its eight do — so every
+		// "какой сегодня X" landed nearest it and cleared the margin: the
+		// dollar rate by 0.0220 and a public holiday by 0.0398, against 0.0883
+		// for a real weather question. The gate then asked "для какого города?"
+		// about the dollar.
+		//
+		// The margin was not the knob. 0.0398 is not a coin flip, and raising
+		// the bar far enough to catch it would take real weather questions with
+		// it. What was missing is the negative class: a day word means the
+		// question is about a day, and says nothing about whether it is about
+		// the sky.
+		"сколько стоит биткоин сегодня",
+		"какой завтра праздник в стране",
+		"во сколько сегодня восход солнца",
+		"кто вчера победил в чемпионате",
+		// The frame itself, twice. "какая сегодня погода" is a weather seed,
+		// and the four above did not move "какой сегодня курс доллара" or
+		// "что интересного произошло сегодня в мире" off weather, because what
+		// pulls them is the frame and not the noun. A frame that both topics
+		// use has to sit on both sides, or the side that owns it wins every
+		// noun it has never seen.
+		"какой сегодня курс валют",
+		"что сегодня происходит в мире",
+		// The same story one topic over, found while verifying V-554 on the
+		// box: "кто изобрёл телефон" ran a LAN scan and answered "нашла 3
+		// устройства". The network set opens with "кто в сети сейчас" and
+		// names devices throughout, so a "кто ..." question about any device
+		// noun landed there. A device has a history, and asking about it is
+		// not asking what is plugged in.
+		"кто изобрёл телефон",
+		"когда появился первый компьютер",
+		"как работает роутер",
 	},
 }
 
@@ -201,6 +289,35 @@ func (x *topicIndex) best(vec []float32) (label topicLabel, margin float64, ok b
 	return label, first - second, true
 }
 
+// turnVector returns the turn's query vector, computing it on first ask and
+// caching it on the turn.
+//
+// It exists because every topic source sits ABOVE the "embed" source in
+// querySources, and that source was the only thing that ever set t.vec. So
+// turnIsAbout was reading an empty vector on every deployed turn, best returned
+// ok=false, and all six recognisers ran on their keyword floors — the seeds
+// decided nothing outside the tests, which embed the utterance themselves and
+// call best directly. Found on the box on 05-08-2026: "что мне нужно купить" was
+// answered from an old note, and the seeds place it as the list by 0.0841.
+//
+// Computing here rather than moving the embed source up: the cost is paid by the
+// turns that ask, the cache means queryEmbed below reuses this one, and the
+// order of querySources stays what its comments argue for.
+func (h *reactiveHandler) turnVector(ctx context.Context, t *queryTurn) []float32 {
+	if len(t.vec) > 0 || h.recall.embedder == nil {
+		return t.vec
+	}
+	vec, err := router.EmbedQuery(ctx, h.recall.embedder, t.dec.Utterance)
+	if err != nil {
+		// The floor answers. A topic source is not the place to fail a turn:
+		// the recall sources below hit the same embedder and report it there.
+		log.Printf("voice: topic vector for %q: %v", t.dec.Utterance, err)
+		return nil
+	}
+	t.vec = vec
+	return vec
+}
+
 // turnIsAbout — the recogniser every topic source calls. The seeds decide when
 // the embedder is there, which is every deployed box; floor is the source's own
 // keyword test, which answers when they are not.
@@ -213,7 +330,7 @@ func (x *topicIndex) best(vec []float32) (label topicLabel, margin float64, ok b
 // network by 0.0055; isNetworkQuery says no, so it stays the complaint it is.
 func (h *reactiveHandler) turnIsAbout(ctx context.Context, t *queryTurn, want topicLabel, floor func(string) bool) bool {
 	h.recall.topics.load(ctx, h.recall.embedder)
-	label, margin, ok := h.recall.topics.best(t.vec)
+	label, margin, ok := h.recall.topics.best(h.turnVector(ctx, t))
 	if !ok {
 		return floor(t.dec.Utterance)
 	}

cmd/mavend/topics_test.go

@@ -25,6 +25,8 @@ func TestTopicFloorAnswersWithoutSeeds(t *testing.T) {
 		{"что включено в доме?", topicHome, isHomeQuery, true},
 		{"какие устройства в сети?", topicNetwork, isNetworkQuery, true},
 		{"что требует внимания?", topicAttend, isAttentionQuery, true},
+		{"что нового в лентах?", topicFeed, feedFloor, true},
+		{"что в списке покупок?", topicList, listFloor, true},
 		{"почему небо синее", topicWeather, isWeatherQuery, false},
 		{"я дома", topicHome, isHomeQuery, false},
 		{"интернет не работает", topicNetwork, isNetworkQuery, false},
@@ -86,6 +88,50 @@ func TestONNXTopics(t *testing.T) {
 		{"что требует моего внимания сейчас", topicAttend, isAttentionQuery},
 		{"что не так с базой данных", topicAttend, isAttentionQuery},
 		{"есть что-то срочное на сегодня", topicAttend, isAttentionQuery},
+		{"что нового в ленте за сегодня", topicFeed, feedFloor},
+		{"какие сегодня заголовки", topicFeed, feedFloor},
+		{"что нового про искусственный интеллект", topicFeed, feedFloor},
+		// The greeting. It has to lose to topicOther, or fall thin enough that
+		// ParseFeedQuery — which declines a vague noun with no topic — answers.
+		{"что нового?", topicOther, feedFloor},
+		{"что мне надо купить в магазине", topicList, listFloor},
+		{"прочитай мне список", topicList, listFloor},
+		{"что там в аптеке нужно взять", topicList, listFloor},
+		// A task read-back is not a list read-back, and the two collide on
+		// "что у меня".
+		{"какие у меня сейчас задачи", topicOther, listFloor},
+		// World questions that name a day (Vikunja #553). Weather was the only
+		// topic carrying day words, so all of these read as weather and two of
+		// them cleared the margin: the gate asked "для какого города?" about
+		// the dollar. The last two are far from any seed on purpose — the
+		// first three are close enough to the new topicOther seeds that they
+		// would pass on similarity alone.
+		{"какой сегодня курс доллара", topicOther, isWeatherQuery},
+		{"какой сегодня праздник", topicOther, isWeatherQuery},
+		{"что интересного произошло сегодня в мире", topicOther, isWeatherQuery},
+		{"во сколько завтра открывается музей", topicOther, isWeatherQuery},
+		{"кто сегодня играет в лиге чемпионов", topicOther, isWeatherQuery},
+		// The control the seeds above must not cost: real weather still reads
+		// as weather, including the two that lean on the keyword floor.
+		{"будет ли завтра дождь в москве", topicWeather, isWeatherQuery},
+		{"какая температура завтра утром", topicWeather, isWeatherQuery},
+		// The same shape one topic over, seen on the box (Vikunja #554): a
+		// device has a history, and asking about it is not asking what is
+		// plugged in. "кто изобрёл телефон" answered "нашла 3 устройства".
+		// Held out from the seeds, which name the telephone and the computer.
+		{"кто придумал радио", topicOther, isNetworkQuery},
+		{"когда изобрели телевизор", topicOther, isNetworkQuery},
+		{"как устроен телефон внутри", topicOther, isNetworkQuery},
+		// The control: a real scan is still a scan.
+		{"какие устройства подключены к вайфаю", topicNetwork, isNetworkQuery},
+		// Questions about her (Vikunja #555), held out from selfSeeds.
+		{"а что ты вообще умеешь делать", topicSelf, selfFloor},
+		{"какие у тебя навыки", topicSelf, selfFloor},
+		{"расскажи мне о себе", topicSelf, selfFloor},
+		{"what are you able to do", topicSelf, selfFloor},
+		// The control: an attention question is about the state of his things,
+		// and it is the neighbour these seeds could have taken.
+		{"что требует внимания у меня в сервисах", topicAttend, isAttentionQuery},
 	}
 
 	h := &reactiveHandler{recall: recallWiring{embedder: emb}}

cmd/mavend/turnrole.go

@@ -0,0 +1,354 @@
+package main
+
+import (
+	"strings"
+	"unicode"
+
+	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/lexicon"
+	"github.com/kami/maven/internal/router"
+)
+
+// turnRole — what this utterance IS, relative to the action Maven is in the
+// middle of assembling. The five roles are the owner's vocabulary (Vikunja
+// #558), plus the sixth answer a resolver is allowed to give: not_applicable,
+// which hands the turn back to generic dispatch.
+//
+// It exists because the arbitration used to be ordering. The clarify resolver,
+// the confirm gate, the follow-up merge and the repair marker all ran BEFORE
+// the router, so the claimant holding conversational state decided what an
+// utterance was without asking the one component whose job that is — and on
+// 2026-08-05 "какая сейчас погода в Риме?" became the time of a reminder,
+// because the extractor found "сейчас" in it and nothing looked at the rest.
+//
+// The rule that fixes that: a routed decision which stands on its own — its own
+// intent, its own slots filled from its own words — is not an answer, whatever
+// the extractor found inside it.
+type turnRole string
+
+const (
+	roleAnswer        turnRole = "answer"         // it fills the slot she asked about
+	roleCorrection    turnRole = "correction"     // it replaces a value she already had
+	roleSideQuery     turnRole = "side_query"     // a question of its own, asked mid-flow
+	roleNewRequest    turnRole = "new_request"    // a different request entirely
+	roleAside         turnRole = "aside"          // something he stated, not an answer
+	roleCancel        turnRole = "cancel"         // call the pending action off
+	roleNotApplicable turnRole = "not_applicable" // nothing is pending; not our turn
+)
+
+// frameWords — the words that can stand around a bare slot value without adding
+// a request. Every member is a closed class from internal/lexicon: the frame
+// itself, the interrogatives, the parts of a spoken clock, the days and the
+// months. Assembled once; the sets are copies, so this cannot edit them.
+var frameWords = buildFrameWords()
+
+func buildFrameWords() map[string]bool {
+	out := make(map[string]bool)
+	add := func(list []string) {
+		for _, w := range list {
+			out[strings.ToLower(w)] = true
+		}
+	}
+	add(lexicon.SlotValueFrame())
+	add(lexicon.Interrogatives())
+	add(lexicon.PartsOfDay())
+	add(lexicon.HalfHourWords())
+	add(lexicon.DayOffsetWords())
+	for i := 0; i < 7; i++ {
+		out[lexicon.Weekday(i)] = true
+	}
+	for m := 1; m <= 12; m++ {
+		out[lexicon.MonthGenitive(m)] = true
+	}
+	for hh := 0; hh <= 23; hh++ {
+		add(strings.Fields(lexicon.HourSpoken(hh)))
+	}
+	return out
+}
+
+// cancelWords — the same, for the words that call the pending action off.
+var cancelWords = buildCancelWords()
+
+func buildCancelWords() map[string]bool {
+	out := make(map[string]bool)
+	for _, w := range lexicon.DialogueCancel() {
+		out[strings.ToLower(w)] = true
+	}
+	return out
+}
+
+// turnTokens splits an utterance the way the router's own predicates do: over
+// letters and digits, lowercased, so punctuation and a clock's colon fall out.
+func turnTokens(text string) []string {
+	return strings.FieldsFunc(strings.ToLower(text), func(r rune) bool {
+		return !unicode.IsLetter(r) && !unicode.IsDigit(r)
+	})
+}
+
+// ownContent lists the tokens of an utterance that are neither frame nor value:
+// what it is about, over and above the thing she asked for. Numbers go out
+// because a number is the commonest slot value there is, and the closed number
+// and day lexicons go out with them.
+//
+// Empty ⇒ the utterance is a slot value and nothing else, however it is dressed
+// up. That is the whole test, and it is what separates "а что если в 11:00" —
+// which is a time, hedged — from "какая сейчас погода в Риме?", which leaves
+// "погода" and "риме" behind and is therefore about something.
+func ownContent(text string) []string {
+	var out []string
+	for _, tok := range turnTokens(text) {
+		if frameWords[tok] || lexicon.IsFillerParticle(tok) {
+			continue
+		}
+		if _, ok := lexicon.Cardinal(tok); ok {
+			continue
+		}
+		if _, ok := lexicon.Ordinal(tok); ok {
+			continue
+		}
+		if isNumeric(tok) {
+			continue
+		}
+		out = append(out, tok)
+	}
+	return out
+}
+
+func isNumeric(tok string) bool {
+	for _, r := range tok {
+		if !unicode.IsDigit(r) {
+			return false
+		}
+	}
+	return tok != ""
+}
+
+// isCancel reports whether the utterance is nothing but a call-off. Every
+// content token has to be a cancel word, so "забудь" ends the exchange and
+// "забудь купить молоко" does not.
+func isCancel(text string) bool {
+	content := ownContent(text)
+	if len(content) == 0 {
+		return false
+	}
+	for _, tok := range content {
+		if !cancelWords[tok] {
+			return false
+		}
+	}
+	return true
+}
+
+// carriesOwnRequest reads the ROUTED decision for the thing that decides this:
+// does the utterance ask for something in its own right? Each intent is asked
+// the question in its own terms, because "its own slots filled from its own
+// words" means a different field for each of them.
+//
+// A query or a system question needs no further evidence — the router already
+// read a question in these words. The write intents need the verb or the slot
+// that names the request, so a bare value the router guessed a home for does
+// not count as one.
+func carriesOwnRequest(dec router.Decision, text string) bool {
+	if dec.Clarify {
+		// The router itself was unsure. An utterance she could not route is
+		// not an utterance that outranks the question in front of it.
+		return false
+	}
+	switch dec.Intent {
+	case router.IntentQuery, router.IntentSystem:
+		return true
+	case router.IntentReminder:
+		return carriesReminderVerb(text)
+	case router.IntentFact, router.IntentNote:
+		return router.CarriesCaptureVerb(text)
+	case router.IntentAct:
+		// An act that resolved to a capability is a command. One that did not
+		// is words she cannot execute anyway, so it stays an answer and gets
+		// re-asked — the same thing that happens to it today.
+		return dec.Slots.HasFn
+	default: // chat
+		return false
+	}
+}
+
+// carriesReminderVerb — "напомни" and its forms, matched over tokens. The
+// reminder verbs are a closed lexicon and are not capture verbs, so
+// CarriesCaptureVerb never sees them.
+func carriesReminderVerb(text string) bool {
+	toks := turnTokens(text)
+	for _, v := range lexicon.ReminderVerbs() {
+		for _, t := range toks {
+			if t == strings.ToLower(v) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// isPleasantry matches the WHOLE utterance against lexicon.Pleasantries, after
+// lowercasing and dropping the punctuation a greeting carries.
+//
+// Whole utterance and not tokens. Every token rule tried here was wrong on
+// something: "вечер" answers "это утра или вечера?", "нет" answers a confirm,
+// and "спокойной" alone is not an utterance at all. A greeting is a fixed
+// phrase, so matching it as one costs nothing and claims nothing else.
+func isPleasantry(text string) bool {
+	t := strings.ToLower(strings.TrimSpace(text))
+	t = strings.Trim(t, " .,!?…")
+	t = strings.Join(strings.Fields(t), " ")
+	if t == "" {
+		return false
+	}
+	for _, p := range lexicon.Pleasantries() {
+		if t == p {
+			return true
+		}
+	}
+	return false
+}
+
+// offlineOwnRequest is the shape half of the evidence: the offline token tests,
+// which cost nothing and never depend on the model that produced the routing.
+// It is also the whole answer when there is no route to read — the classifier
+// is the failure floor and a turn must never break on the model.
+func offlineOwnRequest(text string) bool {
+	return router.IsQuestionShaped(text) || router.CarriesCaptureVerb(text) || carriesReminderVerb(text)
+}
+
+// classifyTurnRole decides what this utterance is against the pending action.
+//
+// The fast path is the first line and it is a fast path to the SAME answer, not
+// a second decision procedure: an utterance with no content of its own can
+// never be a request of its own, so it can never be anything but an answer, and
+// the route below would spend a second on the resident model to say so. Every
+// other utterance is routed first, and the role is read off the decision.
+//
+// `routed` is the turn's routing, already computed; ok is false when there was
+// none to compute (no router wired, or the route failed). A failed route falls
+// to the offline shape tests rather than breaking the turn.
+func classifyTurnRole(q *dialogue.PendingQuestion, text string, answer dialogue.Slots, routed router.Decision, ok bool) turnRole {
+	if isCancel(text) {
+		return roleCancel
+	}
+	// Two pieces of evidence, and the content gate in front of both. The shape
+	// tests are the floor and answer for free; the route is what sees a request
+	// with no shape to it — "погода в риме" asks a question and carries neither
+	// a question mark nor an interrogative, and only the router knows that.
+	//
+	// An utterance of pure frame gets one more chance, and V-577 is why. Every
+	// token of "что у меня сегодня?" is frame, so the content gate called it an
+	// answer, the parked reminder took "сегодня" for its time, and the question
+	// he asked was answered nowhere. A routed intent beats a frame match,
+	// because the frame is a hint and the route is a decision.
+	//
+	// The condition is that it fills nothing she asked about. That keeps the
+	// hedged "а что если в 11:00" an answer, which is what it is: it carries the
+	// hour, and no route saying "question" changes that. It works because the
+	// extractor no longer reads a day word as the current clock, so a sentence
+	// that names no hour now fills nothing to weigh.
+	// A pleasantry is neither (V-663). "спасибо" and "привет" fell through to
+	// roleAnswer, so a question about a reminder's DAY was re-asked at a man
+	// saying thank you, and the retry it spent was one of the three bounds
+	// meant to end the ride. It is an aside: answered as itself, the question
+	// resumed on the tail, no attempt spent, one ride counted. Placed above the
+	// content gate because "доброе утро" has content and states nothing, so
+	// neither half of the evidence below can reach it.
+	if q != nil && isPleasantry(text) {
+		return roleAside
+	}
+	own := false
+	if len(ownContent(text)) > 0 {
+		own = offlineOwnRequest(text) || (ok && carriesOwnRequest(routed, text))
+	} else if ok && fillsNothingAsked(q, answer) {
+		own = carriesOwnRequest(routed, text)
+	}
+	if !own {
+		if isAside(q, text, answer, routed, ok) {
+			return roleAside
+		}
+		if replacesFilledSlot(q, answer) {
+			return roleCorrection
+		}
+		return roleAnswer
+	}
+	if router.IsQuestionShaped(text) || (ok && (routed.Intent == router.IntentQuery || routed.Intent == router.IntentSystem)) {
+		return roleSideQuery
+	}
+	return roleNewRequest
+}
+
+// isAside reports whether the utterance is something he STATED while she was
+// waiting on a question (V-577 shape 2).
+//
+// "у меня новый ноутбук" said into a parked reminder was dropped in silence: it
+// carries no capture verb, so it is not a request of its own, and it fills no
+// slot, so it is not an answer either. Neither storing it nor saying it was
+// ignored is the one behaviour that is wrong, and it was the behaviour.
+//
+// Three conditions, and all three are needed. The route has to call it a
+// statement AND stand behind that, so a bare time is never an aside. It has to
+// fill none of what she asked about, so an answer she can use stays an answer.
+// And it has to say something, so a shrug is still a failed answer and still
+// spends a retry.
+func isAside(q *dialogue.PendingQuestion, text string, answer dialogue.Slots, routed router.Decision, ok bool) bool {
+	if !ok || q == nil {
+		return false
+	}
+	if !statesSomething(routed) {
+		return false
+	}
+	if len(ownContent(text)) == 0 {
+		return false
+	}
+	return fillsNothingAsked(q, answer)
+}
+
+// statesSomething reports whether the route is evidence that these words state
+// a thing, rather than a guess she has to interrupt a flow over.
+//
+// Two kinds of evidence, and the second one exists because the classifier floor
+// marks nearly everything Clarify. A parsed fact key comes from the
+// deterministic fact parser and not from a similarity score, so "я выпил воды"
+// is a statement on any engine. A confident note or fact is the other kind, and
+// that is the one the resident model gives for "у меня новый ноутбук".
+func statesSomething(routed router.Decision) bool {
+	switch routed.Intent {
+	case router.IntentFact:
+		return routed.Slots.HasKey || !routed.Clarify
+	case router.IntentNote:
+		return !routed.Clarify
+	}
+	return false
+}
+
+// fillsNothingAsked reports whether the utterance gave her none of what she
+// asked for. Nothing is pending counts as nothing filled.
+func fillsNothingAsked(q *dialogue.PendingQuestion, answer dialogue.Slots) bool {
+	if q == nil {
+		return true
+	}
+	return len(dialogue.StillMissing(q.Missing, answer)) == len(q.Missing)
+}
+
+// replacesFilledSlot reports whether the utterance overwrites something the
+// pending action already had, rather than filling the gap she asked about —
+// "нет, на девять" while she is waiting for the subject. Both are handled the
+// same way (dialogue.Answer already prefers the newer value), so this only
+// names the turn honestly for the log and for the decision trace V-564 adds.
+func replacesFilledSlot(q *dialogue.PendingQuestion, answer dialogue.Slots) bool {
+	if q == nil {
+		return false
+	}
+	asked := make(map[dialogue.Slot]bool, len(q.Missing))
+	for _, s := range q.Missing {
+		asked[s] = true
+	}
+	if answer.HasTime && q.Slots.HasTime && !asked[dialogue.SlotTime] && !answer.Time.Equal(q.Slots.Time) {
+		return true
+	}
+	if answer.HasKey && q.Slots.HasKey && !asked[dialogue.SlotKey] && answer.Key != q.Slots.Key {
+		return true
+	}
+	return false
+}

cmd/mavend/turnrole_test.go

@@ -0,0 +1,440 @@
+package main
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/router"
+)
+
+// TestOwnContentSeparatesAValueFromAQuestion pins the test the whole role
+// classifier rests on: after the frame, the numbers and the closed time sets
+// come out, does anything of his own remain? A hedged time leaves nothing. A
+// question about the weather leaves the weather.
+func TestOwnContentSeparatesAValueFromAQuestion(t *testing.T) {
+	cases := []struct {
+		text string
+		own  bool
+	}{
+		{"в 11:00", false},
+		{"в семь вечера", false},
+		{"нет, в 15:00", false},
+		{"а что если в 11:00", false},
+		{"на 9", false},
+		{"а, да, прости — на 9", false},
+		{"завтра", false},
+		{"в половине восьмого", false},
+		{"какая сейчас погода в Риме?", true},
+		{"кто изобрёл телефон", true},
+		{"напомни в 11:00", true},
+		{"позвонить маме", true},
+		{"запиши что я пил воду", true},
+	}
+	for _, tc := range cases {
+		if got := len(ownContent(tc.text)) > 0; got != tc.own {
+			t.Errorf("ownContent(%q) = %v, want own content = %v", tc.text, ownContent(tc.text), tc.own)
+		}
+	}
+}
+
+// TestCancelIsTheWholeUtterance — a call-off calls the request off, and a
+// sentence that merely contains the word does not.
+func TestCancelIsTheWholeUtterance(t *testing.T) {
+	for _, yes := range []string{"отмена", "забудь", "неважно", "проехали", "cancel", "ой, отмена"} {
+		if !isCancel(yes) {
+			t.Errorf("isCancel(%q) = false, want true", yes)
+		}
+	}
+	for _, no := range []string{"забудь купить молоко", "в 11:00", "позвонить маме", ""} {
+		if isCancel(no) {
+			t.Errorf("isCancel(%q) = true, want false", no)
+		}
+	}
+}
+
+// TestTurnRoleReadsTheRoutedDecision — the inversion itself. The same utterance
+// gets a different role depending on what the router made of it, which is the
+// evidence the old guard never had.
+func TestTurnRoleReadsTheRoutedDecision(t *testing.T) {
+	q := &dialogue.PendingQuestion{
+		Intent:  dialogue.Intent(router.IntentReminder),
+		Missing: []dialogue.Slot{dialogue.SlotTime},
+	}
+	dec := func(in router.Intent, s router.Slots) router.Decision {
+		return router.Decision{Intent: in, Slots: s}
+	}
+	cases := []struct {
+		name   string
+		text   string
+		routed router.Decision
+		ok     bool
+		answer dialogue.Slots
+		want   turnRole
+	}{
+		{
+			// The measured defect. The extractor finds "сейчас" and would have
+			// closed the gap with it; the route says this is a question of its
+			// own, and the question wins.
+			name:   "a world question mid-flow is a side query",
+			text:   "какая сейчас погода в Риме?",
+			routed: dec(router.IntentQuery, router.Slots{Text: "какая сейчас погода в Риме?"}),
+			ok:     true,
+			answer: dialogue.Slots{HasTime: true, Time: time.Now()},
+			want:   roleSideQuery,
+		},
+		{
+			name:   "a hedged time is an answer even routed as a query",
+			text:   "а что если в 11:00",
+			routed: dec(router.IntentQuery, router.Slots{Text: "а что если в 11:00"}),
+			ok:     true,
+			answer: dialogue.Slots{HasTime: true, Time: time.Now()},
+			want:   roleAnswer,
+		},
+		{
+			name:   "a fresh reminder is a new request",
+			text:   "напомни завтра позвонить маме",
+			routed: dec(router.IntentReminder, router.Slots{Text: "позвонить маме", HasTime: true}),
+			ok:     true,
+			want:   roleNewRequest,
+		},
+		{
+			name:   "a capture is a new request",
+			text:   "запиши что я пил воду",
+			routed: dec(router.IntentFact, router.Slots{Key: "water", HasKey: true}),
+			ok:     true,
+			want:   roleNewRequest,
+		},
+		{
+			name:   "an act that resolved to a capability is a new request",
+			text:   "выключи свет в спальне",
+			routed: dec(router.IntentAct, router.Slots{Fn: "light_off", HasFn: true}),
+			ok:     true,
+			want:   roleNewRequest,
+		},
+		{
+			// She could not route it. An utterance she did not understand does
+			// not outrank the question in front of it.
+			name:   "a clarify decision is not a request of its own",
+			text:   "выключи свет",
+			routed: router.Decision{Intent: router.IntentAct, Slots: router.Slots{Fn: "light_off", HasFn: true}, Clarify: true},
+			ok:     true,
+			want:   roleAnswer,
+		},
+		{
+			// V-577 shape 1. Every token is frame, so the content gate called
+			// this an answer and the reminder took "сегодня" for its time. It
+			// fills nothing she asked about, so the route decides, and the route
+			// says the calendar answers it.
+			name:   "an agenda question of pure frame words is a side query",
+			text:   "что у меня сегодня?",
+			routed: dec(router.IntentQuery, router.Slots{}),
+			ok:     true,
+			want:   roleSideQuery,
+		},
+		{
+			// V-577 shape 2. Neither a slot value nor a request nor a cancel.
+			// It was dropped in silence; it is an aside, and an aside is stored
+			// and re-asked.
+			name:   "a fact stated mid-flow is an aside",
+			text:   "у меня новый ноутбук",
+			routed: dec(router.IntentNote, router.Slots{Text: "у меня новый ноутбук"}),
+			ok:     true,
+			want:   roleAside,
+		},
+		{
+			// A route she is not sure of is not evidence that he stated
+			// anything, and "позвонить маме" is the answer to the other half of
+			// a reminder.
+			name:   "an unsure note is not an aside",
+			text:   "позвонить маме",
+			routed: router.Decision{Intent: router.IntentNote, Clarify: true},
+			ok:     true,
+			want:   roleAnswer,
+		},
+		{
+			name: "a bare noun that answers nothing is still an answer",
+			text: "ага",
+			ok:   false,
+			want: roleAnswer,
+		},
+		{
+			name: "no route to read falls back to the shape",
+			text: "кто изобрёл телефон",
+			ok:   false,
+			want: roleSideQuery,
+		},
+		{
+			name: "a call-off needs no route at all",
+			text: "отмена",
+			ok:   false,
+			want: roleCancel,
+		},
+	}
+	for _, tc := range cases {
+		if got := classifyTurnRole(q, tc.text, tc.answer, tc.routed, tc.ok); got != tc.want {
+			t.Errorf("%s: classifyTurnRole(%q) = %s, want %s", tc.name, tc.text, got, tc.want)
+		}
+	}
+}
+
+// TestTurnRoleNamesACorrection — the answer overwrites a slot she was not
+// asking about. Handled like an answer, named as what it is.
+func TestTurnRoleNamesACorrection(t *testing.T) {
+	nine := time.Date(2026, 8, 6, 9, 0, 0, 0, time.UTC)
+	q := &dialogue.PendingQuestion{
+		Intent:  dialogue.Intent(router.IntentReminder),
+		Missing: []dialogue.Slot{dialogue.SlotText},
+		Slots:   dialogue.Slots{HasTime: true, Time: nine.Add(2 * time.Hour)},
+	}
+	got := classifyTurnRole(q, "нет, на 9", dialogue.Slots{HasTime: true, Time: nine}, router.Decision{}, false)
+	if got != roleCorrection {
+		t.Fatalf("role = %s, want %s", got, roleCorrection)
+	}
+}
+
+// TestRomeIsAnsweredAndTheReminderIsNotInvented — the measured failure of
+// 2026-08-05, end to end through the real cascade. "напомни позвонить маме"
+// parks the time question; the weather question that follows must not become
+// its answer and must not create a reminder for a time nobody asked for.
+//
+// V-560 got that far by DROPPING the parked request and saying so, and the
+// owner rejected the notice on sight: he did not ask to lose the reminder. So
+// the contract here is V-561's — the flow is suspended, this turn's reply ends
+// with the question coming back, and nothing says anything was let go.
+func TestRomeIsAnsweredAndTheReminderIsNotInvented(t *testing.T) {
+	ctx := context.Background()
+	h, st := newRoutingClarifyHandler(t)
+
+	if reply := h.handleText(ctx, "web", "напомни позвонить маме"); !strings.Contains(reply, "?") {
+		t.Fatalf("expected the time question, got %q", reply)
+	}
+	reply := h.handleText(ctx, "web", "какая сейчас погода в Риме?")
+	if strings.Contains(reply, "напомню") {
+		t.Fatalf("the question was eaten as the reminder's time again: %q", reply)
+	}
+	if strings.Contains(reply, clarifyDropped) {
+		t.Fatalf("a side query suspends the flow; nothing was dropped, so nothing may say so: %q", reply)
+	}
+	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
+	if !strings.HasSuffix(reply, resumed) {
+		t.Fatalf("the reply must end with the resumed question %q, got %q", resumed, reply)
+	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 0 {
+		t.Fatalf("a reminder was invented for a time nobody asked for: %v err=%v", reminders, err)
+	}
+	// Still parked, and still on its first attempt: he answered the side query,
+	// not this question, so no retry may have been spent on it.
+	q := h.clarifyStore.Get(dialogueIDFor(sourceText, "web"), h.now())
+	if q == nil {
+		t.Fatal("the parked question was dropped instead of suspended")
+	}
+	if q.Attempts != 1 {
+		t.Fatalf("the side query spent a clarify attempt: attempts = %d, want 1", q.Attempts)
+	}
+	if !strings.Contains(q.Utterance, "маме") {
+		t.Fatalf("the suspended request lost what it was about: %q", q.Utterance)
+	}
+}
+
+// TestClarifyCancelEndsTheExchange — "отмена" while she is waiting calls the
+// half-built request off, out loud, and creates nothing.
+func TestClarifyCancelEndsTheExchange(t *testing.T) {
+	ctx := context.Background()
+	h, st := newRoutingClarifyHandler(t)
+
+	if reply := h.handleText(ctx, "web", "напомни позвонить маме"); !strings.Contains(reply, "?") {
+		t.Fatalf("expected the time question, got %q", reply)
+	}
+	if reply := h.handleText(ctx, "web", "отмена"); reply != clarifyCancelled {
+		t.Fatalf("reply = %q, want %q", reply, clarifyCancelled)
+	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 0 {
+		t.Fatalf("a cancelled request still landed: %v err=%v", reminders, err)
+	}
+	if h.clarifyStore.Get(dialogueIDFor(sourceText, "web"), h.now()) != nil {
+		t.Fatal("a cancelled exchange must leave nothing parked")
+	}
+}
+
+// TestTheTurnIsRoutedOnce — the cost bound. A turn with a question parked pays
+// for one extra route and not two: the clarify resolver and the pipeline read
+// the same memo.
+func TestTheTurnIsRoutedOnce(t *testing.T) {
+	h, _ := newRoutingClarifyHandler(t)
+	rt := h.newTurnRoute("какая сейчас погода в Риме?", h.now())
+	ctx := withTurnRoute(withDialogueID(context.Background(), voiceDialogueID), rt)
+
+	first, ok := h.routeForRole(ctx, rt.text)
+	if !ok {
+		t.Fatal("the cascade must produce a decision to classify against")
+	}
+	second, _, _, err := rt.resolve(ctx)
+	if err != nil {
+		t.Fatalf("resolve: %v", err)
+	}
+	if second.Intent != first.Intent || second.Utterance != first.Utterance {
+		t.Fatalf("the pipeline routed again and got something else: %+v vs %+v", second, first)
+	}
+}
+
+// TestASuspendedQuestionDoesNotRideForever — V-654, the measured failure of
+// 2026-08-07 (docs/evals/2026-08-07-week-of-usage-transcript.md, t=51 to t=58).
+//
+// A side query suspends the parked question, spends no attempt and restarts the
+// TTL. Nothing else bounded it, so one unfilled time slot came back on the end
+// of six consecutive unrelated replies and stopped only when a seventh turn
+// happened to read as a failed answer. Three step-asides, then she lets it go
+// and says so.
+func TestASuspendedQuestionDoesNotRideForever(t *testing.T) {
+	ctx := context.Background()
+	h, st := newRoutingClarifyHandler(t)
+	id := dialogueIDFor(sourceText, "web")
+	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
+
+	if reply := h.handleText(ctx, "web", "напомни позвонить маме"); !strings.Contains(reply, "?") {
+		t.Fatalf("expected the time question, got %q", reply)
+	}
+
+	// Three questions of his own. Each one is answered as itself and each one
+	// brings the open question back, exactly as V-561 asks.
+	asides := []string{
+		"о чём мы вчера говорили?",
+		"какие у меня напоминания?",
+		"сколько времени?",
+	}
+	for i, text := range asides {
+		reply := h.handleText(ctx, "web", text)
+		if !strings.HasSuffix(reply, resumed) {
+			t.Fatalf("side query %d: the question must come back, got %q", i+1, reply)
+		}
+		if strings.Contains(reply, clarifyDropped) {
+			t.Fatalf("side query %d: nothing was let go yet, so nothing may say so: %q", i+1, reply)
+		}
+		q := h.clarifyStore.Get(id, h.now())
+		if q == nil {
+			t.Fatalf("side query %d: the question was dropped early", i+1)
+		}
+		if q.Attempts != 1 {
+			t.Fatalf("side query %d: a step-aside spent an attempt: %d", i+1, q.Attempts)
+		}
+		if q.Suspends != i+1 {
+			t.Fatalf("side query %d: suspends = %d, want %d", i+1, q.Suspends, i+1)
+		}
+	}
+
+	// The fourth. She has stepped aside as often as she is willing to, so the
+	// request goes — out loud, and without the question on the tail.
+	reply := h.handleText(ctx, "web", "что у меня сегодня?")
+	if !strings.Contains(reply, clarifyDropped) {
+		t.Fatalf("the request was let go in silence: %q", reply)
+	}
+	if strings.HasSuffix(reply, resumed) {
+		t.Fatalf("a question she has let go must not be asked again: %q", reply)
+	}
+	if h.clarifyStore.Get(id, h.now()) != nil {
+		t.Fatal("the question must be gone once she has said she let it go")
+	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 0 {
+		t.Fatalf("a reminder was invented for a time nobody gave: %v err=%v", reminders, err)
+	}
+}
+
+// TestAnAnsweredGapResetsTheSuspendBudget — the counter measures CONSECUTIVE
+// step-asides. He filled a gap, so the run is broken and the next question
+// starts with its full allowance: a long exchange he is engaged with must not
+// run out of patience on his behalf.
+func TestAnAnsweredGapResetsTheSuspendBudget(t *testing.T) {
+	ctx := context.Background()
+	h, _ := newRoutingClarifyHandler(t)
+	id := dialogueIDFor(sourceText, "web")
+
+	// A bare "напомни" is missing both halves, so answering the subject re-parks
+	// the request with a question about the time.
+	if reply := h.handleText(ctx, "web", "напомни"); !strings.Contains(reply, "?") {
+		t.Fatalf("expected a question, got %q", reply)
+	}
+	if reply := h.handleText(ctx, "web", "какие у меня напоминания?"); reply == "" {
+		t.Fatal("the side query must be answered as itself")
+	}
+	if q := h.clarifyStore.Get(id, h.now()); q == nil || q.Suspends != 1 {
+		t.Fatalf("the side query was not counted: %+v", q)
+	}
+	if reply := h.handleText(ctx, "web", "позвонить маме"); reply == "" {
+		t.Fatal("the answer must be consumed")
+	}
+	q := h.clarifyStore.Get(id, h.now())
+	if q == nil {
+		t.Fatal("a reminder still needs its time, so a question must be parked")
+	}
+	if q.Suspends != 0 {
+		t.Fatalf("answering a gap must reset the suspend budget: suspends = %d", q.Suspends)
+	}
+	// The ride it already took is carried across the re-park (V-663). Resetting
+	// both counters here is what let one question ride twenty-six replies.
+	if q.Rides != 1 {
+		t.Fatalf("the aside it already took was forgotten: rides = %d", q.Rides)
+	}
+}
+
+// TestTwoBoundsCannotRearmEachOther — V-663.
+//
+// MaxSuspends landed and the measurement did not move: twenty-six of 140 turns
+// carried a tail before it and twenty-six after. This is the shape it misses,
+// taken from the 2026-08-08 run, where one question rode turns 7 to 13.
+//
+// An aside spends no attempt, so MaxAttempts never reaches it. A turn that
+// reads as a failed answer zeroes Suspends, so MaxSuspends never reaches the
+// asides either. Alternating the two rearms each bound with the other's
+// traffic. Rides counts both kinds and is never reset, so it is what ends this.
+func TestTwoBoundsCannotRearmEachOther(t *testing.T) {
+	ctx := context.Background()
+	h, _ := newRoutingClarifyHandler(t)
+	id := dialogueIDFor(sourceText, "web")
+	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
+
+	if reply := h.handleText(ctx, "web", "напомни позвонить маме"); !strings.Contains(reply, "?") {
+		t.Fatalf("expected the time question, got %q", reply)
+	}
+
+	// Two asides. Each one rides and neither spends an attempt.
+	for i := 0; i < 2; i++ {
+		reply := h.handleText(ctx, "web", "какие у меня напоминания?")
+		if !strings.HasSuffix(reply, resumed) {
+			t.Fatalf("aside %d: the question must come back, got %q", i+1, reply)
+		}
+	}
+	q := h.clarifyStore.Get(id, h.now())
+	if q == nil || q.Rides != 2 || q.Suspends != 2 {
+		t.Fatalf("after two asides: %+v", q)
+	}
+
+	// A pleasantry. It used to read as a failed answer, so she re-asked the
+	// question at a man saying thank you and spent an attempt doing it. Now it
+	// is an aside: answered as itself, question on the tail, one more ride.
+	reply := h.handleText(ctx, "web", "спасибо")
+	if !strings.HasSuffix(reply, resumed) {
+		t.Fatalf("a pleasantry lost the parked question: %q", reply)
+	}
+	q = h.clarifyStore.Get(id, h.now())
+	if q == nil || q.Attempts != 1 {
+		t.Fatalf("a pleasantry spent an attempt: %+v", q)
+	}
+	if q.Rides != 3 {
+		t.Fatalf("a pleasantry rode free: %+v", q)
+	}
+
+	// One more ride of any kind and the request goes, out loud.
+	reply = h.handleText(ctx, "web", "какие у меня напоминания?")
+	if !strings.Contains(reply, clarifyDropped) {
+		t.Fatalf("the question rode four asides and was let go in silence: %q", reply)
+	}
+	if strings.HasSuffix(reply, resumed) {
+		t.Fatalf("a question she has let go must not be asked again: %q", reply)
+	}
+	if h.clarifyStore.Get(id, h.now()) != nil {
+		t.Fatal("the question must be gone once she has said she let it go")
+	}
+}

cmd/mavend/turnroute.go

@@ -0,0 +1,125 @@
+package main
+
+import (
+	"context"
+	"log"
+	"sync"
+	"time"
+
+	"github.com/kami/maven/internal/dialogue"
+	"github.com/kami/maven/internal/router"
+)
+
+// turnRoute is this turn's routing, computed at most once.
+//
+// It exists because the arbitration was inverted (Vikunja #560): the clarify
+// resolver now reads the routed decision before deciding what the utterance is,
+// and the pipeline then acts on that same decision. Routing twice would cost a
+// second on the resident model and — worse — could disagree with itself, which
+// is exactly the class of bug this task is about.
+type turnRoute struct {
+	h    *reactiveHandler
+	text string
+	now  time.Time
+
+	once sync.Once
+	dec  router.Decision
+	cont bool
+	prev *dialogue.Session
+	err  error
+
+	// dropped — what she let go of this turn and must say out loud. A parked
+	// request that dies without a word leaves him thinking it landed.
+	dropped string
+
+	// resume — the parked question, re-worded, to put AFTER this turn's answer
+	// (Vikunja #561). A side query does not end the flow it interrupted, so the
+	// reply carries two acts: the answer he asked for, then the question he
+	// still owes her. Empty ⇒ nothing was suspended.
+	resume string
+	// suspended — a flow is parked underneath this turn. askClarify reads it to
+	// decide between Put (replace the top) and Push (keep the flow and stack the
+	// new question on it), because a side query that needs clarifying of its own
+	// must not overwrite the thing it interrupted.
+	suspended bool
+}
+
+type turnRouteKey struct{}
+
+func (h *reactiveHandler) newTurnRoute(text string, now time.Time) *turnRoute {
+	return &turnRoute{h: h, text: text, now: now}
+}
+
+func withTurnRoute(ctx context.Context, rt *turnRoute) context.Context {
+	return context.WithValue(ctx, turnRouteKey{}, rt)
+}
+
+// turnRouteFrom returns the turn's memo, or nil when the caller is not inside
+// runTurn — a unit test calling one resolver directly, most often.
+func turnRouteFrom(ctx context.Context) *turnRoute {
+	rt, _ := ctx.Value(turnRouteKey{}).(*turnRoute)
+	return rt
+}
+
+// resolve does the routing exactly as step 5 of runTurn does it: an elliptical
+// follow-up is answered from the previous turn, everything else goes to the
+// router. One copy of that, so the pre-route the clarify resolver reads and the
+// decision the pipeline acts on cannot drift apart.
+func (r *turnRoute) resolve(ctx context.Context) (router.Decision, bool, *dialogue.Session, error) {
+	r.once.Do(func() {
+		if r.h.dialogueSessions != nil {
+			r.prev = r.h.dialogueSessions.Get(dialogueIDOf(ctx), r.now)
+		}
+		if dec, cont := continuationDecision(r.prev, r.text, r.now); cont {
+			log.Printf("voice: continuation of %s from the previous turn", dec.Intent)
+			r.dec, r.cont = dec, true
+			return
+		}
+		if r.h.router == nil {
+			r.err = router.ErrNoIntents
+			return
+		}
+		r.dec, r.err = r.h.router.Route(ctx, r.text, r.now)
+	})
+	return r.dec, r.cont, r.prev, r.err
+}
+
+// routeForRole gives the role classifier the turn's routed decision. The second
+// return is false when there is no usable decision — no router wired, or the
+// route failed — and the classifier falls back to its offline tests then. A
+// turn must never break on the model, so the error is logged and swallowed
+// here; step 5 reads the same memo and reports it the way it always has.
+func (h *reactiveHandler) routeForRole(ctx context.Context, text string) (router.Decision, bool) {
+	rt := turnRouteFrom(ctx)
+	if rt == nil {
+		rt = h.newTurnRoute(text, h.now())
+	}
+	dec, _, _, err := rt.resolve(ctx)
+	if err != nil {
+		log.Printf("voice: role — no route to classify against (%v), falling back to the offline tests", err)
+		return router.Decision{}, false
+	}
+	return dec, true
+}
+
+// needsRoute reports whether classifying this utterance's role is worth a
+// route. It is not: an utterance with no content of its own carries no request
+// of its own, so the classifier reaches the same answer without the model. A
+// call-off is the same — it is read off a closed lexicon and nothing else.
+//
+// This is a fast path to the SAME answer and must stay one. If it ever needs a
+// rule the classifier does not have, it has become a second decision procedure
+// and it is the thing V-560 deleted.
+//
+// A question shape is the exception and V-577 is why (measured 2026-08-06).
+// "что у меня сегодня?" is an interrogative, a preposition, a particle and a day
+// word, so every token of it is frame and it left no content of its own. The
+// fast path called it an answer, the parked reminder read "сегодня" as its time,
+// and the question he asked was never answered. Asked alone the same sentence
+// routes to query at stage 0, so the route knew and was never consulted.
+func needsRoute(text string) bool {
+	if isCancel(text) {
+		return false
+	}
+	return len(ownContent(text)) > 0 || router.IsQuestionShaped(text)
+}

cmd/mavend/voice.go

@@ -53,6 +53,7 @@ import (
 
 	"github.com/kami/maven/internal/audio"
 	"github.com/kami/maven/internal/crawl"
+	"github.com/kami/maven/internal/decision"
 	"github.com/kami/maven/internal/dialogue"
 	"github.com/kami/maven/internal/ipc"
 	"github.com/kami/maven/internal/lexicon"
@@ -137,6 +138,24 @@ type reactiveHandler struct {
 	// slot per reach, not one for the box. nil ⇒ no carry-over.
 	dialogueSessions *dialogue.SessionStore
 
+	// decisions holds the last few turns' arbitration records (V-564): who
+	// claimed the turn, who lost it and who was never asked. In memory and
+	// bounded, because a turn record is read minutes later or never, and none
+	// of his words belong in a table that outlives the diagnosis. nil ⇒ nothing
+	// is recorded, which is what a test that did not ask for one gets.
+	decisions *decision.Ring
+
+	// traces persists those same records (V-629, routingtrace.go). The ring is
+	// still what /trace reads; this is the second sink, and it exists because the
+	// routing heads cannot be fitted without real utterances. nil ⇒ the ring
+	// alone, which is the behaviour every box had before 06-08-2026.
+	traces traceWriter
+
+	// encoderID names the encoder body live on this box, stored beside each
+	// trace: a fitted distance means nothing under another body. Empty ⇒ no
+	// embedder, so the classifier was the keyword floor.
+	encoderID string
+
 	// clarifyStore parks the request behind an open question she asked (see
 	// clarify.go). nil ⇒ she falls back to the canned "не поняла" reply.
 	clarifyStore *dialogue.ClarifyStore
@@ -247,7 +266,31 @@ const (
 // path wraps it in stt/tts, the text path returns it as-is.
 //
 // The ordering is load-bearing — see the step comments.
-func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSource) string {
+func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSource) (reply string) {
+	// 0. the decision record (V-564). Installed here rather than in the IPC
+	// entry point, so the mic, telegram and the web all leave the same trail —
+	// a record only the web produced would be missing exactly the turns that
+	// are hardest to reproduce. It rides the context, costs a few dozen structs
+	// on a human-rate path, and no claim site can change a route with it.
+	if h.decisions != nil {
+		var rec *decision.Record
+		ctx, rec = decision.With(ctx, text)
+		decision.Expect(ctx, decision.StagePreRoute, preRouteLadder)
+		defer func() {
+			done := rec.Finish(h.now())
+			h.decisions.Push(done)
+			h.persistDecision(ctx, done, src)
+		}()
+	}
+
+	// 0b. the turn's routing, computed at most once and shared (Vikunja #560).
+	// The clarify resolver reads it to decide what this utterance IS before
+	// claiming it, and step 5 acts on the same decision — routing twice would
+	// cost a second on the resident model and could disagree with itself.
+	now := h.now()
+	rt := h.newTurnRoute(text, now)
+	ctx = withTurnRoute(ctx, rt)
+
 	// 1. expired clarify — a question was parked but its TTL ran out, so the
 	// request behind it is gone. Say that out loud (see clarify.go) and carry
 	// on: these words are still routed as a fresh utterance below, with the
@@ -263,7 +306,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	// 2. confirm turn — if a destructive act is parked, this utterance is its
 	// y/n answer, not a fresh command. Handled before routing so "да" doesn't
 	// get classified as some other intent.
-	if reply, handled := h.resolveConfirm(ctx, text); handled {
+	if reply, handled := h.resolveConfirm(ctx, text); notePreRoute(ctx, "confirm", handled) {
 		return withNotice(expiredNotice, reply)
 	}
 
@@ -275,15 +318,27 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	// so the notice is empty here in practice. withNotice anyway: every exit
 	// from runTurn carries it, and that is what stops the next one from
 	// forgetting.
-	if reply, handled := h.resolveClarifyAnswer(ctx, text); handled {
+	if reply, handled := h.resolveClarifyAnswer(ctx, text); notePreRoute(ctx, "clarify-answer", handled) {
 		return withNotice(expiredNotice, reply)
 	}
+	// It did not claim the turn. If it let a parked request go to get out of the
+	// way, that has to be said in front of whatever these words are answered
+	// with — carried on the same notice, so every exit below keeps it.
+	expiredNotice = withNotice(expiredNotice, rt.dropped)
+
+	// 3b. and if it SUSPENDED a request instead of letting it go, the question
+	// comes back on the end of whatever these words are answered with (Vikunja
+	// #561). A deferred append rather than a call at each exit: there are eight
+	// returns between here and the replier, and the flow has to survive all of
+	// them — one that forgot would be a request parked for ever, waiting for an
+	// answer to a question he never heard asked.
+	defer func() { reply = withResumed(reply, rt.resume) }()
 
 	// 4. quiet-hours toggle — keyword match, not classifier-dependent.
 	// "тихий режим" / "quiet on" would route through the classifier
 	// unreliably (it's a command, not a free-form query), so we match it
 	// before routing. Same pattern as the confirm turn above.
-	if reply, handled := h.resolveQuietToggle(ctx, text, src); handled {
+	if reply, handled := h.resolveQuietToggle(ctx, text, src); notePreRoute(ctx, "quiet-toggle", handled) {
 		return withNotice(expiredNotice, reply)
 	}
 
@@ -291,14 +346,14 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	// sent. Only handled when a pending nudge is actually inside the window
 	// (snooze.go); otherwise the words route normally, because "потом" is an
 	// ordinary word and eating every one of them would break real sentences.
-	if reply, handled := h.resolveSnooze(ctx, text, src); handled {
+	if reply, handled := h.resolveSnooze(ctx, text, src); notePreRoute(ctx, "snooze", handled) {
 		return withNotice(expiredNotice, reply)
 	}
 
 	// 4c. spoken ack — "готово" closes that same nudge as `acted`. Only the
 	// contentless form is intercepted here; "выпил воды" keeps routing and
 	// closes the nudge after its fact lands (ackFromFact, step 8b).
-	if reply, handled := h.resolveAck(ctx, text, src); handled {
+	if reply, handled := h.resolveAck(ctx, text, src); notePreRoute(ctx, "ack", handled) {
 		return withNotice(expiredNotice, reply)
 	}
 
@@ -306,7 +361,15 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	// turn and names what it should have been (repair.go). Before routing,
 	// like the confirm and clarify turns: routing the correction as a fresh
 	// utterance files the correction itself instead of fixing anything.
-	if reply, handled := h.resolveRepair(ctx, text); handled {
+	if reply, handled := h.resolveRepair(ctx, text); notePreRoute(ctx, "repair", handled) {
+		return withNotice(expiredNotice, reply)
+	}
+
+	// 4d-ii. and the same correction without a target — "нет, не так" (V-636).
+	// After the targeted one, which is the narrower claim: an utterance that
+	// names an intent is answered by redoing the request, and this rung only
+	// gets the ones that name nothing.
+	if reply, handled := h.resolveUntargetedRepair(ctx, text); notePreRoute(ctx, "repair-negative", handled) {
 		return withNotice(expiredNotice, reply)
 	}
 
@@ -314,7 +377,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	// just read (ordinal.go). Before routing, and only when a list is actually
 	// bound to the session: with nothing offered, "второй" is an ordinary word
 	// and keeps routing.
-	if reply, handled := h.resolveCandidate(ctx, text, src); handled {
+	if reply, handled := h.resolveCandidate(ctx, text, src); notePreRoute(ctx, "ordinal", handled) {
 		return withNotice(expiredNotice, reply)
 	}
 
@@ -323,22 +386,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	// missing, so no amount of routing recovers it, and the model's guess
 	// costs seconds to obtain and is close to a coin flip. Everything else
 	// goes to the router.
-	var (
-		dec  router.Decision
-		err  error
-		prev *dialogue.Session
-	)
-	now := h.now()
-	if h.dialogueSessions != nil {
-		prev = h.dialogueSessions.Get(dialogueIDOf(ctx), now)
-	}
-	cont := false
-	if dec, cont = continuationDecision(prev, text, now); cont {
-		log.Printf("voice: continuation of %s from the previous turn", dec.Intent)
-	}
-	if !cont {
-		dec, err = h.router.Route(ctx, text, now)
-	}
+	dec, cont, prev, err := rt.resolve(ctx)
 	if err != nil {
 		// ErrNoIntents ⇒ classifier unseeded (cold boot). reply with a
 		// "still warming up" rather than a wire error.
@@ -359,21 +407,31 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	// ("а завтра?" … "а послезавтра?") keeps working.
 	if h.dialogueSessions != nil {
 		if !cont {
-			dec = followUpMerge(prev, dec, now)
+			merged := followUpMerge(prev, dec, now)
+			noteMerge(ctx, dec, merged)
+			dec = merged
 		}
 		if !dec.Clarify {
 			h.rememberTurn(ctx, prev, dec, now)
 		}
 	}
 
-	// 7. clarify — she is not sure. If one named thing is missing, ask about it
-	// and park the request (clarify.go); otherwise the replier's canned reply
-	// stands.
-	if dec.Clarify {
+	// 7. clarify — something she needs is missing. If one named thing is missing,
+	// ask about it and park the request (clarify.go); otherwise the replier's
+	// canned reply stands.
+	//
+	// Not gated on dec.Clarify alone (Vikunja #557). A turn the cascade routed
+	// confidently but incompletely skipped this entirely: "напомни позвонить"
+	// reached applyAction, failed on the missing time, parked nothing, and the
+	// "в семь вечера" that followed was web-searched as a world question. A
+	// required slot that missingFor names is a gap whatever the confidence.
+	if dec.Clarify || len(missingFor(dec)) > 0 {
 		if reply := h.hexisBeforeClarify(ctx, dec); reply != "" {
 			return withNotice(expiredNotice, reply)
 		}
 		if question, asked := h.askClarify(ctx, dec); asked {
+			noteTerminal(ctx, "clarify-ask", dec.Intent,
+				"the route was below the threshold, so she asked instead of acting")
 			return withNotice(expiredNotice, question)
 		}
 	}
@@ -390,6 +448,9 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 	// the round-trip stays alive.
 	replyText := h.applyAction(ctx, dec)
 	log.Printf("voice: applyAction returned: %q", replyText)
+	// A query turn was already claimed by a source inside the chain; every other
+	// intent has no chain and no scoreboard, so the handler is the winner.
+	noteTerminal(ctx, "action-handler", dec.Intent, "")
 
 	// 8b. a fact that answers a live nudge closes it as `acted` (ack.go).
 	// Silent: the fact reply stands, she does not congratulate him for it.
@@ -397,7 +458,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 
 	// 9. replier — phrase the reply across the router decision.
 	if replyText == "" {
-		replyText = h.replier.Reply(dec)
+		replyText = h.replier.Reply(ctx, dec)
 	}
 	return withNotice(expiredNotice, replyText)
 }
@@ -490,6 +551,17 @@ func (h *reactiveHandler) replySystem(ctx context.Context, dec router.Decision)
 	}
 }
 
+// sessionAsTurn projects a stored session onto the dialogue.Turn shape used in
+// history lists. Shared by chatHistory and rememberTurn (clarify.go) so the
+// same session is described the same way in both places.
+func sessionAsTurn(s *dialogue.Session) dialogue.Turn {
+	return dialogue.Turn{
+		Intent: s.Intent,
+		Slots:  s.Slots,
+		Text:   s.Slots.Text,
+	}
+}
+
 // chatHistory collects dialogue turns from the session store for the current
 // conversation. Returns prior user utterances (newest last) up to a depth of
 // 4 turns. Returns nil when there's no session or no history.
@@ -503,13 +575,9 @@ func (h *reactiveHandler) chatHistory(ctx context.Context) []dialogue.Turn {
 		return nil
 	}
 	// History already includes the immediate prior turn (set by the dialogue
-	// merge at lines 373-395), plus up to 3 more from deeper history.
+	// merge in runTurn's step 6, above), plus up to 3 more from deeper history.
 	out := make([]dialogue.Turn, 0, 1+len(prev.History))
-	out = append(out, dialogue.Turn{
-		Intent: prev.Intent,
-		Slots:  prev.Slots,
-		Text:   prev.Slots.Text,
-	})
+	out = append(out, sessionAsTurn(prev))
 	out = append(out, prev.History...)
 	return out
 }

cmd/mavend/voicewire.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/decision"
 	"github.com/kami/maven/internal/delivery"
 	"github.com/kami/maven/internal/delivery/voicesink"
 	"github.com/kami/maven/internal/dialogue"
@@ -35,7 +36,9 @@ type voiceWiring struct {
 	sessions  *voice.Sessions
 	voiceSink delivery.Sink
 	embedder  router.Embedder
-	handler   *reactiveHandler // the reactive handler for IPC Chat
+	// heads — the routing heads, nil unless embedder.heads_path is set.
+	heads   *router.RouterHeads
+	handler *reactiveHandler // the reactive handler for IPC Chat
 	// worker clients (set when configured as Remote): closed on shutdown so
 	// mavsttd / mavttsd don't keep a stale conn into a restarting daemon.
 	sttClient *worker.Client
@@ -52,7 +55,11 @@ type voiceWiring struct {
 	// unless a `workstation` block names an address. Held here only so the
 	// prober is stopped on shutdown; callers were handed it at build time.
 	pair *llm.Pair
-	mcp  *mcpWiring
+	// sttPair — CrisperWhisper 2.0 on the workstation with mavsttd as the
+	// floor, nil unless the `workstation.stt` block names an address. Held for
+	// the same reason as pair: to stop its prober on shutdown.
+	sttPair *stt.Pair
+	mcp     *mcpWiring
 	// home — the Home Assistant client, nil unless the `smarthome` block is
 	// enabled (Vikunja #256). Its devices land in the same allowlist as every
 	// other act, so nothing else here has to know about it.
@@ -71,6 +78,9 @@ func (w *voiceWiring) close() {
 	if w.embedder != nil {
 		_ = w.embedder.Close()
 	}
+	if w.heads != nil {
+		_ = w.heads.Close()
+	}
 	if w.server != nil {
 		_ = w.server.Close()
 	}
@@ -83,6 +93,9 @@ func (w *voiceWiring) close() {
 	if w.pair != nil {
 		w.pair.Stop()
 	}
+	if w.sttPair != nil {
+		w.sttPair.Stop()
+	}
 	w.mcp.close()
 }
 
@@ -111,6 +124,7 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 	} else {
 		transcriber = stt.NewStub()
 	}
+	transcriber, w.sttPair = sttSeam(cfg, transcriber)
 	w.transcriber = transcriber
 
 	// ----- tts (Stub in-process OR Remote) -----
@@ -146,8 +160,29 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 		emb = router.NewHashEmbedder(1024)
 	}
 	w.embedder = emb
+
+	// ----- router: routing heads (only when configured, and never fatal) -----
+	// A missing or broken weights file logs and leaves w.heads nil, which is
+	// byte-for-byte the cascade that shipped before V-664. Refusing to start
+	// over a routing accelerator would trade a working box for a better one.
+	if cfg.Voice.Embedder != nil && cfg.Voice.Embedder.HeadsPath != "" {
+		h, err := router.NewRouterHeads(
+			cfg.Voice.Embedder.HeadsPath,
+			cfg.Voice.Embedder.TokenizerPath,
+		)
+		if err != nil {
+			log.Printf("voice: routing heads unavailable, cascade unchanged: %v", err)
+		} else {
+			log.Printf("voice: routing heads loaded from %s", cfg.Voice.Embedder.HeadsPath)
+			w.heads = h
+		}
+	}
+
 	repairFactVectors(dataStore, emb)
 	checkStoredEmbedder(dataStore, emb)
+	// Retention is enforced on write, which is not enough on its own: a box that
+	// goes quiet keeps every trace until the next sixty-fourth turn (V-629).
+	pruneTracesOnStart(dataStore, time.Now())
 
 	// ----- tool executor (the enabled act allowlist, store-backed) -----
 	// Config tools are the declarative bootstrap: seed them into the store as
@@ -175,7 +210,7 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 	// The LAN scanner (Vikunja #257): a read, bounded to the configured
 	// subnets and rate-limited. Off unless the `netscan` block is enabled.
 	w.netscan = wireNetScan(cfg, coreAPI)
-	matcher := tool.NewMatcher(coreAPI)
+	matcher := tool.NewMatcher(coreAPI).WithAliases(toolAliases(cfg.Voice.Tools))
 
 	// ----- weather provider (Open-Meteo when configured, Stub otherwise) -----
 	var weatherProvider weather.Provider
@@ -219,7 +254,8 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 	// against the classifier's 50.0%, at about 1s a turn instead of 30ms (see
 	// config.VoiceConfig.LLMRouter). The classifier always stays wired as the
 	// fallback, so a model error never breaks a turn.
-	rtr := buildRouter(emb, matcher, threshold, pickLLMRouter(cfg.Voice.UseLLMRouter(), hot))
+	rtr := buildRouter(emb, matcher, threshold,
+		pickLLMRouter(cfg.Voice.UseLLMRouter(), hot), w.heads)
 
 	// ----- sessions registry (shared with voicesink) -----
 	sessions := voice.NewSessions()
@@ -235,21 +271,22 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 		memStore = memory.NewInMemoryStore()
 	}
 
-	// ----- dialogue (multi-turn slot carry-over; 2-min follow-up window) -----
+	// ----- dialogue (multi-turn slot carry-over; dialogueSessionTTL follow-up window) -----
 	// Store-backed when the daemon passes a store, so a restart mid-conversation
 	// keeps the thread (Vikunja #363). Sessions past their TTL are dropped on
 	// load, never revived. Clarify's parked question stays in memory only, and
 	// that is a decision rather than an omission (Vikunja #385, docs/design.md):
 	// a restart expires it, so the thread comes back and the open question does
 	// not.
+	const dialogueSessionTTL = 2 * time.Minute
 	var dialogueSessions *dialogue.SessionStore
 	if dataStore != nil {
-		dialogueSessions = dialogue.NewPersistentSessionStore(2*time.Minute, dataStore)
+		dialogueSessions = dialogue.NewPersistentSessionStore(dialogueSessionTTL, dataStore)
 		if err := dialogueSessions.Load(context.Background(), time.Now()); err != nil {
 			log.Printf("dialogue: load saved sessions: %v", err)
 		}
 	} else {
-		dialogueSessions = dialogue.NewSessionStore(2 * time.Minute)
+		dialogueSessions = dialogue.NewSessionStore(dialogueSessionTTL)
 	}
 	clarifyStore := dialogue.NewClarifyStore(clarifyTTL)
 	timeParser := router.NewPythonDateParser()
@@ -293,7 +330,17 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 		},
 		dataStore:        dataStore,
 		dialogueSessions: dialogueSessions,
-		clarifyStore:     clarifyStore,
+		// Always on (V-564). The record is the instrument the rest of V-558 is
+		// measured with, and one that only runs when a flag is set is not there
+		// on the night the misroute happens.
+		decisions: decision.NewRing(),
+		// The second sink (V-629). Same records, persisted, because the routing
+		// heads cannot be fitted from a 25-turn ring. Nil store ⇒ ring only, and
+		// EmbedderID is the same string the vector marker uses, so a trace and a
+		// stored vector name their body the same way.
+		traces:       traceSink(dataStore),
+		encoderID:    router.EmbedderID(emb),
+		clarifyStore: clarifyStore,
 		// 0 here (unset config) ⇒ the dialogue default.
 		clarifyMaxAttempts: cfg.Voice.ClarifyMaxAttempts,
 		extractor:          router.Extractor{Time: timeParser, Acts: matcher, Facts: router.DefaultFactParser{}},
@@ -339,8 +386,13 @@ func modelSeam(cfg *config.Config, resident *llm.Client) (router.Completer, *llm
 		return resident, nil
 	}
 	ws := cfg.Workstation
+	remote := llm.New(ws.URL, time.Duration(ws.Timeout))
+	remote.SetToken(ws.Token)
+	if ws.Token == "" {
+		log.Printf("voice: no workstation.token — mavgpud refuses an unauthenticated request, so this reads as a card that is always busy")
+	}
 	pair := llm.NewPair(
-		llm.New(ws.URL, time.Duration(ws.Timeout)),
+		remote,
 		resident,
 		ws.Health,
 		time.Duration(ws.Probe),
@@ -351,6 +403,44 @@ func modelSeam(cfg *config.Config, resident *llm.Client) (router.Completer, *llm
 	return pair, pair
 }
 
+// sttSeam builds the transcription seam the voice path and the meeting
+// recorder share. It is modelSeam for audio and follows the same rule.
+//
+// With no `workstation.stt` block it hands back the floor untouched, which is
+// today's deploy exactly. With one, it is an stt.Pair preferring CrisperWhisper
+// 2.0 on workpc, which scores 10.4% WER in Russian against the floor's 27.5%
+// (docs/evals/2026-08-09-crisperwhisper2-russian-wer.md).
+//
+// Only the silent half of the degradation rule applies here. A worse transcript
+// is still a turn, so there is nothing to name a gap about and the fallback is
+// never spoken. That is why stt.Pair has no TranscribeRemote.
+func sttSeam(cfg *config.Config, floor stt.Transcriber) (stt.Transcriber, *stt.Pair) {
+	if cfg.Workstation == nil || cfg.Workstation.Stt == nil {
+		return floor, nil
+	}
+	s := cfg.Workstation.Stt
+	lang := ""
+	if cfg.Voice != nil {
+		lang = cfg.Voice.Lang
+		if cfg.Voice.Stt != nil && cfg.Voice.Stt.Lang != "" {
+			lang = cfg.Voice.Stt.Lang
+		}
+	}
+	pair := stt.NewPair(
+		stt.NewHTTPTranscriber(s.URL, s.Token, lang, time.Duration(s.Timeout)),
+		floor,
+		s.Health,
+		time.Duration(s.Probe),
+	)
+	pair.Start(context.Background())
+	if s.Token == "" {
+		log.Print("voice: the workstation transcriber has no token, so anything on the LAN can post audio to it")
+	}
+	log.Printf("voice: workstation transcriber at %s, probed every %s, mavsttd as the floor",
+		s.URL, time.Duration(s.Probe))
+	return pair, pair
+}
+
 func pickLLMRouter(enabled bool, c router.Completer) *router.LLMRouter {
 	if !enabled {
 		return nil
@@ -371,11 +461,12 @@ func pickLLMRouter(enabled bool, c router.Completer) *router.LLMRouter {
 //   - The embedder is provided by wireVoice: HashEmbedder (floor) when no
 //     embedder config is present, or the ONNX multilingual model when
 //     configured — same interface, one constructor change.
-//   - 6 bootstrap examples covering the 5 intents + one compound-capture
-//     placeholder. Spec calls for ~10 per intent at production; this is the
-//     bootstrapping floor swapped by tuning the seed set later.
+//   - The classifier is floored by seedClassifier, which loads one file per
+//     intent from seedDir (models/seeds/<intent>.txt) — see seedClassifier
+//     below for the current intent list and file names.
 //   - Threshold is from voice.router_threshold config (default 0.55).
-func buildRouter(emb router.Embedder, acts router.ActMatcher, threshold float64, llmR *router.LLMRouter) *router.Router {
+func buildRouter(emb router.Embedder, acts router.ActMatcher, threshold float64,
+	llmR *router.LLMRouter, heads *router.RouterHeads) *router.Router {
 	cls := router.NewClassifier(emb)
 	seedClassifier(cls)
 	grammars := router.DefaultGrammars(acts)
@@ -386,6 +477,10 @@ func buildRouter(emb router.Embedder, acts router.ActMatcher, threshold float64,
 	grammars = append(grammars, router.AgendaQueryGrammars()...)
 	// Same reason as the agenda rules, for the feeds: "что нового в лентах?"
 	// routed system and answered "пока не умею" (Vikunja #474).
+	// After the agenda rules, which are the narrower claim, and BEFORE the feed
+	// and list rules, which are not: "что такое лента" is a definition question
+	// and the feed rule would take it on the noun alone (V-655).
+	grammars = append(grammars, router.WorldQueryGrammars()...)
 	grammars = append(grammars, router.FeedQueryGrammar())
 	// The list side of the same exposure: a phrasing with no possessive in it
 	// ("список дел") routed system and never reached queryTasks (Vikunja #467).
@@ -400,6 +495,14 @@ func buildRouter(emb router.Embedder, acts router.ActMatcher, threshold float64,
 	// explicit capture marker beats the model, which called it an act and
 	// rewrote the task text (Vikunja #467). After the rules above because a
 	// marker never collides with a clock or agenda question.
+	// After Praxis, whose bare "закрой" claim this rule cannot reach (it needs the
+	// board noun), and before the capture marker, which would otherwise read
+	// "убери из задач купить молоко" as a new task (Vikunja #512).
+	grammars = append(grammars, router.TaskStatusGrammar())
+	// Before the capture markers, which all need an object. A capture verb
+	// alone is a fact with no key, and the clarify path asks for it rather than
+	// letting the model invent an answer (Vikunja #557).
+	grammars = append(grammars, router.BareCaptureGrammar()...)
 	grammars = append(grammars, router.TaskCaptureGrammar())
 	// After the capture marker, so "запиши" still wins over "расскажи", and
 	// last overall because it matches on the first word alone: "расскажи про
@@ -415,6 +518,7 @@ func buildRouter(emb router.Embedder, acts router.ActMatcher, threshold float64,
 		},
 		Threshold: threshold,
 		LLM:       llmR,
+		Heads:     heads,
 	})
 }
 
@@ -448,9 +552,10 @@ func seedPath() string {
 
 // seedClassifier floors the embedded examples so the cold-boot path
 // doesn't return ErrNoIntents. Loads examples from seedDir — one file per
-// intent (act.txt, reminder.txt, fact.txt, note.txt, query.txt). When the
-// classifier can't decide it falls through to Clarify — the last-resort
-// path asks the user to rephrase rather than guessing wrong.
+// intent (act.txt, reminder.txt, fact.txt, note.txt, query.txt, chat.txt,
+// system.txt). When the classifier can't decide it falls through to
+// Clarify — the last-resort path asks the user to rephrase rather than
+// guessing wrong.
 func seedClassifier(c *router.Classifier) {
 	intents := []router.Intent{
 		router.IntentAct,
@@ -500,6 +605,20 @@ func loadSeedFile(c *router.Classifier, intent router.Intent) (int, error) {
 	return count, nil
 }
 
+// toolAliases collects the spoken phrases per tool name. Without them the act
+// matcher only ever matched the English tool name, so no Russian utterance could
+// reach a tool and every homelab act fell to proposeGap (V-633).
+func toolAliases(tools []config.ToolConfig) map[string][]string {
+	out := make(map[string][]string, len(tools))
+	for _, tc := range tools {
+		if tc.Name == "" || len(tc.Aliases) == 0 {
+			continue
+		}
+		out[tc.Name] = tc.Aliases
+	}
+	return out
+}
+
 // seedTools upserts the config-declared tools into the store as enabled. Editing
 // mavend.json is a human act, so a config tool is enabled by definition; this
 // makes the declarative config the reproducible bootstrap while the store stays

cmd/mavend/weatherq.go

@@ -7,6 +7,10 @@ package main
 import (
 	"regexp"
 	"strings"
+
+	"github.com/kami/maven/internal/lexicon"
+	"github.com/kami/maven/internal/morph"
+	"github.com/kami/maven/internal/router"
 )
 
 // isWeatherQuery returns true if the utterance is about weather.
@@ -27,16 +31,42 @@ func isWeatherQuery(u string) bool {
 // come through whole and "в 5 утра" does not.
 var weatherPlace = regexp.MustCompile(`(?i)(?:^|\s)(?:в|во|in)\s+([\p{L}-]+(?:\s+[\p{L}-]+)?)`)
 
-// weatherNonPlaces — words that follow "в" in a weather question and are not
-// cities. "какая погода в доме" is the smart-home sensor, not Open-Meteo, and
-// "тепло в комнате" is the same question about the same room.
-var weatherNonPlaces = map[string]bool{
+// weatherRooms — the rooms of the house, which are the only words in this
+// guard that belong to it. "какая погода в доме" is the smart-home sensor, not
+// Open-Meteo, and "тепло в комнате" is the same question about the same room.
+//
+// The rest of the guard used to be a third copy of three closed sets that
+// already exist in the lexicon: the weekdays, the parts of the day, and the
+// words that follow "в" without naming a place (V-581). Each copy was short in
+// its own direction — "среду" but not "среде", "утром" but not "утра", "целом"
+// but not "общем" — so the same question phrased one word differently reached
+// the geocoder as a city.
+var weatherRooms = map[string]bool{
 	"доме": true, "квартире": true, "комнате": true, "спальне": true,
 	"гостиной": true, "кухне": true, "гараже": true, "офисе": true,
-	"выходные": true, "субботу": true, "воскресенье": true, "понедельник": true,
-	"вторник": true, "среду": true, "четверг": true, "пятницу": true,
-	"обед": true, "обеде": true, "утро": true, "утром": true, "вечер": true,
-	"вечером": true, "ночь": true, "ночью": true, "целом": true, "принципе": true,
+	"обед": true, "обеде": true, "выходные": true, "выходных": true,
+}
+
+// isWeatherNonPlace reports whether the word after "в" names something other
+// than a place he could ask the weather for.
+func isWeatherNonPlace(word string) bool {
+	if weatherRooms[word] {
+		return true
+	}
+	if _, ok := router.WeekdayIndex(word); ok {
+		return true
+	}
+	for _, w := range lexicon.PartsOfDay() {
+		if word == w || morph.SameWord(word, w) {
+			return true
+		}
+	}
+	for _, w := range lexicon.NotPlaceAfterV() {
+		if word == w {
+			return true
+		}
+	}
+	return false
 }
 
 // extractWeatherLocation returns the place he named, or the configured default
@@ -63,7 +93,7 @@ func extractWeatherLocation(u, defaultLoc string) string {
 	}
 	place := strings.TrimSpace(m[1])
 	first := strings.ToLower(strings.Fields(place)[0])
-	if weatherNonPlaces[first] {
+	if isWeatherNonPlace(first) {
 		return defaultLoc
 	}
 	return place

cmd/mavend/weatherq_test.go

@@ -29,6 +29,13 @@ func TestExtractWeatherLocation(t *testing.T) {
 		// the house sensors and the day words answer elsewhere.
 		{"тепло в комнате?", "Berlin", "Berlin"},
 		{"какая погода в выходные", "Berlin", "Berlin"},
+		// The cases the three private copies of the lexicon were short by
+		// (V-581): a weekday in a case the old map did not list, a part of the
+		// day in one it did not list, and "в общем".
+		{"какая погода в среде", "Berlin", "Berlin"},
+		{"какая погода в воскресеньях", "Berlin", "Berlin"},
+		{"какая погода в понедельникам", "Berlin", "Berlin"},
+		{"какая погода в общем", "Berlin", "Berlin"},
 	}
 	for _, c := range cases {
 		if got := extractWeatherLocation(c.utterance, c.def); got != c.want {

cmd/mavend/wipe.go

@@ -0,0 +1,45 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"io"
+
+	"github.com/kami/maven/internal/store"
+)
+
+// runWipe implements the -wipe flag: it prints what the database holds, and
+// removes it only when the operator also passed -confirm-wipe (Vikunja #494).
+//
+// Two flags rather than one, because the destructive reading of a single flag
+// is the reading a mistyped command gets. Without the confirmation this is a
+// dry run that costs nothing and answers the question a QA session actually
+// has — what is on this box right now.
+//
+// It runs before any daemon component is wired, so nothing is writing while
+// the tables go. The daemon exits afterwards rather than serving a store it
+// just emptied, because every component that read the old rows at boot would
+// still be holding them.
+func runWipe(ctx context.Context, st *store.Store, out io.Writer, confirmed bool) error {
+	counts, err := st.WipeCounts(ctx)
+	if err != nil {
+		return fmt.Errorf("wipe: read counts: %w", err)
+	}
+	total := 0
+	for _, c := range counts {
+		total += c.Rows
+		fmt.Fprintf(out, "  %-24s %d\n", c.Table, c.Rows)
+	}
+	fmt.Fprintf(out, "  %-24s %d rows in %d tables\n", "TOTAL", total, len(counts))
+
+	if !confirmed {
+		fmt.Fprintln(out, "\nnothing was deleted. pass -confirm-wipe to delete all of it.")
+		fmt.Fprintln(out, "config, models, passkeys and the encryption key are files and are never touched.")
+		return nil
+	}
+	if err := st.Wipe(ctx); err != nil {
+		return err
+	}
+	fmt.Fprintf(out, "\nwiped. %d rows gone, the schema is intact, mavend knows nobody.\n", total)
+	return nil
+}

cmd/mavgpud/auth.go

@@ -0,0 +1,145 @@
+package main
+
+import (
+	"crypto/sha256"
+	"crypto/subtle"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"strings"
+)
+
+// The boundary in front of the card.
+//
+// mavgpud has to listen on the LAN, because homesrv is the client and a
+// loopback default takes the model arm down. That makes this the one hop on the
+// workstation anything on the network could reach, and until 2026-08-11 it
+// reverse-proxied every path to llama-server unauthenticated: any client could
+// spend the card, hold the model resident by touching the idle clock, and read
+// /slots, which carries the prompts of whoever else was using it.
+//
+// So: a bearer token every request must carry, read from a file, and a path
+// allowlist so a token that leaks buys the model API and not the admin one. The
+// CW2 transcriber beside this daemon has worked this way since it shipped; this
+// is the same arrangement, not a new one.
+
+// readToken loads the bearer token. The file holds the token and nothing else,
+// trailing newline allowed. A path that is set and unreadable is fatal to the
+// caller: a supervisor that silently ran without its boundary is the failure
+// this exists to prevent.
+func readToken(path string) (string, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("token_file: %w", err)
+	}
+	tok := strings.TrimSpace(string(b))
+	if tok == "" {
+		return "", fmt.Errorf("token_file %s is empty", path)
+	}
+	return tok, nil
+}
+
+// loopbackListen reports whether addr can only be reached from this machine.
+// An empty or wildcard host is not loopback, which is the case that matters:
+// ":8080" is the shipped default and it answers the whole LAN.
+func loopbackListen(addr string) bool {
+	host, _, err := net.SplitHostPort(addr)
+	if err != nil {
+		host = addr
+	}
+	host = strings.Trim(host, "[]")
+	if host == "" {
+		return false
+	}
+	if host == "localhost" {
+		return true
+	}
+	ip := net.ParseIP(host)
+	return ip != nil && ip.IsLoopback()
+}
+
+// allowed is what a token buys. Everything llama-server exposes beyond this is
+// refused, because the endpoints Maven does not call are the expensive ones to
+// hand out: /slots returns other callers' prompts, and its save/restore actions
+// write files chosen by the request.
+//
+// Adding a caller means adding its path here. That is deliberate — the list is
+// short because Maven's use of the workstation is.
+var allowed = map[string]string{
+	"/v1/chat/completions": http.MethodPost,
+	"/v1/completions":      http.MethodPost,
+	"/v1/embeddings":       http.MethodPost,
+	"/v1/models":           http.MethodGet,
+	"/props":               http.MethodGet,
+}
+
+// requireToken authenticates, then bounds. Order matters: an unauthenticated
+// client must not be able to make this daemon allocate a body buffer.
+//
+// /health is not exempt. It reports whether the card is loaded and free, which
+// is exactly what someone deciding whether to take it from him would ask.
+func requireToken(token string, maxBody int64, next http.Handler) http.Handler {
+	want := sha256.Sum256([]byte(token))
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		got := sha256.Sum256([]byte(bearer(r)))
+		if subtle.ConstantTimeCompare(got[:], want[:]) != 1 {
+			w.Header().Set("WWW-Authenticate", "Bearer")
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		r.Body = http.MaxBytesReader(w, r.Body, maxBody)
+		next.ServeHTTP(w, r)
+	})
+}
+
+// bearer pulls the credential out of the header. A malformed header yields the
+// empty string, which fails the comparison like any other wrong token — there
+// is no separate error for it, because telling a caller *how* it was wrong is
+// the only thing a probe learns from a 401.
+func bearer(r *http.Request) string {
+	h := r.Header.Get("Authorization")
+	const prefix = "Bearer "
+	if len(h) <= len(prefix) || !strings.EqualFold(h[:len(prefix)], prefix) {
+		return ""
+	}
+	return strings.TrimSpace(h[len(prefix):])
+}
+
+// allowlist refuses a path the model arm does not use. It answers 404 rather
+// than 403 so a scan cannot map llama-server's surface through this hop.
+func allowlist(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		method, ok := allowed[r.URL.Path]
+		if !ok {
+			http.NotFound(w, r)
+			return
+		}
+		if r.Method != method {
+			w.Header().Set("Allow", method)
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
+// limitInflight caps concurrent proxied requests. A waiter leaves when its own
+// context ends, so a client that gave up does not keep a slot: llama-server
+// runs with -np 1 and queueing here is cheaper than queueing inside the child
+// with a body held in memory on both sides.
+func limitInflight(n int, next http.Handler) http.Handler {
+	if n <= 0 {
+		return next
+	}
+	slots := make(chan struct{}, n)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		select {
+		case slots <- struct{}{}:
+			defer func() { <-slots }()
+			next.ServeHTTP(w, r)
+		case <-r.Context().Done():
+			http.Error(w, "client went away", http.StatusServiceUnavailable)
+		}
+	})
+}

cmd/mavgpud/auth_test.go

@@ -0,0 +1,180 @@
+package main
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// ok is what the boundary is protecting: anything that reaches it has spent
+// the card.
+func ok(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusTeapot) }
+
+func TestRequireTokenRefusesEveryWrongCredential(t *testing.T) {
+	h := requireToken("s3cret", 1<<20, http.HandlerFunc(ok))
+	cases := []struct {
+		name string
+		auth string
+		want int
+	}{
+		{"no header", "", http.StatusUnauthorized},
+		{"wrong token", "Bearer wrong", http.StatusUnauthorized},
+		{"prefix of the token", "Bearer s3cre", http.StatusUnauthorized},
+		{"token with no scheme", "s3cret", http.StatusUnauthorized},
+		{"basic auth", "Basic czNjcmV0", http.StatusUnauthorized},
+		{"right token", "Bearer s3cret", http.StatusTeapot},
+		{"scheme is case-insensitive", "bearer s3cret", http.StatusTeapot},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, "/health", nil)
+			if tc.auth != "" {
+				r.Header.Set("Authorization", tc.auth)
+			}
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, r)
+			if w.Code != tc.want {
+				t.Errorf("status %d, want %d", w.Code, tc.want)
+			}
+		})
+	}
+}
+
+// The 401 must not say which part was wrong. A probe that can tell a malformed
+// header from a wrong token learns the header shape for free.
+func TestUnauthorizedSaysNothingUseful(t *testing.T) {
+	h := requireToken("s3cret", 1<<20, http.HandlerFunc(ok))
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/health", nil))
+	if got := strings.TrimSpace(w.Body.String()); got != "unauthorized" {
+		t.Errorf("body %q, want %q", got, "unauthorized")
+	}
+	if got := w.Header().Get("WWW-Authenticate"); got != "Bearer" {
+		t.Errorf("WWW-Authenticate %q, want Bearer", got)
+	}
+}
+
+// The body cap applies to an authenticated request. An unauthenticated one
+// never gets far enough to allocate anything.
+func TestRequireTokenCapsTheBody(t *testing.T) {
+	var read error
+	h := requireToken("t", 8, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		buf := make([]byte, 64)
+		for read == nil {
+			if _, read = r.Body.Read(buf); read != nil {
+				break
+			}
+		}
+	}))
+	r := httptest.NewRequest(http.MethodPost, "/v1/chat/completions", strings.NewReader(strings.Repeat("x", 4096)))
+	r.Header.Set("Authorization", "Bearer t")
+	h.ServeHTTP(httptest.NewRecorder(), r)
+	if read == nil || !strings.Contains(read.Error(), "too large") {
+		t.Errorf("read error %v, want the body cap", read)
+	}
+}
+
+func TestAllowlistRefusesWhatMavenDoesNotCall(t *testing.T) {
+	h := allowlist(http.HandlerFunc(ok))
+	cases := []struct {
+		method, path string
+		want         int
+	}{
+		{http.MethodPost, "/v1/chat/completions", http.StatusTeapot},
+		{http.MethodGet, "/v1/models", http.StatusTeapot},
+		// /slots returns the prompts of whoever else is using the card, and
+		// its actions write files the request names.
+		{http.MethodGet, "/slots", http.StatusNotFound},
+		{http.MethodPost, "/slots/0?action=save", http.StatusNotFound},
+		{http.MethodGet, "/", http.StatusNotFound},
+		{http.MethodGet, "/v1/chat/completions", http.StatusMethodNotAllowed},
+	}
+	for _, tc := range cases {
+		t.Run(tc.method+" "+tc.path, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, httptest.NewRequest(tc.method, tc.path, nil))
+			if w.Code != tc.want {
+				t.Errorf("status %d, want %d", w.Code, tc.want)
+			}
+		})
+	}
+}
+
+func TestLimitInflightCapsConcurrency(t *testing.T) {
+	const cap = 2
+	var mu sync.Mutex
+	now, peak := 0, 0
+	release := make(chan struct{})
+	h := limitInflight(cap, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		mu.Lock()
+		now++
+		if now > peak {
+			peak = now
+		}
+		mu.Unlock()
+		<-release
+		mu.Lock()
+		now--
+		mu.Unlock()
+	}))
+
+	var wg sync.WaitGroup
+	for i := 0; i < 8; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			h.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodPost, "/v1/chat/completions", nil))
+		}()
+	}
+	// Let the first wave arrive, then drain. The assertion is the peak, and a
+	// peak that never reached the cap still cannot exceed it.
+	close(release)
+	wg.Wait()
+	if peak > cap {
+		t.Errorf("%d requests in flight at once, cap is %d", peak, cap)
+	}
+}
+
+func TestLoopbackListen(t *testing.T) {
+	cases := map[string]bool{
+		":8080":              false, // the shipped default, and the whole LAN
+		"0.0.0.0:8080":       false,
+		"[::]:8080":          false,
+		"192.168.1.105:8080": false,
+		"127.0.0.1:8080":     true,
+		"[::1]:8080":         true,
+		"localhost:8080":     true,
+	}
+	for addr, want := range cases {
+		if got := loopbackListen(addr); got != want {
+			t.Errorf("loopbackListen(%q) = %v, want %v", addr, got, want)
+		}
+	}
+}
+
+func TestReadToken(t *testing.T) {
+	dir := t.TempDir()
+	good := filepath.Join(dir, "tok")
+	if err := os.WriteFile(good, []byte("  abc123\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	got, err := readToken(good)
+	if err != nil || got != "abc123" {
+		t.Errorf("readToken = %q, %v; want abc123", got, err)
+	}
+
+	blank := filepath.Join(dir, "blank")
+	if err := os.WriteFile(blank, []byte("\n\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readToken(blank); err == nil {
+		t.Error("an empty token file is not a token")
+	}
+	if _, err := readToken(filepath.Join(dir, "absent")); err == nil {
+		t.Error("a missing token file is not a token")
+	}
+}

cmd/mavgpud/gpu.go

@@ -34,22 +34,31 @@ type probe struct {
 	drmDev  string
 }
 
-// foreign lists every ROCm process that is not ours. selfPID is the supervisor's
-// llama-server child, or 0 when it is not running.
+// foreign lists every ROCm process that is not ours. self holds the pids of the
+// supervisor's own children, and a child that is not running contributes 0.
+//
+// There is more than one child since 09-08-2026. CW2 registers on the KFD like
+// any ROCm job, so a supervisor that excluded only llama-server would read its
+// own transcriber as a contender, yield the card to it, and never keep a model
+// loaded again.
 //
 // An unreadable kfd tree returns no processes and no error. That is deliberate
 // and it is the safe direction only because startVRAM also has to agree before
 // anything launches: a supervisor that cannot see the KFD never sees free VRAM
 // either, because the CPT run holding the card shows up in the drm totals.
-func (p probe) foreign(selfPID int) []gpuProc {
+func (p probe) foreign(self ...int) []gpuProc {
 	entries, err := os.ReadDir(p.kfdRoot)
 	if err != nil {
 		return nil
 	}
+	mine := make(map[int]bool, len(self))
+	for _, pid := range self {
+		mine[pid] = true
+	}
 	var out []gpuProc
 	for _, e := range entries {
 		pid, err := strconv.Atoi(e.Name())
-		if err != nil || pid == selfPID {
+		if err != nil || mine[pid] {
 			continue
 		}
 		out = append(out, gpuProc{

cmd/mavgpud/gpu_test.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -8,6 +9,7 @@ import (
 	"path/filepath"
 	"strconv"
 	"testing"
+	"time"
 )
 
 // fakeKFD builds the sysfs shape the workstation actually has: one directory
@@ -47,6 +49,24 @@ func TestForeignExcludesOurChild(t *testing.T) {
 	}
 }
 
+// The transcriber is a ROCm process on the same card, so it registers on the
+// KFD exactly like a contender does. Reading it as one is what happened on
+// 2026-08-09 while CW2 ran under its own systemd unit: mavgpud yielded, waited
+// five polls, loaded the model, yielded again, and never held it for a whole
+// minute. Excluding every child is the fix and this is the test of it.
+func TestForeignExcludesEveryChild(t *testing.T) {
+	p := probe{kfdRoot: fakeKFD(t, map[int]int64{478104: 12791693312, 999: 4096, 1001: 1717986918})}
+
+	ours := p.foreign(999, 1001)
+	if len(ours) != 1 || ours[0].PID != 478104 {
+		t.Fatalf("only the CPT run is a contender, got %+v", ours)
+	}
+	// A child that is not running reports pid 0, which must exclude nothing.
+	if got := p.foreign(999, 0); len(got) != 2 {
+		t.Errorf("a stopped child excludes nobody: got %d contenders, want 2", len(got))
+	}
+}
+
 // An empty KFD tree is the state that permits a start, so it must read as empty
 // rather than as an error the caller has to interpret.
 func TestForeignEmptyAndMissing(t *testing.T) {
@@ -81,12 +101,14 @@ func TestFreeVRAM(t *testing.T) {
 // rather than hanging or proxying into a closed port. Maven reads this endpoint
 // on a timer forever, including while the workstation is busy.
 func TestHealthAndProxyRefuseWhenNotReady(t *testing.T) {
-	s := &supervisor{run: newRunner("/bin/true", nil, "")}
+	s := &supervisor{run: newRunner("fake", "/bin/true", nil, "")}
 	h := s.handler(mustURL(t, "http://127.0.0.1:1"))
 
-	for _, path := range []string{"/health", "/v1/chat/completions"} {
+	// The completion is a POST because the allowlist is in front of the
+	// readiness check now, and it answers 405 to a method it never serves.
+	for path, method := range map[string]string{"/health": http.MethodGet, "/v1/chat/completions": http.MethodPost} {
 		w := httptest.NewRecorder()
-		h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, path, nil))
+		h.ServeHTTP(w, httptest.NewRequest(method, path, nil))
 		if w.Code != http.StatusServiceUnavailable {
 			t.Errorf("%s with no model: got %d, want 503", path, w.Code)
 		}
@@ -101,3 +123,28 @@ func mustURL(t *testing.T, s string) *url.URL {
 	}
 	return u
 }
+
+// Yielding is all or nothing. A CPT run wants the whole card, so handing back
+// the language model while the transcriber keeps 1.6GB mapped would leave the
+// other job failing its allocation, which is the outcome yielding exists to
+// prevent.
+func TestYieldStopsEveryChild(t *testing.T) {
+	idle := "while : ; do sleep 1 ; done"
+	s := &supervisor{
+		cfg:   config{EvictAfter: 1, StopGrace: duration(2 * time.Second)},
+		probe: probe{kfdRoot: fakeKFD(t, map[int]int64{478104: 12791693312})},
+		run:   newRunner("llama-server", fakeServer(t, idle), nil, ""),
+		stt:   newRunner("cw2", fakeServer(t, idle), nil, ""),
+	}
+	for _, r := range s.children() {
+		if err := r.start(); err != nil {
+			t.Fatal(err)
+		}
+	}
+	s.tick(context.Background())
+	for _, r := range s.children() {
+		if r.running() {
+			t.Errorf("%s outlived the yield", r.name)
+		}
+	}
+}

cmd/mavgpud/main.go

@@ -10,6 +10,11 @@
 // the card. Not on demand, because a 7-14B takes tens of seconds to load and a
 // world question would be answered by a gap every time the card had been quiet.
 // Not always on, because that holds 16GB against the owner's own jobs.
+//
+// It supervises a second child since 09-08-2026, the CW2 transcriber, and for
+// one reason only: it is a ROCm process on the same card. Any GPU service the
+// owner leaves running beside this daemon reads as a contender and evicts the
+// model, so the card needs one owner rather than two neighbours.
 package main
 
 import (
@@ -31,11 +36,30 @@ type config struct {
 	Listen    string `json:"listen"`     // what Maven talks to
 	LlamaAddr string `json:"llama_addr"` // where llama-server binds
 	LlamaBin  string `json:"llama_bin"`
+
+	// TokenFile holds the bearer token every request must carry. It is a path
+	// and never the token itself, the rule mavpoll, mavmaild and the CW2
+	// transcriber already follow: a secret in a committed config is a secret
+	// in the history. Empty is allowed only on a loopback Listen, and
+	// requireToken is where that is decided.
+	TokenFile string `json:"token_file,omitempty"`
+
+	// MaxBody bounds a proxied request body. A completion is a prompt, and a
+	// prompt that does not fit here would not fit the context window either.
+	MaxBody int64 `json:"max_body_bytes,omitempty"`
+	// MaxInflight bounds how many proxied requests reach llama-server at once.
+	// It runs with -np 1, so anything above a handful only queues inside the
+	// child while holding a connection and a body in memory here.
+	MaxInflight int `json:"max_inflight,omitempty"`
 	// LlamaArgs must include the flags that bind LlamaAddr. They are passed
 	// through untouched so the model, context size and layer count stay the
 	// owner's business and not this daemon's schema.
 	LlamaArgs []string `json:"llama_args"`
 
+	// Stt is optional. Without it mavgpud supervises llama-server alone, which
+	// is everything it did before 09-08-2026.
+	Stt *sttConfig `json:"stt,omitempty"`
+
 	KFDRoot   string `json:"kfd_root"`
 	DRMDevice string `json:"drm_device"`
 
@@ -51,6 +75,22 @@ type config struct {
 	StartAfter int `json:"start_after_polls"`
 }
 
+// sttConfig is the CW2 transcriber, which mavgpud runs for one reason: it is a
+// ROCm process on this card. Left to its own systemd unit it registers on the
+// KFD, the supervisor reads it as a contender, and llama-server is evicted
+// within two polls and restarted five polls later, forever. That thrash was
+// observed on 2026-08-09 and it is what folded the service in here.
+//
+// Maven talks to it directly, not through this daemon. There is no proxy and no
+// idle timer: at 1.6GB it denies the card to nobody, and unloading it would only
+// send the next voice turn to the homesrv floor for no gain.
+type sttConfig struct {
+	// Addr is where the service binds, and it is read only to probe /health.
+	Addr string   `json:"addr"`
+	Bin  string   `json:"bin"`
+	Args []string `json:"args"`
+}
+
 func defaults() config {
 	return config{
 		Listen:      ":8080",
@@ -63,6 +103,8 @@ func defaults() config {
 		MinFreeVRAM: 15 << 30,
 		EvictAfter:  2,
 		StartAfter:  5,
+		MaxBody:     8 << 20,
+		MaxInflight: 4,
 	}
 }
 
@@ -98,13 +140,33 @@ func main() {
 		log.Fatal("mavgpud: llama_bin is required")
 	}
 
+	// A LAN listener with no token is refused rather than downgraded to
+	// loopback. Downgrading would look like a safe default and would take the
+	// model arm down instead: homesrv is the client and it is on the LAN.
+	var token string
+	if cfg.TokenFile != "" {
+		var err error
+		if token, err = readToken(cfg.TokenFile); err != nil {
+			log.Fatalf("mavgpud: %v", err)
+		}
+	} else if !loopbackListen(cfg.Listen) {
+		log.Fatalf("mavgpud: listen %s is reachable from the network and token_file is unset — "+
+			"set token_file, or listen on 127.0.0.1 and accept that Maven cannot reach it", cfg.Listen)
+	}
+
 	base := "http://" + cfg.LlamaAddr
-	run := newRunner(cfg.LlamaBin, cfg.LlamaArgs, base+"/health")
+	run := newRunner("llama-server", cfg.LlamaBin, cfg.LlamaArgs, base+"/health")
 	sup := &supervisor{
 		cfg:   cfg,
 		probe: probe{kfdRoot: cfg.KFDRoot, drmDev: cfg.DRMDevice},
 		run:   run,
 	}
+	if s := cfg.Stt; s != nil {
+		if s.Bin == "" || s.Addr == "" {
+			log.Fatal("mavgpud: stt needs both bin and addr")
+		}
+		sup.stt = newRunner("cw2", s.Bin, s.Args, "http://"+s.Addr+"/health")
+	}
 	sup.touch()
 
 	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
@@ -114,7 +176,20 @@ func main() {
 	if err != nil {
 		log.Fatalf("mavgpud: llama_addr: %v", err)
 	}
-	srv := &http.Server{Addr: cfg.Listen, Handler: sup.handler(target)}
+	var h http.Handler = sup.handler(target)
+	if token != "" {
+		h = requireToken(token, cfg.MaxBody, h)
+	}
+	srv := &http.Server{
+		Addr:    cfg.Listen,
+		Handler: h,
+		// A slow-loris client holds a connection and a header buffer for free
+		// otherwise. No ReadTimeout or WriteTimeout: a completion legitimately
+		// takes minutes on this card, and either one would cut it off.
+		ReadHeaderTimeout: 10 * time.Second,
+		IdleTimeout:       60 * time.Second,
+		MaxHeaderBytes:    1 << 16,
+	}
 	go func() {
 		log.Printf("mavgpud: listening on %s, model %s", cfg.Listen, cfg.LlamaBin)
 		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
@@ -129,13 +204,17 @@ func main() {
 	shut, done := context.WithTimeout(context.Background(), 5*time.Second)
 	defer done()
 	_ = srv.Shutdown(shut)
-	run.stop(time.Duration(cfg.StopGrace))
+	for _, r := range sup.children() {
+		r.stop(time.Duration(cfg.StopGrace))
+	}
 }
 
 type supervisor struct {
 	cfg   config
 	probe probe
 	run   *runner
+	// stt is the CW2 transcriber, or nil when the config names none.
+	stt *runner
 
 	lastReq atomic.Int64 // unix nanos of the last request Maven sent
 
@@ -168,14 +247,14 @@ func (s *supervisor) handler(target *url.URL) http.Handler {
 		w.Header().Set("Content-Type", "application/json")
 		_, _ = w.Write([]byte(`{"status":"ok"}`))
 	})
-	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+	mux.Handle("/", allowlist(limitInflight(s.cfg.MaxInflight, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if !s.run.isReady() {
 			http.Error(w, "model not loaded", http.StatusServiceUnavailable)
 			return
 		}
 		s.touch()
 		proxy.ServeHTTP(w, r)
-	})
+	}))))
 	return mux
 }
 
@@ -198,7 +277,11 @@ func (s *supervisor) loop(ctx context.Context) {
 // allocates, so we see a contender during its startup rather than after it has
 // already failed to get the memory it wanted.
 func (s *supervisor) tick(ctx context.Context) {
-	others := s.probe.foreign(s.run.pid())
+	var pids []int
+	for _, r := range s.children() {
+		pids = append(pids, r.pid())
+	}
+	others := s.probe.foreign(pids...)
 	if len(others) > 0 {
 		s.foreignStreak++
 		s.clearStreak = 0
@@ -207,31 +290,65 @@ func (s *supervisor) tick(ctx context.Context) {
 		s.clearStreak++
 	}
 
-	if s.run.running() {
-		s.run.refreshReady(ctx)
-		switch {
-		case s.foreignStreak >= s.cfg.EvictAfter:
-			log.Printf("mavgpud: yielding the card to %s", describe(others))
-			s.run.stop(time.Duration(s.cfg.StopGrace))
-		case s.idle() > time.Duration(s.cfg.IdleTimeout):
-			log.Printf("mavgpud: idle for %s, unloading", s.idle().Round(time.Second))
-			s.run.stop(time.Duration(s.cfg.StopGrace))
+	// Yielding is all or nothing. A CPT run wants the whole card, and handing
+	// back 8GB while holding 1.6GB is the shape of a failed allocation.
+	if s.foreignStreak >= s.cfg.EvictAfter && s.anyRunning() {
+		log.Printf("mavgpud: yielding the card to %s", describe(others))
+		for _, r := range s.children() {
+			r.stop(time.Duration(s.cfg.StopGrace))
 		}
 		return
 	}
 
-	if s.clearStreak < s.cfg.StartAfter {
+	clear := s.clearStreak >= s.cfg.StartAfter
+
+	if s.run.running() {
+		s.run.refreshReady(ctx)
+		if s.idle() > time.Duration(s.cfg.IdleTimeout) {
+			log.Printf("mavgpud: idle for %s, unloading", s.idle().Round(time.Second))
+			s.run.stop(time.Duration(s.cfg.StopGrace))
+		}
+	} else if clear && s.probe.freeVRAM() >= s.cfg.MinFreeVRAM {
+		s.touch() // the idle clock starts at load, not at the last request before it
+		if err := s.run.start(); err != nil {
+			log.Printf("mavgpud: start llama-server: %v", err)
+		}
+	}
+
+	if s.stt == nil {
 		return
 	}
-	if free := s.probe.freeVRAM(); free < s.cfg.MinFreeVRAM {
+	if s.stt.running() {
+		s.stt.refreshReady(ctx)
 		return
 	}
-	s.touch() // the idle clock starts at load, not at the last request before it
-	if err := s.run.start(); err != nil {
-		log.Printf("mavgpud: start llama-server: %v", err)
+	// No VRAM precondition here, unlike llama-server. That check exists because
+	// a 12B refuses to load when the card is short, and 1.6GB fits wherever the
+	// KFD is clear. Reading free VRAM would also block the transcriber for good
+	// once the language model was resident, since it holds more than the floor.
+	if clear {
+		if err := s.stt.start(); err != nil {
+			log.Printf("mavgpud: start cw2: %v", err)
+		}
 	}
 }
 
+func (s *supervisor) children() []*runner {
+	if s.stt == nil {
+		return []*runner{s.run}
+	}
+	return []*runner{s.run, s.stt}
+}
+
+func (s *supervisor) anyRunning() bool {
+	for _, r := range s.children() {
+		if r.running() {
+			return true
+		}
+	}
+	return false
+}
+
 // describe names the contenders in the log. This log is the instrument for the
 // open question in #488: whether polling the KFD misses a job that wants the
 // card without registering there.

cmd/mavgpud/runner.go

@@ -10,14 +10,18 @@ import (
 	"time"
 )
 
-// runner owns one llama-server process. Owning it is the point of the daemon:
-// the workstation cannot keep a 7-14B resident, because that holds 16GB against
+// runner owns one GPU process. Owning it is the point of the daemon: the
+// workstation cannot keep a 7-14B resident, because that holds 16GB against
 // the owner's CPT runs, Correx and the manga-recap pipeline. So the thing that
 // stays up is this, which costs no VRAM, and the model comes and goes under it.
+//
+// There are two of them since 09-08-2026: llama-server and the CW2 transcriber.
+// name is what the log calls this one.
 type runner struct {
+	name string
 	bin  string
 	args []string
-	// ready is llama-server's own /health, which answers "is a model loaded".
+	// ready is the child's own /health, which answers "is a model loaded".
 	// Loading a 7-14B takes tens of seconds, so started is not ready.
 	readyURL string
 
@@ -32,9 +36,9 @@ type runner struct {
 	http     *http.Client
 }
 
-func newRunner(bin string, args []string, readyURL string) *runner {
+func newRunner(name, bin string, args []string, readyURL string) *runner {
 	return &runner{
-		bin: bin, args: args, readyURL: readyURL,
+		name: name, bin: bin, args: args, readyURL: readyURL,
 		http: &http.Client{Timeout: 2 * time.Second},
 	}
 }
@@ -60,7 +64,7 @@ func (r *runner) isReady() bool {
 	return r.ready
 }
 
-// start launches llama-server. It returns as soon as the process exists, not
+// start launches the child. It returns as soon as the process exists, not
 // when the model is loaded.
 func (r *runner) start() error {
 	r.mu.Lock()
@@ -76,7 +80,7 @@ func (r *runner) start() error {
 		return err
 	}
 	r.cmd, r.ready, r.yielding = cmd, false, false
-	log.Printf("mavgpud: started llama-server pid=%d", cmd.Process.Pid)
+	log.Printf("mavgpud: started %s pid=%d", r.name, cmd.Process.Pid)
 	go func() {
 		err := cmd.Wait()
 		r.mu.Lock()
@@ -84,15 +88,15 @@ func (r *runner) start() error {
 		r.cmd, r.ready, r.yielding = nil, false, false
 		r.mu.Unlock()
 		if yielded {
-			log.Printf("mavgpud: llama-server stopped, card yielded (%v)", err)
+			log.Printf("mavgpud: %s stopped, card yielded (%v)", r.name, err)
 			return
 		}
-		log.Printf("mavgpud: llama-server exited: %v", err)
+		log.Printf("mavgpud: %s exited: %v", r.name, err)
 	}()
 	return nil
 }
 
-// stop ends llama-server and waits for the VRAM to come back. SIGTERM first so
+// stop ends the child and waits for the VRAM to come back. SIGTERM first so
 // it unmaps cleanly, SIGKILL after the grace window. Returning before the
 // process is gone would let the supervisor report a free card while 14GB is
 // still mapped, which is the one lie that would make yielding useless.
@@ -117,11 +121,11 @@ func (r *runner) stop(grace time.Duration) {
 		}
 		time.Sleep(100 * time.Millisecond)
 	}
-	log.Printf("mavgpud: llama-server did not exit in %s, killing", grace)
+	log.Printf("mavgpud: %s did not exit in %s, killing", r.name, grace)
 	_ = syscall.Kill(pgid, syscall.SIGKILL)
 }
 
-// refreshReady asks llama-server whether the model is loaded. Called once per
+// refreshReady asks the child whether the model is loaded. Called once per
 // supervisor tick, never per request.
 func (r *runner) refreshReady(ctx context.Context) {
 	if !r.running() {
@@ -141,6 +145,6 @@ func (r *runner) refreshReady(ctx context.Context) {
 	r.ready = ok
 	r.mu.Unlock()
 	if ok && !was {
-		log.Printf("mavgpud: model ready")
+		log.Printf("mavgpud: %s ready", r.name)
 	}
 }

cmd/mavgpud/runner_test.go

@@ -25,7 +25,7 @@ func fakeServer(t *testing.T, body string) string {
 // status of a routine yield is identical to that of a real crash. Reading the
 // mavgpud log, the two were indistinguishable (Vikunja #491).
 func TestStopMarksTheExitAsAYield(t *testing.T) {
-	r := newRunner(fakeServer(t, "while : ; do sleep 1 ; done"), nil, "")
+	r := newRunner("fake", fakeServer(t, "while : ; do sleep 1 ; done"), nil, "")
 	if err := r.start(); err != nil {
 		t.Fatalf("start: %v", err)
 	}
@@ -49,7 +49,7 @@ func TestStopMarksTheExitAsAYield(t *testing.T) {
 // Stopping when nothing is running must not arm the flag for the next child.
 // The next exit after that would be a real crash logged as a yield.
 func TestStopWithNoChildDoesNotArmTheFlag(t *testing.T) {
-	r := newRunner("/nonexistent", nil, "")
+	r := newRunner("fake", "/nonexistent", nil, "")
 	r.stop(10 * time.Millisecond)
 	r.mu.Lock()
 	defer r.mu.Unlock()

cmd/mavpoll/main.go

@@ -6,10 +6,11 @@
 // restart-free, fail-independent — a crashing poller can't touch the store key
 // (it never had it), worst case a stale env fact until the next tick.
 //
-// Two sources, each its own provenance (the loop's rules trust source):
+// Four sources, each its own provenance (the loop's rules trust source):
 //   - netdata  → poll:netdata      resource alarms (disk/mem/cert/temp)
 //   - kuma     → poll:uptimekuma   service up/down (the source of truth for it)
 //   - zenmoney → poll:zenmoney     spending/income totals (Vikunja #125)
+//   - wireguard → infer:wg         latest handshake, the presence signal
 //
 // The zenmoney source is why the token lives HERE and not in core: the poller
 // already owns every other third-party credential, it holds no store key, and
@@ -76,27 +77,31 @@ func run(args []string) error {
 	if *netdataURL == "" && *kumaURL == "" && *wgIface == "" && *zenTokenFile == "" {
 		return fmt.Errorf("nothing to poll: set -netdata, -kuma, -wg and/or -zenmoney-token-file")
 	}
+	// A bad duration or an empty -wg-cmd used to get past start and kill the
+	// poller on the first tick — time.NewTicker panics on a non-positive
+	// interval, and pollWg indexed field 0 of an empty command. A zero -timeout
+	// is worse than a crash: http.Client reads it as "no deadline", so one
+	// wedged source stalls every other source behind it forever. Refuse all
+	// three here, where the operator sees the message.
+	if *interval <= 0 {
+		return fmt.Errorf("-interval must be positive, got %s", *interval)
+	}
+	if *timeout <= 0 {
+		return fmt.Errorf("-timeout must be positive, got %s", *timeout)
+	}
+	if *wgIface != "" && strings.TrimSpace(*wgCmd) == "" {
+		return fmt.Errorf("-wg-cmd is empty but -wg is set")
+	}
 
-	// The token is read from a file, never taken as a flag value: an argv token
-	// is visible in `ps` to every user on the box and lands in the compose file
-	// and the shell history. Read once at start — a rotated token means a
-	// restart, which is cheaper than re-reading his credential every hour.
-	var zen *zenmoney.Client
-	if *zenTokenFile != "" {
-		raw, err := os.ReadFile(*zenTokenFile)
-		if err != nil {
-			return fmt.Errorf("read zenmoney token: %w", err)
-		}
-		zen, err = zenmoney.New(strings.TrimSpace(string(raw)), *zenURL, *timeout*3)
-		if err != nil {
-			return err
-		}
+	zen, err := newZenClient(*zenTokenFile, *zenURL, *timeout)
+	if err != nil {
+		return err
 	}
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 
-	core, err := ipc.DialWait(*socket, 60*time.Second)
+	core, err := ipc.DialWait(*socket, coreDialWait)
 	if err != nil {
 		return err
 	}
@@ -117,14 +122,46 @@ func run(args []string) error {
 	// The token is never logged, not even its length.
 	log.Printf("mavpoll: polling every %s (netdata=%q kuma=%q wg=%q zenmoney=%v every %s)",
 		*interval, *netdataURL, *kumaURL, *wgIface, zen != nil, *zenInterval)
+	p.loop(ctx, *interval)
+	return nil
+}
+
+// coreDialWait — how long to wait for core's socket at start. The poller and
+// core come up together under compose, so a cold start is a wait, not a failure.
+const coreDialWait = 60 * time.Second
+
+// zenTimeoutFactor — the zenmoney client gets a longer deadline than the other
+// sources. A diff call walks his whole transaction history, where netdata and
+// kuma answer from memory.
+const zenTimeoutFactor = 3
+
+// newZenClient builds the money client, or nil when no token file was given.
+//
+// The token is read from a file, never taken as a flag value: an argv token is
+// visible in `ps` to every user on the box and lands in the compose file and
+// the shell history. Read once at start — a rotated token means a restart,
+// which is cheaper than re-reading his credential every hour.
+func newZenClient(tokenFile, baseURL string, timeout time.Duration) (*zenmoney.Client, error) {
+	if tokenFile == "" {
+		return nil, nil
+	}
+	raw, err := os.ReadFile(tokenFile)
+	if err != nil {
+		return nil, fmt.Errorf("read zenmoney token: %w", err)
+	}
+	return zenmoney.New(strings.TrimSpace(string(raw)), baseURL, timeout*zenTimeoutFactor)
+}
+
+// loop polls until the context is cancelled.
+func (p *poller) loop(ctx context.Context, interval time.Duration) {
 	p.pollOnce(ctx) // fire immediately; don't idle a full interval on start
-	t := time.NewTicker(*interval)
+	t := time.NewTicker(interval)
 	defer t.Stop()
 	for {
 		select {
 		case <-ctx.Done():
 			log.Printf("mavpoll: bye")
-			return nil
+			return
 		case <-t.C:
 			p.pollOnce(ctx)
 		}
@@ -151,8 +188,8 @@ type poller struct {
 	zenLast  time.Time
 }
 
-// pollOnce — one sweep of both sources. A failure in one source logs and does
-// NOT abort the other: netdata being down shouldn't blind kuma and vice versa.
+// pollOnce — one sweep of every configured source. A failure in one logs and
+// does NOT abort the rest: netdata being down shouldn't blind kuma.
 func (p *poller) pollOnce(ctx context.Context) {
 	now := time.Now()
 	if p.netdataURL != "" {
@@ -244,6 +281,14 @@ func (p *poller) pollZenmoney(ctx context.Context, now time.Time) error {
 
 // ---- wireguard: latest handshake → presence signal -------------------------
 
+const (
+	// wgFactKey / wgSource — the presence signal, read by the decay in core.
+	// The source says infer because a handshake is evidence he is home, not a
+	// reading of where he is.
+	wgFactKey = "wg_handshake"
+	wgSource  = "infer:wg"
+)
+
 // pollWg reads `wg show <iface> latest-handshakes` and writes a wg_handshake
 // fact (source=infer:wg) stamped with the MOST RECENT peer handshake time — not
 // now(). Presence decays from the real handshake instant, so the fact's ts must
@@ -253,9 +298,19 @@ func (p *poller) pollZenmoney(ctx context.Context, now time.Time) error {
 // `wg show` needs CAP_NET_ADMIN; run mavpoll with the cap or set -wg-cmd "sudo wg".
 func (p *poller) pollWg(ctx context.Context) error {
 	fields := strings.Fields(p.wgCmd)
+	if len(fields) == 0 {
+		return fmt.Errorf("wg command is empty")
+	}
 	args := append(fields[1:], "show", p.wgIface, "latest-handshakes")
 	out, err := exec.CommandContext(ctx, fields[0], args...).Output()
 	if err != nil {
+		// wg says why it refused on stderr — usually a missing CAP_NET_ADMIN or
+		// an interface that does not exist. Output() drops that, leaving a log
+		// line that reads "exit status 1" and diagnoses nothing.
+		var ee *exec.ExitError
+		if errors.As(err, &ee) && len(ee.Stderr) > 0 {
+			return fmt.Errorf("run %s: %w: %s", p.wgCmd, err, strings.TrimSpace(string(ee.Stderr)))
+		}
 		return fmt.Errorf("run %s: %w", p.wgCmd, err)
 	}
 	maxTs := parseMaxHandshake(string(out))
@@ -263,20 +318,19 @@ func (p *poller) pollWg(ctx context.Context) error {
 		return nil // no peer has ever handshaked → drop out of presence
 	}
 	hs := time.Unix(maxTs, 0)
-	prev, err := p.core.LatestFactBySource(ctx, "wg_handshake", "infer:wg")
+	prev, err := p.core.LatestFactBySource(ctx, wgFactKey, wgSource)
 	if err == nil && !hs.After(prev.Ts) {
 		return nil // not newer → no churn
 	}
-	if err != nil && err != ipc.ErrNoFact && !isNoFact(err) {
-		return fmt.Errorf("read wg_handshake: %w", err)
+	if err != nil && !isNoFact(err) {
+		return fmt.Errorf("read %s: %w", wgFactKey, err)
 	}
-	if _, err := p.core.WriteFact(ctx, ipc.WriteFactReq{
-		Ts: hs, Kind: "env", Key: "wg_handshake", Value: `"up"`,
-		Source: "infer:wg", Confidence: 1.0,
-	}); err != nil {
-		return fmt.Errorf("write wg_handshake: %w", err)
+	// The ts is the handshake instant, not now(): presence decays from when he
+	// was last seen.
+	if err := p.writeFact(ctx, wgFactKey, wgSource, `"up"`, hs); err != nil {
+		return err
 	}
-	log.Printf("mavpoll: wg_handshake @ %s (infer:wg)", hs.Format(time.RFC3339))
+	log.Printf("mavpoll: %s @ %s (%s)", wgFactKey, hs.Format(time.RFC3339), wgSource)
 	return nil
 }
 
@@ -431,29 +485,53 @@ func kumaState(v float64) string {
 
 // ---- helpers ---------------------------------------------------------------
 
-// writeIfChanged writes a `facts(kind=env)` row only when val differs from the
-// latest fact for (key, source). Values are stored JSON-encoded (the store's
-// convention: `"down"`, `"critical"`), matching how rules compare f.Value.
-func (p *poller) writeIfChanged(ctx context.Context, key, source, val string, now time.Time) error {
-	jv, _ := json.Marshal(val) // string never fails to marshal
+// factConfidence — every poll is a direct reading of another service, never an
+// inference, so the fact goes in at full confidence.
+const factConfidence = 1.0
+
+// unchanged reports whether the latest fact for (key, source) already holds
+// jsonVal. A missing fact is not an error here, it is the first write.
+func (p *poller) unchanged(ctx context.Context, key, source, jsonVal string) (bool, error) {
 	prev, err := p.core.LatestFactBySource(ctx, key, source)
 	switch {
-	case err == nil && prev.Value == string(jv):
-		return nil // unchanged → no churn
-	case err != nil && err != ipc.ErrNoFact && !isNoFact(err):
-		return fmt.Errorf("read %s: %w", key, err)
+	case err == nil:
+		return prev.Value == jsonVal, nil
+	case isNoFact(err):
+		return false, nil
+	default:
+		return false, fmt.Errorf("read %s: %w", key, err)
 	}
-	_, err = p.core.WriteFact(ctx, ipc.WriteFactReq{
+}
+
+// writeFact writes one `facts(kind=env)` row. Every poll in this file lands
+// here, so the row shape is written once.
+func (p *poller) writeFact(ctx context.Context, key, source, jsonVal string, now time.Time) error {
+	_, err := p.core.WriteFact(ctx, ipc.WriteFactReq{
 		Ts:         now,
 		Kind:       "env",
 		Key:        key,
-		Value:      string(jv),
+		Value:      jsonVal,
 		Source:     source,
-		Confidence: 1.0, // a direct reading, not an inference
+		Confidence: factConfidence,
 	})
 	if err != nil {
 		return fmt.Errorf("write %s: %w", key, err)
 	}
+	return nil
+}
+
+// writeIfChanged writes only when val differs from the latest fact for
+// (key, source). Values are stored JSON-encoded (the store's convention:
+// `"down"`, `"critical"`), matching how rules compare f.Value.
+func (p *poller) writeIfChanged(ctx context.Context, key, source, val string, now time.Time) error {
+	jv, _ := json.Marshal(val) // a string never fails to marshal
+	same, err := p.unchanged(ctx, key, source, string(jv))
+	if err != nil || same {
+		return err // unchanged → no churn
+	}
+	if err := p.writeFact(ctx, key, source, string(jv), now); err != nil {
+		return err
+	}
 	log.Printf("mavpoll: %s=%s (%s)", key, val, source)
 	return nil
 }
@@ -466,18 +544,12 @@ func (p *poller) writeIfChanged(ctx context.Context, key, source, val string, no
 // The log line names the key and the source, never the figures: mavpoll's log
 // is not the place his spending ends up.
 func (p *poller) writeIfChangedRaw(ctx context.Context, key, source, jsonVal string, now time.Time) error {
-	prev, err := p.core.LatestFactBySource(ctx, key, source)
-	switch {
-	case err == nil && prev.Value == jsonVal:
-		return nil
-	case err != nil && err != ipc.ErrNoFact && !isNoFact(err):
-		return fmt.Errorf("read %s: %w", key, err)
+	same, err := p.unchanged(ctx, key, source, jsonVal)
+	if err != nil || same {
+		return err
 	}
-	if _, err := p.core.WriteFact(ctx, ipc.WriteFactReq{
-		Ts: now, Kind: "env", Key: key, Value: jsonVal,
-		Source: source, Confidence: 1.0,
-	}); err != nil {
-		return fmt.Errorf("write %s: %w", key, err)
+	if err := p.writeFact(ctx, key, source, jsonVal, now); err != nil {
+		return err
 	}
 	log.Printf("mavpoll: %s updated (%s)", key, source)
 	return nil
@@ -490,11 +562,8 @@ func (p *poller) writeIfChangedRaw(ctx context.Context, key, source, jsonVal str
 // The log line names the key only, never the figures: mavpoll's log is not the
 // place his spending ends up.
 func (p *poller) writeMoneyFact(ctx context.Context, key, jsonVal string, now time.Time) error {
-	if _, err := p.core.WriteFact(ctx, ipc.WriteFactReq{
-		Ts: now, Kind: "env", Key: key, Value: jsonVal,
-		Source: zenmoney.Source, Confidence: 1.0,
-	}); err != nil {
-		return fmt.Errorf("write %s: %w", key, err)
+	if err := p.writeFact(ctx, key, zenmoney.Source, jsonVal, now); err != nil {
+		return err
 	}
 	log.Printf("mavpoll: %s read (%s)", key, zenmoney.Source)
 	return nil
@@ -506,6 +575,15 @@ func isNoFact(err error) bool {
 	return errors.Is(err, ipc.ErrNoFact)
 }
 
+// maxBodyBytes caps what a source can make the poller hold. Kuma's whole
+// metrics page is a few hundred kilobytes, so 4 MiB is slack, not a budget.
+//
+// Hitting the cap is an error, not a shorter body. A truncated kuma page parses
+// cleanly right up to the cut, and every monitor past it reads as deleted — the
+// poller would write "unknown" over live services and the down-rule would go
+// quiet. Reading one byte past the cap is how we tell full from truncated.
+const maxBodyBytes = 4 << 20
+
 func (p *poller) get(ctx context.Context, url, basicUser string) ([]byte, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
 	if err != nil {
@@ -519,12 +597,15 @@ func (p *poller) get(ctx context.Context, url, basicUser string) ([]byte, error)
 		return nil, err
 	}
 	defer resp.Body.Close()
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 4<<20))
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxBodyBytes+1))
 	if err != nil {
 		return nil, err
 	}
 	if resp.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("GET %s: %s", url, resp.Status)
 	}
+	if len(body) > maxBodyBytes {
+		return nil, fmt.Errorf("GET %s: body over %d bytes", url, maxBodyBytes)
+	}
 	return body, nil
 }

cmd/mavpoll/main_test.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -212,3 +213,59 @@ func TestRunRequiresSomethingToPoll(t *testing.T) {
 		t.Errorf("err = %v, want a 'nothing to poll' refusal", err)
 	}
 }
+
+// A flag value that would kill the poller later is refused at start, before it
+// dials core: a non-positive interval panics time.NewTicker on the first tick, a
+// zero timeout means http.Client waits forever, and an empty wg command used to
+// index field 0 of an empty slice.
+func TestRunRefusesFlagsThatCrashLater(t *testing.T) {
+	cases := []struct {
+		name string
+		args []string
+		want string
+	}{
+		{"zero interval", []string{"-interval", "0"}, "-interval must be positive"},
+		{"negative interval", []string{"-interval", "-5s"}, "-interval must be positive"},
+		{"zero timeout", []string{"-timeout", "0"}, "-timeout must be positive"},
+		{"empty wg command", []string{"-wg", "wg0", "-wg-cmd", " "}, "-wg-cmd is empty"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			args := append([]string{"-socket", "/tmp/nope.sock"}, c.args...)
+			err := run(args)
+			if err == nil || !strings.Contains(err.Error(), c.want) {
+				t.Errorf("err = %v, want %q", err, c.want)
+			}
+		})
+	}
+}
+
+// pollWg refuses an empty command rather than panicking on fields[0].
+func TestPollWgEmptyCommand(t *testing.T) {
+	p := &poller{core: &factCore{}, wgIface: "wg0", wgCmd: ""}
+	if err := p.pollWg(context.Background()); err == nil {
+		t.Error("want an error, got a poll that ran something")
+	}
+}
+
+// A body at the cap is a truncated body, and a truncated kuma page reads as
+// "every monitor past the cut was deleted". Refuse it instead of parsing it.
+func TestGetRefusesTruncatedBody(t *testing.T) {
+	big := strings.Repeat("x", maxBodyBytes+64)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, big)
+	}))
+	defer srv.Close()
+	p := &poller{http: srv.Client()}
+	if _, err := p.get(context.Background(), srv.URL, ""); err == nil {
+		t.Error("want an over-size refusal, got a silently truncated body")
+	}
+	small := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, "ok")
+	}))
+	defer small.Close()
+	body, err := p.get(context.Background(), small.URL, "")
+	if err != nil || string(body) != "ok" {
+		t.Errorf("get = %q, %v; want the whole small body", body, err)
+	}
+}

cmd/mavsttd/whisper_handler.go

@@ -22,6 +22,18 @@ import (
 // to it before sending, so it's also the rate the silence gate assumes.
 const whisperSampleRate = 16000
 
+// whisperThreads — greedy decode is single-pass and this is a laptop CPU
+// (homesrv), not a server box; 4 was picked to leave headroom for the rest
+// of the daemons sharing the machine, not measured against a latency target.
+const whisperThreads = 4
+
+// noSpeechFloor — whisper's own no_speech_prob past this point means the
+// segment it transcribed is not speech (the model still emits token
+// probabilities for silence/noise, so a high avgLogProb-derived confidence
+// can coexist with a segment that should be zero). Read as "at least 90%
+// sure this was not speech."
+const noSpeechFloor = 0.9
+
 type whisperHandler struct {
 	ctx    *C.struct_whisper_context
 	minMs  int     // clips shorter than this are dropped (hallucination bait)
@@ -101,7 +113,7 @@ func (h *whisperHandler) Transcribe(ctx context.Context, req worker.TranscribeRe
 	params.print_realtime = false
 	params.print_timestamps = false
 	params.print_special = false
-	params.n_threads = C.int(4)
+	params.n_threads = C.int(whisperThreads)
 	params.single_segment = true
 
 	lang := C.CString(req.Lang)
@@ -162,7 +174,7 @@ func (h *whisperHandler) Transcribe(ctx context.Context, req worker.TranscribeRe
 	}
 
 	noSpeechProb := float64(C.whisper_full_get_segment_no_speech_prob(h.ctx, 0))
-	if noSpeechProb > 0.9 {
+	if noSpeechProb > noSpeechFloor {
 		confidence = 0
 	}
 

cmd/mavttsd/piper_handler.go

@@ -116,18 +116,27 @@ func (h *piperHandler) Synthesize(ctx context.Context, req worker.SynthesizeReq)
 	}, nil
 }
 
-// resample22050To16000 converts raw 16-bit PCM from 22050 Hz to 16000 Hz
-// using linear interpolation.
+// piperSampleRate is the rate piper's onnx voices render at (ru_RU-irina and
+// the other models this daemon has been pointed at). targetSampleRate is the
+// canonical maven wire rate (audio.PCM16kMono) that every downstream
+// consumer — playback, the voice wire, whisper on the way back in — expects.
+const (
+	piperSampleRate  = 22050
+	targetSampleRate = 16000
+)
+
+// resample22050To16000 converts raw 16-bit PCM from piperSampleRate to
+// targetSampleRate using linear interpolation.
 func resample22050To16000(input []byte) []byte {
 	if len(input) < 2 {
 		return nil
 	}
 
 	nSamples := len(input) / 2
-	outSamples := int(float64(nSamples) * 16000.0 / 22050.0)
+	outSamples := int(float64(nSamples) * float64(targetSampleRate) / float64(piperSampleRate))
 	output := make([]byte, outSamples*2)
 
-	ratio := 22050.0 / 16000.0
+	ratio := float64(piperSampleRate) / float64(targetSampleRate)
 
 	for i := 0; i < outSamples; i++ {
 		srcPos := float64(i) * ratio

cmd/mavwaked/main.go

@@ -5,12 +5,24 @@
 // is detected sends it as a PushToTalk frame to the voice server. The reply
 // audio is played back through aplay(1).
 //
-// No wake-word model yet (MVP uses voice-activity-only trigger). The
-// SurfaceVoice auth layer caps all commands at L0 (no destructive acts),
-// making accidental triggers safe by design. A proper wake-word engine
-// (openWakeWord / Silero VAD ONNX) is the planned upgrade — the VAD shape
-// (30ms frames, 16kHz PCM) matches silero-vad's input interface exactly, so
-// swapping energy-threshold for ONNX-inference is a local change in vad.go.
+// Voice activity is silero-vad when -vad-model points at the graph, and an
+// energy threshold when it does not. Silero declines noise the threshold
+// accepts: 0 frames against 68 to 99 on the four fixtures, measured in
+// docs/evals/2026-08-09-silero-vad.md. Note that the model window is 512
+// samples and the capture frame is 480, so silero.go re-chunks. This comment
+// used to say the two matched, which was true of silero v4.
+//
+// The keyword is "Мэйвен" and it is required, when -wake-model points at the
+// head (V-487 stage two). Without it anything spoken near the microphone
+// becomes a turn, which the SurfaceVoice auth layer makes safe rather than
+// expensive: it caps all commands at L0, no destructive acts. It does not cap
+// reading, so an open gate still lets the room hear his facts read back.
+// wakeword.go holds the cadence and wakefeatures.go the three models.
+//
+// The conn carries both directions. mavwaked sends utterances and receives
+// proactive nudges on it, and it is opened at startup rather than at the first
+// utterance, because mavend registers a voice session on accept. See nudge.go
+// for why a nudge that is not heard is worse than one that is not delivered.
 //
 // While a reply is playing the capture side is muted (half-duplex): without
 // it, Maven's own voice comes back in through the mic and she answers
@@ -52,6 +64,12 @@ const (
 	defaultAddr     = "127.0.0.1:9100"
 	defaultLang     = "ru"
 	defaultReadSize = 4096 // max PCM bytes per read from arecord (fits multiple frames)
+
+	// defaultWakeWindowMs — how long the keyword stays good for. He says
+	// "Мэйвен" and then a sentence, and the VAD does not close the utterance
+	// until he stops, so this has to outlive the word by the length of what
+	// follows it. It is spent on dispatch: one keyword, one turn.
+	defaultWakeWindowMs = 8000
 )
 
 func main() {
@@ -73,17 +91,38 @@ func run(args []string) error {
 	bargeIn := flag.Bool("barge-in", false, "cut Maven off when he talks over her (needs a room-tuned -barge-in-rms)")
 	bargeRMS := flag.Int("barge-in-rms", defaultBargeRMS, "RMS x10000 a frame must clear to count as barge-in")
 	bargeFrames := flag.Int("barge-in-frames", defaultBargeFrames, "consecutive frames over -barge-in-rms before playback is cut")
+	vadModel := flag.String("vad-model", "", "silero-vad onnx file; empty runs the energy threshold instead")
+	vadThreshold := flag.Float64("vad-threshold", defaultSileroThreshold, "speech probability a frame must clear")
+	onnxLib := flag.String("onnx-lib", os.Getenv("MAVEN_ONNX_LIB"), "libonnxruntime.so, needed with -vad-model")
+	wakeModel := flag.String("wake-model", "", "keyword head onnx; empty ships every utterance, as before V-487")
+	wakeMel := flag.String("wake-mel", "", "melspectrogram.onnx, required with -wake-model")
+	wakeEmbed := flag.String("wake-embed", "", "embedding_model.onnx, required with -wake-model")
+	wakeThreshold := flag.Float64("wake-threshold", defaultWakeThreshold, "score the keyword must clear")
+	wakeWindowMs := flag.Int("wake-window-ms", defaultWakeWindowMs, "ms an utterance may still start after the keyword")
 	flag.CommandLine.Parse(args)
 
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM, syscall.SIGHUP)
 	defer stop()
 
-	// Voice client — reused across utterances; SendRequest reconnects on error.
+	// Voice client — one conn carrying both directions. SendRequest reconnects
+	// on error, and the push receiver redials on its own clock.
 	vc := voice.Dial(*addr)
 	defer vc.Close()
 
-	// VAD engine.
+	// VAD engine. A model that will not load is logged and not fatal: the
+	// energy threshold is worse, and it is a great deal better than a
+	// listening client that refuses to start.
 	vad := NewVAD(*minRMS, *speechMs, *silenceMs, *maxMs)
+	if *vadModel != "" {
+		s, err := newSileroVAD(*vadModel, *onnxLib)
+		if err != nil {
+			log.Printf("mavwaked: silero unavailable, energy threshold unchanged: %v", err)
+		} else {
+			defer s.Close()
+			vad.UseSilero(s, *vadThreshold)
+			log.Printf("mavwaked: silero-vad from %s, threshold %.2f", *vadModel, *vadThreshold)
+		}
+	}
 
 	// Audio source.
 	var src io.ReadCloser
@@ -145,6 +184,29 @@ func run(args []string) error {
 	}
 	sess := newSession(vad, newAplayPlayer(), &voiceSender{vc: vc}, *lang, barge)
 
+	// Keyword gate. A model that will not load is logged and not fatal, for
+	// the same reason silero's is not: an open gate is the daemon he had
+	// yesterday, and a daemon that refuses to start is not.
+	if *wakeModel != "" {
+		w, err := newWakeWord(*wakeMel, *wakeEmbed, *wakeModel, *onnxLib, *wakeThreshold)
+		if err != nil {
+			log.Printf("mavwaked: wake word unavailable, every utterance is a turn: %v", err)
+		} else {
+			defer w.Close()
+			sess.UseWakeWord(w, time.Duration(*wakeWindowMs)*time.Millisecond)
+			log.Printf("mavwaked: wake word from %s, threshold %.3f, window %dms",
+				*wakeModel, *wakeThreshold, *wakeWindowMs)
+		}
+	}
+
+	// Listen for nudges alongside capture. Connect eagerly so mavend has a
+	// voice session before he has said anything: without one, a nudge routed
+	// to voice finds nobody home and goes to the away channels instead.
+	if err := vc.Connect(ctx); err != nil {
+		log.Printf("mavwaked: voice server not reachable yet, retrying in background: %v", err)
+	}
+	go runNudgeReceiver(ctx, vc, sess)
+
 	return captureLoop(ctx, src, sess)
 }
 

cmd/mavwaked/nudge.go

@@ -0,0 +1,79 @@
+package main
+
+// The receiving half of the voice reach (V-671).
+//
+// mavwaked used to send and never listen. It wired no PushHandler, and
+// SendRequest discards a push frame when there is none. The consequence was
+// not a missing feature but a silent one: mavend routes a nudge to the voice
+// session that spoke most recently, and once mavwaked had spoken once it WAS
+// that session. PushToMostRecent succeeded, the dispatcher counted the nudge
+// delivered and stopped rerouting to telegram and ntfy, and mavwaked threw the
+// audio away. He heard nothing, anywhere.
+//
+// So the connection is opened at startup rather than at the first utterance,
+// and it is held open. A client that has never connected has no session, and
+// the dispatcher must be able to tell "he is not at the machine" from "he is,
+// and she has nothing to say".
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+	"time"
+
+	"github.com/kami/maven/internal/voice"
+)
+
+// nudgeRetry is how long to wait before dialling again after the conn ends.
+// mavend restarts on every deploy, and a listener that gives up then is a
+// listener that is deaf until the next reboot.
+const nudgeRetry = 5 * time.Second
+
+// nudgeHandler decodes a push and hands the audio to the session, which
+// speaks it through the same player the reply path uses. It does not play
+// anything itself: the half-duplex gate and barge-in live on the capture
+// loop, and a nudge has to sit under both.
+type nudgeHandler struct{ sess *session }
+
+func (h *nudgeHandler) OnPush(p voice.Push) {
+	if p.Kind != voice.PushKindAudioNudge {
+		log.Printf("mavwaked: ignoring push of unknown kind %q", p.Kind)
+		return
+	}
+	var ap voice.AudioNudgePush
+	if err := json.Unmarshal(p.Params, &ap); err != nil {
+		log.Printf("mavwaked: nudge: decode: %v", err)
+		return
+	}
+	log.Printf("mavwaked: nudge from rule %q (severity %d): %q (%.2fs audio)",
+		ap.RuleName, ap.Severity, ap.Text, ap.Audio.Duration())
+	if len(ap.Audio.Bytes) == 0 {
+		// mavttsd was down or the text was empty. Say so rather than going
+		// quiet: the dispatcher already counted this one as delivered.
+		log.Printf("mavwaked: nudge %q carried no audio, nothing to speak", ap.RuleName)
+		return
+	}
+	h.sess.Nudge(ap.Audio)
+}
+
+// runNudgeReceiver keeps a push handler wired for as long as ctx lives,
+// redialling whenever the conn ends. Returns when ctx is cancelled.
+func runNudgeReceiver(ctx context.Context, vc *voice.Client, sess *session) {
+	h := &nudgeHandler{sess: sess}
+	for {
+		err := vc.RunPushReceiver(ctx, h)
+		if ctx.Err() != nil {
+			return
+		}
+		if err != nil {
+			log.Printf("mavwaked: nudge receiver: %v", err)
+		} else {
+			log.Printf("mavwaked: voice connection ended, reconnecting in %s", nudgeRetry)
+		}
+		select {
+		case <-ctx.Done():
+			return
+		case <-time.After(nudgeRetry):
+		}
+	}
+}

cmd/mavwaked/nudge_test.go

@@ -0,0 +1,170 @@
+package main
+
+// The receiving half: a nudge pushed by mavend has to reach the speaker, and
+// it has to obey the same two gates a reply obeys (V-671).
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/audio"
+	"github.com/kami/maven/internal/voice"
+)
+
+func nudgeAudio() audio.Audio {
+	return audio.Audio{Format: audio.PCM16kMono, Bytes: make([]byte, 8000)}
+}
+
+// pushFrame builds the frame mavend's voicesink sends.
+func pushFrame(t *testing.T, a audio.Audio) voice.Push {
+	t.Helper()
+	body, err := json.Marshal(voice.AudioNudgePush{
+		RuleName: "test-rule",
+		Severity: 3,
+		Audio:    a,
+		Text:     "пора пить воду",
+		Ts:       time.Unix(0, 0),
+	})
+	if err != nil {
+		t.Fatalf("marshal push: %v", err)
+	}
+	return voice.Push{Kind: voice.PushKindAudioNudge, Params: body}
+}
+
+// The defect itself: the push arrived and nothing came out of the speaker.
+func TestNudgeReachesThePlayer(t *testing.T) {
+	sess, p, snd := newTestSession(bargeInConfig{})
+	(&nudgeHandler{sess: sess}).OnPush(pushFrame(t, nudgeAudio()))
+
+	if p.plays != 0 {
+		t.Fatal("nudge played from the push goroutine; it must wait for the capture loop")
+	}
+	if err := sess.feed(context.Background(), silentBytes()); err != nil {
+		t.Fatalf("feed: %v", err)
+	}
+	if p.plays != 1 {
+		t.Fatalf("plays = %d, want 1", p.plays)
+	}
+	if len(p.last.Bytes) != 8000 {
+		t.Errorf("played %d bytes, want the nudge audio", len(p.last.Bytes))
+	}
+	if sess.nudges != 1 {
+		t.Errorf("nudges = %d, want 1", sess.nudges)
+	}
+	if len(snd.sent) != 0 {
+		t.Errorf("a nudge must not be shipped back to the daemon as an utterance")
+	}
+}
+
+// A push of some other kind, or one carrying no audio, must not reach the
+// player and must not wedge the one that follows.
+func TestNudgeIgnoresUnusablePushes(t *testing.T) {
+	sess, p, _ := newTestSession(bargeInConfig{})
+	h := &nudgeHandler{sess: sess}
+
+	h.OnPush(voice.Push{Kind: "something-else", Params: json.RawMessage(`{}`)})
+	h.OnPush(voice.Push{Kind: voice.PushKindAudioNudge, Params: json.RawMessage(`not json`)})
+	h.OnPush(pushFrame(t, audio.Audio{Format: audio.PCM16kMono}))
+
+	if err := sess.feed(context.Background(), silentBytes()); err != nil {
+		t.Fatalf("feed: %v", err)
+	}
+	if p.plays != 0 {
+		t.Fatalf("plays = %d, want 0", p.plays)
+	}
+
+	h.OnPush(pushFrame(t, nudgeAudio()))
+	if err := sess.feed(context.Background(), silentBytes()); err != nil {
+		t.Fatalf("feed: %v", err)
+	}
+	if p.plays != 1 {
+		t.Fatalf("plays after a usable nudge = %d, want 1", p.plays)
+	}
+}
+
+// The half-duplex gate covers a nudge exactly as it covers a reply: she does
+// not start one over herself, and the mic stays muted while it runs.
+func TestNudgeWaitsForTheReplyToFinish(t *testing.T) {
+	sess, p, _ := newTestSession(bargeInConfig{})
+	speakThenPause(t, sess)
+	if !p.Playing() {
+		t.Fatal("expected the reply to be playing")
+	}
+	plays := p.plays
+
+	(&nudgeHandler{sess: sess}).OnPush(pushFrame(t, nudgeAudio()))
+	for i := 0; i < 20; i++ {
+		if err := sess.feed(context.Background(), silentBytes()); err != nil {
+			t.Fatalf("feed: %v", err)
+		}
+	}
+	if p.plays != plays {
+		t.Fatalf("nudge cut across the reply: plays = %d, want %d", p.plays, plays)
+	}
+
+	p.playing = false
+	if err := sess.feed(context.Background(), silentBytes()); err != nil {
+		t.Fatalf("feed: %v", err)
+	}
+	if p.plays != plays+1 {
+		t.Fatalf("nudge never played after the reply ended: plays = %d", p.plays)
+	}
+}
+
+// Speaking a nudge must not leave half a sentence in the VAD. The frames
+// captured before it are pre-nudge speech, and splicing them onto whatever he
+// says afterwards ships one utterance that is two.
+func TestNudgeResetsTheVAD(t *testing.T) {
+	sess, p, snd := newTestSession(bargeInConfig{})
+	loud := frameAt(0.35)
+	speechFrames := (defaultSpeechMs + defaultFrameMs - 1) / defaultFrameMs
+	for i := 0; i < speechFrames+5; i++ {
+		if err := sess.feed(context.Background(), loud); err != nil {
+			t.Fatalf("feed: %v", err)
+		}
+	}
+
+	(&nudgeHandler{sess: sess}).OnPush(pushFrame(t, nudgeAudio()))
+	if err := sess.feed(context.Background(), silentBytes()); err != nil {
+		t.Fatalf("feed: %v", err)
+	}
+	if p.plays != 1 {
+		t.Fatalf("nudge did not play: plays = %d", p.plays)
+	}
+
+	// Playback ends, silence follows. The half-formed utterance must be gone
+	// rather than closing on the first quiet frame.
+	p.playing = false
+	silenceFrames := (defaultSilenceMs+defaultFrameMs-1)/defaultFrameMs + 2
+	for i := 0; i < silenceFrames; i++ {
+		if err := sess.feed(context.Background(), silentBytes()); err != nil {
+			t.Fatalf("feed: %v", err)
+		}
+	}
+	if len(snd.sent) != 0 {
+		t.Fatalf("sent %d utterances after a nudge, want 0", len(snd.sent))
+	}
+}
+
+// Two nudges queued back to back: the newer one is what he hears. The
+// PushHandler contract in internal/voice says the next nudge replaces the
+// stale one rather than dogpiling on it.
+func TestNudgeReplacesAnUnspokenOne(t *testing.T) {
+	sess, p, _ := newTestSession(bargeInConfig{})
+	h := &nudgeHandler{sess: sess}
+
+	h.OnPush(pushFrame(t, audio.Audio{Format: audio.PCM16kMono, Bytes: make([]byte, 4000)}))
+	h.OnPush(pushFrame(t, audio.Audio{Format: audio.PCM16kMono, Bytes: make([]byte, 12000)}))
+
+	if err := sess.feed(context.Background(), silentBytes()); err != nil {
+		t.Fatalf("feed: %v", err)
+	}
+	if p.plays != 1 {
+		t.Fatalf("plays = %d, want 1", p.plays)
+	}
+	if len(p.last.Bytes) != 12000 {
+		t.Errorf("played %d bytes, want the newer nudge", len(p.last.Bytes))
+	}
+}

cmd/mavwaked/session.go

@@ -7,6 +7,7 @@ package main
 import (
 	"context"
 	"log"
+	"sync"
 	"time"
 
 	"github.com/kami/maven/internal/audio"
@@ -19,6 +20,15 @@ type utteranceSender interface {
 	Send(ctx context.Context, utt audio.Audio, lang string) (audio.Audio, error)
 }
 
+// keywordGate answers whether the keyword has just been spoken. The
+// production one is wakeWord; tests substitute a recorder, because a gate that
+// can only be exercised with three ONNX files is a gate nobody tests.
+type keywordGate interface {
+	Feed(frame []int16) bool
+	Reset()
+	Score() float64
+}
+
 // bargeInConfig holds the two numbers barge-in needs. Zero Frames disables
 // barge-in entirely — the half-duplex gate still runs.
 type bargeInConfig struct {
@@ -62,11 +72,29 @@ type session struct {
 	// whenever playback ends.
 	loudFrames int
 
+	// wake is the keyword gate, or nil when no model was loaded. wakeUntil is
+	// how long a keyword stays good for: he says "Мэйвен" and then a sentence,
+	// and the VAD does not close the utterance until he stops, so the window
+	// has to outlive the word by the length of what follows it.
+	wake       keywordGate
+	wakeWindow time.Duration
+	wakeUntil  time.Time
+
+	// pending holds a nudge the push receiver handed over, waiting for the
+	// capture loop to speak it. It is the one field written from another
+	// goroutine, hence the mutex; everything else in this struct belongs to
+	// the capture loop alone.
+	nudgeMu sync.Mutex
+	pending *audio.Audio
+
 	// counters, read by tests and logged on the way out.
 	suppressed int // frames dropped because she was speaking
 	dropped    int // frames dropped as round-trip backlog
 	bargeIns   int // times playback was cut because he spoke over her
 	sent       int // utterances shipped to the daemon
+	nudges     int // proactive pushes spoken through the speaker
+	wakes      int // times the keyword opened the gate
+	ignored    int // complete utterances dropped because the keyword was absent
 
 	// loudSum and loudSeen accumulate the energy of suppressed frames, so
 	// the operator can read what the room actually measures and set
@@ -79,6 +107,12 @@ func newSession(vad *VAD, p player, s utteranceSender, lang string, barge bargeI
 	return &session{vad: vad, player: p, sender: s, lang: lang, barge: barge, now: time.Now}
 }
 
+// UseWakeWord puts the keyword gate in front of dispatch. Without it every
+// utterance is shipped, which is what mavwaked did before V-487 stage two.
+func (s *session) UseWakeWord(w keywordGate, window time.Duration) {
+	s.wake, s.wakeWindow = w, window
+}
+
 // frameDuration is the wall time one captured frame represents.
 const frameDuration = defaultFrameMs * time.Millisecond
 
@@ -138,6 +172,7 @@ func (s *session) feed(ctx context.Context, frame []byte) error {
 		s.bargeIns++
 		s.loudFrames = 0
 		s.vad.Reset()
+		s.resetWake()
 		log.Printf("mavwaked: barge-in — stopped playback")
 		s.replayRecent()
 		return nil
@@ -148,15 +183,101 @@ func (s *session) feed(ctx context.Context, frame []byte) error {
 	if s.loudFrames != 0 {
 		s.loudFrames = 0
 		s.vad.Reset()
+		// The wake word saw nothing during playback, so what it holds is from
+		// before she spoke. Judging what he says next on it would score a
+		// sentence that ended a reply ago.
+		s.resetWake()
 	}
 
-	utt, state := s.vad.Feed(PCMToI16(frame))
+	if s.startPendingNudge() {
+		return nil
+	}
+
+	// The keyword is scored on the same frames the VAD sees, and only on the
+	// ones that reach here: every path above returns while she is speaking, so
+	// her own voice saying "Мэйвен" cannot wake her.
+	pcm := PCMToI16(frame)
+	if s.wake != nil && s.wake.Feed(pcm) {
+		s.wakes++
+		s.wakeUntil = s.now().Add(s.wakeWindow)
+		log.Printf("mavwaked: keyword heard (score %.3f), listening for %s",
+			s.wake.Score(), s.wakeWindow)
+	}
+
+	utt, state := s.vad.Feed(pcm)
 	if state == StateSpeech || utt.Bytes == nil {
 		return nil
 	}
 	return s.dispatch(ctx, utt)
 }
 
+// Nudge hands proactive audio to the session, to be spoken as soon as the
+// capture loop finds a quiet moment. Safe to call from the push receiver
+// goroutine; nothing else here is.
+//
+// A nudge arriving while one is already waiting REPLACES it. That is the
+// contract internal/voice states for PushHandler: the next nudge replaces the
+// stale one in his attention rather than dogpiling on it.
+func (s *session) Nudge(a audio.Audio) {
+	if len(a.Bytes) == 0 {
+		return
+	}
+	s.nudgeMu.Lock()
+	if s.pending != nil {
+		log.Printf("mavwaked: nudge replaced one still waiting to be spoken")
+	}
+	s.pending = &a
+	s.nudgeMu.Unlock()
+}
+
+// takeNudge removes and returns the waiting nudge, or nil.
+func (s *session) takeNudge() *audio.Audio {
+	s.nudgeMu.Lock()
+	defer s.nudgeMu.Unlock()
+	a := s.pending
+	s.pending = nil
+	return a
+}
+
+// startPendingNudge speaks a waiting nudge and reports whether it started
+// one. It runs on the capture loop, past the half-duplex gate, so a nudge
+// never cuts across a reply and never plays into a backlog drain.
+//
+// The VAD is reset first. Playback is about to suppress every frame until it
+// ends, and a half-heard sentence left in the VAD would splice onto whatever
+// he says afterwards. Barge-in needs no special case: it reads the player,
+// and the player does not care which audio it is playing.
+func (s *session) startPendingNudge() bool {
+	a := s.takeNudge()
+	if a == nil {
+		return false
+	}
+	s.vad.Reset()
+	s.nudges++
+	log.Printf("mavwaked: speaking nudge (%.2fs audio)", a.Duration())
+	s.player.Play(*a)
+	return true
+}
+
+// awake reports whether an utterance ending now was addressed to her.
+//
+// With no wake word loaded every utterance is, which is exactly what mavwaked
+// did before this gate existed. An operator with no model file gets the old
+// daemon rather than a daemon that refuses to hear anything.
+func (s *session) awake() bool {
+	if s.wake == nil {
+		return true
+	}
+	return s.now().Before(s.wakeUntil)
+}
+
+// resetWake drops the gate's streaming state when there is a gate.
+func (s *session) resetWake() {
+	if s.wake != nil {
+		s.wake.Reset()
+	}
+}
+
 // keepRecent stores a copy of one barge-in trigger frame, keeping at most
 // barge.Frames of them.
 func (s *session) keepRecent(frame []byte) {
@@ -197,6 +318,19 @@ func (s *session) replayRecent() {
 // whole backlog straight into the VAD, and a Send error did the same on every
 // failed turn, so a dead socket drove a retry loop off nothing but backlog.
 func (s *session) dispatch(ctx context.Context, utt audio.Audio) error {
+	if !s.awake() {
+		s.ignored++
+		log.Printf("mavwaked: utterance ignored, keyword not heard (%.2fs, %d ignored so far)",
+			utt.Duration(), s.ignored)
+		s.vad.Reset()
+		s.resetWake()
+		return nil
+	}
+	// One keyword, one turn. A window that renewed itself on every reply would
+	// leave the microphone open for as long as he kept talking, which is the
+	// state this gate exists to end.
+	s.wakeUntil = time.Time{}
+
 	log.Printf("mavwaked: utterance complete (%.2fs, %d bytes), sending...", utt.Duration(), len(utt.Bytes))
 	start := s.now()
 	reply, err := s.sender.Send(ctx, utt, s.lang)
@@ -225,6 +359,7 @@ func (s *session) dispatch(ctx context.Context, utt audio.Audio) error {
 // recorded before she started speaking.
 func (s *session) dropBacklog(start time.Time) {
 	s.vad.Reset()
+	s.resetWake()
 	s.loudFrames = 0
 	s.recent = s.recent[:0]
 	if elapsed := s.now().Sub(start); elapsed > 0 {

cmd/mavwaked/silero.go

@@ -0,0 +1,171 @@
+package main
+
+// silero-vad, the speech detector that replaces the energy threshold (V-487).
+//
+// Why an energy threshold is not a voice activity detector. It answers "is
+// this frame loud", and a fan, a door and a television are all loud. mavwaked
+// sends every utterance it accepts to speech-to-text and then to the daemon,
+// so a false trigger is a turn Maven takes on something nobody said to her.
+// Silero answers "is this frame speech", which is the question.
+//
+// It is 2.3MB of ONNX and runs on one CPU core in real time. That is not an
+// aside: this is the one model in the system that may never be offloaded or
+// gated on GPU admission, because a wake path that waits on a card is not a
+// wake path.
+//
+// Nil is a working value. Without -vad-model the daemon runs the energy VAD
+// exactly as it did before this file existed.
+
+import (
+	"fmt"
+	"sync"
+
+	ort "github.com/yalue/onnxruntime_go"
+)
+
+const (
+	// sileroWindow — samples per inference at 16kHz. The model is fixed at
+	// 512 and does not accept another size, which is why this file
+	// re-chunks rather than reusing the 480-sample capture frame. main.go
+	// used to claim the two matched; that was true of silero v4.
+	sileroWindow = 512
+
+	// sileroContext — samples of the previous window prepended to each
+	// inference, as the reference implementation does. Without it the first
+	// milliseconds of every window are judged with no history and speech
+	// onsets score low.
+	sileroContext = 64
+
+	// sileroState — the LSTM state carried between windows, [2][1][128].
+	sileroStateDim = 128
+
+	// defaultSileroThreshold — probability above which a window is speech.
+	// 0.5 is the reference default. Raising it costs speech onsets, which
+	// are the quietest part of an utterance.
+	defaultSileroThreshold = 0.5
+)
+
+// sileroVAD holds one ONNX session and the streaming state around it. It is
+// fed 30ms capture frames and answers per frame, buffering across calls
+// because 480 samples never line up with a 512-sample window.
+type sileroVAD struct {
+	mu      sync.Mutex
+	session *ort.DynamicAdvancedSession
+
+	pending []float32              // samples not yet part of a full window
+	context [sileroContext]float32 // tail of the previous window
+	state   []float32              // [2][1][128], carried between windows
+	last    float64                // most recent probability, held between windows
+	sr      []int64
+}
+
+// newSileroVAD loads the graph. The ONNX environment is initialised here when
+// nothing else has done it, because mavwaked has no embedder to do it first.
+func newSileroVAD(modelPath, libPath string) (*sileroVAD, error) {
+	if !ort.IsInitialized() {
+		if libPath != "" {
+			ort.SetSharedLibraryPath(libPath)
+		}
+		if err := ort.InitializeEnvironment(); err != nil {
+			return nil, fmt.Errorf("silero: onnx runtime: %w", err)
+		}
+	}
+	s, err := ort.NewDynamicAdvancedSession(modelPath,
+		[]string{"input", "state", "sr"}, []string{"output", "stateN"}, nil)
+	if err != nil {
+		return nil, fmt.Errorf("silero: load %s: %w", modelPath, err)
+	}
+	return &sileroVAD{
+		session: s,
+		state:   make([]float32, 2*sileroStateDim),
+		sr:      []int64{16000},
+	}, nil
+}
+
+// Speech reports whether the frame carries speech, and the probability behind
+// that answer. A frame that completes no window inherits the previous
+// probability, so the caller sees one answer per frame either way.
+func (s *sileroVAD) Speech(frame []int16, threshold float64) (bool, float64) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	for _, v := range frame {
+		s.pending = append(s.pending, float32(v)/32768.0)
+	}
+	for len(s.pending) >= sileroWindow {
+		p, err := s.infer(s.pending[:sileroWindow])
+		if err != nil {
+			// A failed inference must not silence the microphone. Hold the
+			// last answer and let the next window try again.
+			break
+		}
+		s.last = p
+		s.pending = s.pending[sileroWindow:]
+	}
+	return s.last >= threshold, s.last
+}
+
+// infer runs one window and rolls the state and the context forward.
+func (s *sileroVAD) infer(window []float32) (float64, error) {
+	in := make([]float32, sileroContext+sileroWindow)
+	copy(in, s.context[:])
+	copy(in[sileroContext:], window)
+
+	inT, err := ort.NewTensor(ort.NewShape(1, int64(len(in))), in)
+	if err != nil {
+		return 0, err
+	}
+	defer inT.Destroy()
+	stT, err := ort.NewTensor(ort.NewShape(2, 1, sileroStateDim), s.state)
+	if err != nil {
+		return 0, err
+	}
+	defer stT.Destroy()
+	srT, err := ort.NewTensor(ort.NewShape(1), s.sr)
+	if err != nil {
+		return 0, err
+	}
+	defer srT.Destroy()
+
+	out, err := ort.NewEmptyTensor[float32](ort.NewShape(1, 1))
+	if err != nil {
+		return 0, err
+	}
+	defer out.Destroy()
+	next, err := ort.NewEmptyTensor[float32](ort.NewShape(2, 1, sileroStateDim))
+	if err != nil {
+		return 0, err
+	}
+	defer next.Destroy()
+
+	if err := s.session.Run(
+		[]ort.Value{inT, stT, srT},
+		[]ort.Value{out, next},
+	); err != nil {
+		return 0, err
+	}
+	copy(s.state, next.GetData())
+	copy(s.context[:], in[len(in)-sileroContext:])
+	return float64(out.GetData()[0]), nil
+}
+
+// Reset drops the streaming state. Called at every utterance boundary and
+// after barge-in, so echo-era history never scores the next sentence.
+func (s *sileroVAD) Reset() {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.pending = s.pending[:0]
+	s.context = [sileroContext]float32{}
+	for i := range s.state {
+		s.state[i] = 0
+	}
+	s.last = 0
+}
+
+// Close releases the session.
+func (s *sileroVAD) Close() error {
+	if s == nil || s.session == nil {
+		return nil
+	}
+	return s.session.Destroy()
+}

cmd/mavwaked/silero_test.go

@@ -0,0 +1,149 @@
+package main
+
+// What this measures. The energy threshold cannot tell a voice from a
+// television, and every utterance it accepts becomes a turn. So the test that
+// matters is not "does silero find speech" — it is "does it decline what the
+// energy threshold accepts".
+//
+// Speech is the four piper fixtures mavsttd already scores against. They are
+// synthesised, so nothing of the owner's voice is committed. Non-speech is
+// white noise at the same loudness, which is the cheapest thing that fools an
+// energy floor and the honest floor for this claim.
+//
+// Both halves skip without models/vad/silero_vad.onnx and MAVEN_ONNX_LIB,
+// like the TestONNX measurements in internal/router/eval.
+
+import (
+	"math"
+	"math/rand"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+const wavHeader = 44 // 16kHz mono s16le, written by piper
+
+func loadSilero(t *testing.T) *sileroVAD {
+	t.Helper()
+	model := filepath.Join("..", "..", "models", "vad", "silero_vad.onnx")
+	lib := os.Getenv("MAVEN_ONNX_LIB")
+	if _, err := os.Stat(model); err != nil {
+		t.Skipf("missing %s: %v", model, err)
+	}
+	if lib == "" {
+		t.Skip("MAVEN_ONNX_LIB unset")
+	}
+	s, err := newSileroVAD(model, lib)
+	if err != nil {
+		t.Skipf("silero unavailable: %v", err)
+	}
+	return s
+}
+
+// feedAll runs a whole clip through a VAD and reports how many utterances it
+// produced and how many frames it called speech.
+func feedAll(v *VAD, pcm []int16) (utterances, speechFrames int) {
+	for i := 0; i+frameSamples <= len(pcm); i += frameSamples {
+		frame := pcm[i : i+frameSamples]
+		utt, state := v.Feed(frame)
+		if state == StateSpeech {
+			speechFrames++
+		}
+		if utt.Bytes != nil {
+			utterances++
+		}
+	}
+	return utterances, speechFrames
+}
+
+func readFixture(t *testing.T, name string) []int16 {
+	t.Helper()
+	raw, err := os.ReadFile(filepath.Join("..", "mavsttd", "testdata", name))
+	if err != nil {
+		t.Skipf("missing fixture %s: %v", name, err)
+	}
+	if len(raw) <= wavHeader {
+		t.Fatalf("%s: %d bytes, no audio", name, len(raw))
+	}
+	return PCMToI16(raw[wavHeader:])
+}
+
+// noise returns white noise scaled to the same RMS as ref. Same loudness,
+// nothing said.
+func noise(ref []int16, seed int64) []int16 {
+	target := frameRMS(ref)
+	r := rand.New(rand.NewSource(seed))
+	out := make([]int16, len(ref))
+	for i := range out {
+		out[i] = int16(r.NormFloat64() * target * 32768.0)
+	}
+	return out
+}
+
+func TestSileroHearsSpeechAndDeclinesNoise(t *testing.T) {
+	s := loadSilero(t)
+	defer s.Close()
+
+	for _, name := range []string{"ru_fact.wav", "ru_query.wav", "ru_reminder.wav", "en_act.wav"} {
+		pcm := readFixture(t, name)
+
+		v := NewVAD(0, 0, 0, 0)
+		v.UseSilero(s, defaultSileroThreshold)
+		_, spoke := feedAll(v, pcm)
+		if spoke == 0 {
+			t.Errorf("%s: silero heard no speech in a spoken clip", name)
+		}
+
+		s.Reset()
+		v2 := NewVAD(0, 0, 0, 0)
+		v2.UseSilero(s, defaultSileroThreshold)
+		_, heard := feedAll(v2, noise(pcm, 7))
+
+		energy := NewVAD(0, 0, 0, 0)
+		_, energyHeard := feedAll(energy, noise(pcm, 7))
+
+		t.Logf("%s: speech frames — silero on speech %d, silero on noise %d, energy on noise %d",
+			name, spoke, heard, energyHeard)
+		if heard >= energyHeard {
+			t.Errorf("%s: silero called %d noise frames speech, energy called %d — no improvement",
+				name, heard, energyHeard)
+		}
+		s.Reset()
+	}
+}
+
+// BenchmarkSileroFrame answers the only performance question that matters
+// here: one 30ms frame must cost far less than 30ms on one core, or the
+// detector cannot run always-on beside everything else on that machine.
+func BenchmarkSileroFrame(b *testing.B) {
+	s := loadSilero(&testing.T{})
+	if s == nil {
+		b.Skip("silero unavailable")
+	}
+	defer s.Close()
+	frame := make([]int16, frameSamples)
+	for i := range frame {
+		frame[i] = int16(i%400 - 200)
+	}
+	for i := 0; i < b.N; i++ {
+		s.Speech(frame, defaultSileroThreshold)
+	}
+}
+
+// TestSileroRechunksAcrossFrames pins the reason this file exists. The capture
+// frame is 480 samples and the model window is 512, so a detector that ran one
+// inference per frame would be feeding the model a shape it does not accept.
+func TestSileroRechunksAcrossFrames(t *testing.T) {
+	s := loadSilero(t)
+	defer s.Close()
+
+	silence := make([]int16, frameSamples)
+	for i := 0; i < 20; i++ {
+		if _, p := s.Speech(silence, defaultSileroThreshold); math.IsNaN(p) {
+			t.Fatalf("frame %d: probability is NaN", i)
+		}
+	}
+	if len(s.pending) >= sileroWindow {
+		t.Errorf("pending grew to %d samples, so windows are not being consumed", len(s.pending))
+	}
+}

cmd/mavwaked/vad.go

@@ -68,6 +68,37 @@ type VAD struct {
 	// follows the room's ambient level. Initialised to minRMS; updated
 	// on each silence frame.
 	floorRMS float64
+
+	// speech is silero-vad, or nil. When it is set the energy floor decides
+	// nothing: the question becomes "is this speech" rather than "is this
+	// loud", and the noise floor is not even tracked. Everything after that
+	// answer — the speech hold, the silence hold, the length cap, the
+	// buffer — is the same state machine either way, which is why the
+	// detector goes here and not around this type.
+	speech    *sileroVAD
+	speechMin float64
+}
+
+// UseSilero swaps the energy threshold for the model. Passing nil is a
+// no-op, so a caller that could not load the graph keeps a working VAD.
+func (v *VAD) UseSilero(s *sileroVAD, threshold float64) {
+	if s == nil {
+		return
+	}
+	if threshold <= 0 {
+		threshold = defaultSileroThreshold
+	}
+	v.speech = s
+	v.speechMin = threshold
+}
+
+// isSpeech answers the one question the state machine asks of a frame.
+func (v *VAD) isSpeech(frame []int16, rms float64) bool {
+	if v.speech != nil {
+		ok, _ := v.speech.Speech(frame, v.speechMin)
+		return ok
+	}
+	return rms >= v.floorRMS
 }
 
 // NewVAD creates a VAD with the given thresholds. Zero values use defaults.
@@ -110,7 +141,7 @@ func (v *VAD) State() SpeechState { return v.state }
 // should send the audio to the voice server before feeding more frames.
 func (v *VAD) Feed(frame []int16) (_ audio.Audio, state SpeechState) {
 	rms := frameRMS(frame)
-	isSpeech := rms >= v.floorRMS
+	isSpeech := v.isSpeech(frame, rms)
 
 	switch v.state {
 	case StateSilence:
@@ -175,6 +206,9 @@ func (v *VAD) Feed(frame []int16) (_ audio.Audio, state SpeechState) {
 func (v *VAD) Reset() { v.reset() }
 
 func (v *VAD) reset() {
+	if v.speech != nil {
+		v.speech.Reset()
+	}
 	v.state = StateSilence
 	v.speechFrames = 0
 	v.silenceFrames = 0

cmd/mavwaked/wakefeatures.go

@@ -0,0 +1,202 @@
+package main
+
+// The three models behind the wake word (V-487 stage two).
+//
+// openWakeWord's pipeline, run in a row:
+//
+//	audio      -> melspectrogram.onnx -> 32-bin mel frames, one per 10ms
+//	76 frames  -> embedding_model.onnx -> one 96-dim embedding per 80ms
+//	16 embeds  -> maven_wakeword.onnx  -> one score
+//
+// The first two are frozen and pretrained. Only the last was trained here,
+// which is why it is 100KB and the other two are megabytes. The shapes are
+// not guesses: 2.0s of 16kHz audio measures 197 mel frames, and 76-frame
+// windows at stride 8 give exactly the 16 embeddings the head was fitted on.
+//
+// This file knows ONNX and nothing about the 80ms cadence. wakeword.go knows
+// the cadence and nothing about tensors.
+
+import (
+	"fmt"
+
+	ort "github.com/yalue/onnxruntime_go"
+)
+
+const (
+	// melHop — samples per mel frame. 10ms at 16kHz.
+	melHop = 160
+	// melBins — mel bins per frame, fixed by melspectrogram.onnx.
+	melBins = 32
+	// embedFrames — mel frames one embedding is computed over, 760ms.
+	embedFrames = 76
+	// embedStride — mel frames between embeddings, 80ms.
+	embedStride = 8
+	// embedDim — the embedding width.
+	embedDim = 96
+	// headWindow — embeddings the head scores at once, 1.28s of audio.
+	headWindow = 16
+
+	// melContext — samples of history prepended to each incremental mel
+	// call, chosen so the eight frames this call yields continue exactly
+	// where the previous call's eight stopped.
+	//
+	// melspectrogram.onnx returns N/160-3 frames for N samples, and frame i
+	// covers [i*160, i*160+400). With 480 samples of history the buffer is
+	// 1760 samples, which is 8 frames, and the oldest of them starts one hop
+	// after the newest of the previous call. Less history leaves a gap: the
+	// first frames of a bare chunk would be computed against silence.
+	melContext = 480
+
+	// chunkSamples — audio per embedding step, 80ms.
+	chunkSamples = embedStride * melHop
+)
+
+// wakeModels holds the three ONNX sessions. It runs on CPU threads beside
+// silero and never touches the GPU. That is a rule, not a result: a wake word
+// that waits on card admission is not a wake word.
+type wakeModels struct {
+	mel  *ort.DynamicAdvancedSession
+	emb  *ort.DynamicAdvancedSession
+	head *ort.DynamicAdvancedSession
+}
+
+// newWakeModels loads all three. melPath and embedPath are openWakeWord's
+// frozen feature models; headPath is the keyword head trained for "Мэйвен".
+func newWakeModels(melPath, embedPath, headPath, libPath string) (*wakeModels, error) {
+	if !ort.IsInitialized() {
+		if libPath != "" {
+			ort.SetSharedLibraryPath(libPath)
+		}
+		if err := ort.InitializeEnvironment(); err != nil {
+			return nil, fmt.Errorf("wake word: onnx runtime: %w", err)
+		}
+	}
+	// One thread per session, not the default of every core. Measured on
+	// workpc: the default took mavwaked from 68% of one core to 335% of
+	// three, for three graphs that each run in well under 80ms single
+	// threaded. An always-on gate that eats a quarter of the workstation is
+	// not a gate he will leave running.
+	opts, err := ort.NewSessionOptions()
+	if err != nil {
+		return nil, fmt.Errorf("wake word: session options: %w", err)
+	}
+	defer opts.Destroy()
+	if err := opts.SetIntraOpNumThreads(1); err != nil {
+		return nil, fmt.Errorf("wake word: intra-op threads: %w", err)
+	}
+	if err := opts.SetInterOpNumThreads(1); err != nil {
+		return nil, fmt.Errorf("wake word: inter-op threads: %w", err)
+	}
+	open := func(p string, in, out []string) (*ort.DynamicAdvancedSession, error) {
+		s, err := ort.NewDynamicAdvancedSession(p, in, out, opts)
+		if err != nil {
+			return nil, fmt.Errorf("wake word: load %s: %w", p, err)
+		}
+		return s, nil
+	}
+	m := &wakeModels{}
+	if m.mel, err = open(melPath, []string{"input"}, []string{"output"}); err != nil {
+		return nil, err
+	}
+	if m.emb, err = open(embedPath, []string{"input_1"}, []string{"conv2d_19"}); err != nil {
+		m.Close()
+		return nil, err
+	}
+	if m.head, err = open(headPath, []string{"embeddings"}, []string{"score"}); err != nil {
+		m.Close()
+		return nil, err
+	}
+	return m, nil
+}
+
+// Close releases the three sessions.
+func (m *wakeModels) Close() {
+	if m == nil {
+		return
+	}
+	for _, s := range []*ort.DynamicAdvancedSession{m.mel, m.emb, m.head} {
+		if s != nil {
+			s.Destroy()
+		}
+	}
+	m.mel, m.emb, m.head = nil, nil, nil
+}
+
+// melFrames runs one buffer of samples and returns the mel frames it yielded.
+func (m *wakeModels) melFrames(buf []float32) ([][melBins]float32, error) {
+	in, err := ort.NewTensor(ort.NewShape(1, int64(len(buf))), buf)
+	if err != nil {
+		return nil, err
+	}
+	defer in.Destroy()
+
+	n := int64(len(buf)/melHop - 3)
+	if n < 1 {
+		return nil, fmt.Errorf("wake word: %d samples yield no mel frames", len(buf))
+	}
+	out, err := ort.NewEmptyTensor[float32](ort.NewShape(1, 1, n, melBins))
+	if err != nil {
+		return nil, err
+	}
+	defer out.Destroy()
+
+	if err := m.mel.Run([]ort.Value{in}, []ort.Value{out}); err != nil {
+		return nil, err
+	}
+	data := out.GetData()
+	frames := make([][melBins]float32, n)
+	for i := range frames {
+		for j := 0; j < melBins; j++ {
+			// The scaling openWakeWord applies between the two feature
+			// models, and the head was fitted on its output.
+			frames[i][j] = data[i*melBins+j]/10.0 + 2.0
+		}
+	}
+	return frames, nil
+}
+
+// embedding runs embedFrames mel frames through the frozen embedder.
+func (m *wakeModels) embedding(mels [][melBins]float32) ([embedDim]float32, error) {
+	var e [embedDim]float32
+	flat := make([]float32, 0, embedFrames*melBins)
+	for _, f := range mels {
+		flat = append(flat, f[:]...)
+	}
+	in, err := ort.NewTensor(ort.NewShape(1, embedFrames, melBins, 1), flat)
+	if err != nil {
+		return e, err
+	}
+	defer in.Destroy()
+	out, err := ort.NewEmptyTensor[float32](ort.NewShape(1, 1, 1, embedDim))
+	if err != nil {
+		return e, err
+	}
+	defer out.Destroy()
+	if err := m.emb.Run([]ort.Value{in}, []ort.Value{out}); err != nil {
+		return e, err
+	}
+	copy(e[:], out.GetData())
+	return e, nil
+}
+
+// score runs the trained head over headWindow embeddings.
+func (m *wakeModels) score(embeds [][embedDim]float32) (float64, error) {
+	flat := make([]float32, 0, headWindow*embedDim)
+	for _, e := range embeds {
+		flat = append(flat, e[:]...)
+	}
+	in, err := ort.NewTensor(ort.NewShape(1, headWindow, embedDim), flat)
+	if err != nil {
+		return 0, err
+	}
+	defer in.Destroy()
+	out, err := ort.NewEmptyTensor[float32](ort.NewShape(1, 1))
+	if err != nil {
+		return 0, err
+	}
+	defer out.Destroy()
+	if err := m.head.Run([]ort.Value{in}, []ort.Value{out}); err != nil {
+		return 0, err
+	}
+	return float64(out.GetData()[0]), nil
+}

cmd/mavwaked/wakeword.go

@@ -0,0 +1,195 @@
+package main
+
+// The wake word, "Мэйвен" (V-487 stage two).
+//
+// Silero answers "is this frame speech". It does not answer "was this said to
+// her", and until this file existed nothing did: every utterance near the
+// microphone became a turn. What made that safe rather than expensive was
+// SurfaceVoice capping acts at L0, and L0 does not cap reading, so the room
+// could still hear his facts read back.
+//
+// This file owns the 80ms cadence and the three rings of state between the
+// models. wakefeatures.go owns the tensors.
+//
+// Nil is a working value, and it is the CLOSED gate rather than the open one.
+// Feed on a nil receiver reports no keyword; session.go asks separately
+// whether a gate exists at all. That split is deliberate: a nil that answers
+// "yes, keyword" reads as a working wake word in every log line it produces.
+
+import (
+	"log"
+	"sync"
+)
+
+// defaultWakeThreshold — score above which the keyword was said.
+//
+// Picked from the false-accept rate on held-out Russian speech, not from
+// accuracy: a miss costs him a repeat, a false accept costs a turn nobody
+// asked for. Over 65 minutes of Common Voice, 0.99 woke her three times and
+// 0.999 once, and the difference in recall was one render out of 126. So the
+// default is the strict one. `docs/evals/2026-08-09-wake-word.md` has both
+// tables.
+const defaultWakeThreshold = 0.999
+
+// wakeWord is the streaming state around wakeModels. It is fed the same
+// capture frames the VAD sees and answers whether the keyword has just been
+// spoken.
+type wakeWord struct {
+	mu sync.Mutex
+	m  *wakeModels
+
+	threshold float64
+
+	// pending holds captured samples not yet part of a full 80ms chunk, and
+	// history holds the melContext samples before them.
+	pending []float32
+	history []float32
+
+	// mels is the newest embedFrames mel frames, oldest first.
+	mels [][melBins]float32
+	// embeds is the newest headWindow embeddings, oldest first.
+	embeds [][embedDim]float32
+
+	last float64 // most recent score, held between chunks
+}
+
+// newWakeWord loads the models and wraps them in the streaming gate.
+func newWakeWord(melPath, embedPath, headPath, libPath string, threshold float64) (*wakeWord, error) {
+	m, err := newWakeModels(melPath, embedPath, headPath, libPath)
+	if err != nil {
+		return nil, err
+	}
+	if threshold <= 0 {
+		threshold = defaultWakeThreshold
+	}
+	return &wakeWord{m: m, threshold: threshold}, nil
+}
+
+// Close releases the models.
+func (w *wakeWord) Close() {
+	if w == nil {
+		return
+	}
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	w.m.Close()
+	w.m = nil
+}
+
+// Feed takes one capture frame and reports whether the keyword was heard on
+// it. A nil wakeWord hears nothing.
+func (w *wakeWord) Feed(frame []int16) bool {
+	if w == nil {
+		return false
+	}
+	w.mu.Lock()
+	defer w.mu.Unlock()
+
+	for _, v := range frame {
+		w.pending = append(w.pending, float32(v)/32768.0)
+	}
+	fired := false
+	for len(w.pending) >= chunkSamples {
+		chunk := w.pending[:chunkSamples]
+		if w.step(chunk) {
+			fired = true
+		}
+		w.history = append(w.history[:0], tailFloat32(append(w.history, chunk...), melContext)...)
+		// Slide the remainder to the front rather than reslicing. This runs
+		// every 80ms for as long as the daemon lives.
+		w.pending = append(w.pending[:0], w.pending[chunkSamples:]...)
+	}
+	return fired
+}
+
+// Reset drops the streaming state, so a fresh utterance is not judged on audio
+// from before it. Called after every dispatch and after barge-in, for the same
+// reason silero is: echo-era history must not score the next sentence, and her
+// own voice saying the keyword must not wake her.
+func (w *wakeWord) Reset() {
+	if w == nil {
+		return
+	}
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	w.pending, w.history = w.pending[:0], w.history[:0]
+	w.mels, w.embeds = nil, nil
+	w.last = 0
+}
+
+// Score returns the most recent score, for the operator to read out of the
+// journal when picking a threshold for his room.
+func (w *wakeWord) Score() float64 {
+	if w == nil {
+		return 0
+	}
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	return w.last
+}
+
+// step runs one 80ms chunk through all three models. It returns true when the
+// score crosses the threshold on this chunk.
+func (w *wakeWord) step(chunk []float32) bool {
+	buf := make([]float32, 0, melContext+len(chunk))
+	if pad := melContext - len(w.history); pad > 0 {
+		buf = append(buf, make([]float32, pad)...)
+	}
+	buf = append(buf, tailFloat32(w.history, melContext)...)
+	buf = append(buf, chunk...)
+
+	frames, err := w.m.melFrames(buf)
+	if err != nil {
+		// A failed inference must not silence the microphone. Hold the last
+		// score and let the next chunk try again.
+		log.Printf("mavwaked: wake word: mel: %v", err)
+		return false
+	}
+	w.mels = tailMel(append(w.mels, frames...), embedFrames)
+	if len(w.mels) < embedFrames {
+		return false
+	}
+	e, err := w.m.embedding(w.mels)
+	if err != nil {
+		log.Printf("mavwaked: wake word: embedding: %v", err)
+		return false
+	}
+	w.embeds = tailEmbed(append(w.embeds, e), headWindow)
+	if len(w.embeds) < headWindow {
+		return false
+	}
+	score, err := w.m.score(w.embeds)
+	if err != nil {
+		log.Printf("mavwaked: wake word: head: %v", err)
+		return false
+	}
+	// Report the crossing, not the state. A keyword held above the threshold
+	// for a second is one wake, and firing on every chunk of it would make the
+	// gate look open when it is merely slow to fall.
+	crossed := score >= w.threshold && w.last < w.threshold
+	w.last = score
+	return crossed
+}
+
+// The three rings. Each keeps the newest n entries and nothing older.
+
+func tailFloat32(s []float32, n int) []float32 {
+	if len(s) <= n {
+		return s
+	}
+	return s[len(s)-n:]
+}
+
+func tailMel(s [][melBins]float32, n int) [][melBins]float32 {
+	if len(s) <= n {
+		return s
+	}
+	return append(s[:0], s[len(s)-n:]...)
+}
+
+func tailEmbed(s [][embedDim]float32, n int) [][embedDim]float32 {
+	if len(s) <= n {
+		return s
+	}
+	return append(s[:0], s[len(s)-n:]...)
+}

cmd/mavwaked/wakeword_test.go

@@ -0,0 +1,174 @@
+package main
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+// fakeGate fires on demand instead of running three ONNX models. The gate's
+// own arithmetic is measured on real audio in docs/evals; what these tests
+// cover is the thing that decides whether an utterance is shipped.
+type fakeGate struct {
+	fireOn int // fire when this many frames have been fed, 0 never fires
+	fed    int
+	resets int
+}
+
+func (g *fakeGate) Feed(_ []int16) bool {
+	g.fed++
+	return g.fireOn > 0 && g.fed == g.fireOn
+}
+func (g *fakeGate) Reset()         { g.resets++ }
+func (g *fakeGate) Score() float64 { return 1 }
+
+// wakingSession wires a session whose gate fires on the first frame it sees.
+func wakingSession(fireOn int, window time.Duration) (*session, *fakePlayer, *fakeSender, *fakeGate) {
+	sess, p, snd := newTestSession(bargeInConfig{})
+	g := &fakeGate{fireOn: fireOn}
+	sess.UseWakeWord(g, window)
+	return sess, p, snd, g
+}
+
+func TestKeywordlessSpeechNeverReachesSTT(t *testing.T) {
+	sess, p, snd, g := wakingSession(0, 8*time.Second)
+	speakThenPause(t, sess)
+
+	if len(snd.sent) != 0 {
+		t.Fatalf("sent %d utterances, want 0 — this is the whole point of V-487", len(snd.sent))
+	}
+	if sess.ignored != 1 {
+		t.Errorf("ignored = %d, want 1", sess.ignored)
+	}
+	if p.plays != 0 {
+		t.Errorf("plays = %d, want 0", p.plays)
+	}
+	if g.fed == 0 {
+		t.Error("the gate was never fed a frame")
+	}
+}
+
+func TestKeywordOpensTheGate(t *testing.T) {
+	sess, p, snd, _ := wakingSession(1, 8*time.Second)
+	speakThenPause(t, sess)
+
+	if len(snd.sent) != 1 {
+		t.Fatalf("sent %d utterances, want 1", len(snd.sent))
+	}
+	if sess.wakes != 1 {
+		t.Errorf("wakes = %d, want 1", sess.wakes)
+	}
+	if sess.ignored != 0 {
+		t.Errorf("ignored = %d, want 0", sess.ignored)
+	}
+	if p.plays != 1 {
+		t.Errorf("plays = %d, want 1", p.plays)
+	}
+}
+
+// One keyword buys one turn. Without this the microphone stays open for as
+// long as he keeps talking, which is the state the gate exists to end.
+func TestOneKeywordBuysOneTurn(t *testing.T) {
+	sess, p, snd, _ := wakingSession(1, 8*time.Second)
+	speakThenPause(t, sess)
+	p.Stop()         // she finished her reply
+	sess.discard = 0 // the backlog drain is not what this measures
+	speakThenPause(t, sess)
+
+	if len(snd.sent) != 1 {
+		t.Fatalf("sent %d utterances, want 1: the second had no keyword", len(snd.sent))
+	}
+	if sess.ignored != 1 {
+		t.Errorf("ignored = %d, want 1", sess.ignored)
+	}
+}
+
+// The keyword is heard, then he says nothing for longer than the window. What
+// he says after that is not addressed to her.
+func TestTheKeywordExpires(t *testing.T) {
+	sess, _, snd, _ := wakingSession(1, 500*time.Millisecond)
+	now := time.Unix(1750000000, 0)
+	sess.now = func() time.Time { return now }
+
+	if err := sess.feed(context.Background(), silentBytes()); err != nil {
+		t.Fatalf("feed: %v", err)
+	}
+	if sess.wakes != 1 {
+		t.Fatalf("wakes = %d, want 1", sess.wakes)
+	}
+	now = now.Add(2 * time.Second)
+	speakThenPause(t, sess)
+
+	if len(snd.sent) != 0 {
+		t.Fatalf("sent %d utterances, want 0 — the keyword had expired", len(snd.sent))
+	}
+}
+
+// Barge-in cuts her off whether or not the keyword was heard. What he says
+// after cutting her off still has to carry it.
+func TestBargeInStillInterruptsHer(t *testing.T) {
+	sess, p, _, g := wakingSession(0, 8*time.Second)
+	sess.barge = bargeInConfig{RMS: 0.2, Frames: 3}
+	p.playing = true
+	loud := frameAt(0.35)
+	for i := 0; i < 4; i++ {
+		if err := sess.feed(context.Background(), loud); err != nil {
+			t.Fatalf("feed %d: %v", i, err)
+		}
+	}
+	if sess.bargeIns != 1 {
+		t.Fatalf("bargeIns = %d, want 1", sess.bargeIns)
+	}
+	if p.stops != 1 {
+		t.Errorf("stops = %d, want 1", p.stops)
+	}
+	if g.resets == 0 {
+		t.Error("barge-in left pre-playback audio in the gate")
+	}
+}
+
+// Her own reply must not wake her. Frames captured while the player runs never
+// reach the gate, and the gate is cleared when playback ends.
+func TestHerOwnVoiceNeverReachesTheGate(t *testing.T) {
+	sess, p, _, g := wakingSession(1, 8*time.Second)
+	p.playing = true
+	for i := 0; i < 10; i++ {
+		if err := sess.feed(context.Background(), frameAt(0.35)); err != nil {
+			t.Fatalf("feed: %v", err)
+		}
+	}
+	if g.fed != 0 {
+		t.Fatalf("gate was fed %d frames while she was speaking, want 0", g.fed)
+	}
+	if sess.wakes != 0 {
+		t.Errorf("wakes = %d, want 0", sess.wakes)
+	}
+}
+
+// No model, no gate: the daemon behaves exactly as it did before V-487 stage
+// two. An operator with a missing file gets yesterday's mavwaked, not one that
+// refuses to hear anything.
+func TestNoGateShipsEveryUtterance(t *testing.T) {
+	sess, _, snd := newTestSession(bargeInConfig{})
+	speakThenPause(t, sess)
+
+	if len(snd.sent) != 1 {
+		t.Fatalf("sent %d utterances, want 1", len(snd.sent))
+	}
+	if sess.ignored != 0 {
+		t.Errorf("ignored = %d, want 0", sess.ignored)
+	}
+}
+
+// A nil *wakeWord is the closed gate, not a crash and not an open one.
+func TestNilWakeWordHearsNothing(t *testing.T) {
+	var w *wakeWord
+	if w.Feed([]int16{0, 0, 0}) {
+		t.Error("a nil wake word reported the keyword")
+	}
+	if w.Score() != 0 {
+		t.Error("a nil wake word reported a score")
+	}
+	w.Reset()
+	w.Close()
+}

cmd/mavweb/chat.go

@@ -0,0 +1,195 @@
+package main
+
+import (
+	_ "embed"
+	"errors"
+	"log"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/webauthn"
+)
+
+//go:embed chat.html
+var chatPageHTML string
+
+// chatTmpl — plain text conversation interface. No JS: form POSTs to /api/chat
+// and the handler redirects back to /chat with the response.
+var chatTmpl = parsePage("chat", chatPageHTML, nil)
+
+// chatMsg — one message in the conversation history.
+type chatMsg struct {
+	Role string // "user" | "assistant"
+	Text string
+	// Source — the query source that claimed the turn, shown as a badge beside
+	// the reply. Empty for a turn no source claimed (V-539).
+	Source string
+	// TraceID anchors the correction gesture (V-630). Non-zero ⇒ the turn was
+	// persisted and can be corrected in one click. 0 ⇒ no correction is offered,
+	// which is honest: a box with no database has no turn to correct.
+	TraceID int64
+	// Corrected — the owner already corrected this turn, so the page says thank
+	// you instead of offering the buttons again.
+	Corrected string
+}
+
+// correctionTargets — the seven public intents, in the order the buttons are
+// shown. Read from internal/router rather than typed out, so a new intent cannot
+// exist without a way to correct a turn into it.
+var correctionTargets = []router.Intent{
+	router.IntentFact, router.IntentNote, router.IntentReminder,
+	router.IntentQuery, router.IntentAct, router.IntentChat, router.IntentSystem,
+}
+
+// handleChatPage renders the chat conversation page.
+func handleChatPage(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
+	if !requireCore(w, core, "chat") {
+		return
+	}
+	msgs := []chatMsg{}
+	// Read user message + reply from query params (set by /api/chat redirect).
+	if q := r.URL.Query().Get("q"); q != "" {
+		msgs = append(msgs, chatMsg{Role: "user", Text: q})
+	}
+	if reply := r.URL.Query().Get("r"); reply != "" {
+		id, _ := strconv.ParseInt(r.URL.Query().Get("t"), 10, 64)
+		msgs = append(msgs, chatMsg{
+			Role: "assistant", Text: reply, Source: r.URL.Query().Get("s"),
+			TraceID: id, Corrected: r.URL.Query().Get("c"),
+		})
+	}
+	// UserText rides beside the messages so the correction form can hand the
+	// conversation back on the redirect: this page has no session and no JS, so
+	// what is on screen is what the query params carry.
+	renderPage(w, chatTmpl, struct {
+		Error    string
+		Messages []chatMsg
+		Targets  []router.Intent
+		UserText string
+	}{Messages: msgs, Targets: correctionTargets, UserText: r.URL.Query().Get("q")})
+}
+
+// handleChatAPI processes a chat message POST and redirects back to /chat.
+//
+// State-changing, and the widest surface on this server: the text reaches the
+// router, the LLM, and through mavend's applyAction the whole action path
+// including `act` — so it is gated on the same step-up as POST /tools and
+// POST /api/revert (Vikunja #317). With WebAuthn unconfigured the gate is
+// fail-open exactly like the others (see stepUpOK); with -require-stepup it
+// denies, which is the point of that flag.
+func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		return
+	}
+	if !requireCore(w, core, "chat") {
+		return
+	}
+	if !stepUpGate(w, session, requireStepUp) {
+		return
+	}
+	text := strings.TrimSpace(r.FormValue("text"))
+	if text == "" {
+		http.Redirect(w, r, "/chat", http.StatusSeeOther)
+		return
+	}
+	// One conversation id for the whole web chat, and a different one from
+	// telegram or the mic. A parked question belongs to the reach that was
+	// asked; before this, a clarify nobody answered on the web ate the next
+	// utterance spoken at the mic (Vikunja #466). This server has no
+	// per-browser session, so every browser tab is the same conversation —
+	// which is right for a single-owner box.
+	reply, err := core.Chat(r.Context(), "web", text)
+	if err != nil {
+		log.Printf("chat api: %v", err)
+		http.Redirect(w, r, "/chat", http.StatusSeeOther)
+		return
+	}
+	// The claiming query source rides back on the redirect so the page can show
+	// it. Empty for a turn no source claimed, which is most of them.
+	dest := "/chat?q=" + url.QueryEscape(text) + "&r=" + url.QueryEscape(reply.Reply)
+	if reply.Source != "" {
+		dest += "&s=" + url.QueryEscape(reply.Source)
+	}
+	// The trace id rides along so the reply can carry a correction gesture
+	// (V-630). Absent when nothing persisted, and the page then offers none.
+	if reply.TraceID != 0 {
+		dest += "&t=" + strconv.FormatInt(reply.TraceID, 10)
+	}
+	http.Redirect(w, r, dest, http.StatusSeeOther)
+}
+
+// handleCorrectAPI records that the last turn was routed wrongly (V-630).
+//
+// A correction is the only supervised signal this box gets, and everything else
+// in the trace accumulates on its own. So the gesture has to cost nothing: one
+// POST from the reply he is already looking at, carrying the trace id and
+// optionally the intent it should have been. An unstated target is accepted,
+// because a turn marked wrong with no target is still a usable negative.
+//
+// Step-up gated like POST /api/chat, and that costs the gesture nothing: he
+// tapped to send the turn he is now correcting, so the session is already up.
+// It is gated because trace ids are sequential integers and this writes the one
+// table the routing heads (V-546) will be fitted on. A caller who can guess an
+// id could otherwise mislabel turns he never corrected.
+func handleCorrectAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		return
+	}
+	if !requireCore(w, core, "correct") {
+		return
+	}
+	if !stepUpGate(w, session, requireStepUp) {
+		return
+	}
+	id, err := strconv.ParseInt(strings.TrimSpace(r.FormValue("trace_id")), 10, 64)
+	if err != nil || id <= 0 {
+		http.Error(w, "trace_id required", http.StatusBadRequest)
+		return
+	}
+	shouldBe := strings.TrimSpace(r.FormValue("should_be"))
+	// Only one of the seven, or nothing. Free text here would put an unroutable
+	// label in the one table V-632 fits prototypes from.
+	if shouldBe != "" && !isCorrectionTarget(shouldBe) {
+		http.Error(w, "should_be must be one of the seven intents", http.StatusBadRequest)
+		return
+	}
+	if err := core.CorrectTurn(r.Context(), id, shouldBe); err != nil {
+		log.Printf("correct turn %d: %v", id, err)
+		// A turn past the retention bound is gone, and saying so is different
+		// from saying the write broke.
+		if errors.Is(err, ipc.ErrNoSuchTrace) {
+			http.Error(w, "that turn is no longer stored", http.StatusNotFound)
+			return
+		}
+		http.Error(w, "correction failed", http.StatusBadGateway)
+		return
+	}
+	stamp := shouldBe
+	if stamp == "" {
+		stamp = "wrong"
+	}
+	// Back to the conversation he was in, with the turn still on screen. The
+	// query params carry it, so the correction is preserved by re-sending them.
+	dest := "/chat?q=" + url.QueryEscape(r.FormValue("q")) +
+		"&r=" + url.QueryEscape(r.FormValue("rep")) + "&c=" + url.QueryEscape(stamp)
+	if s := r.FormValue("s"); s != "" {
+		dest += "&s=" + url.QueryEscape(s)
+	}
+	http.Redirect(w, r, dest, http.StatusSeeOther)
+}
+
+// isCorrectionTarget — one of the seven, and nothing else.
+func isCorrectionTarget(s string) bool {
+	for _, t := range correctionTargets {
+		if string(t) == s {
+			return true
+		}
+	}
+	return false
+}