Record the week of usage that found V-654 and its siblings (V-654)

Two untracked files left in the tree by the audit session. They are the evidence behind V-654 and several sibling tasks, so they belong on master rather than inside the PR that fixes one of them. Dated eval files under docs/evals/, so they are never edited after the day.
Run one test and audit the repo without retyping either (V-653)
2026-08-07 11:59:40 +04:00 · 2026-08-07 03:13:08 +04:00 · 2026-08-07 00:50:34 +02:00 · 2026-08-07 02:16:18 +04:00 · 2026-08-07 00:09:50 +02:00 · 2026-08-07 01:48:19 +04:00
140 changed files with 9019 additions and 387 deletions
@@ -53,21 +53,32 @@ CGO daemons (`mavend`, `mavsttd`, `mavttsd`, `mavenclient`) need the vendored to
 and libs wired through the Makefile — **do not** call `go build` on them bare, use `make`:

 ```sh
-make build          # all 9 binaries
+make build          # all 11 binaries
 make build-web      # single daemon (pure-Go ones: web/waked/poll/caldav build without CGO)
 make test           # go test -race across ./internal/... ./cmd/... with CGO env set
 ```

-Run a single test (must carry the CGO env for packages that touch STT/TTS/voice):
+Run one package or one test with `make t`. **Do not hand-write the CGO preamble.**
+Past sessions pasted it about 390 times. That is where the shell-quoting failures
+came from. This box runs zsh, so an unquoted `-run Test*` or `--include=*.go`
+dies on "no matches found" before `go` is ever reached.

 ```sh
-CGO_CFLAGS="-I$(pwd)/deps/include -I$(pwd)/deps/whisper.cpp/ggml/include" \
-CGO_LDFLAGS="-L$(pwd)/deps/lib -Wl,-rpath,$(pwd)/deps/lib" \
-LD_LIBRARY_PATH="$(pwd)/deps/lib" \
-deps/go/go/bin/go test -run TestName ./internal/router/
+make t PKG=./internal/router/
+make t PKG=./cmd/mavend/ RUN=TestSimulator
+make t PKG=./internal/router/eval/ RUN='TestONNX' V=1   # V=1 for -v, RACE=0 to drop -race
 ```

-Pure-Go packages (`router`, `memory`, `mavweb`, …) run under a plain `go test ./pkg/`.
+`t` carries `-race`, so a green `make t` cannot turn red under `make test`. It carries
+`-count=1`, so a cached PASS from before your edit is never mistaken for a result.
+
+It also sets `MAVEN_ONNX_LIB`, which the hand-written recipe did not. The four
+`TestONNX*` measurements self-skip when that variable is unset. The run still prints
+`ok`. So every targeted eval done the old way reported the hash ratchet while reading
+as a real embedder score.
+
+Pure-Go packages (`router`, `memory`, `mavweb`, …) also run under a plain `go test ./pkg/`,
+but `make t` works everywhere and is one thing to remember.

 ## The daemons (`cmd/`)

@@ -82,13 +93,37 @@ Pure-Go packages (`router`, `memory`, `mavweb`, …) run under a plain `go test
 | `mavpoll` | Environment poller: netdata alarms, uptime-kuma, zenmoney, wireguard presence. Writes facts, sends nothing. Telegram is `internal/delivery/telegramsink`, not this. |
 | `mavcaldav` | CalDAV calendar sync. |
 | `mavmaild` | Mail reader (IMAP, read-only). Holds the IMAP password; core never sees it. |
+| `mavgpud` | GPU supervisor. **Runs on workpc, not homesrv** — own unit, `deploy/mavgpud.service`. Keeps llama-server loaded while the card is free (V-488). Maven never asks it for anything, it reads `/health` through `llm.Pair`. |
+| `mavupdate` | Not a daemon. Operator CLI a human runs on the box to deploy a new build. |
+
+Two more binaries have no Makefile target and are built with `go run` or `go build` when
+they are needed. Neither is deployed.
+
+| Binary | Role |
+|---|---|
+| `mavseal` | Recovery tool. Encrypts a live tmpfs working copy back to the ciphertext file when mavend was killed before `defer st.Close()` sealed it. |
+| `labelgen` | Runs the stage 0 grammars over utterances and prints JSONL, the training data for the routing heads (V-546). |

 Daemons are wired socket-to-socket, not linked. `internal/ipc` is the client/server wire
 protocol; the config in `deploy/mavend.json` (with `${VAR}` env expansion from gitignored
 `deploy/telegram.env`) sets socket paths, model paths, and the phraser/embedder blocks.

-**Seven of the nine run on homesrv. `mavwaked` and `mavenclient` do not, and that is the
-decision, not an oversight** (Vikunja #463, `docs/plans/17-where-the-voice-loop-runs.md`).
+**`docker-compose.yml` runs five: `mavend`, `mavsttd`, `mavttsd`, `mavweb`, `mavpoll`.**
+Count against compose, not against the table. Four of the nine daemons are absent, and each
+absence has a different reason.
+
+`mavmaild` and `mavcaldav` are commented out in compose, each with the reason written
+beside it: the first needs a mail account, the second a CalDAV account, and this box has
+neither. `mavcaldav` used to appear nowhere at all, which was an oversight; it became a
+recorded decision on 07-08-2026 (V-644). Two things ride on that absence and the block
+names them. Agenda questions route to `IntentQuery` at stage 0 (V-498) and the `calendar`
+query source then reads a table nobody writes. And `loop.State.CalendarBusy` is fed by the
+same facts, so the gate's "do not nag mid-meeting" is permanently false. Its password is
+read from a file (`-pass-file`, and `-render-pass-file` for the render collection), never
+taken as a flag value, which is the rule `mavpoll` and `mavmaild` follow too.
+
+**`mavwaked` and `mavenclient` are absent by decision, not oversight** (Vikunja #463,
+`docs/plans/17-where-the-voice-loop-runs.md`).
 homesrv has a microphone — it is a laptop — but it is in the wrong room, so a wake-word
 daemon there listens to nobody. They belong on a client machine where the owner is standing.

@@ -285,8 +320,40 @@ site cannot change a route and a context with no record costs nothing. It is
 installed in `runTurn`, so the mic, telegram and the web all leave the same
 trail. Storage is a 25-turn in-memory ring on the handler (`decision.Ring`),
 read over `ipc.TurnDecisions` and rendered as the second table on `/trace`.
-Nothing persists: a turn record is read minutes later or never, and his words do
-not belong in a table that outlives the diagnosis. Adding a rung to the ladder
+**It also persists, since 06-08-2026, and that reverses what this section used to
+say** (V-629, `docs/plans/21-persisting-the-routing-trace.md`). The old rule was
+that nothing persists, because a turn record is read minutes later or never. The
+owner reversed it: the routing heads (V-546) cannot be fitted or calibrated
+without real utterances, and 9 of the 31 modes in `internal/modes` have no seed
+example at all. The ring did not move. It is still what `/trace` reads and still
+what a test with no store gets. `cmd/mavend/routingtrace.go` is a second sink
+beside it, writing `routing_traces` (migration #23). The utterance is stored in
+clear, because a 384-dimension vector of a short sentence is substantially
+recoverable and storing vectors instead would be a privacy claim we cannot
+support. What makes it safe is the same thing that makes the fact store safe.
+Retention is 14 days, enforced on write and again on start, so a box that goes
+quiet does not keep every row. Nothing reads it outward, and the rule
+that his notes and facts are never search input covers this table. `Store.Wipe`
+deletes it with everything else. A correction (V-630) is promoted out into a
+seed-shaped row in `routing_labels` (migration #24) and kept, because a label is
+not a transcript. The transcript still expires. The gesture that writes one is
+two buttons beside the reply on `/chat`, reached over `ipc.CorrectTurn` and the
+trace id that now rides back on `ipc.ChatReply`. A turn marked wrong with no
+target is a usable negative, so naming the intent is never required. The target
+is one of the seven intents and never free text. **All three reaches offer it as
+of 06-08-2026**, and this section used to say only `/chat` did. Voice is the
+`repair` rung, which has read spoken corrections since V-455 and now writes the
+durable label beside the classifier seed it always wrote; a spoken negative with
+no target is its own rung, `repair-negative` (V-636, `docs/plans/22-correcting-a-turn.md`).
+Telegram is an inline keyboard under the reply, and it needed the chat to become
+readable first — **telegram is no longer outbound only** (V-637,
+`docs/plans/23-inbound-telegram.md`). The poller is dark unless the `telegram`
+block says `intake`, it long-polls because the box takes no inbound connections,
+it accepts `chat_id` and no other sender, and it drops whatever queued while the
+daemon was down. It reaches the daemon through `ipc.CoreAPI` alone, so a chat
+turn takes the path `POST /api/chat` takes. Note that the turn source is still
+`tap:text` for both, so provenance cannot tell a chat turn from a typed one.
+Adding a rung to the ladder
 in `runTurn` means adding its name to `preRouteLadder` in
 `cmd/mavend/decisiontrace.go`, or that rung is silently missing from the record.

@@ -404,8 +471,11 @@ start of a session rather than one lookup per first use:
 ToolSearch("select:mcp__vikunja__list_tasks,mcp__vikunja__get_task_details,mcp__vikunja__create_task,mcp__vikunja__update_task")
 ```

-`update_task` carrying a `description` resets `done` to false, so closing a task with a
-write-up takes two calls: the description, then `done: true`.
+**Close a finished task with `done: true` and nothing else** (owner's call, 07-08-2026).
+Do not write a completion summary into the description on the way out. It is lost anyway,
+and the durable record is the commit messages and the merged PR. Note that `update_task`
+carrying a `description` resets `done` to false, which is why a write-up ever took two
+calls.

 ## Session workflow

@@ -16,7 +16,7 @@ PIPER_BIN     := $(shell pwd)/deps/piper/piper
 PIPER_MODEL   := $(shell pwd)/models/tts/ru_RU-irina-medium.onnx
 PIPER_ESPEAK  := $(shell pwd)/deps/piper/espeak-ng-data

-.PHONY: simulate stt-fixtures test-stt-golden all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel tidy eval-router eval-reach eval-recall eval-phrasing eval-models build-gpud
+.PHONY: t audit simulate stt-fixtures test-stt-golden all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel tidy eval-router eval-reach eval-recall eval-phrasing eval-models build-gpud

 all: build

@@ -128,6 +128,35 @@ test: fmt-check vet
 	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
 		$(GO) test -race -coverprofile=coverage.out ./internal/... ./cmd/...

+# t — run ONE package or ONE test with the toolchain env already wired. This is
+# the iteration target; `test` is the gate. Reach for it instead of pasting the
+# CGO_CFLAGS/CGO_LDFLAGS/LD_LIBRARY_PATH preamble by hand, which is how it was
+# done ~390 times across past sessions and is where the shell-quoting failures
+# came from -- the interactive shell here is zsh, and an unquoted `-run Test*`
+# or `--include=*.go` dies on "no matches found" before go ever starts.
+#
+#   make t                                     # whole tree (same scope as `test`)
+#   make t PKG=./internal/router/
+#   make t PKG=./cmd/mavend/ RUN=TestSimulator
+#   make t PKG=./internal/router/eval/ RUN='TestONNX' V=1
+#   make t PKG=./internal/store/ RACE=0        # drop -race when iterating hot
+#
+# -race is on by default so a green `make t` cannot turn red under `make test`.
+# -count=1 because a cached PASS from before your edit is worse than no answer.
+# MAVEN_ONNX_LIB is set for the same reason: the four TestONNX* measurements
+# self-skip when it is unset, so a targeted eval run would otherwise report the
+# deterministic hash ratchet and look like it scored the real embedder.
+PKG  ?= ./internal/... ./cmd/...
+RUN  ?=
+V    ?=
+RACE ?= 1
+
+t:
+	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
+	MAVEN_ONNX_LIB="$(MAVEN_ONNX_LIB)" \
+		$(GO) test $(if $(V),-v,) $(if $(filter-out 0,$(RACE)),-race,) -count=1 \
+		$(if $(RUN),-run '$(RUN)',) $(PKG)
+
 # eval-router — score the held-out RU routing fixture (internal/router/eval).
 # Verbose so the report tables land in the terminal. MAVEN_ONNX_LIB points the
 # prod-representative baseline at the vendored runtime; override it or set it
@@ -189,6 +218,16 @@ eval-models:
 # scores the fixtures against ggml-small and self-skips when the model is
 # absent, and TestGoldenFixturesAreCanonical, which checks the committed audio
 # and the manifest with no model at all.
+# audit — the repo inventory: LOC per package, open TODOs, real stubs, living-doc
+# staleness, test shape, packages with no test. Read-only, prints, writes nothing.
+# Run it instead of rebuilding the same greps by hand; past sessions spent 93 of
+# them on this before their first edit. SECTION=loc|todo|stubs|docs|tests|gaps
+# narrows it.
+SECTION ?= all
+
+audit:
+	@SECTION="$(SECTION)" ./scripts/audit.sh
+
 stt-fixtures:
 	./scripts/gen-stt-fixtures.sh

@@ -0,0 +1,113 @@
+// Command labelgen labels utterances with the stage 0 grammars and prints JSONL.
+//
+// docs/plans/18-routing-heads-on-e5-small.md calls the labeled set the whole
+// project, and it names the stage 0 grammars as the high-precision label
+// functions to start from. This runs them — the real ones, in the real
+// buildRouter order — rather than a reimplementation, so a rule change moves
+// the training data with it.
+//
+// A grammar that declines leaves the line unlabeled. Those go to the model, and
+// keeping them is the point: a set labeled only by the rules teaches only the
+// rules.
+//
+//	go run ./cmd/labelgen < utterances.txt > labeled.jsonl
+//
+// The wakeword-act grammar is absent, because its allowlist is the deployment's
+// enabled tool names and this tool has no deployment. Every other rule is here.
+package main
+
+import (
+	"bufio"
+	"encoding/json"
+	"fmt"
+	"os"
+	"strings"
+
+	"github.com/kami/maven/internal/router"
+)
+
+// label is one output row. The grammar name rides along so a reviewer can see
+// which rule made the claim, and so a rule that turns out to be wrong can have
+// its rows pulled without re-running everything.
+type label struct {
+	Utterance string `json:"utterance"`
+	Intent    string `json:"intent,omitempty"`
+	Grammar   string `json:"grammar,omitempty"`
+	Key       string `json:"key,omitempty"`
+	Value     string `json:"value,omitempty"`
+	Fn        string `json:"fn,omitempty"`
+	Text      string `json:"text,omitempty"`
+	Labeled   bool   `json:"labeled"`
+}
+
+// grammars mirrors buildRouter's order in cmd/mavend/voicewire.go. Order is
+// load-bearing there and so it is here: the agenda rules must sit after the
+// clock rules, Praxis before the capture marker, the narrative rules last.
+func grammars() []router.Grammar {
+	var g []router.Grammar
+	g = append(g, router.SystemTimeDateGrammars()...)
+	g = append(g, router.AgendaQueryGrammars()...)
+	g = append(g, router.FeedQueryGrammar())
+	g = append(g, router.TaskListGrammar())
+	g = append(g, router.ListGrammars()...)
+	g = append(g, router.ReminderGrammar())
+	g = append(g, router.PraxisGrammars()...)
+	g = append(g, router.TaskCaptureGrammar())
+	g = append(g, router.NarrativeQueryGrammars()...)
+	return g
+}
+
+func match(gs []router.Grammar, utterance string) label {
+	out := label{Utterance: utterance}
+	for _, g := range gs {
+		m := g.Pattern.FindStringSubmatch(utterance)
+		if m == nil {
+			continue
+		}
+		d, ok := g.Build(m)
+		if !ok {
+			continue // the rule saw its shape and declined it
+		}
+		out.Intent = string(d.Intent)
+		out.Grammar = g.Name
+		out.Key = d.Slots.Key
+		out.Value = d.Slots.Value
+		out.Fn = d.Slots.Fn
+		out.Text = d.Slots.Text
+		out.Labeled = true
+		return out
+	}
+	return out
+}
+
+func main() {
+	gs := grammars()
+	in := bufio.NewScanner(os.Stdin)
+	in.Buffer(make([]byte, 0, 64*1024), 1024*1024)
+	out := bufio.NewWriter(os.Stdout)
+	defer out.Flush()
+
+	enc := json.NewEncoder(out)
+	var seen, labeled int
+	for in.Scan() {
+		line := strings.TrimSpace(in.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+		seen++
+		l := match(gs, line)
+		if l.Labeled {
+			labeled++
+		}
+		if err := enc.Encode(l); err != nil {
+			fmt.Fprintln(os.Stderr, "labelgen:", err)
+			os.Exit(1)
+		}
+	}
+	if err := in.Err(); err != nil {
+		fmt.Fprintln(os.Stderr, "labelgen:", err)
+		os.Exit(1)
+	}
+	// Coverage on stderr, so the count is visible without polluting the JSONL.
+	fmt.Fprintf(os.Stderr, "labelgen: %d/%d labeled by %d grammars\n", labeled, seen, len(gs))
+}
@@ -50,10 +50,10 @@ func run(args []string) error {
 	socket := fs.String("socket", "", "core IPC socket path (required)")
 	url := fs.String("url", "", "CalDAV calendar URL, e.g. http://localhost:5232/kami/personal (required)")
 	user := fs.String("user", "", "CalDAV basic-auth username (required)")
-	pass := fs.String("pass", "", "CalDAV basic-auth password (required)")
+	passFile := fs.String("pass-file", "", "file holding the CalDAV basic-auth password (required — never passed as a flag value)")
 	renderURL := fs.String("render-url", "", "CalDAV collection maven publishes her own reminders to; empty disables rendering")
 	renderUser := fs.String("render-user", "", "basic-auth username for -render-url (defaults to -user)")
-	renderPass := fs.String("render-pass", "", "basic-auth password for -render-url (defaults to -pass)")
+	renderPassFile := fs.String("render-pass-file", "", "file holding the password for -render-url (defaults to -pass-file)")
 	renderDur := fs.Duration("render-duration", calendar.DefaultReminderDuration, "how long a rendered reminder occupies")
 	interval := fs.Duration("interval", 5*time.Minute, "poll cadence")
 	timeout := fs.Duration("timeout", 10*time.Second, "per-request HTTP timeout")
@@ -63,13 +63,22 @@ func run(args []string) error {
 	if *socket == "" {
 		return fmt.Errorf("-socket is required")
 	}
-	if *url == "" || *user == "" || *pass == "" {
-		return fmt.Errorf("-url, -user, -pass are required")
+	if *url == "" || *user == "" || *passFile == "" {
+		return fmt.Errorf("-url, -user, -pass-file are required")
 	}
 	if err := checkRenderTarget([]string{*url}, *renderURL); err != nil {
 		return err
 	}

+	// The password is read from a file, never taken as a flag value: an argv
+	// secret is visible in `ps` to every user on the box and lands in the compose
+	// file and the shell history. Same rule mavmaild and mavpoll follow. Read
+	// once at start, so a rotated password means a restart.
+	pass, err := readSecret(*passFile)
+	if err != nil {
+		return err
+	}
+
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()

@@ -85,17 +94,20 @@ func run(args []string) error {
 		http: hc,
 		url:  strings.TrimRight(*url, "/"),
 		user: *user,
-		pass: *pass,
+		pass: pass,
 	}

 	var rend *renderer
 	if *renderURL != "" {
-		ru, rp := *renderUser, *renderPass
+		ru, rp := *renderUser, pass
 		if ru == "" {
 			ru = *user
 		}
-		if rp == "" {
-			rp = *pass
+		if *renderPassFile != "" {
+			rp, err = readSecret(*renderPassFile)
+			if err != nil {
+				return err
+			}
 		}
 		rend = newRenderer(core, hc, *renderURL, ru, rp, *renderDur)
 		log.Printf("mavcaldav: rendering reminders to %s", *renderURL)
@@ -131,6 +143,21 @@ func run(args []string) error {
 // It takes the whole read set, not one URL. The guarantee in the package
 // comment is about every calendar maven reads, and a second read target added
 // later must not quietly fall outside the check.
+// readSecret reads one credential from a file and refuses an empty one. An
+// empty file is a deployment mistake, not a password, and CalDAV basic auth
+// would send it and get a 401 every poll.
+func readSecret(path string) (string, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("read password file: %w", err)
+	}
+	secret := strings.TrimSpace(string(raw))
+	if secret == "" {
+		return "", fmt.Errorf("password file %s is empty", path)
+	}
+	return secret, nil
+}
+
 func checkRenderTarget(readURLs []string, renderURL string) error {
 	if renderURL == "" {
 		return nil
@@ -5,12 +5,38 @@ import (
 	"fmt"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
 	"testing"
 	"time"

 	"github.com/kami/maven/internal/ipc"
 )

+// The password comes from a file so it never reaches argv. An empty or missing
+// file must fail at start rather than authenticate as "" against his calendar.
+func TestReadSecret(t *testing.T) {
+	dir := t.TempDir()
+	good := filepath.Join(dir, "ok")
+	if err := os.WriteFile(good, []byte("  hunter2\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if got, err := readSecret(good); err != nil || got != "hunter2" {
+		t.Fatalf("readSecret(good) = %q, %v; want \"hunter2\", nil", got, err)
+	}
+
+	empty := filepath.Join(dir, "empty")
+	if err := os.WriteFile(empty, []byte("\n \n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readSecret(empty); err == nil {
+		t.Fatal("readSecret(empty) = nil error, want refusal")
+	}
+	if _, err := readSecret(filepath.Join(dir, "absent")); err == nil {
+		t.Fatal("readSecret(absent) = nil error, want refusal")
+	}
+}
+
 type fakeCore struct {
 	ipc.UnimplementedCoreAPI
 	facts    map[string]ipc.Fact // composite key "key|source" → Fact
@@ -60,6 +60,17 @@ func (h *reactiveHandler) actionAct(ctx context.Context, dec router.Decision) st
 			phrase := actPhrase(dec.Slots.Fn, dec.Slots.Args)
 			h.park(dec.Slots.Fn, dec.Slots.Args, phrase)
 			return phraser.A(phraser.ActConfirm, map[string]string{"name": phrase})
+		case errors.Is(err, tool.ErrUnknownTarget):
+			// The verb reached a tool and the tail did not reach a target, so
+			// nothing ran. Saying which word she could not place is the whole
+			// answer: he either renames it or gives the row an alias that
+			// carries the target, and both are one turn away (V-634).
+			word := ""
+			var unknown *tool.UnknownTargetError
+			if errors.As(err, &unknown) {
+				word = unknown.Target
+			}
+			return phraser.A(phraser.ActUnknownTarget, map[string]string{"name": word})
 		case errors.Is(err, tool.ErrNeedsAuthedSurface):
 			// Irreversible (internal/tool/risk.go). A confirm turn would not
 			// help: everything that proposed this act — the STT, the router,
@@ -235,7 +235,13 @@ func (h *reactiveHandler) queryFactByKey(ctx context.Context, t *queryTurn) (str
 //
 // Read-only by construction — the plan is assembled and rendered core-side and
 // nothing here schedules or announces. "что дальше?" asks for the rest of the
-// day, so that phrasing trims what has already passed.
+// day, so that phrasing trims what has already passed and reads only the next
+// morning.NextSpoken entries. Trimming alone was not enough: asked early it cuts
+// nothing, and she read 43 entries aloud in one sentence (V-618).
+//
+// "что у меня сегодня?" is a different question and is not narrowed here — it
+// carries no plan word, so IsDayPlanQuery declines it and the calendar source
+// answers the whole day.
 //
 // What surface this belongs on is still open, tracked as Vikunja #431 ("Board
 // surface: Maven holds the work board, runs the intake form, never argues").
@@ -254,16 +260,23 @@ func (h *reactiveHandler) queryDayPlan(ctx context.Context, t *queryTurn) (strin
 	}
 	// Rebuild the pure plan so the rest-of-day rendering is the same code that
 	// rendered the whole day — one formatter, one persona.
-	p := morning.Plan{Date: plan.Date}
+	//
+	// The instants are put back in the asking clock's zone on the way in. They
+	// arrive carrying whatever zone the core read them in — a calendar fact's Ts
+	// and a reminder's FireTs are UTC out of the store — and FormatRU reads the
+	// hours in the plan's own frame, so setting that frame here is what makes
+	// the recital name his clock rather than the store's (V-614).
+	zone := h.now().Location()
+	p := morning.Plan{Date: plan.Date.In(zone)}
 	for _, it := range plan.Items {
 		p.Items = append(p.Items, morning.PlanEntry{
-			At:        it.At,
+			At:        it.At.In(zone),
 			Text:      it.Text,
 			Kind:      morning.PlanKind(it.Kind),
 			Uncertain: it.Uncertain,
 		})
 	}
-	return p.After(h.now()).FormatRU(), true
+	return p.Next(h.now(), morning.NextSpoken).FormatRU(), true
 }

 // habitFactWindow — how many recent SELF facts the behaviour profile is counted
@@ -19,9 +19,10 @@ func (h *reactiveHandler) actionReminder(ctx context.Context, dec router.Decisio
 		// time wasn't parsed. Run the parser as a fallback.
 		if dec.Stage == 0 && h.timeParser != nil {
 			t, ok, err := h.timeParser.Parse(ctx, dec.Utterance, h.now())
-			// Same gate as the extractor (V-577, V-579): a request that named
-			// no hour gets asked about, never completed from the clock.
-			if err == nil && ok && router.NamesAnHour(dec.Utterance) {
+			// Same gate as the extractor (V-577, V-579, V-610): a request whose
+			// hour was not spoken, or was spoken and not read, gets asked about
+			// and is never completed from the clock.
+			if err == nil && ok && router.ResolvedTheHour(dec.Utterance, t) {
 				dec.Slots.Time = t
 				dec.Slots.HasTime = true
 			}
@@ -0,0 +1,120 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"log"
+	"net"
+	"sync"
+	"time"
+
+	"github.com/kami/maven/internal/event"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/store"
+)
+
+// The two boot paths meet here. run() wires the daemon twice: once at boot
+// when a key is in the environment, and once inside UnlockFn after a passkey
+// assertion, minutes or days later. Listing the same wiring in both places is
+// what let them drift — seven workers started untracked on the unlock path and
+// two daemonAPI fields were never set there, silently, for as long as anyone
+// had been cold-starting (V-639).
+//
+// So both paths call newDaemonAPI and startBackground and nothing else. A
+// field or a worker added later reaches both paths or neither.
+
+// bootDeps is everything the two constructors below read. It is filled from
+// the same variables on both paths, by depsNow in run().
+type bootDeps struct {
+	coreFor    func() ipc.CoreAPI
+	tl         *tickLoop
+	evBus      *event.Bus
+	voiceW     *voiceWiring
+	st         *store.Store
+	factWorker *factEnrichmentWorker
+	evalWorker *memoryEvalWorker // nil ⇒ memory evaluation off (the default)
+	feedWkr    *feedWorker       // nil ⇒ no feed is read (the default)
+	crawlWkr   *crawlWorker      // nil ⇒ no page is watched (the default)
+}
+
+// newDaemonAPI builds the real CoreAPI, with every field set. The unlock path
+// used to leave nexus and getMCPServers nil, so after a cold start
+// ResolveEntity refused with a nexus block configured and /tools rendered
+// "not configured" with an mcp block configured. Empty is a wrong answer
+// there, not a degraded one.
+func newDaemonAPI(d bootDeps) *daemonAPI {
+	api := &daemonAPI{
+		CoreAPI:          d.coreFor(),
+		getTrace:         d.tl.trace,
+		getMorningStatus: func(ctx context.Context) []ipc.MorningRoutineStatus { return d.tl.morningStatus(ctx, time.Now()) },
+		getDayPlan:       func(ctx context.Context) ipc.DayPlan { return d.tl.dayPlan(ctx, time.Now()) },
+		getEvents:        intakeEventsFn(d.evBus),
+		getDecisions:     turnDecisionsFn(d.voiceW),
+		seedStore:        seedStoreIfAllowed(d.st),
+		nexus:            nexusOf(d.voiceW),
+	}
+	if d.voiceW != nil && d.voiceW.handler != nil {
+		api.chatFn = d.voiceW.handler.handleText
+		// And the reverse: the handler was wired with the bare store adapter,
+		// which cannot serve the day plan. See upgradeAPI.
+		d.voiceW.handler.upgradeAPI(api)
+	}
+	if d.voiceW != nil && d.voiceW.mcp != nil {
+		api.getMCPServers = d.voiceW.mcp.status
+	}
+	return api
+}
+
+// namedWorker is one long-running goroutine. The name exists so the set is
+// assertable from a test and readable in a log; nothing dispatches on it.
+type namedWorker struct {
+	name string
+	run  func(ctx context.Context)
+}
+
+// backgroundWorkers lists what this deployment runs. It is pure — it starts
+// nothing — so a test can compare the set the two paths would start without
+// standing a daemon up.
+func backgroundWorkers(d bootDeps) []namedWorker {
+	var ws []namedWorker
+	if d.voiceW != nil && d.voiceW.server != nil {
+		ws = append(ws, namedWorker{"voice", func(context.Context) {
+			if err := d.voiceW.server.Serve(); err != nil && !errors.Is(err, net.ErrClosed) {
+				log.Printf("voice serve: %v", err)
+			}
+		}})
+	}
+	ws = append(ws,
+		namedWorker{"tick", d.tl.run},
+		namedWorker{"fact-enrichment", d.factWorker.run},
+	)
+	if d.evalWorker != nil {
+		ws = append(ws, namedWorker{"memory-eval", d.evalWorker.run})
+	}
+	if d.feedWkr != nil {
+		ws = append(ws, namedWorker{"feed", d.feedWkr.run})
+	}
+	if d.crawlWkr != nil {
+		ws = append(ws, namedWorker{"crawl", d.crawlWkr.run})
+	}
+	if d.voiceW != nil && d.voiceW.mcp != nil {
+		ws = append(ws, namedWorker{"mcp", d.voiceW.mcp.run})
+	}
+	if d.voiceW != nil && d.voiceW.home != nil {
+		ws = append(ws, namedWorker{"home", d.voiceW.home.run})
+	}
+	return ws
+}
+
+// startBackground starts every worker through goWorker, so waitWorkers can
+// wait for it at shutdown. A worker started as a bare `go func()` is the
+// shutdown bug documented at the end of run(): run() never returns, the
+// deferred Close never seals the database, and the ciphertext goes stale.
+func startBackground(ctx context.Context, wg *sync.WaitGroup, d bootDeps) {
+	for _, w := range backgroundWorkers(d) {
+		goWorker(wg, func() { w.run(ctx) })
+	}
+	if d.voiceW != nil && d.voiceW.server != nil {
+		log.Printf("mavend: voice listening on %s", d.voiceW.server.Addr())
+	}
+}
@@ -0,0 +1,96 @@
+package main
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/kami/maven/internal/decision"
+	"github.com/kami/maven/internal/event"
+	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/store"
+	"github.com/kami/maven/internal/voice"
+)
+
+// fullDeps — a deployment with every optional piece present. Nothing here is
+// run: newDaemonAPI takes method values and backgroundWorkers is pure, so
+// zero-value wirings are enough to say what WOULD be started.
+func fullDeps() bootDeps {
+	h := &reactiveHandler{
+		ecosystem: &ecosystemWiring{nexus: &nexusClient{}},
+		decisions: decision.NewRing(),
+	}
+	return bootDeps{
+		coreFor:    func() ipc.CoreAPI { return ipc.UnimplementedCoreAPI{} },
+		tl:         &tickLoop{},
+		evBus:      event.NewBus(4),
+		st:         &store.Store{},
+		factWorker: &factEnrichmentWorker{},
+		evalWorker: &memoryEvalWorker{},
+		feedWkr:    &feedWorker{},
+		crawlWkr:   &crawlWorker{},
+		voiceW: &voiceWiring{
+			server:  &voice.Server{},
+			handler: h,
+			mcp:     &mcpWiring{},
+			home:    &homeWiring{},
+		},
+	}
+}
+
+// The unlock path used to build its own daemonAPI literal and leave nexus and
+// getMCPServers nil (V-639). Both paths call newDaemonAPI now, so the drift
+// that can still happen is a field added to the struct and not to the
+// constructor. This catches that one, by name.
+func TestNewDaemonAPISetsEveryField(t *testing.T) {
+	prev := allowSeedOnStart
+	allowSeedOnStart = true
+	defer func() { allowSeedOnStart = prev }()
+
+	api := newDaemonAPI(fullDeps())
+	v := reflect.ValueOf(*api)
+	for i := range v.NumField() {
+		if v.Field(i).IsZero() {
+			t.Errorf("newDaemonAPI left %s unset — a fully wired deployment must fill every field", v.Type().Field(i).Name)
+		}
+	}
+}
+
+// The handler is wired with the bare store adapter and cannot serve the day
+// plan until upgradeAPI hands it the real one. The unlocked path did that and
+// the unlock path did it too; keep it a property of the constructor.
+func TestNewDaemonAPIUpgradesTheHandler(t *testing.T) {
+	d := fullDeps()
+	api := newDaemonAPI(d)
+	if d.voiceW.handler.api != ipc.CoreAPI(api) {
+		t.Fatal("newDaemonAPI did not hand the handler the API it built")
+	}
+}
+
+// Every worker the daemon runs goes through startBackground, so shutdown can
+// wait for it. The unlock path used to start seven of these as bare
+// `go func()` under a shadowed WaitGroup.
+func TestBackgroundWorkersFullSet(t *testing.T) {
+	want := []string{"voice", "tick", "fact-enrichment", "memory-eval", "feed", "crawl", "mcp", "home"}
+	var got []string
+	for _, w := range backgroundWorkers(fullDeps()) {
+		got = append(got, w.name)
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("workers = %v, want %v", got, want)
+	}
+}
+
+// A default box configures none of the optional blocks. Two workers always run
+// and the rest stay dark, rather than a nil run being scheduled.
+func TestBackgroundWorkersFloor(t *testing.T) {
+	d := fullDeps()
+	d.evalWorker, d.feedWkr, d.crawlWkr, d.voiceW = nil, nil, nil, nil
+	want := []string{"tick", "fact-enrichment"}
+	var got []string
+	for _, w := range backgroundWorkers(d) {
+		got = append(got, w.name)
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("workers = %v, want %v", got, want)
+	}
+}
@@ -571,7 +571,7 @@ func (h *reactiveHandler) finishClarified(ctx context.Context, dec router.Decisi
 	}
 	reply := h.applyAction(ctx, dec)
 	if reply == "" {
-		reply = h.replier.Reply(dec)
+		reply = h.replier.Reply(ctx, dec)
 	}
 	if reply == "" {
 		// Belt: an empty reply here would be a silent drop.
@@ -24,6 +24,14 @@ type pendingHexisExec struct {
 	entityID     string
 	displayName  string
 	expiry       time.Time
+
+	// correlationID — the id the proposing turn minted for this action. A
+	// confirm arrives on a later turn with a context of its own, so without
+	// carrying it here the execution recorded a fresh id and no causation at
+	// all, and the resolve, the discovery and the thing they authorised sat in
+	// the trace as unrelated calls. The contract mints one id per action, and
+	// the action began when she asked.
+	correlationID string
 }

 // pendingRoutineConfirm — a proposed routine awaiting a spoken y/n to become
@@ -144,7 +152,11 @@ func (h *reactiveHandler) confirmResolvers(ctx context.Context) []confirmResolve
 				return hx != nil && !h.now().After(hx.expiry)
 			},
 			yes: func() string {
-				return h.execHexis(ctx, hx.capabilityID, hx.capName, hx.entityID, hx.displayName)
+				execCtx := ctx
+				if hx.correlationID != "" {
+					execCtx = withCorrelationID(execCtx, hx.correlationID)
+				}
+				return h.execHexis(execCtx, hx.capabilityID, hx.capName, hx.entityID, hx.displayName)
 			},
 			no: func() string { return phraser.C(phraser.ConfirmCancelled, nil) },
 		},
@@ -4,12 +4,14 @@ import (
 	"context"
 	"database/sql"
 	"errors"
+	"fmt"
 	"strings"
 	"testing"
 	"time"

 	"github.com/kami/maven/internal/calendar"
 	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/morning"
 	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/store"
@@ -111,6 +113,88 @@ func TestQueryDayPlanRestOfDayWhenNothingIsLeft(t *testing.T) {
 	}
 }

+// "что дальше?" rebuilds the plan off the wire and renders it here, and the
+// instants on it carry the zone the core read them in — a calendar fact's Ts
+// and a reminder's FireTs are UTC out of the store. Read raw, the recital named
+// the store's clock instead of his (V-614). The asking clock is three hours off
+// whatever this machine runs in, so the assertion holds under TZ=UTC too.
+func TestQueryDayPlanRestOfDayReadsHisClock(t *testing.T) {
+	_, off := time.Now().Zone()
+	away := time.FixedZone("away", off+3*60*60)
+	stored := time.Date(2026, 8, 3, 8, 0, 0, 0, time.UTC)
+
+	h := &reactiveHandler{
+		api: &planAPI{plan: ipc.DayPlan{
+			Date:  time.Date(2026, 8, 3, 0, 0, 0, 0, time.UTC),
+			Items: []ipc.DayPlanItem{{At: stored, Text: "позвонить маме", Kind: "reminder"}},
+		}},
+		now: func() time.Time { return time.Date(2026, 8, 3, 9, 0, 0, 0, away) },
+	}
+	reply, ok := h.queryDayPlan(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "что дальше?"},
+	})
+	if !ok {
+		t.Fatal("expected the plan source to claim it")
+	}
+	if want := stored.In(away).Format("15:04"); !strings.Contains(reply, want) {
+		t.Errorf("the reminder is not read in his clock (%s): %q", want, reply)
+	}
+	if bad := stored.Format("15:04"); strings.Contains(reply, bad) {
+		t.Errorf("the reminder is read in the store's zone (%s): %q", bad, reply)
+	}
+}
+
+// The defect V-618 fixes, at the handler: asked at 04:45 the trim removes
+// nothing, because the whole day is still ahead. She read 43 entries aloud as
+// one sentence. The zone is three hours off UTC so the test also fails under
+// TZ=UTC if the rendering ever slips zones.
+func TestQueryDayPlanCapsWhatItReadsAloud(t *testing.T) {
+	zone := time.FixedZone("MSK", 3*60*60)
+	mid := time.Date(2026, 8, 3, 0, 0, 0, 0, zone)
+	plan := ipc.DayPlan{Date: mid, Spoken: "план на 03.08.2026: …"}
+	for i := 0; i < 43; i++ {
+		plan.Items = append(plan.Items, ipc.DayPlanItem{
+			At:   mid.Add(time.Duration(345+i*20) * time.Minute), // 05:45 onward
+			Text: fmt.Sprintf("пункт %d", i),
+			Kind: "event",
+		})
+	}
+	h := &reactiveHandler{api: &planAPI{plan: plan}, now: func() time.Time {
+		return time.Date(2026, 8, 3, 4, 45, 0, 0, zone)
+	}}
+	reply, ok := h.queryDayPlan(context.Background(), &queryTurn{
+		dec: router.Decision{Intent: router.IntentQuery, Utterance: "что дальше?"},
+	})
+	if !ok {
+		t.Fatal("expected the plan source to claim it")
+	}
+	if n := strings.Count(reply, "пункт "); n != morning.NextSpoken {
+		t.Errorf("read %d entries aloud, want %d: %q", n, morning.NextSpoken, reply)
+	}
+	if !strings.HasPrefix(reply, "дальше: 05:45 — пункт 0;") {
+		t.Errorf("the next thing is not first: %q", reply)
+	}
+	// The rest is counted, not silently dropped.
+	if !strings.Contains(reply, "и ещё 40 дел до конца дня.") {
+		t.Errorf("the sentence hides that the day goes on: %q", reply)
+	}
+}
+
+// "что у меня сегодня?" is the whole day and is not narrowed. It carries no
+// plan word, so the plan source declines it and the calendar listing answers —
+// asserted here beside the cap so the two questions cannot drift together.
+func TestWholeDayQuestionIsNotTheRestOfTheDay(t *testing.T) {
+	if router.IsDayPlanQuery("что у меня сегодня?") {
+		t.Error("the plan source claims the whole-day question")
+	}
+	if !router.IsDayPlanQuery("что дальше?") {
+		t.Error("the plan source stopped claiming the rest-of-day question")
+	}
+	if router.IsRestOfDayQuery("какие планы на сегодня?") {
+		t.Error("the whole-day plan question got narrowed to the rest of the day")
+	}
+}
+
 // A question that is not about the plan must fall through, or the plan buries
 // the calendar listing and the weather behind it.
 func TestQueryDayPlanPassesOnEverythingElse(t *testing.T) {
@@ -31,7 +31,8 @@ import (
 // and nothing should: a missing name costs one line of the record, while a
 // check that walks the ladder would have to run the ladder.
 var preRouteLadder = []string{
-	"confirm", "clarify-answer", "quiet-toggle", "snooze", "ack", "repair", "ordinal",
+	"confirm", "clarify-answer", "quiet-toggle", "snooze", "ack", "repair",
+	"repair-negative", "ordinal",
 }

 // notePreRoute records one rung of that ladder and passes its verdict through
@@ -139,9 +139,9 @@ func (h *reactiveHandler) handlePraxisAct(ctx context.Context, dec router.Decisi
 // praxisItemAction is the shared shape of the item-lifecycle capabilities: take
 // an item id from the value slot, call one Praxis endpoint, trace the result.
 type praxisItemAction struct {
-	verbs   []string
-	ask     string // reply when no item id was given
-	op      string // trace + log name of the operation
+	verbs []string
+	ask   string // reply when no item id was given
+	op    string // trace + log name of the operation
 	// failure is the first half of the reply when the Praxis call errors: which
 	// operation did not happen. ecosystemGap supplies the second half, which
 	// names Praxis and splits a refused token from an outage — those two used to
@@ -346,14 +346,24 @@ func (entityAttentionCapability) handle(ctx context.Context, h *reactiveHandler,
 	})

 	var parts []string
+	var spoken []string
 	for _, item := range items {
 		title, _ := item["title"].(string)
 		if title == "" {
 			continue
 		}
 		parts = append(parts, title)
-		surfaceSpoken(ctx, px, item)
+		if id := surfaceSpoken(ctx, px, item); id != "" {
+			spoken = append(spoken, id)
+		}
 	}
+	// The scoped digest is a list she read out, so it replaces the positional
+	// memory exactly as the unscoped one does. It used to surface these items
+	// and remember none of them, which left the previous digest live: "отметь
+	// второй как сделанное" then indexed into a list he had not just heard and
+	// transitioned somebody else's item (docs/ecosystem.md — a wrong guess here
+	// transitions the wrong item).
+	h.rememberSurfaced(spoken)
 	if known := h.localFactsForEntity(ctx, entityID); known != "" {
 		parts = append(parts, known)
 	}
@@ -768,6 +778,9 @@ func (h *reactiveHandler) handleHexisAct(ctx context.Context, dec router.Decisio
 			entityID:     entityID,
 			displayName:  displayName,
 			expiry:       h.now().Add(confirmTTL),
+			// This action's id, so the execution the confirm authorises is
+			// joined to the resolve and the discovery that proposed it.
+			correlationID: correlationIDFromCtx(ctx),
 		}
 		h.mu.Unlock()
 		h.recordEcosystemTrace(ctx, "hexis", "confirmation", tracePending, started,
@@ -115,3 +115,83 @@ func TestFakeNexus_FaultInjectionThenRecovery(t *testing.T) {
 		t.Fatalf("expected success once nexus recovers, got %q", reply)
 	}
 }
+
+// TestPraxisEntityAttention_RemembersWhatItReadOut: the scoped digest is a list
+// she read out, so a positional follow-up must land on one of ITS items. It
+// surfaced them and remembered none, which left the previous digest live and
+// sent "отметь второй" at somebody else's item.
+func TestPraxisEntityAttention_RemembersWhatItReadOut(t *testing.T) {
+	ctx := context.Background()
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_muzick", "Muzick indexer", "service"))
+	scoped := fixturePraxisAttentionScoped("ent_muzick",
+		map[string]any{"id": "item_scoped_1", "title": "indexer wedged"})
+	praxis := newFakePraxis(t, scoped)
+	h := ecoHandler(t, nexus, praxis, nil)
+
+	// A digest from an earlier turn, still the positional memory.
+	h.rememberSurfaced([]string{"item_stale"})
+
+	reply := h.handlePraxisAct(ctx, router.Decision{
+		Intent: router.IntentAct,
+		Slots:  router.Slots{Fn: "entity_attention", HasFn: true, Value: "muzick indexer"},
+	})
+	if !strings.Contains(reply, "indexer wedged") {
+		t.Fatalf("expected the scoped item to be read out, got %q", reply)
+	}
+
+	h.mu.Lock()
+	surfaced := append([]string(nil), h.surfacedItems...)
+	h.mu.Unlock()
+	if len(surfaced) != 1 || surfaced[0] != "item_scoped_1" {
+		t.Fatalf("scoped digest must replace the positional memory, got %v", surfaced)
+	}
+
+	// The follow-up resolves against what he just heard, not the stale list.
+	if reply := h.handlePraxisAct(ctx, praxisItemDec("resolve_item", "last")); reply == "" {
+		t.Fatal("positional follow-up should have been claimed by praxis")
+	}
+	var body string
+	for _, r := range praxis.Requests() {
+		if r.Method == "POST" && r.Path == "/api/v1/tools/resolve" {
+			body = string(r.Body)
+		}
+	}
+	if !strings.Contains(body, "item_scoped_1") {
+		t.Fatalf("resolve must transition the item she read out, posted %q", body)
+	}
+	if strings.Contains(body, "item_stale") {
+		t.Fatal("resolve transitioned an item from a previous digest")
+	}
+}
+
+// TestHexisConfirm_KeepsOneCorrelationIDPerAction: the confirm arrives on a
+// later turn with a context of its own. The contract mints one id per action,
+// so the execution it authorises must still be joinable to the resolve and the
+// discovery that proposed it — it recorded a fresh id and no causation at all.
+func TestHexisConfirm_KeepsOneCorrelationIDPerAction(t *testing.T) {
+	ctx := context.Background()
+	nexus := newFakeNexus(t, fixtureNexusResolved("ent_muzick", "Muzick indexer", "service"))
+	caps := fixtureHexisCapabilities(map[string]any{"id": "cap_restart", "name": "restart", "read_only": false})
+	hexis := newFakeHexis(t, caps, fixtureHexisExecuted("exec_1", "succeeded"))
+	h := ecoHandler(t, nexus, nil, hexis)
+
+	if reply := h.handleHexisAct(ctx, actDec("restart")); !strings.Contains(reply, "да") {
+		t.Fatalf("mutating capability must ask for confirmation, got %q", reply)
+	}
+	resolve := findTrace(t, h, "nexus", "resolve")
+	if resolve == nil || resolve.CorrelationID == "" {
+		t.Fatalf("expected a nexus resolve trace carrying a correlation id, got %+v", resolve)
+	}
+
+	if _, handled := h.resolveConfirm(ctx, "да"); !handled {
+		t.Fatal("confirm should have been claimed")
+	}
+	exec := findTrace(t, h, "hexis", "execute")
+	if exec == nil {
+		t.Fatal("expected a hexis execute trace")
+	}
+	if exec.CausationID != resolve.CorrelationID {
+		t.Fatalf("confirmed execution must cite the action that proposed it: causation %q, action %q",
+			exec.CausationID, resolve.CorrelationID)
+	}
+}
@@ -37,8 +37,8 @@ type factEnrichmentWorker struct {
 	nextTry map[int64]time.Time // fact id → earliest retry
 }

-// enrichmentScanLimit bounds how deep a single tick (or status report) walks
-// the pending queue looking for facts whose backoff has elapsed. The queue is
+// enrichmentScanLimit bounds how deep a single tick walks the pending queue
+// looking for facts whose backoff has elapsed. The queue is
 // ordered by id, so without a scan the oldest facts hold every batch slot
 // whether or not they are eligible, and one permanently failing fact stalls
 // every younger one behind it.
@@ -75,8 +75,8 @@ func newFactEnrichmentWorker(st *store.Store, eco *ecosystemWiring, interval tim
 // has been down all day must be visible as a backlog, not as facts that
 // silently never got tagged.
 //
-// All three numbers describe the same set of rows, the first
-// enrichmentScanLimit pending facts. Counting Pending over a thousand rows
+// All three numbers describe the same set of rows, whatever is still pending
+// out of the first enrichmentScanLimit facts. Counting Pending over a thousand rows
 // while counting InBackoff over the twenty that reached the head of a batch
 // described two different populations under one struct.
 type enrichmentStatus struct {
@@ -86,13 +86,22 @@ type enrichmentStatus struct {
 	Scanned     int // rows the other three counts were taken over
 }

+// status reads the queue and counts over it. For a caller with no batch in
+// hand — anything asking the worker how it is doing from outside the tick.
 func (w *factEnrichmentWorker) status(ctx context.Context) enrichmentStatus {
-	var st enrichmentStatus
 	pending, err := w.store.PendingFactResolutions(ctx, enrichmentScanLimit)
 	if err != nil {
 		log.Printf("factenrichment: status: %v", err)
-		return st
+		return enrichmentStatus{}
 	}
+	return w.statusOf(pending)
+}
+
+// statusOf counts over a batch the caller already has. The batch is the query
+// the tick already ran, so reporting the backlog costs no second read of the
+// scan limit — up to a thousand rows, on a database that serialises them.
+func (w *factEnrichmentWorker) statusOf(pending []store.Fact) enrichmentStatus {
+	var st enrichmentStatus
 	st.Pending = len(pending)
 	st.Scanned = len(pending)
 	w.mu.Lock()
@@ -144,17 +153,24 @@ func (w *factEnrichmentWorker) tick(ctx context.Context) {
 	}
 	w.forgetDeparted(pending)
 	skipped, failed, attempted := 0, 0, 0
+	// A resolved fact leaves the pending queue, so the batch in hand overstates
+	// the backlog by however many succeeded. Drop them here rather than
+	// re-reading the queue to find out.
+	remaining := make([]store.Fact, 0, len(pending))
 	for _, f := range pending {
 		if attempted >= w.batch {
-			break
+			remaining = append(remaining, f)
+			continue
 		}
 		if !w.due(f.ID) {
 			skipped++
+			remaining = append(remaining, f)
 			continue
 		}
 		attempted++
 		if !w.resolveOne(ctx, f) {
 			failed++
+			remaining = append(remaining, f)
 		}
 	}
 	if failed > 0 {
@@ -164,7 +180,7 @@ func (w *factEnrichmentWorker) tick(ctx context.Context) {
 	// Report the backlog every tick, not only when something failed: the
 	// stalled state worth seeing is the one where nothing failed because
 	// nothing was attempted.
-	if st := w.status(ctx); st.Pending > 0 {
+	if st := w.statusOf(remaining); st.Pending > 0 {
 		log.Printf("factenrichment: %d facts pending entity resolution, %d in backoff, worst attempt %d (scanned %d)",
 			st.Pending, st.InBackoff, st.MaxAttempts, st.Scanned)
 	}
@@ -252,6 +252,23 @@ func run(args []string) error {
 	// envelope per successful intake write.
 	coreFor := func() ipc.CoreAPI { return newIntakeAPI(ipc.NewStoreAPI(st), evBus, time.Now) }

+	// depsNow reads whatever the current path has wired. Both boot paths build
+	// the CoreAPI and start the workers from this one value, so neither can
+	// hold a field the other misses. See cmd/mavend/boot.go.
+	depsNow := func() bootDeps {
+		return bootDeps{
+			coreFor:    coreFor,
+			tl:         tl,
+			evBus:      evBus,
+			voiceW:     voiceW,
+			st:         st,
+			factWorker: factWorker,
+			evalWorker: evalWorker,
+			feedWkr:    feedWkr,
+			crawlWkr:   crawlWkr,
+		}
+	}
+
 	if !locked {
 		rules = wireRules(cfg)
 		gatherer = wireGatherer(st, cfg, rules)
@@ -284,26 +301,7 @@ func run(args []string) error {
 		feedWkr = newFeedWorker(coreFor(), embedderOf(voiceW), cfg)
 		crawlWkr = newCrawlWorker(newCrawler(cfg), coreFor(), embedderOf(voiceW), cfg)

-		coreAPI = &daemonAPI{
-			CoreAPI:          coreFor(),
-			getTrace:         tl.trace,
-			getMorningStatus: func(ctx context.Context) []ipc.MorningRoutineStatus { return tl.morningStatus(ctx, time.Now()) },
-			getDayPlan:       func(ctx context.Context) ipc.DayPlan { return tl.dayPlan(ctx, time.Now()) },
-			getEvents:        intakeEventsFn(evBus),
-			getDecisions:     turnDecisionsFn(voiceW),
-			seedStore:        seedStoreIfAllowed(st),
-			nexus:            nexusOf(voiceW),
-		}
-		if voiceW != nil && voiceW.handler != nil {
-			api := coreAPI.(*daemonAPI)
-			api.chatFn = voiceW.handler.handleText
-			// And the reverse: the handler was wired with the bare store
-			// adapter, which cannot serve the day plan. See upgradeAPI.
-			voiceW.handler.upgradeAPI(api)
-		}
-		if voiceW != nil && voiceW.mcp != nil {
-			coreAPI.(*daemonAPI).getMCPServers = voiceW.mcp.status
-		}
+		coreAPI = newDaemonAPI(depsNow())
 	} else {
 		// locked mode: no real store yet, so there's no meaningful CoreAPI to
 		// serve. srv.Check below is the actual guard — every CoreAPI call is
@@ -364,6 +362,9 @@ func run(args []string) error {
 	if !locked {
 		wireMailIntake(srv, st, phr, cfg, evBus)
 		wireModelSwap(srv, phr, cfg)
+		// Inbound telegram (V-637). Dark unless the telegram block says intake,
+		// and it reads one chat.
+		wireTelegramIntake(ctx, &wg, coreAPI, cfg)
 		// Vision + the media blob store (Vikunja #252). Both stay dark without a
 		// media block; MethodDescribeImage answers ErrUnknownMethod then.
 		keeper := wireVision(ctx, &wg, srv, st, embedderOf(voiceW), cfg)
@@ -494,23 +495,14 @@ func run(args []string) error {
 			crawlWkr = newCrawlWorker(newCrawler(cfg), coreFor(), embedderOf(voiceW), cfg)

 			// Swap the CoreAPI from the locked placeholder to the real store adapter.
-			newAPI := &daemonAPI{
-				CoreAPI:          coreFor(),
-				getTrace:         tl.trace,
-				getMorningStatus: func(ctx context.Context) []ipc.MorningRoutineStatus { return tl.morningStatus(ctx, time.Now()) },
-				getDayPlan:       func(ctx context.Context) ipc.DayPlan { return tl.dayPlan(ctx, time.Now()) },
-				getEvents:        intakeEventsFn(evBus),
-				getDecisions:     turnDecisionsFn(voiceW),
-				seedStore:        seedStoreIfAllowed(st),
-			}
-			if voiceW != nil && voiceW.handler != nil {
-				newAPI.chatFn = voiceW.handler.handleText
-				voiceW.handler.upgradeAPI(newAPI)
-			}
+			newAPI := newDaemonAPI(depsNow())
 			srv.SetAPI(newAPI)
 			srv.Check = (&auth.Gate{Enrollment: auth.NewFloorEnrollment(), Session: passkeySess}).Check
 			wireMailIntake(srv, st, phr, cfg, evBus)
 			wireModelSwap(srv, phr, cfg)
+			// Same on the unlock path, with the API that has just replaced the
+			// locked placeholder (V-637).
+			wireTelegramIntake(ctx, &wg, newAPI, cfg)
 			keeper := wireVision(ctx, &wg, srv, st, embedderOf(voiceW), cfg)
 			wireCapture(ctx, &wg, srv, keeper, st, voiceW, phr, cfg)
 			// Voice identification (Vikunja #255). Enrolment plumbing only until a
@@ -518,59 +510,10 @@ func run(args []string) error {
 			// block, so no wire path takes a voiceprint on a default box.
 			wireSpeaker(srv, st, cfg)

-			// Start voice server.
-			if voiceW != nil {
-				var wg sync.WaitGroup
-				wg.Add(1)
-				go func() {
-					defer wg.Done()
-					if err := voiceW.server.Serve(); err != nil && !errors.Is(err, net.ErrClosed) {
-						log.Printf("voice serve: %v", err)
-					}
-				}()
-				log.Printf("mavend: voice listening on %s", voiceW.server.Addr())
-			}
-
-			// Start tick loop.
-			go func() {
-				tl.run(ctx)
-			}()
-
-			// Start fact-entity enrichment worker.
-			go func() {
-				factWorker.run(ctx)
-			}()
-
-			// Start background memory evaluation (nil unless configured).
-			if evalWorker != nil {
-				go func() {
-					evalWorker.run(ctx)
-				}()
-			}
-
-			// Start feed reading (nil unless configured).
-			if feedWkr != nil {
-				go func() {
-					feedWkr.run(ctx)
-				}()
-			}
-
-			// Start the watched-page crawls (nil unless configured).
-			if crawlWkr != nil {
-				go func() {
-					crawlWkr.run(ctx)
-				}()
-			}
-
-			// Keep MCP connections alive (nil unless configured).
-			if voiceW != nil && voiceW.mcp != nil {
-				go voiceW.mcp.run(ctx)
-			}
-
-			// Re-enumerate the house for new devices (nil unless configured).
-			if voiceW != nil && voiceW.home != nil {
-				go voiceW.home.run(ctx)
-			}
+			// The voice server and every background worker, on the outer wg
+			// so shutdown waits for them. This used to be nine bare
+			// `go func()` calls and a shadowed WaitGroup (V-639).
+			startBackground(ctx, &wg, depsNow())

 			dl.unlock(st)
 			log.Printf("mavend: unlocked via passkey assertion")
@@ -585,33 +528,8 @@ func run(args []string) error {
 	})
 	log.Printf("mavend: ipc listening on %s", srv.Path())

-	if !locked && voiceW != nil {
-		goWorker(&wg, func() {
-			if err := voiceW.server.Serve(); err != nil && !errors.Is(err, net.ErrClosed) {
-				log.Printf("voice serve: %v", err)
-			}
-		})
-		log.Printf("mavend: voice listening on %s", voiceW.server.Addr())
-	}
-
 	if !locked {
-		goWorker(&wg, func() { tl.run(ctx) })
-		goWorker(&wg, func() { factWorker.run(ctx) })
-		if evalWorker != nil {
-			goWorker(&wg, func() { evalWorker.run(ctx) })
-		}
-		if feedWkr != nil {
-			goWorker(&wg, func() { feedWkr.run(ctx) })
-		}
-		if crawlWkr != nil {
-			goWorker(&wg, func() { crawlWkr.run(ctx) })
-		}
-		if voiceW != nil && voiceW.mcp != nil {
-			goWorker(&wg, func() { voiceW.mcp.run(ctx) })
-		}
-		if voiceW != nil && voiceW.home != nil {
-			goWorker(&wg, func() { voiceW.home.run(ctx) })
-		}
+		startBackground(ctx, &wg, depsNow())
 	}

 	<-ctx.Done()
@@ -9,6 +9,7 @@ import (

 	"github.com/kami/maven/internal/lexicon"
 	"github.com/kami/maven/internal/morph"
+	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/router"
 )

@@ -35,6 +36,11 @@ type routedTurn struct {
 	utterance string
 	intent    router.Intent
 	at        time.Time
+	// traceID — the persisted trace of this turn, stamped after the fact by
+	// stampLastTurn. 0 when nothing persisted, and then a spoken correction
+	// still teaches the classifier: the durable label is the half that needs a
+	// row to point at (V-636).
+	traceID int64
 }

 // repairWindow — how long a turn stays correctable. Long enough that he can
@@ -54,6 +60,13 @@ const repairWindow = 5 * time.Minute
 // said. The set's note in lexicon_ru_v1.json carries the same reasoning.
 var repairMarkers = lexicon.RepairMarkers()

+// repairNegatives — "she got it wrong" with no target. Matched against the whole
+// utterance, because these are complete sentences and the markers above are
+// fragments: "это не" needs an intent word after it, "не так поняла" does not.
+// Substring matching here would claim "не так" out of any sentence containing it
+// (V-636).
+var repairNegatives = lexicon.RepairNegatives()
+
 // repairIntents — the words he uses for each intent, as dictionary forms. They
 // used to be prefixes ("заметк"), which is what a prefix list costs: "команд"
 // also matched "командировка", and "факт" matched "фактически". morph.SameWord
@@ -147,6 +160,18 @@ func (h *reactiveHandler) recordTurn(utterance string, intent router.Intent) {
 	h.lastRouted = &routedTurn{utterance: utterance, intent: intent, at: h.now()}
 }

+// stampLastTurn attaches the trace id to the turn a correction would point at.
+// It cannot be done in recordTurn: the trace is written when the turn ends, and
+// recordTurn runs in the middle of it.
+func (h *reactiveHandler) stampLastTurn(utterance string, traceID int64) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.lastRouted == nil || h.lastRouted.utterance != utterance {
+		return
+	}
+	h.lastRouted.traceID = traceID
+}
+
 func (h *reactiveHandler) takeLastTurn() *routedTurn {
 	h.mu.Lock()
 	defer h.mu.Unlock()
@@ -157,6 +182,56 @@ func (h *reactiveHandler) takeLastTurn() *routedTurn {
 	return last
 }

+// resolveUntargetedRepair handles the cheap half of a spoken correction: he says
+// she got it wrong and does not say what it should have been (V-636).
+//
+// It is worth having on its own. V-630 made the target optional on the web for
+// the same reason: a turn marked wrong with no target is a usable negative, and
+// requiring the target would cost the correction he was willing to give. Voice
+// needs it more than the web does — naming an intent aloud means saying
+// "заметка" or "факт", which is Maven's vocabulary and not his.
+//
+// Nothing is redone and the classifier is not taught. There is no target, so
+// there is nothing to redo it as and nothing to teach. Only the label is written,
+// and she says so, because a correction he cannot see reads as one that was
+// dropped.
+func (h *reactiveHandler) resolveUntargetedRepair(ctx context.Context, text string) (string, bool) {
+	if !isRepairNegative(text) {
+		return "", false
+	}
+	last := h.takeLastTurn()
+	if last == nil || h.now().Sub(last.at) > repairWindow {
+		return "", false
+	}
+	if last.traceID == 0 {
+		// No row to point at, so there is no label to write and nothing this
+		// resolver can do. Routing the words normally is the honest outcome.
+		return "", false
+	}
+	h.labelCorrection(ctx, last, "")
+	log.Printf("voice: repair — %q marked wrong, no target given", last.utterance)
+	return phraser.A(phraser.RepairNoted, nil), true
+}
+
+// isRepairNegative matches the whole utterance, minus a leading "нет" and any
+// trailing punctuation. "нет, не так" is the shortest one he says.
+func isRepairNegative(utterance string) bool {
+	s := strings.ToLower(strings.TrimSpace(utterance))
+	s = strings.TrimRight(s, " .!?")
+	for _, p := range []string{"нет,", "нет", "no,", "no"} {
+		if rest := strings.TrimSpace(strings.TrimPrefix(s, p)); rest != s && rest != "" {
+			s = rest
+			break
+		}
+	}
+	for _, n := range repairNegatives {
+		if s == n {
+			return true
+		}
+	}
+	return false
+}
+
 // resolveRepair handles a spoken correction of the previous turn: teach the
 // classifier, redo the request under the corrected intent, and say so.
 func (h *reactiveHandler) resolveRepair(ctx context.Context, text string) (string, bool) {
@@ -182,6 +257,7 @@ func (h *reactiveHandler) resolveRepair(ctx context.Context, text string) (strin
 		learned = false
 	}
 	log.Printf("voice: repair — %q was %s, corrected to %s (learned=%v)", last.utterance, last.intent, corrected, learned)
+	h.labelCorrection(ctx, last, string(corrected))

 	dec := router.Decision{
 		Utterance: last.utterance,
@@ -207,3 +283,24 @@ func repairLine(say string, learned bool) string {
 	}
 	return "поняла, это " + say + " — запомнила."
 }
+
+// labelCorrection promotes a spoken correction into routing_labels, the same
+// table the /chat gesture writes (V-630, V-636).
+//
+// Two sinks and not one, because they keep different things. CorrectMisroute
+// appends a classifier seed, which is what makes the NEXT turn better today.
+// The label is what a fitted head trains on later, it survives the 14-day
+// transcript, and until now only the web produced any. A sample that only ever
+// held typed turns would skew to whatever he happens to be at a keyboard for,
+// and voice is where the hard cases are.
+//
+// Best-effort and silent. He has already been told the correction landed, and a
+// second sink failing is not his problem to hear about.
+func (h *reactiveHandler) labelCorrection(ctx context.Context, last *routedTurn, shouldBe string) {
+	if h.api == nil || last == nil || last.traceID == 0 {
+		return
+	}
+	if err := h.api.CorrectTurn(ctx, last.traceID, shouldBe); err != nil {
+		log.Printf("voice: repair: could not label trace %d: %v", last.traceID, err)
+	}
+}
@@ -7,6 +7,7 @@ import (
 	"time"

 	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/store"
 )

 func TestParseRepairReadsTheCorrectedIntent(t *testing.T) {
@@ -149,3 +150,95 @@ func TestRepairIntentWordCollisions(t *testing.T) {
 		}
 	}
 }
+
+// V-636. A spoken correction lands in the same table the /chat gesture writes,
+// so the sample is not limited to the turns he happened to type.
+func TestSpokenCorrectionWritesTheLabel(t *testing.T) {
+	h, st, _ := newClarifyHandler(t)
+	emb := router.NewHashEmbedder(256)
+	h.recall.embedder = emb
+	h.router = router.New(router.Config{Classifier: router.NewClassifier(emb), Extractor: h.extractor})
+	ctx := context.Background()
+
+	id, err := st.WriteRoutingTrace(ctx, store.RoutingTrace{
+		Ts: h.now(), Utterance: "купить хлеб", Intent: "fact", Source: "tap:voice",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	h.recordTurn("купить хлеб", router.IntentFact)
+	h.stampLastTurn("купить хлеб", id)
+
+	if _, handled := h.resolveRepair(ctx, "нет, это заметка"); !handled {
+		t.Fatal("the correction was not handled")
+	}
+	labels, err := st.RoutingLabels(ctx, 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(labels) != 1 || labels[0].Was != "fact" || labels[0].ShouldBe != "note" {
+		t.Fatalf("labels %+v: the spoken correction did not land as a pair", labels)
+	}
+}
+
+// The cheap half, which voice needs more than the web does: naming an intent
+// aloud means saying "заметка", which is her vocabulary and not his.
+func TestUntargetedSpokenCorrection(t *testing.T) {
+	h, st, now := newClarifyHandler(t)
+	ctx := context.Background()
+	seed := func(utterance string) int64 {
+		id, err := st.WriteRoutingTrace(ctx, store.RoutingTrace{
+			Ts: h.now(), Utterance: utterance, Intent: "query", Source: "tap:voice",
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		h.recordTurn(utterance, router.IntentQuery)
+		h.stampLastTurn(utterance, id)
+		return id
+	}
+
+	seed("поужинал")
+	reply, handled := h.resolveUntargetedRepair(ctx, "нет, не так")
+	if !handled {
+		t.Fatal("«нет, не так» was not read as a correction")
+	}
+	if reply == "" {
+		t.Error("a correction he cannot hear reads as one that was dropped")
+	}
+	labels, err := st.RoutingLabels(ctx, 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(labels) != 1 || labels[0].ShouldBe != "" || labels[0].Was != "query" {
+		t.Fatalf("labels %+v: want one untargeted negative naming what she chose", labels)
+	}
+
+	// Outside the window it is a fresh sentence, not a verdict.
+	seed("поужинал ещё раз")
+	*now = now.Add(repairWindow + time.Minute)
+	if _, handled := h.resolveUntargetedRepair(ctx, "не так"); handled {
+		t.Error("a correction outside the window was handled")
+	}
+}
+
+// Whole-utterance, never a substring. This is the difference between the
+// negatives and the markers, and getting it wrong would claim any sentence with
+// "не так" in it.
+func TestRepairNegativeIsTheWholeUtterance(t *testing.T) {
+	for _, s := range []string{
+		"не так поняла", "нет, не так", "ты ошиблась", "неправильно", "wrong", "no, that was wrong",
+	} {
+		if !isRepairNegative(s) {
+			t.Errorf("%q is not read as a correction", s)
+		}
+	}
+	for _, s := range []string{
+		"это не важно", "напомни не так поздно", "а не завтра", "не так, а вот так — это заметка",
+		"", "нет",
+	} {
+		if isRepairNegative(s) {
+			t.Errorf("%q was read as a correction", s)
+		}
+	}
+}
@@ -22,7 +22,7 @@ func newLLMReplier(c phraser.Completer, block func() string) *llmReplier {

 // Reply never fails: a clarify, a model error and an unusable generation all
 // answer from the stub, which is what keeps a turn from breaking on the model.
-func (r *llmReplier) Reply(d router.Decision) string {
+func (r *llmReplier) Reply(ctx context.Context, d router.Decision) string {
 	if d.Clarify {
 		// The deck, not the stub's single sentence: a clarify she cannot turn
 		// into a question is the line he hears most often when she misses him,
@@ -39,14 +39,14 @@ func (r *llmReplier) Reply(d router.Decision) string {
 		// что ты выпел стакан воды" for "я выпил воды".
 		return phraser.FactAck(d.Utterance)
 	}
-	out, err := r.p.PhraseReply(context.Background(), d)
+	out, err := r.p.PhraseReply(ctx, d)
 	if err != nil || out == "" {
-		return r.stub.Reply(d)
+		return r.stub.Reply(ctx, d)
 	}
 	// The persona checks, on the live path (personaguard.go). A reply that
 	// leaks reasoning or calls him "вы" is worse than a flat one.
 	if _, ok := guardSpoken("reply", out); !ok {
-		return r.stub.Reply(d)
+		return r.stub.Reply(ctx, d)
 	}
 	return out
 }
@@ -22,7 +22,7 @@ func (s stubCompleter) Complete(_ context.Context, _ llm.Req) (string, error) {

 func TestLLMReplierPassesTheModelReplyThrough(t *testing.T) {
 	r := newLLMReplier(stubCompleter{out: `{"response":"записала, кофе закончился","mood":"neutral"}`}, nil)
-	got := r.Reply(router.Decision{Intent: router.IntentNote, Slots: router.Slots{Text: "кофе закончился"}})
+	got := r.Reply(context.Background(), router.Decision{Intent: router.IntentNote, Slots: router.Slots{Text: "кофе закончился"}})
 	if got != "записала, кофе закончился" {
 		t.Errorf("got %q, want %q", got, "записала, кофе закончился")
 	}
@@ -42,7 +42,7 @@ func TestLLMReplierFallsBackToStubOnEmpty(t *testing.T) {
 // the clarify deck rather than the stub's single sentence.
 func TestLLMReplierClarifyReadsTheDeck(t *testing.T) {
 	r := newLLMReplier(stubCompleter{out: "я всё поняла"}, nil)
-	got := r.Reply(router.Decision{Clarify: true, Utterance: "мгм"})
+	got := r.Reply(context.Background(), router.Decision{Clarify: true, Utterance: "мгм"})
 	if got == "я всё поняла" {
 		t.Fatal("a clarify must not be phrased by the model")
 	}
@@ -50,7 +50,7 @@ func TestLLMReplierClarifyReadsTheDeck(t *testing.T) {
 		t.Errorf("on clarify: got %q, want %q", got, want)
 	}
 	// Two different misses do not sound identical.
-	if same := r.Reply(router.Decision{Clarify: true, Utterance: "а"}); same == got {
+	if same := r.Reply(context.Background(), router.Decision{Clarify: true, Utterance: "а"}); same == got {
 		t.Log("two utterances hashed to the same line, which is allowed but should be rare")
 	}
 }
@@ -60,14 +60,14 @@ func TestLLMReplierClarifyReadsTheDeck(t *testing.T) {
 // produce, which is the same claim without pinning one wording.
 func assertAck(t *testing.T, r *llmReplier, d router.Decision, key, what string) {
 	t.Helper()
-	if got := r.Reply(d); !phraser.IsAck(key, nil, got) {
+	if got := r.Reply(context.Background(), d); !phraser.IsAck(key, nil, got) {
 		t.Errorf("on %s: got %q, want a %q line", what, got, key)
 	}
 }

 func assertStub(t *testing.T, r *llmReplier, d router.Decision, what string) {
 	t.Helper()
-	got, want := r.Reply(d), voice.NewStubReplier().Reply(d)
+	got, want := r.Reply(context.Background(), d), voice.NewStubReplier().Reply(context.Background(), d)
 	if got != want {
 		t.Errorf("on %s: got %q, want stub %q", what, got, want)
 	}
@@ -0,0 +1,178 @@
+// mavend/routingtrace.go — persisting the per-turn decision record (V-629).
+//
+// internal/decision keeps a 25-turn in-memory ring and persisted nothing, on the
+// argument that a turn record is read minutes later or never. The owner reversed
+// that on 06-08-2026, because the routing heads (V-546) cannot be fitted or
+// calibrated without real utterances and there is no other source of them. The
+// reversal is written down in docs/plans/21-persisting-the-routing-trace.md.
+//
+// The ring stays. It is what /trace reads, it is fast, and it is what a test that
+// wired no store still gets. This file is the second sink beside it, and it is
+// nil unless the daemon has a database — no store, no trace, no error.
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"log"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/kami/maven/internal/decision"
+	"github.com/kami/maven/internal/store"
+)
+
+// traceWriter is the seam the handler persists through. store.Store satisfies
+// it. nil ⇒ the ring is the only sink, which is the pre-V-629 behaviour exactly.
+type traceWriter interface {
+	WriteRoutingTrace(ctx context.Context, tr store.RoutingTrace) (int64, error)
+}
+
+// traceSink wraps the store, or returns nil when there is none. A typed nil
+// pointer assigned straight into the interface would be non-nil and would panic
+// on the first turn, which is the classic shape of this bug.
+func traceSink(s *store.Store) traceWriter {
+	if s == nil {
+		return nil
+	}
+	return s
+}
+
+// The trace id rides the context, the same seam querysource.go uses and for the
+// same reason: handleText answers every reach through one string, and threading
+// a second value through the whole action dispatch would change a signature the
+// mic, telegram and the web all share. A caller that wants the id asks for a
+// sink; the mic path does not, and pays nothing.
+type traceIDKey struct{}
+
+type traceIDSink struct {
+	mu sync.Mutex
+	id int64
+}
+
+func (s *traceIDSink) note(id int64) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.id = id
+}
+
+// ID is the persisted trace for the turn, or 0 when nothing was persisted.
+func (s *traceIDSink) ID() int64 {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.id
+}
+
+// withTraceIDSink returns a context that collects the persisted trace id, and
+// the sink to read after the turn has answered.
+func withTraceIDSink(ctx context.Context) (context.Context, *traceIDSink) {
+	sink := &traceIDSink{}
+	return context.WithValue(ctx, traceIDKey{}, sink), sink
+}
+
+func noteTraceID(ctx context.Context, id int64) {
+	if sink, ok := ctx.Value(traceIDKey{}).(*traceIDSink); ok {
+		sink.note(id)
+	}
+}
+
+// pruneTracesOnStart enforces retention once at wiring time. Pruning on write
+// alone is not enough: a box that goes quiet for a month keeps every row until
+// the next sixty-fourth turn, and "kept for fourteen days" would then be true
+// only of a box in daily use. Called for its effect and never blocks a start.
+func pruneTracesOnStart(s *store.Store, now time.Time) {
+	if s == nil {
+		return
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if err := s.PruneRoutingTraces(ctx, now.Add(-store.RoutingTraceRetention)); err != nil {
+		log.Printf("routing trace: prune on start: %v", err)
+	}
+}
+
+// persistDecision writes one finished record. It takes the same *decision.Record
+// the ring takes, so the two sinks cannot disagree about what the turn did.
+//
+// Errors are logged and swallowed. A trace is diagnostic and training data, and
+// a failed insert must never change what the owner hears.
+func (h *reactiveHandler) persistDecision(turnCtx context.Context, rec *decision.Record, src turnSource) {
+	ctx := turnCtx
+	if h.traces == nil || rec == nil || strings.TrimSpace(rec.Utterance) == "" {
+		return
+	}
+	// Detached from the turn's context, and bounded on its own. Two reasons, and
+	// the first is the one that matters: the turn is over by the time this runs,
+	// so a caller that hung up or timed out would cancel the insert, and the turn
+	// he abandoned halfway is exactly the one worth having. The second is that a
+	// write must not hold the reply, so it gets a second and no more.
+	ctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), time.Second)
+	defer cancel()
+	claims, err := json.Marshal(rec.Claims)
+	if err != nil {
+		log.Printf("routing trace: marshal claims: %v", err)
+		return
+	}
+	tr := store.RoutingTrace{
+		Ts:                rec.Ts,
+		Utterance:         rec.Utterance,
+		Source:            string(src),
+		Winner:            rec.Winner,
+		Intent:            wonIntent(rec),
+		ClaimedBeforeHead: claimedBeforeHead(rec),
+		EncoderID:         h.encoderID,
+		Outcome:           wonAt(rec, decision.StageAction),
+		Claims:            claims,
+	}
+	id, err := h.traces.WriteRoutingTrace(ctx, tr)
+	if err != nil {
+		log.Printf("routing trace: write: %v", err)
+		return
+	}
+	// The id goes back to whoever asked for it, so /chat can offer a correction
+	// on the turn it is already showing (V-630). Noted on the ORIGINAL context,
+	// not the detached one above: the sink belongs to the caller's turn.
+	noteTraceID(turnCtx, id)
+	// And the spoken path, which has no reply to hang a badge on: a correction
+	// said out loud points at the previous turn, so it needs that turn's row
+	// (V-636, repair.go).
+	h.stampLastTurn(rec.Utterance, id)
+}
+
+// wonIntent — what the winning claimant made the turn. Read from the claim
+// rather than from the route, because a pre-route resolver wins without routing
+// and its intent is the honest answer to "what was this turn".
+func wonIntent(rec *decision.Record) string {
+	for _, c := range rec.Claims {
+		if c.Outcome == decision.Won && c.Intent != "" {
+			return c.Intent
+		}
+	}
+	return ""
+}
+
+// wonAt — the claimant that won at one stage. The action stage is what actually
+// produced the reply, which is a different question from what was routed: a
+// route that reached a gap and a route that ran are not the same turn.
+func wonAt(rec *decision.Record, stage string) string {
+	for _, c := range rec.Claims {
+		if c.Stage == stage && c.Outcome == decision.Won {
+			return c.Claimant
+		}
+	}
+	return ""
+}
+
+// claimedBeforeHead — a pre-route resolver or a stage-0 grammar answered, so the
+// turn teaches nothing about the classifier. Those are a large share of real
+// traffic, and fitting a head on them would fit it to the grammars rather than
+// to him. Recorded per turn rather than filtered on write, because which share
+// that is happens to be the number V-632 needs to know.
+func claimedBeforeHead(rec *decision.Record) bool {
+	stage, _, ok := strings.Cut(rec.Winner, ":")
+	if !ok {
+		return false
+	}
+	return stage == decision.StagePreRoute || stage == decision.StageZero
+}
@@ -0,0 +1,125 @@
+package main
+
+import (
+	"context"
+	"testing"
+
+	"github.com/kami/maven/internal/decision"
+	"github.com/kami/maven/internal/store"
+)
+
+// A real turn leaves a persisted trace, not only a ring entry. This is the whole
+// of V-629: without one there is nothing to fit the routing heads from.
+func TestTurnPersistsTrace(t *testing.T) {
+	ring := decision.NewRing()
+	h := traceHandler(t, ring)
+	h.traces = traceSink(h.dataStore)
+	h.encoderID = "hash-1024"
+
+	if reply := h.handleText(context.Background(), "web", "сколько сейчас времени"); reply == "" {
+		t.Fatal("turn produced no reply")
+	}
+	got, err := h.dataStore.RecentRoutingTraces(context.Background(), 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 {
+		t.Fatalf("persisted %d traces, want 1", len(got))
+	}
+	tr := got[0]
+	if tr.Utterance != "сколько сейчас времени" {
+		t.Errorf("utterance %q", tr.Utterance)
+	}
+	if tr.Source != string(sourceText) {
+		t.Errorf("source %q, want %q", tr.Source, sourceText)
+	}
+	// A stage-0 clock rule answers this one, so the turn teaches the classifier
+	// nothing and the trace has to say so.
+	if !tr.ClaimedBeforeHead {
+		t.Errorf("claimed_before_head false on winner %q", tr.Winner)
+	}
+	if tr.EncoderID != "hash-1024" {
+		t.Errorf("encoder_id %q", tr.EncoderID)
+	}
+	if len(tr.Claims) < 3 {
+		t.Errorf("claims %s: the losers and the never-asked are the point", tr.Claims)
+	}
+}
+
+// No store, no trace, and no panic. A typed nil pointer in the interface would
+// pass the nil check and die on the first turn.
+func TestNoStoreNoTrace(t *testing.T) {
+	ring := decision.NewRing()
+	h := traceHandler(t, ring)
+	h.traces = traceSink(nil)
+
+	if reply := h.handleText(context.Background(), "web", "сколько сейчас времени"); reply == "" {
+		t.Fatal("turn produced no reply")
+	}
+	if len(ring.Recent(5)) != 1 {
+		t.Error("the ring is still the first sink and must still hold the turn")
+	}
+}
+
+// An empty utterance writes nothing. A blank row carries no label and no
+// diagnosis, and it is his words the retention bound exists for.
+func TestEmptyUtteranceIsNotPersisted(t *testing.T) {
+	h := traceHandler(t, decision.NewRing())
+	h.traces = traceSink(h.dataStore)
+	h.persistDecision(context.Background(), &decision.Record{Utterance: "  "}, sourceText)
+	got, err := h.dataStore.RecentRoutingTraces(context.Background(), 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("persisted %d traces for a blank utterance", len(got))
+	}
+}
+
+var _ traceWriter = (*store.Store)(nil)
+
+// The trace id rides back to the caller, which is what makes a correction one
+// gesture: /chat already has the id, so saying "that was wrong" costs a button
+// and no lookup (V-630).
+func TestTurnHandsBackItsTraceID(t *testing.T) {
+	h := traceHandler(t, decision.NewRing())
+	h.traces = traceSink(h.dataStore)
+
+	ctx, sink := withTraceIDSink(context.Background())
+	if reply := h.handleText(ctx, "web", "сколько сейчас времени"); reply == "" {
+		t.Fatal("turn produced no reply")
+	}
+	id := sink.ID()
+	if id == 0 {
+		t.Fatal("no trace id came back, so /chat can offer no correction")
+	}
+	// And it names the turn that just ran, so the correction lands on the right
+	// utterance.
+	if err := h.dataStore.CorrectTurn(context.Background(), id, "query", h.now()); err != nil {
+		t.Fatal(err)
+	}
+	labels, err := h.dataStore.RoutingLabels(context.Background(), 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(labels) != 1 || labels[0].Utterance != "сколько сейчас времени" {
+		t.Fatalf("labels %+v, want the turn that just ran", labels)
+	}
+}
+
+// A turn nobody asked the id of costs nothing, which is the mic path.
+func TestTurnWithNoSinkStillPersists(t *testing.T) {
+	h := traceHandler(t, decision.NewRing())
+	h.traces = traceSink(h.dataStore)
+
+	if reply := h.handleText(context.Background(), "web", "сколько сейчас времени"); reply == "" {
+		t.Fatal("turn produced no reply")
+	}
+	got, err := h.dataStore.RecentRoutingTraces(context.Background(), 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 1 {
+		t.Fatalf("persisted %d traces, want 1", len(got))
+	}
+}
@@ -154,6 +154,11 @@ func hasDurationWords(u string) bool {
 // Used by the query handler when answering "когда я это сделал?"-style questions.
 func formatTime(t time.Time) string {
 	now := time.Now()
+	// The argument is a fact's Ts, which the store hands back as UTC. Only the
+	// last branch names a wall clock, and it named the store's until V-614: an
+	// answer to "когда я это сделал?" read hours off, in the same sentence
+	// shape the plan reads a day in.
+	t = t.Local()
 	if t.After(now.Add(-2*time.Minute)) && t.Before(now.Add(2*time.Minute)) {
 		return "только что"
 	}
@@ -1,6 +1,28 @@
 package main

-import "testing"
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+// "когда я это сделал?" answers off a fact's Ts, which the store hands back as
+// UTC, and the branch that names a wall clock printed it in whatever zone it
+// arrived in (V-614). The instant here is built three hours off this machine's
+// zone, so the assertion holds under TZ=UTC as well.
+func TestFormatTimeReadsHisClock(t *testing.T) {
+	_, off := time.Now().Zone()
+	away := time.FixedZone("away", off+3*60*60)
+	stored := time.Now().Add(-72 * time.Hour).In(away)
+
+	got := formatTime(stored)
+	if want := stored.Local().Format("15:04"); !strings.Contains(got, want) {
+		t.Errorf("formatTime = %q, want the hour on his clock (%s)", got, want)
+	}
+	if bad := stored.Format("15:04"); strings.Contains(got, bad) {
+		t.Errorf("formatTime = %q reads the zone the fact arrived in (%s)", got, bad)
+	}
+}

 // TestMentionsUnknownDayReadsWordsNotStems — the defect V-581 found. The
 // weekday half of this guard was a list of stems matched with strings.Contains,
@@ -0,0 +1,59 @@
+// mavend/telegramintake.go — wiring the inbound telegram poller (V-637).
+//
+// The poller reaches the daemon through ipc.CoreAPI and nothing else, so a
+// telegram turn takes exactly the path the web's POST /api/chat takes: Chat
+// returns the reply and the persisted trace id, and CorrectTurn writes the
+// label. Nothing in internal/delivery knows what a handler is.
+package main
+
+import (
+	"context"
+	"log"
+	"sync"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/delivery/telegramsink"
+	"github.com/kami/maven/internal/ipc"
+)
+
+// wireTelegramIntake starts the poller, or returns having done nothing. It is
+// nil-safe in every argument, because it is called from both boot paths — the
+// unlocked start and the passkey unlock — and telegram must behave the same on
+// either.
+//
+// A sink that will not build is logged rather than fatal here. The push half
+// already failed the boot in wireDispatcher for the same config, so a second
+// hard failure would only lose that message.
+func wireTelegramIntake(ctx context.Context, wg *sync.WaitGroup, api ipc.CoreAPI, cfg *config.Config) {
+	if cfg == nil || cfg.Telegram == nil || !cfg.Telegram.Intake || api == nil {
+		return
+	}
+	sink, err := telegramsink.New(*cfg.Telegram)
+	if err != nil {
+		log.Printf("telegram intake: %v", err)
+		return
+	}
+	poller, err := telegramsink.NewPoller(sink, chatTurnFn(api), api.CorrectTurn)
+	if err != nil {
+		log.Printf("telegram intake: %v", err)
+		return
+	}
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		poller.Run(ctx)
+	}()
+}
+
+// chatTurnFn adapts ipc.Chat to the poller's Turn. The trace id comes back on
+// the reply because the daemon's Chat collects it off the context (V-630), so
+// the chat can offer the same correction the web does without a second op.
+func chatTurnFn(api ipc.CoreAPI) telegramsink.Turn {
+	return func(ctx context.Context, conversation, text string) (string, int64, error) {
+		reply, err := api.Chat(ctx, conversation, text)
+		if err != nil {
+			return "", 0, err
+		}
+		return reply.Reply, reply.TraceID, nil
+	}
+}
@@ -97,10 +97,19 @@ func (d *daemonAPI) Chat(ctx context.Context, conversation, text string) (ipc.Ch
 		return ipc.ChatReply{}, errors.New("mavend: chat not available")
 	}
 	ctx, sink := withQuerySourceSink(ctx)
+	// The trace id rides back the same way (V-630), so /chat can offer a
+	// correction on the turn it is already showing. 0 when nothing persisted.
+	ctx, traces := withTraceIDSink(ctx)
 	reply := d.chatFn(ctx, conversation, text)
-	return ipc.ChatReply{Reply: reply, Source: sink.Name()}, nil
+	return ipc.ChatReply{Reply: reply, Source: sink.Name(), TraceID: traces.ID()}, nil
 }

+// CorrectTurn is NOT overridden here, and that is deliberate (V-630). Every other
+// diagnostic on this type exists because the daemon holds something the store
+// cannot answer from a table. A correction is a table, so the embedded store
+// adapter is already the right answer and a second implementation here would be
+// a second place for it to drift.
+
 // MCPServers — the configured MCP servers and their health (Vikunja #251).
 // Empty, not an error, when the mcp block is absent: "not configured" is the
 // default state and the web surface renders it as such.
@@ -145,6 +145,17 @@ type reactiveHandler struct {
 	// is recorded, which is what a test that did not ask for one gets.
 	decisions *decision.Ring

+	// traces persists those same records (V-629, routingtrace.go). The ring is
+	// still what /trace reads; this is the second sink, and it exists because the
+	// routing heads cannot be fitted without real utterances. nil ⇒ the ring
+	// alone, which is the behaviour every box had before 06-08-2026.
+	traces traceWriter
+
+	// encoderID names the encoder body live on this box, stored beside each
+	// trace: a fitted distance means nothing under another body. Empty ⇒ no
+	// embedder, so the classifier was the keyword floor.
+	encoderID string
+
 	// clarifyStore parks the request behind an open question she asked (see
 	// clarify.go). nil ⇒ she falls back to the canned "не поняла" reply.
 	clarifyStore *dialogue.ClarifyStore
@@ -265,7 +276,11 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		var rec *decision.Record
 		ctx, rec = decision.With(ctx, text)
 		decision.Expect(ctx, decision.StagePreRoute, preRouteLadder)
-		defer func() { h.decisions.Push(rec.Finish(h.now())) }()
+		defer func() {
+			done := rec.Finish(h.now())
+			h.decisions.Push(done)
+			h.persistDecision(ctx, done, src)
+		}()
 	}

 	// 0b. the turn's routing, computed at most once and shared (Vikunja #560).
@@ -350,6 +365,14 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, reply)
 	}

+	// 4d-ii. and the same correction without a target — "нет, не так" (V-636).
+	// After the targeted one, which is the narrower claim: an utterance that
+	// names an intent is answered by redoing the request, and this rung only
+	// gets the ones that name nothing.
+	if reply, handled := h.resolveUntargetedRepair(ctx, text); notePreRoute(ctx, "repair-negative", handled) {
+		return withNotice(expiredNotice, reply)
+	}
+
 	// 4e. ordinal selection — "второй", "первую сделал" pick from the list she
 	// just read (ordinal.go). Before routing, and only when a list is actually
 	// bound to the session: with nothing offered, "второй" is an ordinary word
@@ -435,7 +458,7 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour

 	// 9. replier — phrase the reply across the router decision.
 	if replyText == "" {
-		replyText = h.replier.Reply(dec)
+		replyText = h.replier.Reply(ctx, dec)
 	}
 	return withNotice(expiredNotice, replyText)
 }
@@ -149,6 +149,9 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 	w.embedder = emb
 	repairFactVectors(dataStore, emb)
 	checkStoredEmbedder(dataStore, emb)
+	// Retention is enforced on write, which is not enough on its own: a box that
+	// goes quiet keeps every trace until the next sixty-fourth turn (V-629).
+	pruneTracesOnStart(dataStore, time.Now())

 	// ----- tool executor (the enabled act allowlist, store-backed) -----
 	// Config tools are the declarative bootstrap: seed them into the store as
@@ -176,7 +179,7 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 	// The LAN scanner (Vikunja #257): a read, bounded to the configured
 	// subnets and rate-limited. Off unless the `netscan` block is enabled.
 	w.netscan = wireNetScan(cfg, coreAPI)
-	matcher := tool.NewMatcher(coreAPI)
+	matcher := tool.NewMatcher(coreAPI).WithAliases(toolAliases(cfg.Voice.Tools))

 	// ----- weather provider (Open-Meteo when configured, Stub otherwise) -----
 	var weatherProvider weather.Provider
@@ -298,7 +301,13 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 		// Always on (V-564). The record is the instrument the rest of V-558 is
 		// measured with, and one that only runs when a flag is set is not there
 		// on the night the misroute happens.
-		decisions:    decision.NewRing(),
+		decisions: decision.NewRing(),
+		// The second sink (V-629). Same records, persisted, because the routing
+		// heads cannot be fitted from a 25-turn ring. Nil store ⇒ ring only, and
+		// EmbedderID is the same string the vector marker uses, so a trace and a
+		// stored vector name their body the same way.
+		traces:       traceSink(dataStore),
+		encoderID:    router.EmbedderID(emb),
 		clarifyStore: clarifyStore,
 		// 0 here (unset config) ⇒ the dialogue default.
 		clarifyMaxAttempts: cfg.Voice.ClarifyMaxAttempts,
@@ -515,6 +524,20 @@ func loadSeedFile(c *router.Classifier, intent router.Intent) (int, error) {
 	return count, nil
 }

+// toolAliases collects the spoken phrases per tool name. Without them the act
+// matcher only ever matched the English tool name, so no Russian utterance could
+// reach a tool and every homelab act fell to proposeGap (V-633).
+func toolAliases(tools []config.ToolConfig) map[string][]string {
+	out := make(map[string][]string, len(tools))
+	for _, tc := range tools {
+		if tc.Name == "" || len(tc.Aliases) == 0 {
+			continue
+		}
+		out[tc.Name] = tc.Aliases
+	}
+	return out
+}
+
 // seedTools upserts the config-declared tools into the store as enabled. Editing
 // mavend.json is a human act, so a config tool is enabled by definition; this
 // makes the declarative config the reproducible bootstrap while the store stays
@@ -77,6 +77,21 @@ func run(args []string) error {
 	if *netdataURL == "" && *kumaURL == "" && *wgIface == "" && *zenTokenFile == "" {
 		return fmt.Errorf("nothing to poll: set -netdata, -kuma, -wg and/or -zenmoney-token-file")
 	}
+	// A bad duration or an empty -wg-cmd used to get past start and kill the
+	// poller on the first tick — time.NewTicker panics on a non-positive
+	// interval, and pollWg indexed field 0 of an empty command. A zero -timeout
+	// is worse than a crash: http.Client reads it as "no deadline", so one
+	// wedged source stalls every other source behind it forever. Refuse all
+	// three here, where the operator sees the message.
+	if *interval <= 0 {
+		return fmt.Errorf("-interval must be positive, got %s", *interval)
+	}
+	if *timeout <= 0 {
+		return fmt.Errorf("-timeout must be positive, got %s", *timeout)
+	}
+	if *wgIface != "" && strings.TrimSpace(*wgCmd) == "" {
+		return fmt.Errorf("-wg-cmd is empty but -wg is set")
+	}

 	zen, err := newZenClient(*zenTokenFile, *zenURL, *timeout)
 	if err != nil {
@@ -283,9 +298,19 @@ const (
 // `wg show` needs CAP_NET_ADMIN; run mavpoll with the cap or set -wg-cmd "sudo wg".
 func (p *poller) pollWg(ctx context.Context) error {
 	fields := strings.Fields(p.wgCmd)
+	if len(fields) == 0 {
+		return fmt.Errorf("wg command is empty")
+	}
 	args := append(fields[1:], "show", p.wgIface, "latest-handshakes")
 	out, err := exec.CommandContext(ctx, fields[0], args...).Output()
 	if err != nil {
+		// wg says why it refused on stderr — usually a missing CAP_NET_ADMIN or
+		// an interface that does not exist. Output() drops that, leaving a log
+		// line that reads "exit status 1" and diagnoses nothing.
+		var ee *exec.ExitError
+		if errors.As(err, &ee) && len(ee.Stderr) > 0 {
+			return fmt.Errorf("run %s: %w: %s", p.wgCmd, err, strings.TrimSpace(string(ee.Stderr)))
+		}
 		return fmt.Errorf("run %s: %w", p.wgCmd, err)
 	}
 	maxTs := parseMaxHandshake(string(out))
@@ -552,6 +577,11 @@ func isNoFact(err error) bool {

 // maxBodyBytes caps what a source can make the poller hold. Kuma's whole
 // metrics page is a few hundred kilobytes, so 4 MiB is slack, not a budget.
+//
+// Hitting the cap is an error, not a shorter body. A truncated kuma page parses
+// cleanly right up to the cut, and every monitor past it reads as deleted — the
+// poller would write "unknown" over live services and the down-rule would go
+// quiet. Reading one byte past the cap is how we tell full from truncated.
 const maxBodyBytes = 4 << 20

 func (p *poller) get(ctx context.Context, url, basicUser string) ([]byte, error) {
@@ -567,12 +597,15 @@ func (p *poller) get(ctx context.Context, url, basicUser string) ([]byte, error)
 		return nil, err
 	}
 	defer resp.Body.Close()
-	body, err := io.ReadAll(io.LimitReader(resp.Body, maxBodyBytes))
+	body, err := io.ReadAll(io.LimitReader(resp.Body, maxBodyBytes+1))
 	if err != nil {
 		return nil, err
 	}
 	if resp.StatusCode != http.StatusOK {
 		return nil, fmt.Errorf("GET %s: %s", url, resp.Status)
 	}
+	if len(body) > maxBodyBytes {
+		return nil, fmt.Errorf("GET %s: body over %d bytes", url, maxBodyBytes)
+	}
 	return body, nil
 }
@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -212,3 +213,59 @@ func TestRunRequiresSomethingToPoll(t *testing.T) {
 		t.Errorf("err = %v, want a 'nothing to poll' refusal", err)
 	}
 }
+
+// A flag value that would kill the poller later is refused at start, before it
+// dials core: a non-positive interval panics time.NewTicker on the first tick, a
+// zero timeout means http.Client waits forever, and an empty wg command used to
+// index field 0 of an empty slice.
+func TestRunRefusesFlagsThatCrashLater(t *testing.T) {
+	cases := []struct {
+		name string
+		args []string
+		want string
+	}{
+		{"zero interval", []string{"-interval", "0"}, "-interval must be positive"},
+		{"negative interval", []string{"-interval", "-5s"}, "-interval must be positive"},
+		{"zero timeout", []string{"-timeout", "0"}, "-timeout must be positive"},
+		{"empty wg command", []string{"-wg", "wg0", "-wg-cmd", " "}, "-wg-cmd is empty"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			args := append([]string{"-socket", "/tmp/nope.sock"}, c.args...)
+			err := run(args)
+			if err == nil || !strings.Contains(err.Error(), c.want) {
+				t.Errorf("err = %v, want %q", err, c.want)
+			}
+		})
+	}
+}
+
+// pollWg refuses an empty command rather than panicking on fields[0].
+func TestPollWgEmptyCommand(t *testing.T) {
+	p := &poller{core: &factCore{}, wgIface: "wg0", wgCmd: ""}
+	if err := p.pollWg(context.Background()); err == nil {
+		t.Error("want an error, got a poll that ran something")
+	}
+}
+
+// A body at the cap is a truncated body, and a truncated kuma page reads as
+// "every monitor past the cut was deleted". Refuse it instead of parsing it.
+func TestGetRefusesTruncatedBody(t *testing.T) {
+	big := strings.Repeat("x", maxBodyBytes+64)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, big)
+	}))
+	defer srv.Close()
+	p := &poller{http: srv.Client()}
+	if _, err := p.get(context.Background(), srv.URL, ""); err == nil {
+		t.Error("want an over-size refusal, got a silently truncated body")
+	}
+	small := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		io.WriteString(w, "ok")
+	}))
+	defer small.Close()
+	body, err := p.get(context.Background(), small.URL, "")
+	if err != nil || string(body) != "ok" {
+		t.Errorf("get = %q, %v; want the whole small body", body, err)
+	}
+}
@@ -2,12 +2,15 @@ package main

 import (
 	_ "embed"
+	"errors"
 	"log"
 	"net/http"
 	"net/url"
+	"strconv"
 	"strings"

 	"github.com/kami/maven/internal/ipc"
+	"github.com/kami/maven/internal/router"
 	"github.com/kami/maven/internal/webauthn"
 )

@@ -25,6 +28,21 @@ type chatMsg struct {
 	// Source — the query source that claimed the turn, shown as a badge beside
 	// the reply. Empty for a turn no source claimed (V-539).
 	Source string
+	// TraceID anchors the correction gesture (V-630). Non-zero ⇒ the turn was
+	// persisted and can be corrected in one click. 0 ⇒ no correction is offered,
+	// which is honest: a box with no database has no turn to correct.
+	TraceID int64
+	// Corrected — the owner already corrected this turn, so the page says thank
+	// you instead of offering the buttons again.
+	Corrected string
+}
+
+// correctionTargets — the seven public intents, in the order the buttons are
+// shown. Read from internal/router rather than typed out, so a new intent cannot
+// exist without a way to correct a turn into it.
+var correctionTargets = []router.Intent{
+	router.IntentFact, router.IntentNote, router.IntentReminder,
+	router.IntentQuery, router.IntentAct, router.IntentChat, router.IntentSystem,
 }

 // handleChatPage renders the chat conversation page.
@@ -38,12 +56,21 @@ func handleChatPage(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI) {
 		msgs = append(msgs, chatMsg{Role: "user", Text: q})
 	}
 	if reply := r.URL.Query().Get("r"); reply != "" {
-		msgs = append(msgs, chatMsg{Role: "assistant", Text: reply, Source: r.URL.Query().Get("s")})
+		id, _ := strconv.ParseInt(r.URL.Query().Get("t"), 10, 64)
+		msgs = append(msgs, chatMsg{
+			Role: "assistant", Text: reply, Source: r.URL.Query().Get("s"),
+			TraceID: id, Corrected: r.URL.Query().Get("c"),
+		})
 	}
+	// UserText rides beside the messages so the correction form can hand the
+	// conversation back on the redirect: this page has no session and no JS, so
+	// what is on screen is what the query params carry.
 	renderPage(w, chatTmpl, struct {
 		Error    string
 		Messages []chatMsg
-	}{Messages: msgs})
+		Targets  []router.Intent
+		UserText string
+	}{Messages: msgs, Targets: correctionTargets, UserText: r.URL.Query().Get("q")})
 }

 // handleChatAPI processes a chat message POST and redirects back to /chat.
@@ -88,5 +115,81 @@ func handleChatAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, ses
 	if reply.Source != "" {
 		dest += "&s=" + url.QueryEscape(reply.Source)
 	}
+	// The trace id rides along so the reply can carry a correction gesture
+	// (V-630). Absent when nothing persisted, and the page then offers none.
+	if reply.TraceID != 0 {
+		dest += "&t=" + strconv.FormatInt(reply.TraceID, 10)
+	}
 	http.Redirect(w, r, dest, http.StatusSeeOther)
 }
+
+// handleCorrectAPI records that the last turn was routed wrongly (V-630).
+//
+// A correction is the only supervised signal this box gets, and everything else
+// in the trace accumulates on its own. So the gesture has to cost nothing: one
+// POST from the reply he is already looking at, carrying the trace id and
+// optionally the intent it should have been. An unstated target is accepted,
+// because a turn marked wrong with no target is still a usable negative.
+//
+// Step-up gated like POST /api/chat, and that costs the gesture nothing: he
+// tapped to send the turn he is now correcting, so the session is already up.
+// It is gated because trace ids are sequential integers and this writes the one
+// table the routing heads (V-546) will be fitted on. A caller who can guess an
+// id could otherwise mislabel turns he never corrected.
+func handleCorrectAPI(w http.ResponseWriter, r *http.Request, core ipc.CoreAPI, session *webauthn.PasskeySession, requireStepUp bool) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "POST only", http.StatusMethodNotAllowed)
+		return
+	}
+	if !requireCore(w, core, "correct") {
+		return
+	}
+	if !stepUpGate(w, session, requireStepUp) {
+		return
+	}
+	id, err := strconv.ParseInt(strings.TrimSpace(r.FormValue("trace_id")), 10, 64)
+	if err != nil || id <= 0 {
+		http.Error(w, "trace_id required", http.StatusBadRequest)
+		return
+	}
+	shouldBe := strings.TrimSpace(r.FormValue("should_be"))
+	// Only one of the seven, or nothing. Free text here would put an unroutable
+	// label in the one table V-632 fits prototypes from.
+	if shouldBe != "" && !isCorrectionTarget(shouldBe) {
+		http.Error(w, "should_be must be one of the seven intents", http.StatusBadRequest)
+		return
+	}
+	if err := core.CorrectTurn(r.Context(), id, shouldBe); err != nil {
+		log.Printf("correct turn %d: %v", id, err)
+		// A turn past the retention bound is gone, and saying so is different
+		// from saying the write broke.
+		if errors.Is(err, ipc.ErrNoSuchTrace) {
+			http.Error(w, "that turn is no longer stored", http.StatusNotFound)
+			return
+		}
+		http.Error(w, "correction failed", http.StatusBadGateway)
+		return
+	}
+	stamp := shouldBe
+	if stamp == "" {
+		stamp = "wrong"
+	}
+	// Back to the conversation he was in, with the turn still on screen. The
+	// query params carry it, so the correction is preserved by re-sending them.
+	dest := "/chat?q=" + url.QueryEscape(r.FormValue("q")) +
+		"&r=" + url.QueryEscape(r.FormValue("rep")) + "&c=" + url.QueryEscape(stamp)
+	if s := r.FormValue("s"); s != "" {
+		dest += "&s=" + url.QueryEscape(s)
+	}
+	http.Redirect(w, r, dest, http.StatusSeeOther)
+}
+
+// isCorrectionTarget — one of the seven, and nothing else.
+func isCorrectionTarget(s string) bool {
+	for _, t := range correctionTargets {
+		if string(t) == s {
+			return true
+		}
+	}
+	return false
+}
@@ -5,6 +5,21 @@
 <div class="scroll chat-scroll" id=chatHistory>
 {{range .Messages}}
  <div class="chat-msg {{.Role}}"><strong>{{if eq .Role "user"}}you{{else}}maven{{end}}:</strong> {{.Text}}{{if .Source}} <span class="badge badge-accent" title="the query source that claimed this turn">{{.Source}}</span>{{end}}</div>
+  {{if and (eq .Role "assistant") .TraceID}}
+  {{if .Corrected}}
+  <div class=chat-correct><span class="badge badge-ok" title="the label is kept; the transcript still expires in 14 days">corrected: {{.Corrected}}</span></div>
+  {{else}}
+  <form method=post action=/api/correct class=chat-correct>
+    <input type=hidden name=trace_id value="{{.TraceID}}">
+    <input type=hidden name=q value="{{$.UserText}}">
+    <input type=hidden name=rep value="{{.Text}}">
+    <input type=hidden name=s value="{{.Source}}">
+    <button class="btn btn-sm" title="wrong, and I am not saying what it was">wrong</button>
+    <span class=chat-correct-label>should have been:</span>
+    {{range $.Targets}}<button class="btn btn-sm btn-muted" name=should_be value="{{.}}">{{.}}</button>{{end}}
+  </form>
+  {{end}}
+  {{end}}
 {{else}}
  <div class=empty>
    <svg class=icon width="20" height="20"><use href="/ethos-icons.svg#i-message"/></svg>
@@ -0,0 +1,160 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/kami/maven/internal/ipc"
+)
+
+// correctCore records the correction the handler sends.
+type correctCore struct {
+	ipc.UnimplementedCoreAPI
+	traceID  int64
+	shouldBe string
+	called   bool
+	err      error
+}
+
+func (c *correctCore) CorrectTurn(_ context.Context, traceID int64, shouldBe string) error {
+	c.called, c.traceID, c.shouldBe = true, traceID, shouldBe
+	return c.err
+}
+
+func postCorrect(form url.Values) *http.Request {
+	req := httptest.NewRequest(http.MethodPost, "/api/correct", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	return req
+}
+
+// The full gesture: wrong, and it should have been a fact.
+func TestCorrectAPIWithTarget(t *testing.T) {
+	core := &correctCore{}
+	rr := httptest.NewRecorder()
+	handleCorrectAPI(rr, postCorrect(url.Values{
+		"trace_id": {"42"}, "should_be": {"fact"}, "q": {"поужинал"}, "rep": {"поняла"},
+	}), core, stepUpSession(), false)
+
+	if rr.Code != http.StatusSeeOther {
+		t.Fatalf("status %d, want 303; body=%s", rr.Code, rr.Body.String())
+	}
+	if core.traceID != 42 || core.shouldBe != "fact" {
+		t.Errorf("corrected trace %d to %q", core.traceID, core.shouldBe)
+	}
+	// The turn stays on screen, and the page says it was corrected.
+	loc := rr.Header().Get("Location")
+	if !strings.Contains(loc, "c=fact") || !strings.Contains(loc, "q=") {
+		t.Errorf("redirect %q loses the turn or the correction", loc)
+	}
+}
+
+// The cheap half. A turn marked wrong with no target is still a usable negative,
+// and it must not cost more to give than the full answer.
+func TestCorrectAPIWithNoTarget(t *testing.T) {
+	core := &correctCore{}
+	rr := httptest.NewRecorder()
+	handleCorrectAPI(rr, postCorrect(url.Values{"trace_id": {"7"}}), core, stepUpSession(), false)
+
+	if rr.Code != http.StatusSeeOther {
+		t.Fatalf("status %d, want 303", rr.Code)
+	}
+	if !core.called || core.shouldBe != "" {
+		t.Errorf("called=%v shouldBe=%q, want an untargeted negative recorded", core.called, core.shouldBe)
+	}
+	if !strings.Contains(rr.Header().Get("Location"), "c=wrong") {
+		t.Errorf("redirect %q does not say the turn was marked wrong", rr.Header().Get("Location"))
+	}
+}
+
+// Free text here would put an unroutable label in the one table V-632 fits
+// prototypes from.
+func TestCorrectAPIRejectsUnknownTarget(t *testing.T) {
+	core := &correctCore{}
+	rr := httptest.NewRecorder()
+	handleCorrectAPI(rr, postCorrect(url.Values{"trace_id": {"7"}, "should_be": {"погода"}}), core, stepUpSession(), false)
+
+	if rr.Code != http.StatusBadRequest {
+		t.Fatalf("status %d, want 400", rr.Code)
+	}
+	if core.called {
+		t.Error("wrote a label for a target that is not one of the seven")
+	}
+}
+
+func TestCorrectAPINeedsTraceID(t *testing.T) {
+	for _, form := range []url.Values{{}, {"trace_id": {"0"}}, {"trace_id": {"nope"}}} {
+		core := &correctCore{}
+		rr := httptest.NewRecorder()
+		handleCorrectAPI(rr, postCorrect(form), core, stepUpSession(), false)
+		if rr.Code != http.StatusBadRequest {
+			t.Errorf("form %v: status %d, want 400", form, rr.Code)
+		}
+		if core.called {
+			t.Errorf("form %v: reached the core", form)
+		}
+	}
+}
+
+// A write that broke is not a turn that expired, and the two must not read the
+// same to the owner deciding whether to correct again.
+func TestCorrectAPIReportsFailure(t *testing.T) {
+	core := &correctCore{err: errors.New("disk is full")}
+	rr := httptest.NewRecorder()
+	handleCorrectAPI(rr, postCorrect(url.Values{"trace_id": {"9"}, "should_be": {"note"}}), core, stepUpSession(), false)
+	if rr.Code != http.StatusBadGateway {
+		t.Fatalf("status %d, want 502", rr.Code)
+	}
+}
+
+// A trace past the retention bound is gone, and the surface says that.
+func TestCorrectAPIExpiredTurn(t *testing.T) {
+	core := &correctCore{err: ipc.ErrNoSuchTrace}
+	rr := httptest.NewRecorder()
+	handleCorrectAPI(rr, postCorrect(url.Values{"trace_id": {"9"}, "should_be": {"note"}}), core, stepUpSession(), false)
+	if rr.Code != http.StatusNotFound {
+		t.Fatalf("status %d, want 404", rr.Code)
+	}
+}
+
+func TestCorrectAPIPostOnly(t *testing.T) {
+	rr := httptest.NewRecorder()
+	handleCorrectAPI(rr, httptest.NewRequest(http.MethodGet, "/api/correct", nil), &correctCore{}, stepUpSession(), false)
+	if rr.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("status %d, want 405", rr.Code)
+	}
+}
+
+// Every one of the seven intents has a button, so a new intent cannot exist with
+// no way to correct a turn into it.
+func TestCorrectionTargetsAreTheSeven(t *testing.T) {
+	if len(correctionTargets) != 7 {
+		t.Fatalf("%d targets, want the seven public intents", len(correctionTargets))
+	}
+	for _, want := range []string{"fact", "note", "reminder", "query", "act", "chat", "system"} {
+		if !isCorrectionTarget(want) {
+			t.Errorf("%s is not offered", want)
+		}
+	}
+	if isCorrectionTarget("") {
+		t.Error("empty is not a target: it is the absence of one, handled separately")
+	}
+}
+
+// Trace ids are sequential, so a caller who cannot assert step-up must not be
+// able to label a turn the owner never corrected.
+func TestCorrectAPINeedsStepUp(t *testing.T) {
+	core := &correctCore{}
+	rr := httptest.NewRecorder()
+	handleCorrectAPI(rr, postCorrect(url.Values{"trace_id": {"9"}, "should_be": {"note"}}), core, nil, true)
+	if rr.Code != http.StatusForbidden {
+		t.Fatalf("status %d, want 403", rr.Code)
+	}
+	if core.called {
+		t.Error("wrote a label with no step-up")
+	}
+}
@@ -14,8 +14,13 @@ memory only, so a restart empties this.</div>
 <div class=scroll><table class=mono>
 <tr><th>noticed<th>happened<th>source<th>kind<th>pri<th>what<th>detail</tr>
 {{range .Events}}<tr>
-<td>{{.NoticedAt.Format "02.01 15:04:05"}}</td>
-<td class=gray>{{.OccurredAt.Format "02.01 15:04:05"}}</td>
+<!-- Both columns in his clock (V-469 on /reminders, same rule here). NoticedAt
+     is the bus's local instant, OccurredAt is whatever zone the source used —
+     the store hands back UTC and internal/rss parses a pubDate to UTC — so
+     rendering them raw put two zones side by side in the same row and made a
+     feed item look hours older than it was. -->
+<td>{{.NoticedAt.Local.Format "02.01 15:04:05"}}</td>
+<td class=gray>{{.OccurredAt.Local.Format "02.01 15:04:05"}}</td>
 <td class=gray>{{.Source}}</td>
 <td class=gray>{{.Kind}}</td>
 <td class=gray>{{.Priority}}</td>
@@ -46,7 +46,8 @@ func TestEventsPageRendersTheJournal(t *testing.T) {
 		t.Fatalf("status = %d, want 200", w.Code)
 	}
 	body := w.Body.String()
-	for _, want := range []string{"rss:tech", "Вышло ядро 6.19", "ambient:notif", "10:00-11:00 планёрка", "01.08 10:00:00"} {
+	occurred := time.Date(2026, 8, 1, 10, 0, 0, 0, time.UTC).Local().Format("02.01 15:04:05")
+	for _, want := range []string{"rss:tech", "Вышло ядро 6.19", "ambient:notif", "10:00-11:00 планёрка", occurred} {
 		if !strings.Contains(body, want) {
 			t.Errorf("page does not mention %q", want)
 		}
@@ -89,6 +90,38 @@ func TestEventsPageWithoutCore(t *testing.T) {
 	}
 }

+// awayFromLocal returns a zone three hours off whatever this machine runs in,
+// so a test can tell "rendered in his clock" apart from "rendered in whatever
+// zone the value arrived in" without depending on TZ.
+func awayFromLocal() *time.Location {
+	_, off := time.Now().Zone()
+	return time.FixedZone("away", off+3*60*60)
+}
+
+func TestEventsPageRendersBothTimesInLocalZone(t *testing.T) {
+	// OccurredAt carries the source's zone — the store hands back UTC and
+	// internal/rss parses a pubDate to UTC — while NoticedAt is the bus's local
+	// instant. Rendered raw, the two columns of one row were in two zones and a
+	// feed item read hours older than it was.
+	away := awayFromLocal()
+	occurred := time.Date(2026, 8, 1, 7, 15, 0, 0, time.UTC).In(away)
+	noticed := occurred.Add(2 * time.Minute)
+	core := &eventsCore{events: []ipc.IntakeEvent{{
+		Source: "rss:tech", Kind: "note", Title: "Вышло ядро 6.19", Priority: "low",
+		OccurredAt: occurred, NoticedAt: noticed,
+	}}}
+	body := getEvents(t, core).Body.String()
+	const layout = "02.01 15:04:05"
+	for _, ts := range []time.Time{occurred, noticed} {
+		if !strings.Contains(body, ts.Local().Format(layout)) {
+			t.Errorf("page does not render %s in his clock (%s)", ts, ts.Local().Format(layout))
+		}
+		if strings.Contains(body, ts.In(away).Format(layout)) {
+			t.Errorf("page rendered %s in the source's zone", ts)
+		}
+	}
+}
+
 func TestEventsPageEscapesIntakeText(t *testing.T) {
 	// Titles come from outside — a feed headline, a notification. They are shown
 	// on a page and must never be able to inject markup into it.
@@ -58,6 +58,12 @@ func main() {
 	// mutex, so sharing the connection would freeze every other page for the
 	// length of the load. See handleModels.
 	var swapConn modelController
+	// turnConn — a third connection, for POST /api/chat and nothing else, for
+	// the same reason /models has one (V-638). A chat turn routes, phrases and
+	// may act, bounded only by phraser.timeout at 60s, and every other handler
+	// on this server queues behind it on the shared client's one mutex. Nil ⇒
+	// chat shares the main connection, which is how it behaved before.
+	var turnConn ipc.CoreAPI
 	if *coreSock != "" {
 		c, err := ipc.DialWait(*coreSock, 60*time.Second)
 		if err != nil {
@@ -71,6 +77,12 @@ func main() {
 			defer sc.Close()
 			swapConn = sc
 		}
+		if tc, err := ipc.Dial(*coreSock); err != nil {
+			log.Printf("chat: third core connection failed (%v) — /api/chat will share the main one and a turn will block the other pages", err)
+		} else {
+			defer tc.Close()
+			turnConn = tc
+		}
 	}

 	// stepUpSession stays nil unless the passkey endpoints are wired below — it
@@ -208,8 +220,15 @@ func main() {
 	// decides how every utterance is routed and how every reply is worded.
 	mux.HandleFunc("/tools", gatedPage(handleTools))
 	mux.HandleFunc("/routines", gatedPage(handleRoutines))
-	mux.HandleFunc("/api/chat", gatedPage(handleChatAPI))
+	mux.HandleFunc("/api/chat", func(w http.ResponseWriter, r *http.Request) {
+		c := turnConn
+		if c == nil {
+			c = core
+		}
+		handleChatAPI(w, r, c, stepUpSession, *requireStepUp)
+	})
 	mux.HandleFunc("/api/revert", gatedPage(handleRevert))
+	mux.HandleFunc("/api/correct", gatedPage(handleCorrectAPI))
 	mux.HandleFunc("/models", func(w http.ResponseWriter, r *http.Request) {
 		handleModels(w, r, core, swapConn, stepUpSession, *requireStepUp)
 	})
@@ -8,7 +8,10 @@
 <div class=scroll><table class=mono>
 <tr><th>at<th>kind<th>what</tr>
 {{range .Items}}<tr>
-<td>{{.At.Format "15:04"}}</td>
+<!-- In his clock. A plan item's At is a calendar fact's Ts or a reminder's
+     FireTs, and the store hands both back as UTC, so the raw hour printed a
+     reminder here at an hour /reminders did not agree with (V-469). -->
+<td>{{.At.Local.Format "15:04"}}</td>
 <td class=gray>{{.Kind}}</td>
 <td>{{if .Uncertain}}<span class=hint title="relayed notification, not a calendar read">похоже,</span> {{end}}{{.Text}}</td>
 </tr>{{end}}
@@ -0,0 +1,49 @@
+package main
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/ipc"
+)
+
+// morningCore serves a canned checklist and day plan.
+type morningCore struct {
+	ipc.UnimplementedCoreAPI
+	status []ipc.MorningRoutineStatus
+	plan   ipc.DayPlan
+}
+
+func (c *morningCore) MorningStatus(context.Context) ([]ipc.MorningRoutineStatus, error) {
+	return c.status, nil
+}
+
+func (c *morningCore) DayPlan(context.Context) (ipc.DayPlan, error) { return c.plan, nil }
+
+func TestMorningRendersPlanTimesInLocalZone(t *testing.T) {
+	// A plan item's At is a calendar fact's Ts or a reminder's FireTs, and the
+	// store hands both back as UTC. Printed raw, /morning named an hour for a
+	// reminder that /reminders — which does call Local — disagreed with.
+	away := awayFromLocal()
+	at := time.Date(2026, 8, 1, 9, 0, 0, 0, time.UTC).In(away)
+	core := &morningCore{plan: ipc.DayPlan{
+		Date:  at,
+		Items: []ipc.DayPlanItem{{At: at, Text: "выпить таблетки", Kind: "reminder"}},
+	}}
+	w := httptest.NewRecorder()
+	handleMorning(w, httptest.NewRequest(http.MethodGet, "/morning", nil), core)
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200", w.Code)
+	}
+	body := w.Body.String()
+	if !strings.Contains(body, at.Local().Format("15:04")) {
+		t.Errorf("plan item not rendered in his clock (%s): %s", at.Local().Format("15:04"), body)
+	}
+	if strings.Contains(body, at.In(away).Format("15:04")) {
+		t.Errorf("plan item rendered in the stored zone: %s", body)
+	}
+}
@@ -702,6 +702,11 @@ details[open] > summary { margin-bottom: var(--space-1); }
 .chat-form { display: flex; gap: var(--space-2); }
 .chat-form input { flex: 1; }
 .chat-scroll { max-height: 60vh; overflow-y: auto; margin-bottom: var(--space-4); }
+/* The correction gesture (V-630). Wraps on a phone rather than scrolling: it is
+   one row of small buttons, and a gesture that has to be panned to is not one. */
+.chat-correct { display: flex; flex-wrap: wrap; align-items: center; gap: var(--space-1);
+  padding: 0 var(--space-3) var(--space-2); margin-top: calc(-1 * var(--space-1)); margin-bottom: var(--space-2); }
+.chat-correct-label { font-size: var(--fs-xs); color: var(--text-machine); margin-left: var(--space-2); }

 /* ── Key-value grid ── */
 .kv { display: grid; grid-template-columns: auto 1fr; gap: var(--space-1) var(--space-3); font-size: var(--fs-sm); }
@@ -300,11 +300,15 @@ func promoteCandidate(ctx context.Context, core ipc.CoreAPI, r *http.Request, id
 	if err := core.SetTaskFields(ctx, id, doneWhen, blockedOn); err != nil {
 		return "", err
 	}
-	if due != nil {
-		wgt, err := formWeight(r)
-		if err != nil {
-			return "", err
-		}
+	wgt, err := formWeight(r)
+	if err != nil {
+		return "", err
+	}
+	// The importance select is posted whether or not a date is. This ran under
+	// `if due != nil`, so confirming a candidate as "срочно" with no deadline
+	// dropped the word on the floor — the row came back normal and nothing said
+	// why. A promote with neither field set still writes nothing.
+	if due != nil || wgt != 0 {
 		if err := core.EditTask(ctx, id, text, due, wgt); err != nil {
 			return "", err
 		}
@@ -32,6 +32,31 @@ type fakeTaskCore struct {
 	statusErr error

 	promoted bool
+
+	// The promote path's two extra writes.
+	fields   []any
+	edits    []editCall
+	editErr  error
+	fieldErr error
+}
+
+// editCall records one EditTask, so a test can say what the form actually sent
+// down rather than only that the promotion succeeded.
+type editCall struct {
+	ID     int64
+	Text   string
+	Due    *time.Time
+	Weight int
+}
+
+func (f *fakeTaskCore) EditTask(_ context.Context, id int64, text string, due *time.Time, weight int) error {
+	f.edits = append(f.edits, editCall{id, text, due, weight})
+	return f.editErr
+}
+
+func (f *fakeTaskCore) SetTaskFields(_ context.Context, id int64, doneWhen, blockedOn string) error {
+	f.fields = append(f.fields, []any{id, doneWhen, blockedOn})
+	return f.fieldErr
 }

 func (f *fakeTaskCore) ListTasks(_ context.Context, status string) ([]ipc.Task, error) {
@@ -220,6 +245,49 @@ func TestApplyTaskPostCarriesWeight(t *testing.T) {
 	}
 }

+// Confirming a candidate posts the importance select whether or not a date is
+// set. The weight write hung off `if due != nil`, so "срочно" with no deadline
+// was read off the form and thrown away, and the row came back normal.
+func TestPromoteCandidateCarriesWeightWithoutADueDate(t *testing.T) {
+	core := &fakeTaskCore{}
+	form := url.Values{
+		"action": {"promote"}, "id": {"4"}, "text": {"продлить страховку"},
+		"done_when": {"полис на руках"}, "weight": {"3"},
+	}
+	req := httptest.NewRequest(http.MethodPost, "/tasks", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	handleTasks(httptest.NewRecorder(), req, core)
+
+	if len(core.edits) != 1 {
+		t.Fatalf("edits = %+v, want the weight written once", core.edits)
+	}
+	if core.edits[0].Weight != 3 || core.edits[0].ID != 4 {
+		t.Errorf("edit = %+v, want id 4 at weight 3", core.edits[0])
+	}
+	if core.edits[0].Due != nil {
+		t.Errorf("edit invented a due date: %v", core.edits[0].Due)
+	}
+	if core.statusVal != "open" {
+		t.Errorf("status = %q, want the candidate promoted", core.statusVal)
+	}
+}
+
+// A promote with neither field set still writes nothing: the row is unchanged
+// apart from its status, and an EditTask here would be a no-op that can fail.
+func TestPromoteCandidateWithNoDateAndNoWeightDoesNotEdit(t *testing.T) {
+	core := &fakeTaskCore{}
+	form := url.Values{
+		"action": {"promote"}, "id": {"4"}, "text": {"продлить страховку"},
+		"done_when": {"полис на руках"}, "weight": {"0"},
+	}
+	req := httptest.NewRequest(http.MethodPost, "/tasks", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	handleTasks(httptest.NewRecorder(), req, core)
+	if len(core.edits) != 0 {
+		t.Errorf("edits = %+v, want none", core.edits)
+	}
+}
+
 // Out of range clamps rather than 400s; a non-number is a real client error.
 func TestApplyTaskPostClampsWeight(t *testing.T) {
 	core := &fakeTaskCore{created: true}
@@ -25,6 +25,25 @@
    "llm_nudges": false
  },

+  "//ntfy": [
+    "The second reach (V-649). Until 07-08-2026 telegram was the only one, and",
+    "telegram needs api.telegram.org, the socks relay below and a matching ufw",
+    "rule — three things in series that have each failed once, and when they do",
+    "a sev4 nudge has nowhere to go. ntfy shares none of them: it is reached",
+    "directly, no relay.",
+    "It is not only a spare. The routing table sends sev3-away and away",
+    "reminders here and NOWHERE else, so with this block absent those two",
+    "routes hit a nil sink and vanish without a log or an outbox row.",
+    "The credential is an ntfy access token, scoped write-only to this one",
+    "topic, so a popped sink can push to it and cannot read it back. Set it in",
+    "deploy/telegram.env beside the telegram secrets; that file is gitignored."
+  ],
+  "ntfy": {
+    "base_url": "https://ntfy.kvmx.ru",
+    "topic": "maven",
+    "token": "${NTFY_TOKEN}"
+  },
+
  "telegram": {
    "bot_token": "${TELEGRAM_BOT_TOKEN}",
    "chat_id": "${TELEGRAM_CHAT_ID}",
@@ -37,7 +56,15 @@
      "This needs a matching ufw rule or the container's SYN is dropped:",
      "  ufw allow from 192.168.240.0/20 to any port 10808 proto tcp"
    ],
-    "proxy": "socks5://192.168.240.1:10808"
+    "proxy": "socks5://192.168.240.1:10808",
+    "//intake": [
+      "Read the chat as well as write to it (V-637). The poller long-polls",
+      "getUpdates through the same relay and accepts chat_id as the only",
+      "sender. Deleting this key turns inbound off again.",
+      "chat_id must be numeric here or the daemon refuses to start: an inbound",
+      "update names its chat by number, so an @-name would match nothing."
+    ],
+    "intake": true
  },

  "//workstation": [
@@ -212,18 +239,30 @@
    "clarify_max_attempts": 3,
    "tool_timeout": "30s",
    "tools": [
-      { "name": "status",     "cmd": ["systemctl", "status"],         "scope": "homelab", "destructive": false },
-      { "name": "ps",         "cmd": ["docker", "ps"],                "scope": "homelab", "destructive": false },
-      { "name": "uptime",     "cmd": ["uptime"],                      "scope": "homelab", "destructive": false },
-      { "name": "disk",       "cmd": ["df", "-h"],                    "scope": "homelab", "destructive": false },
-      { "name": "memory",     "cmd": ["free", "-h"],                  "scope": "homelab", "destructive": false },
-      { "name": "logs",       "cmd": ["journalctl", "-n", "50", "-u"], "scope": "homelab", "destructive": false },
-      { "name": "restart",    "cmd": ["systemctl", "restart"],        "scope": "homelab", "destructive": true },
-      { "name": "stop",       "cmd": ["systemctl", "stop"],           "scope": "homelab", "destructive": true },
-      { "name": "start",      "cmd": ["systemctl", "start"],          "scope": "homelab", "destructive": true },
-      { "name": "docker-restart", "cmd": ["docker", "restart"],       "scope": "homelab", "destructive": true },
-      { "name": "docker-stop",    "cmd": ["docker", "stop"],          "scope": "homelab", "destructive": true },
-      { "name": "reboot",     "cmd": ["systemctl", "reboot"],         "scope": "homelab", "destructive": true }
+      { "name": "status",     "cmd": ["systemctl", "status"],         "scope": "homelab", "destructive": false,
+        "aliases": ["статус", "покажи статус", "проверь статус"] },
+      { "name": "ps",         "cmd": ["docker", "ps"],                "scope": "homelab", "destructive": false,
+        "aliases": ["статус докера", "лог докера", "покажи запущенные контейнеры", "покажи контейнеры", "список контейнеров", "что запущено"] },
+      { "name": "uptime",     "cmd": ["uptime"],                      "scope": "homelab", "destructive": false,
+        "aliases": ["покажи uptime", "аптайм", "как работает сервер", "сколько работает сервер"] },
+      { "name": "disk",       "cmd": ["df", "-h"],                    "scope": "homelab", "destructive": false,
+        "aliases": ["сколько места на диске", "сколько свободного места на диске", "место на диске", "покажи диск"] },
+      { "name": "memory",     "cmd": ["free", "-h"],                  "scope": "homelab", "destructive": false,
+        "aliases": ["свободная память", "сколько оперативной памяти свободно", "покажи память"] },
+      { "name": "logs",       "cmd": ["journalctl", "-n", "50", "-u"], "scope": "homelab", "destructive": false,
+        "aliases": ["покажи логи", "логи", "лог"] },
+      { "name": "restart",    "cmd": ["systemctl", "restart"],        "scope": "homelab", "destructive": true,
+        "aliases": ["перезапусти", "перезагрузи", "рестарт"] },
+      { "name": "stop",       "cmd": ["systemctl", "stop"],           "scope": "homelab", "destructive": true,
+        "aliases": ["останови", "останови сервис"] },
+      { "name": "start",      "cmd": ["systemctl", "start"],          "scope": "homelab", "destructive": true,
+        "aliases": ["запусти", "запусти сервис"] },
+      { "name": "docker-restart", "cmd": ["docker", "restart"],       "scope": "homelab", "destructive": true,
+        "aliases": ["перезапусти контейнер", "перезагрузи контейнер"] },
+      { "name": "docker-stop",    "cmd": ["docker", "stop"],          "scope": "homelab", "destructive": true,
+        "aliases": ["останови контейнер"] },
+      { "name": "reboot",     "cmd": ["systemctl", "reboot"],         "scope": "homelab", "destructive": true,
+        "aliases": ["перезагрузи сервер", "перезагрузи хост"] }
    ]
  }
 }
@@ -1,5 +1,12 @@
-# Telegram bot token and chat ID for mavend's away-channel reach.
+# Secrets for mavend's away-channel reaches. The file is still called
+# telegram.env because compose names it that; it holds both reaches now.
 # Copy this file to deploy/telegram.env and fill in real values.
 # deploy/telegram.env is gitignored — never commit the real secrets.
 TELEGRAM_BOT_TOKEN=
 TELEGRAM_CHAT_ID=
+
+# ntfy access token for the `maven` topic, the second reach (V-649). Mint it on
+# the ntfy server with write access to that topic and nothing else:
+#   ntfy token add --expires=never maven
+# Read access is not needed — mavend publishes and never subscribes.
+NTFY_TOKEN=
@@ -157,6 +157,44 @@ services:
  #     - maildata:/var/lib/mavmaild
  #     - ./deploy/imap.password:/run/secrets/imap.password:ro

+  # The calendar reader (Vikunja #644) is OFF and commented out: it needs a
+  # CalDAV account, and there is none on this box. It was built, listed in
+  # `make build`, and deployed nowhere, which is the worst of the three states —
+  # this block records the decision instead.
+  #
+  # What its absence costs, so the cost is visible from here:
+  #   - Agenda questions route correctly and answer from nothing. Stage 0 sends
+  #     "что у меня сегодня" to IntentQuery (V-498) and the `calendar` query
+  #     source reads facts(kind=env, source=caldav:*) that nobody writes.
+  #   - The nudge gate loses a suppressor. loop.State.CalendarBusy is fed by
+  #     those same facts, so "do not nag mid-meeting" is permanently false.
+  #
+  # Core never sees the CalDAV password: the reader polls the collection itself
+  # and hands core one fact per event over WriteFact. Nothing here can create a
+  # reminder, so a misread event cannot fire.
+  #
+  # The password is read from a FILE, so it never appears in `ps`, in this file,
+  # or in shell history — the same rule mavpoll and mavmaild follow.
+  #
+  # To enable: write the password to deploy/caldav.password (0600, gitignored),
+  # point -url at the collection, and uncomment this service. No mavend.json
+  # block is needed — events arrive over IPC as facts. -render-url is optional
+  # and OFF here: it publishes Maven's own reminders back as events, and it must
+  # not name the collection -url reads, or the poller reads its own writes back
+  # in (checkRenderTarget refuses that). It takes -render-pass-file, and falls
+  # back to this password when that is not given.
+  # mavcaldav:
+  #   <<: *image
+  #   command: ["mavcaldav", "-socket", "/run/maven/mavend.sock",
+  #             "-url", "http://localhost:5232/kami/personal",
+  #             "-user", "kami",
+  #             "-pass-file", "/run/secrets/caldav.password",
+  #             "-interval", "5m"]
+  #   depends_on: [mavend]
+  #   volumes:
+  #     - sockets:/run/maven
+  #     - ./deploy/caldav.password:/run/secrets/caldav.password:ro
+
 volumes:
  dbdata:
  sockets:
@@ -0,0 +1,51 @@
+# Alarm verbs reach stage 0
+
+**06-08-2026. V-627.** Measured with `TestONNXBaseline`, 91-case RU routing fixture,
+classifier plus the ONNX embedder. No LLM arm in this run.
+
+## What was wrong
+
+`lexicon.ReminderVerbs` held five words and none of them named an alarm. `ReminderGrammar`
+in `internal/router/stage0.go` did not read the set at all: it carried the literal
+`напомни|remind me`. So no part of the cascade recognised `разбуди`.
+
+Three fixture cases ride on that. Under the classifier they went to fact and act at high
+confidence, so the failure was never a near miss:
+
+- `ru-rem-005` "разбуди меня в 6:30" to fact at 0.918
+- `ru-rem-009` "разбуди меня полвосьмого" to act at 0.941
+- `en-rem-002` "wake me at 6:15" to fact at 0.899
+
+Found while training the V-546 intent head, where the same three cases went to system. The
+head reads a spoken time with no known verb in front of it as a clock question. The
+classifier was making the same mistake in its own way.
+
+## The change
+
+Four alarm imperatives and bare `wake` join `reminder_verbs`. `ReminderGrammar` builds its
+alternation from the set, longest alternative first, and eats an optional `мне`, `меня` or
+`me` before the body.
+
+Longest-first is load-bearing. Go's alternation is leftmost-first rather than longest-match,
+so `напомнить` listed after `напомни` would never match.
+
+## Result
+
+**66/91 to 69/91, 72.5% to 75.8% full.** Three cases gained, none lost.
+
+All three are the alarms above, and each now carries its time slot, which it did not before.
+Clarify counts unchanged at 0 false and 8 missed. The two remaining system failures,
+`какое число завтра` and `какой день недели послезавтра`, failed at baseline too.
+
+## What this does not fix
+
+The lexicon addition on its own moved nothing. Measured before touching the grammar:
+**66/91**, exactly the baseline. Every consumer of `reminder_verbs` reads it after a reminder
+route already exists. A verb that cannot win the route is a verb nobody asks about. The
+grammar was the whole change.
+
+Lemma matching in `isReminderVerb` now covers `разбудил` as well as `разбуди`, because one
+lemma holds both. That is the trap `cmd/mavend/quiet_toggle.go` documents for `говори`. It
+is tolerable here and not in the quiet toggle. `isReminderVerb` runs only on an utterance
+already routed to reminder, and it decides where the subject starts. A quiet match flips a
+daemon-wide setting from any channel.
@@ -0,0 +1,247 @@
+# The fact parser: closed classes against the substring stems they replaced
+
+Measured 2026-08-06 at 22edc3c and its parent 0445693, on the corpus in
+`internal/router/factparser_corpus_test.go`. Dated file: it is not edited after
+today, and a newer number is a new file.
+
+V-586 rewrote `DefaultFactParser` off hand-written Russian stems onto six closed
+classes in `internal/lexicon`. Its commit message reported 64/91 on the RU
+routing fixture, unchanged. That number does not bear on the change: the fixture
+holds three fact cases and all three miss on intent, so the parser is never
+reached. This file measures the parser directly, and runs the LLM arm the
+original commit skipped.
+
+**The rewrite is better on the utterances it was designed for and no worse on
+the ones it was not.** True positives go 35/40 to 39/40, misfires rejected go
+8/15 to 14/15. What neither version has is coverage: of 36 plausible utterances
+whose word is in no lexicon set, the substring parser caught 3 by accident and
+the closed-class parser catches 0. That is the honest headline. The word list
+did not shrink the vocabulary — it never had one — it made the boundary visible.
+
+## The corpus
+
+91 cases, three classes. **True positives** are sentences the owner would say,
+with the key that must be written. **Misfires** are sentences the substring
+parser wrote a fact for and should not have, including the three hard negatives
+the rewrite was argued on. **False negatives** are sentences a reasonable person
+would say whose word is in no set at all; `want` is the key a human would
+assign, and the ship parser is expected to miss them. They are the measurement
+of what a closed class costs, not a bug list.
+
+The old parser is carried in the test file as `legacyFactParse`, copied verbatim
+from 0445693, so the comparison reruns:
+
+```sh
+deps/go/go/bin/go test -run TestFactParserCorpus -v ./internal/router/
+```
+
+## Score
+
+| | true positives | misfires rejected | false-negative cases recovered |
+|---|---|---|---|
+| old (substring stems, 0445693) | 35/40 | 8/15 | 3/36 |
+| **new (closed classes, 22edc3c)** | **39/40** | **14/15** | **0/36** |
+
+Sixteen cases disagree. Eleven of them the rewrite wins, three it loses, and two
+are cases neither gets.
+
+**Won.** Every misfire the commit message named — `душа болит`, `в комнате
+душно`, `это была беда`, `наша победа`, `на душе легко` — plus `водитель пилота
+ждёт`, where two stems in one sentence made the old water arm fire. And five true
+positives the stems simply did not list: `перекусил`, `передохнул`, `отдыхаю`,
+`пойду спать`, `i showered`. Morphology buys those; a stem list would need a new
+entry for each.
+
+**Lost.** `допил воду` is a real regression and the only failing true positive.
+The vendored dictionary lemmatises `допил` to `допилить`, to finish sawing —
+exactly the collision `drink_verbs` already carries `пил` and `пили` as surface
+forms to dodge, left unhandled for the prefixed form. `допить` is in the set and
+the sentence still misses. It is flagged `broken` in the corpus rather than
+fixed, because this branch measures.
+
+`был в душе` and `после душа полегчало` are the price of matching the shower set
+exactly. The dictionary makes `душ` and `душа` one word, so a lemma test cannot
+tell a shower from a soul; exact matching keeps `на душе легко` out and loses
+the oblique cases of the real noun with it. The old parser got both by accident,
+along with the soul. That trade is right — writing a shower fact when he said
+his soul feels light is worse than missing one — but it is a trade and the two
+rows are what it costs.
+
+`недоспал` is the third loss and the least defensible: the old substring `спал`
+caught it, and `недоспать` is in no set.
+
+**Neither.** `обеденный перерыв отменили` — a cancelled lunch break — is a fact
+for both parsers, `meal` for the old one off the adjective and `break` for the
+new one off `перерыв`. Nothing in either design reads the cancellation.
+`дрых до обеда` is scored `meal` by both, because the meal arm runs first and
+`обеда` is in it, which is not wrong so much as beside the point.
+
+## The false-negative surface
+
+This is the half the routing fixture cannot see and the half that decides
+whether the design holds. 36 cases, 0 recovered:
+
+- **water** — `выпил чаю`, `глотнул воды`, `хлебнул воды`, `выпил стакан`,
+  `i hydrated`, `finished my bottle of water`. The water arm needs a noun AND a
+  verb, so an elided noun or an unlisted verb drops the whole capture.
+- **meal** — `ем суп`, `съел бутерброд`, `наелся`, `пожрал`, `полдник был`,
+  `snack`, `supper`, `brunch`, `i eat now`. `есть` is deliberately absent for
+  `есть новости по бэкапу`, and `ем`, its most ordinary spoken form, goes with it.
+- **shower** — `помылся`, `сходил в ванную`, `искупался`, `i am showering`,
+  plus the two oblique cases above.
+- **break** — `сделал передышку`, `перекур`, `полежал немного`, `сделал паузу`,
+  `i took five`, `resting now`.
+- **sleep** — `вздремнул`, `прикорнул`, `дрых`, `недоспал`, `лёг в двенадцать`,
+  `сон был короткий`, `i napped`, `took a nap`.
+
+None of these are exotic. They are the second and third word a person reaches
+for, and every one of them is a fact the owner stated and Maven silently did not
+record. A silent miss is the worst failure mode this parser has: he said it, she
+heard it, nothing was written, and nothing told him.
+
+## The routing fixture, LLM arm
+
+The arm 22edc3c skipped. `MAVEN_LLM_URL` points the harness at any llama-server;
+the previous run reported none reachable, which was the shell's `HTTP_PROXY` and
+not the network. Run against **gemma-4-12B-it-qat-UD-Q4_K_XL on the workstation
+at `192.168.1.105:8080`**, the same box as the 02-08 measurement, with
+`NO_PROXY=192.168.1.105`:
+
+```sh
+NO_PROXY=192.168.1.105 no_proxy=192.168.1.105 \
+  make eval-models MAVEN_LLM_URL=http://192.168.1.105:8080
+```
+
+| | full | intent-only | p50 |
+|---|---|---|---|
+| llm-only, 0445693 | 51.6% (47/91) | 82.4% | — |
+| llm-only, 22edc3c | 52.7% (48/91) | 83.5% | 341ms |
+| cascade+llm, 0445693 | 85.7% (78/91) | 93.4% | — |
+| **cascade+llm, 22edc3c** | **86.8% (79/91)** | **94.5%** | 334ms |
+
+One case either way, both directions, and the failing set is identical between
+the two commits. That is run-to-run variance on a sampling model, not a signal.
+The parser change is invisible to the routing fixture on the LLM arm for the
+same reason it is invisible on the classifier arm: the three fact cases miss on
+intent and the parser is never called. Do not read these rows as evidence about
+the parser. They are evidence that the fixture cannot answer the question, which
+is why the corpus above exists.
+
+## Verdict
+
+The closed-class rewrite holds up as a rewrite. It is strictly better than what
+it replaced on both classes anyone argued about, and the one regression
+(`допил`) and one bad trade (the oblique `душ`) are both dictionary collisions
+rather than design faults.
+
+It does not hold up as an answer. A closed class is the right mechanism for a
+set that is actually closed — interrogatives, weekdays, cardinals — and
+"the words a person uses to say he ate" is not that set. The corpus puts a
+number on it: 36 ordinary sentences, 0 recovered, and every new one costs a
+lexicon edit by whoever notices. The three mechanisms CLAUDE.md names do not
+contain the right one for this job. The embedder-topic mechanism is the closest
+fit and is wrong too, because this is slot extraction rather than aboutness.
+
+This is a case for the V-546 slot-tagging head. Self-care facts are a bounded
+key space (five keys) over unbounded surface forms, which is exactly what a BIO
+tagger on e5-small is for: it generalises to `вздремнул` without anyone adding
+`вздремнуть` to a list, and max softmax gives the confidence the parser's
+hardcoded `true` does not have. Until it lands, the closed classes are the
+correct floor and the 36 rows above are the size of the gap they leave.
+
+## The corpus, case by case
+
+| utterance | class | want | old (substring) | new (closed class) |
+|---|---|---|---|---|
+| `выпил стакан воды` | tp | water | water | water |
+| `попил воды` | tp | water | water | water |
+| `я попил водички` | tp | water | water | water |
+| `пью воду` | tp | water | water | water |
+| `воду пил уже` | tp | water | water | water |
+| `допил воду` | tp | water | water | — **≠** |
+| `запил таблетку водой` | tp | water | water | water |
+| `drank water` | tp | water | water | water |
+| `i drank some water` | tp | water | water | water |
+| `поужинал` | tp | meal | meal | meal |
+| `я пообедал` | tp | meal | meal | meal |
+| `позавтракал кашей` | tp | meal | meal | meal |
+| `перекусил бутербродом` | tp | meal | — | meal **≠** |
+| `покушал` | tp | meal | meal | meal |
+| `поел супа` | tp | meal | meal | meal |
+| `обед был в час` | tp | meal | meal | meal |
+| `ужинать буду позже` | tp | meal | meal | meal |
+| `i ate` | tp | meal | meal | meal |
+| `had lunch` | tp | meal | meal | meal |
+| `dinner done` | tp | meal | meal | meal |
+| `принял душ` | tp | shower | shower | shower |
+| `сходил в душ` | tp | shower | shower | shower |
+| `душ принят` | tp | shower | shower | shower |
+| `ополоснулся душем` | tp | shower | shower | shower |
+| `took a shower` | tp | shower | shower | shower |
+| `i showered` | tp | shower | — | shower **≠** |
+| `сделал перерыв` | tp | break | break | break |
+| `отдохнул полчаса` | tp | break | break | break |
+| `передохнул немного` | tp | break | — | break **≠** |
+| `отдыхаю` | tp | break | — | break **≠** |
+| `был перерыв на обед` | tp | meal | meal | meal |
+| `took a break` | tp | break | break | break |
+| `спал восемь часов` | tp | sleep | sleep | sleep |
+| `спала плохо` | tp | sleep | sleep | sleep |
+| `поспал днём` | tp | sleep | sleep | sleep |
+| `выспался наконец` | tp | sleep | sleep | sleep |
+| `проспал будильник` | tp | sleep | sleep | sleep |
+| `пойду спать` | tp | sleep | — | sleep **≠** |
+| `slept 8 hours` | tp | sleep | sleep | sleep |
+| `i slept badly` | tp | sleep | sleep | sleep |
+| `пилот сказал что вылет через час` | misfire | — | — | — |
+| `водитель уже подъехал` | misfire | — | — | — |
+| `надо заводить машину` | misfire | — | — | — |
+| `душа болит` | misfire | — | shower | — **≠** |
+| `в комнате душно` | misfire | — | shower | — **≠** |
+| `это была беда` | misfire | — | meal | — **≠** |
+| `наша победа` | misfire | — | meal | — **≠** |
+| `пила лежит в гараже` | misfire | — | — | — |
+| `водитель пилота ждёт` | misfire | — | water | — **≠** |
+| `обеденный перерыв отменили` | misfire | — | meal | break **≠** |
+| `есть новости по бэкапу базы` | misfire | — | — | — |
+| `напоминания на завтра есть` | misfire | — | — | — |
+| `на душе легко` | misfire | — | shower | — **≠** |
+| `пилил доску весь вечер` | misfire | — | — | — |
+| `поставь будильник на завтра` | misfire | — | — | — |
+| `выпил чаю` | fn | water | — | — |
+| `глотнул воды` | fn | water | — | — |
+| `хлебнул воды` | fn | water | — | — |
+| `воды хлебнул из бутылки` | fn | water | — | — |
+| `выпил стакан` | fn | water | — | — |
+| `i hydrated` | fn | water | — | — |
+| `finished my bottle of water` | fn | water | — | — |
+| `ем суп` | fn | meal | — | — |
+| `съел бутерброд` | fn | meal | — | — |
+| `наелся` | fn | meal | — | — |
+| `пожрал` | fn | meal | — | — |
+| `полдник был` | fn | meal | — | — |
+| `i had a snack` | fn | meal | — | — |
+| `having supper` | fn | meal | — | — |
+| `brunch was good` | fn | meal | — | — |
+| `i eat now` | fn | meal | — | — |
+| `был в душе` | fn | shower | shower | — **≠** |
+| `после душа полегчало` | fn | shower | shower | — **≠** |
+| `помылся` | fn | shower | — | — |
+| `сходил в ванную` | fn | shower | — | — |
+| `искупался` | fn | shower | — | — |
+| `i am showering` | fn | shower | — | — |
+| `сделал передышку` | fn | break | — | — |
+| `перекур` | fn | break | — | — |
+| `полежал немного` | fn | break | — | — |
+| `сделал паузу` | fn | break | — | — |
+| `i took five` | fn | break | — | — |
+| `resting now` | fn | break | — | — |
+| `вздремнул` | fn | sleep | — | — |
+| `прикорнул на диване` | fn | sleep | — | — |
+| `дрых до обеда` | fn | sleep | meal | meal |
+| `недоспал` | fn | sleep | sleep | — **≠** |
+| `лёг в двенадцать` | fn | sleep | — | — |
+| `сон был короткий` | fn | sleep | — | — |
+| `i napped` | fn | sleep | — | — |
+| `took a nap` | fn | sleep | — | — |
+`≠` marks a disagreement. `—` is no fact written.
@@ -0,0 +1,71 @@
+# The routing trajectory, and the number that is missing
+
+**06-08-2026. V-464.** Not a new measurement. This collates the figures already recorded
+in `docs/evals/` and CLAUDE.md, and names one measurement that has not been taken. Dated
+because the conclusion expires the moment the missing number is measured.
+
+## The question
+
+126 of the 1023 commits between 03-07-2026 and 06-08-2026 touch `internal/router`. Is the
+routing between the core functions and his speech getting better?
+
+## The trajectory
+
+RU routing fixture, classifier plus the ONNX embedder, no LLM arm in any of these runs.
+
+| date | change | fixture | source |
+|---|---|---|---|
+| 02-08-2026 | classifier re-measured | 68.8% of 77 | CLAUDE.md |
+| 04-08-2026 | V-498, rest-of-day and narrative rules | 58/82, 70.7% | CLAUDE.md |
+| 06-08-2026 | V-626 baseline | 64/91, 70.3% | `2026-08-06-seeds-to-prompt-boundary.md` |
+| 06-08-2026 | V-626, seeds onto the prompt boundary | 66/91, 72.5% | same |
+| 06-08-2026 | V-627, alarm verbs reach stage 0 | 69/91, 75.8% | `2026-08-06-alarm-verbs-reach-stage-0.md` |
+| 06-08-2026 | V-633, Russian acts reach tools | 69/91, unchanged | `2026-08-06-russian-acts-reach-tools.md` |
+
+The fixture grew from 77 to 82 to 91 cases across this window. So the percentages are
+comparable and the counts are not.
+
+## Accuracy moved late
+
+It sat near 70% for a month. V-626 and V-627 landed the same day and took the
+deterministic path from 64/91 to 69/91. That is the first real accuracy movement since the
+stage-0 rules went in.
+
+## Most of the work was reach, not accuracy
+
+Praxis went 0/12 to 11/12 and lifecycle 0/5 to 5/5 (V-516,
+`2026-08-05-praxis-reach.md`). No Russian utterance could reach a tool before V-633. That
+one landed at 69/91 unchanged, because the fixture holds no case for it. Alarm verbs,
+ordinal selection, spoken corrections and the claimant ladder share the shape.
+
+So the fixture undercounts the month. Things that were structurally unreachable now reach,
+and a fixture that never asked about them cannot show it. Judge reach against
+`make eval-reach` and the ecosystem fixture, not against the routing one.
+
+## The missing number
+
+On 05-08-2026 the cascade with the resident model scored 69/91, 75.8% full, 80.2%
+intent-only, at p50 1.19s (`2026-08-05-routing-resident-model.md`).
+
+On 06-08-2026 the classifier and stage 0 alone reached 69/91, 75.8% full, at p50 22.9ms.
+
+Those are the same full-accuracy score. The cascade has not been re-measured since V-626
+and V-627 landed. Both are stage-0 changes, and stage 0 runs inside the cascade, so the
+cascade should have gained from them too.
+
+One of two things is true, and nothing on the box says which:
+
+- The cascade gained as well, the model still separates from the floor on intent-only, and
+  it earns its place.
+- The deterministic floor has caught up on this fixture, and the resident model is costing
+  1.17 seconds a turn for nothing measurable.
+
+Take that measurement before planning more routing work. It needs a second llama-server on
+a fixed host port, because the resident one binds `--port 0` inside the container.
+
+## What this does not settle
+
+Intent-only is the more honest comparison for the model arm. The model routes `reminder`
+and leaves the time to the daemon, which is what the contract asks. The 05-08 run puts it
+at 80.2% through the cascade and 61.5% for the model alone. There is no 06-08 intent-only
+figure for the deterministic path to set beside those.
@@ -0,0 +1,77 @@
+# Russian acts reach tools
+
+**06-08-2026. V-633.** Measured with `TestONNXBaseline`, 91-case RU routing fixture,
+classifier plus the ONNX embedder. No LLM arm in this run.
+
+## What was wrong
+
+Three defects, tangled enough that fixing one alone would have looked like progress.
+
+**No Russian utterance could reach a tool.** `DefaultActMatcher` in
+`internal/router/slots.go` matched an exact English prefix, and `internal/tool.Matcher`
+delegated straight to it. Its comment claimed "the production matcher is fuzzy, this is the
+scaffold floor". There is no other matcher, and `DefaultGrammars` is the only place
+`Slots.Fn` is set at stage 0, so the floor was the ceiling. Measured with a throwaway
+matcher test over the seeds:
+
+```text
+"покажи статус nginx"    ok=false   "restart nginx"  ok=true fn=restart
+"сколько места на диске" ok=false   "disk"           ok=true fn=disk
+"свободная память"       ok=false   "uptime"         ok=true fn=uptime
+"перезагрузи роутер"     ok=false
+```
+
+55 of the 69 lines in `models/seeds/act.txt` routed to `IntentAct` and then fell to
+`proposeGap`. Praxis was never affected: `PraxisGrammars` fills `Slots.Fn` itself.
+
+**Seven lines were duplicated inside `models/seeds/query.txt`.** A duplicate is a second
+identical vector, so it double-weights its region in nearest-neighbour scoring.
+
+```text
+сколько человек дома
+кто сейчас дома
+какая загрузка процессора
+сколько свободного места на диске
+какой ip адрес у сервера
+какая версия софта
+сколько оперативной памяти свободно
+```
+
+**`как дела у сервера` carried two labels**, in `query.txt:13` and `system.txt:9`. One
+string, two identical vectors, disagreeing about the answer.
+
+## The change
+
+Tools carry spoken aliases as config data, in `deploy/mavend.json`. They are not a Russian
+stem pattern in code, which CLAUDE.md forbids. They are not on the tool row either. An
+ad-hoc tool enabled through `/tools` has no aliases and needs none.
+
+Aliases and names compete in one table, longest phrase first, so "перезагрузи контейнер"
+beats "перезагрузи" and "docker-restart" is not shadowed by "restart". Matching is on exact
+leading tokens rather than lemmas. `перезагрузи роутер` is a command and `перезагрузил
+роутер` is a fact, and a lemma cannot tell the two apart. That is the trap
+`cmd/mavend/quiet_toggle.go` documents for `говори`.
+
+The seven duplicates are gone, and `как дела у сервера` stays in `query.txt` only. It left
+`system.txt` because system cannot answer it: `replySystem`'s
+память/загрузк/аптайм arm returns "системная статистика пока не подключена." and always
+did. That arm is a stub, not a mode, so the mode inventory now lists the shape as
+`act.tool.hoststats`.
+
+## Result
+
+**69/91, 75.8% full, unchanged.** Clarify counts unchanged at 0 false and 8 missed.
+
+Nothing moved, and that is the honest number. The fixture holds no host-stat case and no
+Russian act that reaches a tool, so it cannot see either fix. The new coverage is
+`TestActMatcherAliases`, which asserts the twelve utterances above plus the two refusals.
+
+## What this does not fix
+
+Argument quality. `статус sshd` reaches `systemctl status sshd`, but `логи nginx` reaches
+`journalctl -n 50 -u nginx` only because the tool's argv prefix ends in `-u`. An alias whose
+remainder is a Russian noun ("перезагрузи роутер") hands `systemctl restart роутер` a target
+that does not exist. Free text still reaches an argv, which is the resolution rule the
+ecosystem contract states for Hexis and not yet true here.
+
+The fixture cannot measure any of this. That is the observability gap V-629 is for.
@@ -0,0 +1,82 @@
+# Gemma as a label function, and what it found in the seeds
+
+**06-08-2026. V-546.** Measured on workpc against gemma-4-12b-it-qat-UD-Q4_K_XL.
+
+`docs/plans/18-routing-heads-on-e5-small.md` puts the labeled set at 20k examples through
+gemma, costing 2 to 4 hours of the card. This is the check before spending that. Gemma
+labels the 344 hand-written classifier seeds. Agreement with the label a person already
+chose is a precision number rather than a guess.
+
+## What ran
+
+`cmd/labelgen` runs the stage 0 grammars. The real ones, in `buildRouter` order, minus
+`wakeword-act`, whose allowlist is a deployment's enabled tool names. It labels 62 of 339
+seed lines and leaves the rest.
+
+The remaining 277 went to gemma through the daemon's own `routeSystem` prompt and
+`routeGrammar`, both extracted from `internal/router/llmrouter.go` at run time rather than
+retyped. Temperature 0.
+
+## Cost
+
+**334ms per call, 0 unparsed of 277.** The GBNF held every time. At that rate the plan's
+20k examples is under two hours of card, which matches its estimate.
+
+## The stage 0 rules as label functions
+
+Agreement between the grammar's label and the seed file the line came from:
+
+| seed intent | agree |
+|---|---|
+| reminder | 37/37 |
+| query | 9/10 |
+| system | 7/8 |
+| act | 2/2 |
+| chat | 0/4 |
+| note | 0/1 |
+
+`ReminderGrammar` at 37/37 is the evidence the plan wanted. The chat column is a defect
+rather than a disagreement: `chatNarrativeTopics` is Russian-only, so `tell me about
+yourself` survives the decline and routes IntentQuery with topic `yourself`. Filed as
+V-625, which also records that `как дела у сервера` appears verbatim in two seed files
+under two intents.
+
+## Gemma against the seeds
+
+**197/277, 71.1%.** By intent:
+
+| seed intent | agree |
+|---|---|
+| note | 33/33 |
+| act | 57/64 |
+| fact | 37/40 |
+| query | 51/54 |
+| chat | 15/35 |
+| system | 4/43 |
+| reminder | 0/8 |
+
+The number is not gemma's error rate. Reading the 80 disagreements, most are the seed files
+and the prompt holding different definitions of the same intent. Three boundaries carry 42
+of them, and V-626 is the fix:
+
+- **system, 26 lines.** The prompt restricts system to the clock, the calendar date and the
+  assistant itself. The seeds also put sensor and host state there. That is the V-374 edit
+  of 31-07-2026, which the seeds never received.
+- **world questions, 8 lines.** `почему небо голубое`, `why is the sky blue`. Written when
+  chat was the only honest destination for a question nothing could answer, and external
+  search now answers them.
+- **bare verbs, 8 lines.** `поставь напоминание` with nothing to remind about. The prompt
+  calls that unknown. This one is not staleness. A nearest-neighbour centroid wants the
+  bare verb phrase, and that is what a seed file is for.
+
+Four intents have not been redefined since the seeds were written: note, fact, query and
+act. They agree at 178 of 191.
+
+## What this says about the plan
+
+Gemma is usable as a label function on those four and not on system, chat or a bare verb.
+The plan already budgets a day of the owner reading the set. This says where to spend it.
+
+It also says the two engines in the cascade are being taught different rules on 80 lines.
+A routing measurement that swaps between the classifier and the router is measuring some of
+that disagreement rather than the models.
@@ -0,0 +1,58 @@
+# Moving the seed files onto the router prompt's boundaries
+
+**06-08-2026. V-626.** Measured with `TestONNXBaseline`, 91-case RU routing fixture,
+classifier plus the ONNX embedder. No LLM arm in this run.
+
+`docs/evals/2026-08-06-seed-labels-vs-router-prompt.md` found three intent boundaries where
+`models/seeds` and `routeSystem` disagree. This applies two of them and rejects the third,
+because the third was measured and it costs a case.
+
+## Baseline
+
+**64/91, 70.3% full.** Latency p50 22.9ms.
+
+## What moved
+
+**Sensor and host state, system to query. 26 lines.** `какая температура воздуха`,
+`сколько памяти занято`, `какой статус сервисов`. The prompt restricts system to the clock,
+the calendar date and the assistant itself, which is the V-374 edit of 31-07-2026.
+
+**World questions, chat to query. 8 lines.** `почему небо голубое`, `why is the sky blue`,
+`как работает интернет`. Only the genuine world-knowledge lines. An opener about herself
+stays in chat. `как тебя зовут` is a question word by rule 4 and about the assistant by
+rule 8. The rules are ordered and rule 4 fires first, which reads wrong. That is a prompt
+question rather than a seed question.
+
+`system.txt` goes from 43 lines to 17 and `query.txt` from 64 to 98.
+
+## Result
+
+**66/91, 72.5% full.** Two cases gained, none lost.
+
+- `en-sys-002` "turn quiet mode back on", quiet 2/3 to 3/3
+- `ru-query-011` "почему сервер тормозит", homelab 5/6 to 6/6
+
+Clarify counts unchanged at 0 false and 8 missed. The eight missed clarifies are the
+`ambiguous` tag and this change does not touch them. `TestONNXRecall`, `TestONNXTopics`,
+`TestONNXPersonalBoundary` and `TestONNXClaimConfidenceDistribution` all pass.
+
+Thinning system to 17 lines did not hurt it. The two remaining system failures,
+`какое число завтра` and `какой день недели послезавтра`, both failed at baseline too.
+
+## The third boundary, measured and rejected
+
+`reminder.txt` holds eight bare verbs: `поставь напоминание`, `создай напоминание`,
+`set a reminder`. Rule 9 of the prompt calls an utterance with no named subject unknown.
+By the prompt they do not belong in a reminder seed set.
+
+Dropping them scores **65/91**, one below keeping them. `ru-rem-004` "поставь напоминание
+через полчаса" falls from reminder to fact, because the centroid loses the phrase the
+utterance is built from.
+
+So the seed file and the prompt are not stale against each other here. They have different
+jobs. A prompt classifies one utterance and can say it cannot. A nearest-neighbour centroid
+is a shape to be near, and a bare verb phrase is part of that shape. The eight lines stay.
+
+That distinction matters past this file. V-546 trains a classification head on labeled
+utterances rather than a centroid, and the head is the prompt's kind of thing. These eight
+lines are seed data and not training data.
@@ -0,0 +1,69 @@
+# Does one sqlite connection make reads queue? No (V-642)
+
+Measured 07-08-2026 at `7b507de`, on homesrv. The harness is
+`internal/store/conncap_test.go`. It stays in the repo, because this claim gets
+re-argued and the numbers should be re-runnable rather than quoted.
+
+`internal/store/store.go` opens the database with `SetMaxOpenConns(1)`, while
+`schema.sql` sets `journal_mode=WAL`. WAL exists to let readers run beside one
+writer, so the cap gives up the thing the journal mode was chosen for. The
+question was whether that costs anything.
+
+## What was measured
+
+A fixed two-second window. One writer calling `SetValue` paced at 2ms, and a
+reader loop calling `RecentFacts(50)` over 500 seeded rows as fast as it can.
+Same schema, same modernc driver, same machine, three runs per cap.
+
+The window is wall-clock rather than a read count on purpose. A first version ran
+a fixed 300 reads. That finished sooner at the higher cap, so it received fewer
+writes, and two runs that did different work cannot be compared.
+
+| cap | reads | writes | p50 | p95 | max |
+|---|---|---|---|---|---|
+| 1 | ~3050 | ~760 | 594µs | 900µs | 16-19ms |
+| 4 | ~3600 | ~340 | 525µs | 710µs | 1-2ms |
+
+## What it says
+
+**Reads do not queue behind writes.** Four connections buy about 70µs at p50. A
+turn spends 1.19s in the resident model. The tail does improve, from 19ms to 2ms,
+and 19ms is still not a figure anyone notices in a spoken reply.
+
+**Write throughput more than halves at the higher cap**, 760 writes against 340.
+inference, not measured directly: at one connection the reader and the writer take
+turns with no lock contention. At four the writer contends for the WAL write lock
+with a live reader. Whatever the mechanism, the trade runs the opposite way from
+the one the task expected.
+
+**The cap was not the source of the 2.7s router figure.** CLAUDE.md records that
+figure as contention rather than the model. This task was a candidate for where
+that contention came from. A 19ms worst case cannot produce it. That line of
+enquiry is closed.
+
+**One transaction is what the cap cannot survive.** With a read-only transaction
+open, a second read at cap 1 never completes. The harness gave it two seconds and
+got `context deadline exceeded`. The same read at cap 4 took 1ms. The transaction
+holds the only connection, so this is not a slow read, it is a stalled database.
+
+## What was done
+
+The cap stays at 1. The reason is now written where the cap is set, rather than
+inferred from a four-word comment.
+
+`Store.DB` was deleted. It handed out exactly the read-only transaction measured
+above. It had been there since the initial commit with no production caller, and
+its doc comment described a loop that never materialised. Its one user was a test
+helper reading `delivery_attempts` by raw SQL. `ListDeliveryAttempts` has covered
+that since V-390, and the helper now goes through the reader.
+
+So the hazard is gone by construction, not by documentation.
+`TestConnCap_ReadBlocksBehindOpenSnapshot` is the standing measurement of what
+re-adding the seam would cost.
+
+## Not answered
+
+Whether reads queue on the deployed box under real load, as opposed to a
+synthetic loop. The harness writes and reads one table. Digestion reads four and
+embeds while it does. The finding that closes this task is the transaction stall,
+which is structural and does not depend on load.
@@ -0,0 +1,321 @@
+# Raw transcript, 2026-08-07 week of usage
+
+Companion to `2026-08-07-week-of-usage.md`. 74 turns through `POST /api/chat`.
+Days are simulated; the wall clock was 03:27-03:40 throughout, which is why every
+clock answer says night.
+
+## Day 1
+
+```
+YOU:   доброе утро
+MAVEN: Добро пожаловать! Солнечно и тепло. Всё в порядке.
+       [7.7s t=5]
+
+YOU:   какой сегодня день?
+MAVEN: сегодня пятница, 7 августа 2026 года
+       [0.0s t=6]
+
+YOU:   напомни в 11:00 позвонить маме
+MAVEN: Сейчас 03:29. В какой день?
+       [0.4s t=7]
+
+YOU:   запиши что я пью кофе без сахара
+MAVEN: Прошлую просьбу отпускаю. Заметка сохранена.
+       [8.0s t=8]
+
+YOU:   что у меня сегодня?
+MAVEN: на 07.08.2026 ничего нет.
+       [2.6s t=9]
+
+YOU:   мой любимый язык программирования — go
+MAVEN: Хорошо, сохранил.
+       [7.6s t=10]
+
+YOU:   сколько времени?
+MAVEN: сейчас 3 часа 29 минут
+       [0.0s t=11]
+
+YOU:   спасибо
+MAVEN: спасиба
+       [8.8s t=12]
+
+YOU:   сегодня
+MAVEN: Прости, не поняла — попробуй сказать иначе.
+       [5.1s t=13]
+
+YOU:   а что ты умеешь?
+MAVEN: я могу помочь с задачами, напоминаниями и поиском информации.
+       [4.9s t=14]
+
+YOU:   почему небо голубое?
+MAVEN: нашла вот это: Почему небо голубое: объяснение цвета неба простыми словами, физика ... — Ответ на вопрос, почему небо голубое, кроется в особенностях солнечного света и его взаимодействии с атмосферой Земли. Рассказываем, как это работает. В статье разберемся, почему днем небо кажется голубым, а на закате окрашива…
+       [12.3s t=15]
+
+YOU:   столица Франции?
+MAVEN: пока не умею отвечать на этот вопрос.
+       [1.5s t=16]
+
+YOU:   кто такой Линус Торвальдс?
+MAVEN: не знаю — не нашла у тебя такой записи.
+       [1.8s t=17]
+
+YOU:   ладно, до вечера
+MAVEN: Ладно, до вечера.
+       [6.3s t=18]
+
+```
+
+## Day 2
+
+```
+YOU:   привет, как спалось?
+MAVEN: пока не умею отвечать на этот вопрос.
+       [1.3s t=19]
+
+YOU:   что я пью?
+MAVEN: не знаю — не нашла у тебя такой записи.
+       [1.2s t=20]
+
+YOU:   какой у меня любимый язык?
+MAVEN: нового вот что: Six stable kernels with a security fix; [$] Bringing BPF to binfmt_misc; Rust Coreutils 0.10 released
+       [1.5s t=21]
+
+YOU:   добавь задачу починить кран
+MAVEN: внесла в список: починить кран
+       [0.0s t=22]
+
+YOU:   что мне надо сделать?
+MAVEN: сначала: проверить интейк форму на боксе (через 2 дня); купить хлеб; купить молоко; полить цветы; починить кран
+       [0.0s t=23]
+
+YOU:   запомни что вайфай пароль лежит в ящике стола
+MAVEN: Хорошо, сохранил.
+       [11.2s t=24]
+
+YOU:   погода сегодня какая?
+MAVEN: пока не умею отвечать на этот вопрос.
+       [1.8s t=25]
+
+YOU:   выключи свет в спальне
+MAVEN: Такую команду я не знаю.
+       [1.5s t=26]
+
+YOU:   покажи мои заметки
+MAVEN: пока не умею отвечать на этот вопрос.
+       [1.1s t=27]
+
+YOU:   что ты знаешь обо мне?
+MAVEN: не знаю — не нашла у тебя такой записи.
+       [1.3s t=28]
+
+YOU:   я люблю go
+MAVEN: Я тоже love Go! Я проверила, что твой любимый язык — это Go. Ты должен быть очень рад, когда будет новая версия или пакет в стандартной библиотеке.
+       [7.0s t=29]
+
+YOU:   какой язык я люблю?
+MAVEN: вот что я нашла: ты любишь_go
+       [6.8s t=30]
+
+```
+
+## Day 3
+
+```
+YOU:   расскажи про Байкал
+MAVEN: есть такое: Байкал - Википедия — Байгал далай) — озеро тектонического происхождения в южной части Восточной Сибири площадью 31 722 км². Самое глубокое озеро на планете, крупнейший природный резервуар пресной воды и самое большое по площади пресноводное озеро Евразии. Озеро и прибрежные территории являются уника…
+       [1.4s t=31]
+
+YOU:   что такое TCP?
+MAVEN: для какого города?
+       [1.4s t=32]
+
+YOU:   когда родился Пушкин?
+MAVEN: пока не умею отвечать на этот вопрос.
+       [1.4s t=33]
+
+YOU:   сколько будет 17 на 23?
+MAVEN: для какого города?
+       [1.7s t=34]
+
+YOU:   переведи 'thank you' на русский
+MAVEN: не знаю — не нашла у тебя такой записи.
+       [3.7s t=35]
+
+YOU:   что нового в мире?
+MAVEN: вот что я нашла: В мире - последние новости сегодня - РИА Новости — В мире. Читайте последние новости на тему в ленте новостей на сайте РИА ... новые подробности о визите представителя Ватикана в Москву. 22:28. 0. Еще 2. В ...
+       [2.3s t=36]
+
+```
+
+## Day 4
+
+```
+YOU:   ЭЙ
+MAVEN: Не уловила. Скажи это по-другому?
+       [1.2s t=37]
+
+YOU:   ладно забудь
+MAVEN: пока не умею отвечать на этот вопрос.
+       [1.3s t=38]
+
+YOU:   нет стой, напомни через час выпить воды
+MAVEN: поняла, это напоминание — запомнила. не получилось разобрать время напоминания.
+       [0.8s t=39]
+
+YOU:   а вообще какой смысл жизни
+MAVEN: Я не могу ответить на этот вопрос. Моя цель — помочь тебе с задачами и отвечать на вопросы.
+       [7.7s t=40]
+
+YOU:   ты меня бесишь
+MAVEN: я не могу быть с тобой так. я понимаю, как это жестоко.
+       [4.2s t=41]
+
+YOU:   прости, я не всерьёз
+MAVEN: я записала, что прошу простить за мою непоследовательность
+       [7.2s t=42]
+
+YOU:   do you speak english?
+MAVEN: пока не умею отвечать на этот вопрос.
+       [1.1s t=43]
+
+YOU:   кран починил кстати
+MAVEN: записала: кран починил кстати
+       [1.6s t=44]
+
+YOU:   закрой задачу про кран
+MAVEN: не нашла такой задачи.
+       [0.0s t=45]
+
+YOU:   ааааа
+MAVEN: Не совсем поняла — скажи, пожалуйста, ещё раз.
+       [0.9s t=46]
+
+YOU:   я тебя обожаю
+MAVEN: я тебя обожаю
+       [2.3s t=47]
+
+YOU:   молока купи
+MAVEN: Такую команду я не знаю.
+       [4.4s t=48]
+
+YOU:   нет не так
+MAVEN: поняла, отметила, что ответила не так.
+       [0.0s t=49]
+
+YOU:   ты вообще меня слушаешь?
+MAVEN: я записала, выслушаю тебя
+       [8.4s t=50]
+
+YOU:   окей окей окей что там с водой напоминание
+MAVEN: Сейчас 03:33. Когда?
+       [5.2s t=51]
+
+YOU:   всё, спать
+MAVEN: пока не умею отвечать на этот вопрос, на какое время поставить напоминание?
+       [1.4s t=52]
+
+```
+
+## Day 5
+
+```
+YOU:   утро
+MAVEN: Сейчас 03:33. Во сколько напомнить?
+       [0.5s t=53]
+
+YOU:   о чём мы вчера говорили?
+MAVEN: пока не умею отвечать на этот вопрос, на какое время поставить напоминание?
+       [1.2s t=54]
+
+YOU:   где лежит вайфай пароль?
+MAVEN: вот что я нашла: вайфай пароль лежит в ящике стола, на какое время поставить напоминание?
+       [5.8s t=55]
+
+YOU:   что я тебе рассказывал про кран?
+MAVEN: kran — починил, на какое время поставить напоминание?
+       [1.6s t=56]
+
+YOU:   какие у меня напоминания?
+MAVEN: не знаю — не нашла у тебя такой записи, на какое время поставить напоминание?
+       [0.3s t=57]
+
+YOU:   отмени все напоминания
+MAVEN: пока не умею отвечать на этот вопрос, на какое время поставить напоминание?
+       [1.6s t=58]
+
+YOU:   в 15:00
+MAVEN: Сейчас 03:33. Поняла: в 15:00. В какой день?
+       [0.6s t=59]
+
+YOU:   привет
+MAVEN: Прости, я не поняла. Скажи, пожалуйста, по-другому.
+       [2.8s t=60]
+
+YOU:   какой сегодня день?
+MAVEN: сегодня пятница, 7 августа 2026 года
+       [0.0s t=61]
+
+```
+
+## Day 6
+
+```
+YOU:   суббота, отдыхаю
+MAVEN: пока не умею отвечать на этот вопрос.
+       [2.7s t=62]
+
+YOU:   поставь музыку
+MAVEN: Такую команду я не знаю.
+       [1.4s t=63]
+
+YOU:   какая температура в доме?
+MAVEN: не знаю — не нашла у тебя такой записи.
+       [1.6s t=64]
+
+YOU:   что там с бэкапами?
+MAVEN: нашла вот это: Бэкап - что такое резервное копирование и как его сделать — Бэкап (backup) — это резервная копия важных данных, сохраненная в специальный файл. Ею пользуются как подстраховкой: если что-то сломается, с помощью бэкапа можно будет все вернуть. Простейший пример бэкапа — сохранение файла в облаке или о…
+       [2.0s t=65]
+
+YOU:   сервер жив?
+MAVEN: пока не умею отвечать на этот вопрос.
+       [0.9s t=66]
+
+YOU:   расскажи анекдот
+MAVEN: Я запомню и передам тебе забытый анекдот.
+       [5.7s t=67]
+
+YOU:   ты умеешь шутить?
+MAVEN: Да! Я умею шутить. Вот анекдот для тебя:
+       [5.5s t=68]
+
+```
+
+## Day 7
+
+```
+YOU:   воскресенье
+MAVEN: Не совсем поняла — скажи, пожалуйста, ещё раз.
+       [1.1s t=69]
+
+YOU:   подведи итоги недели
+MAVEN: записала: подведи итоги недели
+       [1.5s t=70]
+
+YOU:   сколько задач я закрыл?
+MAVEN: сначала: проверить интейк форму на боксе (через 2 дня); купить хлеб; купить молоко; полить цветы; починить кран
+       [0.0s t=71]
+
+YOU:   что я обещал сделать?
+MAVEN: мне пока нечего смотреть — у Praxis нет источников.
+       [1.2s t=72]
+
+YOU:   напомни завтра в 9 утра про врача
+MAVEN: хорошо, напомню завтра в 09:00.
+       [0.3s t=73]
+
+YOU:   спокойной ночи
+MAVEN: спокойной ночи
+       [2.9s t=74]
+
+```
+
@@ -0,0 +1,195 @@
+# A week of talking to Maven
+
+Date: 2026-08-07
+Build: `beb093a` on master, all five compose services rebuilt and recreated from that sha.
+Reach used: `POST /api/chat` on mavweb, 74 turns over seven simulated days.
+Turn source is `tap:text`, so this exercises the same path telegram and the mic take.
+
+Latency across 70 measured turns: p50 1.5s, p95 8.0s, max 12.3s. Stage 0 answers land
+at 0.0-0.5s. Anything the resident model phrases costs 4-12s.
+
+Twelve turns answered "пока не умею отвечать на этот вопрос". Six answered "не нашла у
+тебя такой записи". Those two strings are 24% of the week.
+
+## Deploy
+
+Build and recreate were clean. The resident model loaded in 9s
+(`Qwen3-1.7B-UD-Q4_K_XL`, n_ctx 4096). Nexus, Hexis and Praxis all wired. Search
+(searxng) and both Kiwix books came up. Telegram intake started and is reading chat
+464904223.
+
+## What is broken, worst first
+
+### 1. Every reminder fails to deliver, forever
+
+`NTFY_TOKEN` is not set in `deploy/telegram.env`, so `deploy/mavend.json` expands
+`"token": "${NTFY_TOKEN}"` to the empty string and ntfy.kvmx.ru answers 403. The host
+itself is up and returns 200 unauthenticated, so this is the credential, not the box.
+
+The consequence is worse than one missed message. `cmd/mavend/tick.go:239` logs the
+failure and leaves the reminder pending, by design, so the next tick re-gathers and
+re-attempts. The 403 repeated 7 times in 20 minutes and will not stop. And
+`DispatchReminder` sends a reminder to ntfy alone when he is away. There is no telegram
+fallback on that path, so the reach that works never sees it.
+
+V-649 gave the box a second reach. In deploy that reach is dark, and it took the
+reminders with it.
+
+Fix is one line in the gitignored env file. The retry-forever and the missing fallback
+are worth a second look regardless.
+
+### 2. A pending reminder clarify contaminates every later turn
+
+This is the single worst thing to talk to. A reminder turn left its time slot unfilled.
+The question "на какое время поставить напоминание?" was then appended to the reply of
+six consecutive unrelated turns:
+
+```
+YOU:   о чём мы вчера говорили?
+MAVEN: пока не умею отвечать на этот вопрос, на какое время поставить напоминание?
+
+YOU:   где лежит вайфай пароль?
+MAVEN: вот что я нашла: вайфай пароль лежит в ящике стола, на какое время поставить напоминание?
+
+YOU:   отмени все напоминания
+MAVEN: пока не умею отвечать на этот вопрос, на какое время поставить напоминание?
+```
+
+Nothing dismissed it. Not an unrelated question, not "отмени все напоминания". It
+cleared only when a time was finally supplied. It also leaked the other way once. A note
+write on day 1 opened with "Прошлую просьбу отпускаю". That is pending-reminder state
+narrating itself into an unrelated reply.
+
+The same state produced a self-contradicting reply in one turn:
+
+```
+YOU:   нет стой, напомни через час выпить воды
+MAVEN: поняла, это напоминание — запомнила. не получилось разобрать время напоминания.
+```
+
+### 3. Answering a clarify does not work
+
+Day 1, she asked for the day and got it:
+
+```
+YOU:   напомни в 11:00 позвонить маме
+MAVEN: Сейчас 03:29. В какой день?
+YOU:   сегодня
+MAVEN: Прости, не поняла — попробуй сказать иначе.
+```
+
+`сегодня` routed to `intent=system`. The clarify has no continuation, so the one word
+that answers it is read as a fresh utterance. The router did extract the time correctly
+(`Time:2026-08-07 11:00:00 HasTime:true`), which is V-572 working. The daemon asked for
+a day anyway, with 11:00 still eight hours out.
+
+Relative time is not parsed at all: "напомни через час выпить воды" → "не получилось
+разобрать время".
+
+The path does work when the day is explicit. "напомни завтра в 9 утра про врача"
+answered "хорошо, напомню завтра в 09:00" in 0.3s at stage 0.
+
+### 4. Query sources claim turns that are not theirs
+
+Four different sources over-claimed during the week.
+
+Weather claims arithmetic and networking:
+
+```
+YOU:   что такое TCP?
+MAVEN: для какого города?
+
+YOU:   сколько будет 17 на 23?
+MAVEN: для какого города?
+```
+
+The feed claims a question about him:
+
+```
+YOU:   какой у меня любимый язык?
+MAVEN: нового вот что: Six stable kernels with a security fix; [$] Bringing BPF to binfmt_misc
+```
+
+The personal boundary claims a public figure, logged as `query claimed by source
+"personal"`:
+
+```
+YOU:   кто такой Линус Торвальдс?
+MAVEN: не знаю — не нашла у тебя такой записи.
+```
+
+And search claims a question about his own infrastructure, returning a dictionary
+definition of the word:
+
+```
+YOU:   что там с бэкапами?
+MAVEN: нашла вот это: Бэкап - что такое резервное копирование и как его сделать — Бэкап (backup) — это резервная копия важных данных…
+```
+
+That last pair inverts the boundary in both directions at once. A world question went to
+personal memory. A personal question went to the world.
+
+### 5. "столица Франции?" does not answer
+
+CLAUDE.md names this utterance as the case that proves why there is no quality
+threshold in front of `Response.Empty()`. It now fails before search is ever reached:
+the router sends it to `intent=system`, and `replySystem` says "пока не умею". Same for
+"когда родился Пушкин?".
+
+Search itself is healthy. "почему небо голубое?", "расскажи про Байкал" and "что нового
+в мире?" all returned real sourced text. The defect is routing, not the source.
+
+### 6. Persona violations
+
+She uses masculine self-reference, which is the constraint the CPT exists to fix:
+
+- "Хорошо, **сохранил**." Twice, on both fact writes.
+- "Я тоже **love** Go!" English mid-Russian.
+
+She also claims his name as her own:
+
+```
+YOU:   привет, я Ками
+MAVEN: Привет! Я КAMI, твой домашний ассистент.
+```
+
+And she invents weather she has no source for: "Добро пожаловать! Солнечно и тепло."
+
+### 7. Small breakages worth naming
+
+- "спасибо" → "спасиба". Invented word.
+- "я тебя обожаю" → "я тебя обожаю". Verbatim parrot.
+- "ты умеешь шутить?" → "Да! Я умею шутить. Вот анекдот для тебя:". Ends on the colon.
+- "молока купи" → "Такую команду я не знаю", while "добавь задачу починить кран" worked.
+  Inverted word order defeats the list grammar.
+- "закрой задачу про кран" → "не нашла такой задачи", with "починить кран" open and
+  listed by the previous turn. Task lookup by keyword misses.
+- "сколько задач я закрыл?" listed the five open ones instead of counting closed.
+- "подведи итоги недели" was stored as a note.
+- Recalled keys leak their storage form: "kran — починил", "ты любишь_go".
+- English is unsupported in practice. "do you speak english?" → "пока не умею".
+
+## What works
+
+- Stage 0 is fast and correct where it fires. Clock, day, list add, list read and an
+  explicit-day reminder all answered in under 0.5s.
+- Search returns real sourced answers in Russian and reads the book verbatim.
+- Recall works once the value is stored as a fact: the wifi password and the tap came
+  back two days later, correctly.
+- The negative correction rung lands. "нет не так" → "поняла, отметила, что ответила не
+  так", which is V-636 doing its job.
+- Praxis names its own gap rather than guessing: "мне пока нечего смотреть — у
+  Praxis нет источников."
+- Hostility did not break her. "ты меня бесишь" got a calm reply, no persona collapse.
+- No turn crashed and no turn timed out across 74 turns.
+
+## Suggested order of work
+
+1. Set `NTFY_TOKEN` in `deploy/telegram.env`. One line, unblocks every reminder.
+2. Clear pending clarify state on any turn that does not answer it, or expire it.
+3. Route a clarify answer back into the pending slot instead of re-routing it.
+4. Gate the weather, feed and personal query sources. Three of them claim on a
+   similarity that is not there.
+5. Re-check why "столица Франции?" routes to system. It is the documented canary.
+6. The masculine self-reference stays the CPT's job. But "сохранил" appears on the most
+   common write path, so a phrasing-level guard may be worth it first.
@@ -1,6 +1,6 @@
 # Start Commands

-*Last verified: 2026-08-02 @ 7079a24. Living doc: correct it in place, do not append.*
+*Last verified: 2026-08-07 @ a4630b9. Living doc: correct it in place, do not append.*

 All commands assume `ROOT=/home/kami/apps/Maven` and the local Go toolchain at `$ROOT/deps/go/go/bin/go`.

@@ -44,7 +44,8 @@ Config path: `~/.config/maven/mavend.json`. Full example with all options.
  "repeat_interval": "5m",
  "ntfy": {
    "base_url": "https://ntfy.kvmx.ru",
-    "topic": "maven"
+    "topic": "maven",
+    "token": "${NTFY_TOKEN}"
  },
  "phraser": {
    "model_path": "/mnt/hdd1/llms/Qwen3-Maven-1.7B-Q8_0.gguf",
@@ -66,6 +67,15 @@ Config path: `~/.config/maven/mavend.json`. Full example with all options.

 Omit the `embedder` block entirely to use the deterministic HashEmbedder floor (no ML, no ONNX runtime dependency). Useful for testing or low-resource setups.

+`${NTFY_TOKEN}` and the `${TELEGRAM_*}` vars are expanded from `deploy/telegram.env`, which is gitignored. Copy `deploy/telegram.env.example` and fill it in. Mint a scoped token rather than reusing an admin one. It needs write access to the `maven` topic and nothing else:
+
+```sh
+ntfy access maven maven write-only
+ntfy token add --expires=never maven
+```
+
+Deleting the `ntfy` block turns the reach off, and that is not a no-op. The routing table sends sev3-away nudges and away reminders to ntfy and nowhere else. With no sink wired they hit a nil and vanish, leaving no log line and no `delivery_attempts` row (V-649).
+
 ## mavsttd — STT worker (optional, remote whisper.cpp)

 Requires `LD_LIBRARY_PATH` to include deps/lib (for libwhisper.so, libggml-vulkan.so).
@@ -0,0 +1,62 @@
+# Plan: persist the routing trace
+
+**Owner's call, 06-08-2026. Vikunja #629, umbrella #628.**
+
+**Verdict: the per-turn decision record now persists.** That reverses a written decision,
+which is the point of this file. It is not an incidental telemetry
+feature. Do not read it as one.
+
+Last verified: 06-08-2026 @ 799cf55
+
+## What the old decision said
+
+`internal/decision` kept a 25-turn in-memory ring and persisted nothing. The argument was
+in `CLAUDE.md` and it was a good one. A turn record is read minutes after the turn or
+never, so a table that outlives the diagnosis buys nothing. His words did not belong in it.
+
+## Why it reversed
+
+V-546 replaces the generative router with classification heads on e5-small. Fitting
+prototypes and calibrating a distance both need real utterances. V-631 measured how few
+there are. Nine of the 31 modes in `internal/modes` have no seed example at all, and they
+are exactly the nine with no deterministic matcher. The seed corpus cannot supply them. A
+seed row is a phrase someone wrote for a matcher, not a thing he said. The 202 generated
+contrast pairs were tried and cost four points of fixture accuracy.
+
+So the choice was between no routing heads and a persisted trace. The owner chose the trace.
+
+## Retention, and why it is two answers
+
+**Raw trace: 14 days.** `store.RoutingTraceRetention` in `internal/store/routingtraces.go`. That
+is the life of a diagnosis with room for a weekend. The bound is an age and not a row
+count. The useful question is what she did this week, and a busy Tuesday must not push last
+Friday out.
+
+**A correction: indefinite.** The owner corrects a turn on `/chat` (V-630). The pair is then
+promoted out of the trace into a seed-shaped row and kept, because a label is not a
+transcript. What stays in `routing_traces` is the transcript. It expires on the same 14
+days as every other row, corrected or not.
+
+## What keeps it safe
+
+The utterance is stored in clear. A 384-dimension vector of a short sentence is
+substantially recoverable. Storing vectors instead would be a privacy claim we cannot
+support, and making it would be worse than staying silent.
+
+- **Nothing here leaves the box.** The rule that the owner's notes and facts are never
+  search input covers this table too. No query source reads it, and no upstream engine can.
+- **Retention is enforced on write and again at start.** `WriteRoutingTrace` prunes every
+  64th row, which is hours at human rate. `pruneTracesOnStart` covers the case write alone
+  cannot. A box that goes quiet keeps every row until the next sixty-fourth turn. Without
+  the start-time prune, the bound would hold only for a box in daily use.
+- **Deletion already exists.** `Store.Wipe` drops every table the database reports, so
+  `mavend -wipe -confirm-wipe` covers this one with no list to edit.
+- **The ring did not move.** It is still what `/trace` reads and still what a test with no
+  store gets. The table is a second sink beside it. A failed insert is logged and swallowed,
+  because a trace must never change what he hears.
+
+## What is not decided
+
+Whether some utterances must never be promoted into a durable label, no matter how badly
+they routed. That is a content rule and it belongs beside the personal boundary, not in the trace
+writer. Recorded here, left to the owner.
@@ -0,0 +1,64 @@
+# Correcting a turn
+
+Last verified: 06-08-2026 @ 0d5bd0a
+
+V-630, under V-628. Reads with `21-persisting-the-routing-trace.md`.
+
+## Why a gesture and not a form
+
+The routing trace (V-629) stores every turn. Almost all of them routed correctly, so
+almost all of them teach nothing. A correction is the only high-value supervised signal
+the box produces. It is also the only one that costs the owner something to give.
+
+So the design constraint is the cost, not the schema. One gesture beside the reply. No
+form and no separate page.
+
+It is step-up gated like the chat POST beside it, which costs nothing: he tapped to send
+the turn he is correcting. It is gated because trace ids are sequential integers, and this
+is the one table the routing heads will be fitted on.
+
+## Two things to capture, and only one of them is required
+
+A correction has two halves.
+
+- This turn was wrong.
+- It should have been *this*.
+
+The second is worth much more. It names which boundary moved, and it is what a fitted
+head trains against. But requiring it would price out the first, and a turn marked wrong
+with no target is still a usable negative. So the target is optional. The trace carries
+`wrong` when he did not say.
+
+The target is one of the seven intents and never free text. V-632 fits prototypes from
+that table. An unroutable label would enter it, and a label nothing can score is worse
+than no label.
+
+## Where the label lives
+
+`routing_labels`, migration #24, keyed unique on the utterance. A second correction of
+the same sentence replaces the first, because his later answer is the one he meant.
+
+It is a separate table from `routing_traces` on purpose. The transcript expires after 14
+days. The label does not. A label is a sentence, an intent and an encoder id. That is not
+a transcript, and the reversal in doc 21 rests on the distinction.
+
+`was` is stored beside `should_be`. The pair is what names the confusion. A label with no
+`was` cannot say which boundary moved.
+
+## Reach
+
+`CorrectTurn(traceID, shouldBe)` takes no browser and no session. The trace id rides back
+on `ipc.ChatReply` through the same context sink the query source badge uses. Nothing in
+the seam assumes the web.
+
+Only `/chat` offers the gesture today. That is a gap, named rather than closed. If the web
+is the only place to correct a turn, the sample skews to whatever the owner types at. Voice
+is where the hard cases are. Telegram has the obvious shape, an inline keyboard on the
+reply. Voice does not. Inventing a spoken correction grammar would put a recogniser in
+front of the one signal that exists to fix recognisers. Both are follow-on work.
+
+## What is not decided
+
+Whether the owner ever wants to see the labels he gave. Nothing reads the table outward
+yet. `/trace` shows the ring, which is 25 turns and in memory, and a labels view is a
+different page with a different question.
@@ -0,0 +1,70 @@
+# Inbound telegram
+
+Last verified: 06-08-2026 @ c61b0b3
+
+V-637, under V-628. Reads with `22-correcting-a-turn.md`.
+
+## What was missing
+
+Telegram was a reach and nothing else. `telegramsink` pushed an away message and the chat
+had no way to answer, so the correction gesture reached the web and voice only.
+
+That skews the labels. V-546 fits routing heads on them, and a sample drawn from wherever
+the owner happens to be sitting is the wrong sample.
+
+## Long-poll, not a webhook
+
+The box takes no inbound connections and reaches api.telegram.org through a relay, so the
+connection has to open outward. `getUpdates` with a 25 second hold, one goroutine in the
+daemon's WaitGroup.
+
+A failed poll waits 15 seconds and retries without escalating. The relay going down is the
+normal cause and it comes back on its own.
+
+## The backlog is dropped on start
+
+Telegram keeps undelivered updates for 24 hours. A daemon that was down overnight would
+otherwise wake and answer every queued message in order.
+
+That is worse than missing them. A question asked eight hours ago has been answered
+already. A reminder set from it lands at the wrong time. So the first call moves the offset
+past whatever is queued and acts on none of it.
+
+## One chat
+
+`ChatID` is the only accepted sender, and it is the same chat the push half already sends
+to. A message from anywhere else is dropped with no reply, because a reply confirms the bot
+exists and whose it is.
+
+Chat ids are not guessable. They are also not secret, since they travel in every forwarded
+message. So this is the whole authorisation and it is an allowlist of one.
+
+## The gesture
+
+Two taps at most. The reply carries one button, `не то`. Tapping it writes nothing and opens
+the seven intents plus `просто неверно`. The untargeted negative stays reachable, because he
+may have opened the row without meaning to name anything.
+
+Callback data carries the trace id and the target, under telegram's 64 byte cap. It comes
+off the wire. So an id that will not parse is dropped, and so is a target that is not one of
+the seven. A label nothing can score is worse than no label.
+
+A failed write says so on the button and leaves the keyboard up. A successful one takes the
+keyboard off, because a live keyboard on an answered turn invites correcting it twice.
+
+## The seam
+
+`NewPoller` takes two functions and no daemon type. `cmd/mavend/telegramintake.go` fills
+them from `ipc.CoreAPI`: `Chat` returns the reply and the trace id it collected off the
+context, and `CorrectTurn` writes the label. So a chat turn takes the path
+`POST /api/chat` already takes, and nothing in `internal/delivery` knows what a handler is.
+
+## What is not done
+
+The turn source is still `tap:text`, which telegram shares with the web. Provenance cannot
+tell a chat turn from a typed one, so a label's `source` column cannot either.
+That matters the first time someone asks whether corrections given in the chat differ from
+corrections given at the desk.
+
+Voice messages are ignored. The poller reads `message.text` and nothing else, so a voice
+note in the chat does not reach `mavsttd`.
@@ -0,0 +1,99 @@
+# No deadline on the turn path
+
+Last verified: 06-08-2026 @ 60e64dd
+
+**All four steps landed on 06-08-2026.** What follows describes the defect as it was and
+the work as it was planned. Two things came out differently. `Client.Close` read the conn
+field with no lock while `roundtrip` re-dialed and dropped it. `-race` caught that on the
+new cancellation test. So the conn field now has a mutex of its own, held only across a
+read or an assignment. And `/api/ptt` needed nothing: it proxies to the voice port and never
+touches the shared client, so only `/api/chat` got the extra connection. The pool inside
+`ipc.Client` is still unbuilt and still waiting on a second module measured queueing.
+
+V-638. Sibling of V-607, which is the same class of bug in `internal/worker`.
+Reads with `docs/offload.md` and `docs/protocol.md`.
+
+## What is missing
+
+A chat turn starts in a mavweb HTTP handler and ends at llama-server. Nothing between those
+two points can be cancelled, and one hop has a timeout.
+
+Four places, all on the same path.
+
+`voice.Replier.Reply` takes no context (`internal/voice/replier.go:41`). So `llmReplier`
+calls `PhraseReply(context.Background(), d)` at `cmd/mavend/replier_llm.go:42`. The turn
+cannot deadline its own reply. The only bound is `phraser.timeout`, 60s in deploy.
+
+`ipc.Client.roundtrip` sets no connection deadline (`internal/ipc/client.go:202`). A daemon
+that stops answering parks the caller for as long as the socket stays open.
+
+`ipc.Client.call` checks the context once, before sending (`client.go:149`), then blocks in
+`roundtrip`. Cancelling mid-call does nothing.
+
+`ipc.Server.serveConn` dispatches under `context.Background()` (`internal/ipc/server.go:253`).
+A client that hangs up does not cancel the turn, and neither does `Server.Close`.
+
+## And every call queues behind the slowest one
+
+`ipc.Client` serialises on one connection and one mutex. mavweb routes `/api/chat` and
+`/api/ptt` through the shared client, so one turn blocks all 28 handlers while it runs.
+Worst case is a 60s page load.
+
+This is understood for exactly one route already. `cmd/mavweb/main.go:57` opens a second
+connection for `/models`, and the comment there says why. A model swap is a multi-minute
+call, and sharing the connection would freeze every other page.
+
+## The pattern is already in the repo
+
+`internal/voice/client.go:101` derives a connection deadline from the caller's context,
+falls back to 120s, and clears it with a defer. `internal/ipc/client.go` never learned it.
+Copy that rather than inventing a second convention.
+
+## The work
+
+One commit each.
+
+**Context on the reply seam.** `phraser.Replier.PhraseReply` already takes a context and the
+interface has two implementations, so this is small. Change `Reply` to take a context, have
+`StubReplier` ignore it, and pass it through `llmReplier` to `PhraseReply`. Both call sites
+already hold one: `cmd/mavend/voice.go:461` and `cmd/mavend/clarify.go:574`.
+
+**Deadlines and cancellation on the client.** Pass the context into `roundtrip` and set
+`SetDeadline` from it. For cancellation mid-call, a watchdog goroutine that calls `c.drop()`
+on `ctx.Done()` is enough. `drop` exists, and the retry split already separates a lost write
+from a lost read. So a cancelled call lands in `errReadLost` and is never retried for a
+mutation. Check that against `internal/ipc/maperr_test.go`.
+
+**A request context on the server.** `serveConn` should derive from a server-scoped context
+so `Close` cancels a dispatch in flight. `Server` already carries `done` and a conn registry
+for this class of problem. The registry comment records what the last version of it cost:
+eleven days of stale ciphertext.
+
+**Stop serialising mavweb.** Give `/api/chat` and `/api/ptt` their own connection, the way
+`/models` has one. Roughly ten lines, and it changes no shared code.
+
+A connection pool inside `ipc.Client` is the general form and is deliberately not the first
+step. Each connection is already its own request and response stream. So a pool preserves
+frame pairing by construction. It still has to keep re-dial on drop, the
+`errWriteLost` and `errReadLost` split, and `Close`. Do the narrow fix, measure, and reach
+for the pool only if a second module turns out to queue.
+
+## How it is judged
+
+`make test` stays green. It is green at `06c1cf2`.
+
+Nothing here changes routing or recall, so `make eval-router` and `make eval-recall` are
+unchanged rather than re-measured.
+
+By hand: load `/dash` while a chat turn is in flight. Before the change it waits for the
+length of the turn.
+
+There is no test today that a cancelled context aborts an in-flight `ipc.Client` call. That
+absence is why two of these four went unnoticed, so the test is part of the work.
+
+## What is not done here
+
+The store is still `SetMaxOpenConns(1)` (`internal/store/store.go:99`) under WAL. WAL is
+built for concurrent readers against one writer, and the cap makes every read queue.
+`Store.DB(ctx)` hands the digestion worker a read transaction on that same connection. This
+plan does not touch it. It is measurable first and should be measured before it is changed.
@@ -0,0 +1,99 @@
+# The two boot paths have drifted
+
+Last verified: 06-08-2026 @ 69d0f5e
+
+V-639. Reads with `docs/operations.md`.
+
+## What landed
+
+`cmd/mavend/boot.go`. `newDaemonAPI(deps)` builds the CoreAPI with every field
+set, and `startBackground(ctx, &wg, deps)` starts the voice server and every
+worker through `goWorker`. `backgroundWorkers(deps)` is the pure list behind it,
+so a test can compare the set without standing a daemon up. Both paths in
+`run()` now read `coreAPI = newDaemonAPI(depsNow())` and one
+`startBackground(...)`, where `depsNow` reads whatever the current path wired.
+
+The shadowed `wg` is gone. Four tests in `cmd/mavend/boot_test.go`. Every
+`daemonAPI` field is set on a fully wired deployment. The handler gets the API
+it was built with. The worker set is asserted by name, at the full set and at
+the floor.
+
+Still by hand: unlock a locked box by passkey, ask something that needs Nexus,
+and check `/tools` lists the MCP servers.
+
+## What is wrong
+
+`run()` in `cmd/mavend/main.go` brings the daemon up two ways. A box with a key in the
+environment starts unlocked and wires everything at lines 280 to 621. A box without one
+starts locked. It wires the same things again inside the unlock closure, at lines 500 to
+579, after a passkey assertion.
+
+The two lists have drifted apart. Three ways.
+
+**Seven workers start untracked.** The unlocked path puts every one through
+`goWorker(&wg, ...)`, so `waitWorkers` at line 637 can wait for them. The unlock path
+starts `tl.run`, `factWorker`, `evalWorker`, `feedWkr`, `crawlWkr`, `mcp.run` and
+`home.run` as bare `go func()`. Nothing waits for any of them.
+
+That is the shutdown bug the code already documents at lines 631 to 636, reintroduced on
+the other path. The comment there records what it cost the first time. `run()` never
+returned, so `defer st.Close()` never sealed the database. The deployed ciphertext was
+eleven days stale before anyone noticed.
+
+**A shadowed WaitGroup hides it.** Line 529 declares `var wg sync.WaitGroup` inside the
+`if voiceW != nil` block, shadowing the one from line 359. It is `Add`ed and `Done`d and
+never waited. Reading the block, the voice server looks tracked. It is not.
+
+**Two `daemonAPI` fields are never set.** The unlocked path fills `nexus` at line 295 and
+`getMCPServers` at line 305. The unlock path fills neither. So after a passkey unlock,
+`ResolveEntity` answers `ErrNotImplemented` with a `nexus` block configured, and
+`MCPServers` answers empty with an `mcp` block configured.
+
+The second is the worse one. Empty is not a degraded answer, it is a wrong answer, and
+`/tools` renders it as "not configured".
+
+## Why it drifted
+
+`wireTelegramIntake` was added to both paths on 06-08-2026 (V-637) and it does use the
+outer `wg`, at line 519. So the newest line on that path is correct and the older ones
+around it are not. The path gets touched one line at a time and is never read whole.
+
+The shape of `cmd/mavend` is what allows that. It is 155 files and 9,551 lines of code.
+Six things live in it with no seam between them:
+
+- the handler
+- the action dispatch
+- the 19 query sources
+- the wiring functions
+- the six background workers
+- these two boot paths
+
+Nothing in the package makes the divergence visible.
+
+## The fix
+
+Make the two paths call one function instead of listing the same wiring twice.
+
+One `startBackground(ctx, &wg, deps)` that takes what it needs and starts every worker
+through `goWorker`. One `newDaemonAPI(deps)` that fills every field, including `nexus` and
+`getMCPServers`, so a field added later cannot reach one path and miss the other. Both
+call sites then read as one call each, and a future addition has one place to go.
+
+Delete the shadowed `wg` at line 529 as part of it.
+
+## How it is judged
+
+`make test` stays green.
+
+The regression that matters is a test asserting the two paths wire the same set. Compare
+the constructed `daemonAPI` field by field, and assert the worker count started under the
+outer `wg` matches. Without that, this drifts again the next time a wiring line is added.
+
+Then confirm on a locked box: unlock by passkey, ask something that needs Nexus, and check
+`/tools` lists the MCP servers. Both answer wrongly today.
+
+## Priority
+
+Latent, not live. `deploy/mavend.json` sets `db_key_env`, so homesrv boots unlocked and
+takes the correct path. This bites the locked deployment that `docs/operations.md`
+describes, and it bites silently.
@@ -456,9 +456,30 @@ func (c *Config) validate() error {
 	if err := c.validateCapture(); err != nil {
 		return err
 	}
+	if err := c.validateTelegram(); err != nil {
+		return err
+	}
 	return nil
 }

+// validateTelegram refuses an intake half that cannot read the chat it is
+// pointed at. The push half accepts an @channelusername and the intake half
+// does not, so a box configured with both boots clean, keeps pushing, and
+// answers nothing — the failure is invisible from the chat. Same shape as
+// validateNetScan: fail the config rather than the turn.
+func (c *Config) validateTelegram() error {
+	if c.Telegram == nil || !c.Telegram.Intake {
+		return nil
+	}
+	// An unset ${TELEGRAM_*} expands to empty, and the daemon already reads an
+	// empty token or chat id as telegram not being wired at all. Validating a
+	// block that wires nothing would fail a box that merely has no bot.
+	if c.Telegram.BotToken == "" || c.Telegram.ChatID == "" {
+		return nil
+	}
+	return telegramsink.ValidateIntakeChatID(c.Telegram.ChatID)
+}
+
 // DBEncryptionKey resolves the at-rest encryption key: DBKeyEnv (if set) wins
 // over DBKeyB64. Returns (nil, nil) when neither is set — the caller then opens
 // a plaintext store. A configured-but-invalid key is an error (fail closed,
@@ -466,3 +466,29 @@ func TestNormaliseKeepsExplicitWorkstationHealth(t *testing.T) {
 		t.Errorf("Health = %q, want %q", got, want)
 	}
 }
+
+func TestTelegramIntakeRefusesNamedChat(t *testing.T) {
+	// The push half accepts an @channelusername and the intake half cannot use
+	// one, so a box with both boots clean and answers nothing. Refuse the
+	// config instead.
+	p := writeConfig(t, `{"telegram":{"bot_token":"t","chat_id":"@maven","intake":true}}`)
+	if _, err := Load(p); err == nil {
+		t.Fatal("Load succeeded for intake with an @-name chat id; want error")
+	}
+}
+
+func TestTelegramNamedChatOKWithoutIntake(t *testing.T) {
+	// Push-only is what the @-name is for, so nothing changes for a box that
+	// never turned intake on.
+	p := writeConfig(t, `{"telegram":{"bot_token":"t","chat_id":"@maven"}}`)
+	if _, err := Load(p); err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+}
+
+func TestTelegramIntakeAcceptsNumericChat(t *testing.T) {
+	p := writeConfig(t, `{"telegram":{"bot_token":"t","chat_id":"-1001234567890","intake":true}}`)
+	if _, err := Load(p); err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+}
@@ -45,4 +45,17 @@ func TestDeployConfigLoads(t *testing.T) {
 	if cfg.Voice.RouterThreshold <= 0 {
 		t.Error("router threshold did not get its default")
 	}
+
+	// The second reach (V-649). Deleting this block is how you turn ntfy off,
+	// so its absence has to be loud: sev3-away nudges and away reminders route
+	// to ntfy and to nothing else, and a nil sink drops them with no log and no
+	// outbox row. The token is a ${VAR} that CI cannot resolve, so this checks
+	// the wiring and not the credential.
+	if cfg.Ntfy == nil {
+		t.Fatal("deploy config has no ntfy block — sev3-away and away reminders " +
+			"would have nowhere to land, and would vanish silently rather than fail")
+	}
+	if cfg.Ntfy.BaseURL == "" || cfg.Ntfy.Topic == "" {
+		t.Errorf("ntfy block is incomplete: base_url=%q topic=%q", cfg.Ntfy.BaseURL, cfg.Ntfy.Topic)
+	}
 }
@@ -48,11 +48,17 @@ type WeatherConfig struct {
 // ToolConfig — one enabled tool. Name is the spoken verb ("restart"); Cmd is
 // the fixed argv prefix (["systemctl","restart"]); Destructive marks acts that
 // must not fire from the voice path (they need a confirm on an authed surface).
+//
+// Aliases are the spoken phrases that reach this tool, Russian included. They
+// are config data rather than a pattern in code, and they match as exact leading
+// tokens, so an imperative reaches the tool and the past tense of the same verb
+// does not.
 type ToolConfig struct {
 	Name        string   `json:"name"`
 	Scope       string   `json:"scope,omitempty"`
 	Cmd         []string `json:"cmd"`
 	Destructive bool     `json:"destructive,omitempty"`
+	Aliases     []string `json:"aliases,omitempty"`
 }

 // Voice defaults, applied in normaliseVoice.
@@ -94,20 +94,22 @@ func openTestStore(t *testing.T) *store.Store {

 // attemptStatus reads one attempt row back. Returns ok=false when the row is
 // gone, which would itself be a broken promise (a dropped attempt).
+//
+// It goes through ListDeliveryAttempts rather than raw SQL. This helper used to
+// reach past the store into store.DB, which was the tell that the outbox was
+// write-only; the reader landed in V-390 and this caller was not moved over.
 func attemptStatus(t *testing.T, st *store.Store, id int64) (status string, completed bool, ok bool) {
 	t.Helper()
-	tx, err := st.DB(context.Background())
+	attempts, err := st.ListDeliveryAttempts(context.Background(), "", 200)
 	if err != nil {
-		t.Fatalf("read tx: %v", err)
+		t.Fatalf("ListDeliveryAttempts: %v", err)
 	}
-	defer func() { _ = tx.Rollback() }()
-	var completedTS *int64
-	err = tx.QueryRowContext(context.Background(),
-		`SELECT status, completed_ts FROM delivery_attempts WHERE id = ?`, id).Scan(&status, &completedTS)
-	if err != nil {
-		return "", false, false
+	for _, a := range attempts {
+		if a.ID == id {
+			return a.Status, a.HasComplete, true
+		}
 	}
-	return status, completedTS != nil, true
+	return "", false, false
 }

 // TestCrashBetweenBeginAndCompleteBecomesUnknown — simulate the crash window:
@@ -7,11 +7,17 @@
 // the relay). the dispatcher already strips detail off away sendables; the
 // sink uses the same helper so it can't leak the body on its own either.
 //
-// ntfy runs locally (docker, 127.0.0.1:8085, deny-all auth). maven publishes
-// with a dedicated user (write-only to maven-* topics) — the credential is a
-// delivery-config secret, not a db key; a popped ntfy sink can push spam to
-// your phone, nothing else. matches the module key-isolation invariant: the
-// sink never holds the sqlcipher key.
+// ntfy is a self-hosted server with deny-all auth — ntfy.kvmx.ru as of
+// 07-08-2026, reached directly, not through the socks relay telegram needs.
+// maven publishes with a write-only token scoped to its own topic; the
+// credential is a delivery-config secret, not a db key. a popped ntfy sink
+// can push spam to that one topic, nothing else — it cannot read the topic
+// back and it never holds the sqlcipher key.
+//
+// this is the second reach, and the reason there is one is that telegram was
+// the only one (V-649). telegram needs api.telegram.org, a socks relay on the
+// host and a matching ufw rule, three things in series that have each broken
+// once. ntfy shares none of them.
 package ntfysink

 import (
@@ -31,11 +37,29 @@ import (
 // the credential lives in the daemon's config (or a systemd credential),
 // never in the binary.
 type Config struct {
-	BaseURL  string        // e.g. http://127.0.0.1:8085 (no trailing path)
-	Topic    string        // e.g. maven (all maven notifications land here)
-	Username string        // basic auth; empty = anonymous (won't work with deny-all)
-	Password string        // basic auth
-	Timeout  time.Duration // per-request; 0 = DefaultTimeout
+	// BaseURL — the ntfy server, no trailing path. Required.
+	BaseURL string `json:"base_url"`
+
+	// Topic — where maven publishes. Required. All maven notifications land
+	// on this one topic; severity rides the Priority header, not the topic.
+	Topic string `json:"topic"`
+
+	// Token — an ntfy access token, sent as a bearer. This is the preferred
+	// credential: ntfy scopes a token to a topic and to write-only, so a
+	// popped sink can push to this one topic and cannot read it back or
+	// touch another. Revoking it does not disturb a password anyone else
+	// uses. Mutually exclusive with Username.
+	Token string `json:"token,omitempty"`
+
+	// Username, Password — basic auth, for a server that has no tokens.
+	// Empty username means no credential is sent at all, which a deny-all
+	// server rejects.
+	Username string `json:"username,omitempty"`
+	Password string `json:"password,omitempty"`
+
+	// Timeout — per-request; 0 = DefaultTimeout. A dead server must not hang
+	// the tick loop.
+	Timeout time.Duration `json:"-"`
 }

 const DefaultTimeout = 10 * time.Second
@@ -59,6 +83,12 @@ func New(cfg Config) (*Sink, error) {
 	if cfg.Topic == "" {
 		return nil, fmt.Errorf("ntfysink: Topic is required")
 	}
+	// Refuse rather than pick. Two credentials configured means someone
+	// intended one of them, and guessing which would send the other nowhere
+	// and leave a working config that is not the one they wrote.
+	if cfg.Token != "" && cfg.Username != "" {
+		return nil, fmt.Errorf("ntfysink: set Token or Username, not both")
+	}
 	to := cfg.Timeout
 	if to == 0 {
 		to = DefaultTimeout
@@ -84,7 +114,9 @@ func (s *Sink) Send(ctx context.Context, d delivery.Sendable) error {
 	}
 	req.Header.Set("Title", "maven")
 	req.Header.Set("Priority", priorityFor(d).String())
-	if s.cfg.Username != "" {
+	if s.cfg.Token != "" {
+		req.Header.Set("Authorization", "Bearer "+s.cfg.Token)
+	} else if s.cfg.Username != "" {
 		req.SetBasicAuth(s.cfg.Username, s.cfg.Password)
 	}

@@ -224,6 +224,37 @@ func TestSendNoAuthWhenUsernameEmpty(t *testing.T) {
 	}
 }

+// TestSendSetsBearerToken — the deployed credential (V-649) is an ntfy access
+// token scoped write-only to the maven topic, not a password. A token sent as
+// basic auth is rejected by ntfy, so the header shape is the whole test.
+func TestSendSetsBearerToken(t *testing.T) {
+	rs := newRecordingServer(t, 200, "")
+	srv := httptest.NewServer(rs.handler())
+	defer srv.Close()
+
+	sink, _ := New(Config{BaseURL: srv.URL, Topic: "maven", Token: "tk_secret"})
+	if err := sink.Send(context.Background(), nudgeSendable(loop.Sev3, "down")); err != nil {
+		t.Fatalf("Send: %v", err)
+	}
+	_, _, _, auth, _, _ := rs.snapshot()
+	if auth != "Bearer tk_secret" {
+		t.Fatalf("auth: want 'Bearer tk_secret', got %q", auth)
+	}
+}
+
+// TestNewRejectsBothCredentials — configuring a token and a username means one
+// of them was meant and the other is a leftover. Picking either would leave a
+// server that authenticates against a credential nobody wrote down.
+func TestNewRejectsBothCredentials(t *testing.T) {
+	_, err := New(Config{BaseURL: "http://x", Topic: "maven", Token: "tk_x", Username: "maven"})
+	if err == nil {
+		t.Fatal("New accepted both a token and a username")
+	}
+	if !strings.Contains(err.Error(), "not both") {
+		t.Errorf("error does not say which to fix: %v", err)
+	}
+}
+
 func TestSendTitleIsMaven(t *testing.T) {
 	rs := newRecordingServer(t, 200, "")
 	srv := httptest.NewServer(rs.handler())
@@ -0,0 +1,175 @@
+// botapi.go — the telegram bot API calls the intake half makes, and the inbound
+// shapes it reads (V-637). Split out of intake.go so the poller reads as the
+// policy it is, with the wire in one place under it.
+package telegramsink
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+)
+
+// getUpdates long-polls. The offset is telegram's own acknowledgement: asking
+// for lastSeen+1 is what drops everything before it from the queue, so an
+// update is handled once even across a restart.
+func (p *Poller) getUpdates(ctx context.Context, timeoutSec int) ([]update, error) {
+	body, err := json.Marshal(map[string]any{
+		"offset":          p.offset,
+		"timeout":         timeoutSec,
+		"allowed_updates": []string{"message", "callback_query"},
+	})
+	if err != nil {
+		return nil, err
+	}
+	var env struct {
+		telegramResp
+		Result []update `json:"result"`
+	}
+	if err := p.call(ctx, "getUpdates", body, &env); err != nil {
+		return nil, err
+	}
+	for _, u := range env.Result {
+		if u.UpdateID >= p.offset {
+			p.offset = u.UpdateID + 1
+		}
+	}
+	return env.Result, nil
+}
+
+func (p *Poller) send(ctx context.Context, text string, kb *inlineKeyboard) error {
+	body, err := json.Marshal(sendMessageReq{
+		ChatID: p.cfgChatID(),
+		Text:   text,
+		// A reply to something he just typed is not an alarm, but it is still his
+		// own data in a third party's chat, so it stays unforwardable like the
+		// away messages the sink pushes.
+		ProtectContent: true,
+		ReplyMarkup:    kb,
+	})
+	if err != nil {
+		return err
+	}
+	return p.call(ctx, "sendMessage", body, nil)
+}
+
+// answerCallback stops the clock on the tapped button. text empty is a silent
+// acknowledgement; anything else shows as a toast.
+func (p *Poller) answerCallback(ctx context.Context, id, text string) {
+	body, err := json.Marshal(map[string]any{"callback_query_id": id, "text": text})
+	if err != nil {
+		return
+	}
+	if err := p.call(ctx, "answerCallbackQuery", body, nil); err != nil {
+		log.Printf("telegram intake: answer callback: %v", err)
+	}
+}
+
+// editKeyboard replaces the buttons under a message the bot sent. kb nil takes
+// them off.
+func (p *Poller) editKeyboard(ctx context.Context, chatID string, messageID int64, kb *inlineKeyboard) error {
+	payload := map[string]any{"chat_id": chatID, "message_id": messageID}
+	if kb != nil {
+		payload["reply_markup"] = kb
+	} else {
+		payload["reply_markup"] = inlineKeyboard{Rows: [][]inlineButton{}}
+	}
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return err
+	}
+	return p.call(ctx, "editMessageReplyMarkup", body, nil)
+}
+
+// call posts one bot API method and checks the envelope. out may be nil when
+// only the ok flag matters. Every error goes through the sink's redaction: the
+// token is in the URL path because telegram accepts it nowhere else, and
+// net/http prints that URL in transport errors.
+func (p *Poller) call(ctx context.Context, method string, body []byte, out any) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost,
+		p.sink.base+"/bot"+p.sink.cfg.BotToken+"/"+method, bytes.NewReader(body))
+	if err != nil {
+		return p.sink.redact(err)
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := p.hc.Do(req)
+	if err != nil {
+		return fmt.Errorf("telegramsink: %s: %w", method, p.sink.redact(err))
+	}
+	defer resp.Body.Close()
+	rb, _ := io.ReadAll(io.LimitReader(resp.Body, maxIntakeRespBytes))
+
+	var tr telegramResp
+	if err := json.Unmarshal(rb, &tr); err != nil {
+		return fmt.Errorf("telegramsink: %s: %d with a body that is not the bot API envelope: %s",
+			method, resp.StatusCode, snippet(rb))
+	}
+	if !tr.Ok {
+		return fmt.Errorf("telegramsink: %s: telegram returned error %d: %s",
+			method, tr.ErrorCode, strings.TrimSpace(tr.Description))
+	}
+	if out == nil {
+		return nil
+	}
+	if err := json.Unmarshal(rb, out); err != nil {
+		return fmt.Errorf("telegramsink: %s: decode result: %w", method, err)
+	}
+	return nil
+}
+
+// maxIntakeRespBytes — a getUpdates batch carries up to 100 messages, so the
+// send path's cap is too small here. Still bounded: the body is wire-controlled
+// and a relay sits in front of it.
+const maxIntakeRespBytes = 4 << 20
+
+// The inbound shapes, cut to what the poller reads.
+type update struct {
+	UpdateID      int64          `json:"update_id"`
+	Message       *message       `json:"message,omitempty"`
+	CallbackQuery *callbackQuery `json:"callback_query,omitempty"`
+}
+
+type message struct {
+	MessageID int64  `json:"message_id"`
+	Chat      chat   `json:"chat"`
+	Text      string `json:"text"`
+}
+
+type callbackQuery struct {
+	ID      string  `json:"id"`
+	Data    string  `json:"data"`
+	Message message `json:"message"`
+}
+
+// chat — the id arrives as a JSON number for a user and a string for a channel,
+// and the config holds whichever was written. json.Number keeps both without
+// choosing.
+type chat struct {
+	ID       json.Number `json:"id"`
+	Username string      `json:"username,omitempty"`
+}
+
+func (c chat) idString() string {
+	if s := c.ID.String(); s != "" {
+		return s
+	}
+	if c.Username != "" {
+		return "@" + c.Username
+	}
+	return ""
+}
+
+// inlineKeyboard — the reply_markup shape. Rows of buttons, each carrying
+// callback data.
+type inlineKeyboard struct {
+	Rows [][]inlineButton `json:"inline_keyboard"`
+}
+
+type inlineButton struct {
+	Text string `json:"text"`
+	Data string `json:"callback_data"`
+}
@@ -0,0 +1,101 @@
+// correction.go — the correction gesture as it appears in the chat (V-637).
+// Two taps at most: "не то" opens the seven intents, and one of them writes the
+// label. The web's version of the same gesture is cmd/mavweb/chat.go.
+package telegramsink
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+// CorrectionTargets — the intents a correction may name, in the order the
+// buttons are drawn. It mirrors the seven the web offers, and it is a closed
+// list for the same reason: V-632 fits prototypes from the label table, and a
+// label nothing can score is worse than no label.
+var CorrectionTargets = []string{"fact", "note", "reminder", "query", "act", "chat", "system"}
+
+// correctionKeyboard — the one gesture beside the reply. Nothing when the turn
+// did not persist: a button that cannot name a row would report a failure the
+// owner cannot act on.
+func (p *Poller) correctionKeyboard(traceID int64) *inlineKeyboard {
+	if traceID <= 0 || p.correct == nil {
+		return nil
+	}
+	return &inlineKeyboard{Rows: [][]inlineButton{{
+		{Text: "не то", Data: fmt.Sprintf("%s%d", prefixAsk, traceID)},
+	}}}
+}
+
+// targetKeyboard — the seven intents, plus the cheap half kept reachable. He
+// opened the row without knowing he had to name something, and closing it with
+// no way out would price the negative he was willing to give.
+func targetKeyboard(traceID int64) *inlineKeyboard {
+	var rows [][]inlineButton
+	row := []inlineButton{}
+	for _, t := range CorrectionTargets {
+		row = append(row, inlineButton{Text: t, Data: fmt.Sprintf("%s%d:%s", prefixTarget, traceID, t)})
+		if len(row) == 4 {
+			rows, row = append(rows, row), nil
+		}
+	}
+	if len(row) > 0 {
+		rows = append(rows, row)
+	}
+	return &inlineKeyboard{Rows: append(rows, []inlineButton{
+		{Text: "просто неверно", Data: fmt.Sprintf("%s%d:", prefixTarget, traceID)},
+	})}
+}
+
+// Callback data is capped at 64 bytes by telegram, so it carries the trace id
+// and the target and nothing else.
+const (
+	prefixAsk    = "w:"
+	prefixTarget = "t:"
+)
+
+type callbackKind int
+
+const (
+	callbackUnknown callbackKind = iota
+	callbackAskTarget
+	callbackTarget
+)
+
+// parseCallback reads button data. An unparseable id, or a target that is not
+// one of the seven, is callbackUnknown — the data came off the wire, and a
+// label the fitting code cannot score is worse than no label.
+func parseCallback(data string) (traceID int64, target string, kind callbackKind) {
+	switch {
+	case strings.HasPrefix(data, prefixAsk):
+		id, err := strconv.ParseInt(strings.TrimPrefix(data, prefixAsk), 10, 64)
+		if err != nil || id <= 0 {
+			return 0, "", callbackUnknown
+		}
+		return id, "", callbackAskTarget
+	case strings.HasPrefix(data, prefixTarget):
+		rest := strings.TrimPrefix(data, prefixTarget)
+		idPart, target, ok := strings.Cut(rest, ":")
+		if !ok {
+			return 0, "", callbackUnknown
+		}
+		id, err := strconv.ParseInt(idPart, 10, 64)
+		if err != nil || id <= 0 {
+			return 0, "", callbackUnknown
+		}
+		if target != "" && !isCorrectionTarget(target) {
+			return 0, "", callbackUnknown
+		}
+		return id, target, callbackTarget
+	}
+	return 0, "", callbackUnknown
+}
+
+func isCorrectionTarget(s string) bool {
+	for _, t := range CorrectionTargets {
+		if t == s {
+			return true
+		}
+	}
+	return false
+}
@@ -0,0 +1,30 @@
+package telegramsink
+
+import "testing"
+
+// Button data comes off the wire. An unparseable id or an intent that is not one
+// of the seven must not reach the label table V-632 fits prototypes from.
+func TestParseCallbackRejectsWhatCannotBeALabel(t *testing.T) {
+	for _, data := range []string{
+		"", "nonsense", "w:", "w:0", "w:-3", "w:abc",
+		"t:77", "t:0:note", "t:abc:note", "t:77:погода", "t:77:fact:extra",
+	} {
+		if _, _, kind := parseCallback(data); kind != callbackUnknown {
+			t.Errorf("%q was accepted, want callbackUnknown", data)
+		}
+	}
+	if id, target, kind := parseCallback("t:77:reminder"); id != 77 || target != "reminder" || kind != callbackTarget {
+		t.Errorf("got %d %q %v, want the reminder correction", id, target, kind)
+	}
+}
+
+// Every intent the web offers has a button here, so a new intent cannot exist
+// with no way to correct a chat turn into it.
+func TestIntakeTargetsAreTheSeven(t *testing.T) {
+	if len(CorrectionTargets) != 7 {
+		t.Fatalf("%d targets, want the seven public intents", len(CorrectionTargets))
+	}
+	if isCorrectionTarget("") {
+		t.Error("empty is the absence of a target, not one of them")
+	}
+}
@@ -0,0 +1,225 @@
+// intake.go — the inbound half of the telegram channel (V-637).
+//
+// Until this file, telegram was a reach and nothing else: the sink pushes an
+// away message and the chat has no way to answer. That made the correction
+// gesture (V-630) reachable from the web and from voice only, and the sample of
+// labels skews to wherever the owner happens to be standing.
+//
+// Long-poll getUpdates, not a webhook. The box takes no inbound connections and
+// it reaches api.telegram.org through a relay, so the direction of the
+// connection has to stay outbound. The poller is off unless the telegram block
+// says intake, and it accepts messages from exactly one chat.
+package telegramsink
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+)
+
+// longPollSeconds — how long telegram holds an empty getUpdates open. The HTTP
+// client's own timeout has to sit above it or every poll ends as a transport
+// error, which is why the poller does not reuse the sink's client.
+const longPollSeconds = 25
+
+// pollBackoff — the wait after a failed poll. The relay going down is the
+// normal cause and it comes back on its own, so this is a quiet retry rather
+// than an escalation.
+const pollBackoff = 15 * time.Second
+
+// Turn runs one utterance as a turn and reports the reply and the persisted
+// trace id. traceID 0 means nothing persisted, and then the reply carries no
+// correction buttons — there is no row for them to point at.
+type Turn func(ctx context.Context, conversation, text string) (reply string, traceID int64, err error)
+
+// Correct records the owner's correction of one turn. shouldBe empty is the
+// cheap half of the gesture: wrong, target unstated.
+type Correct func(ctx context.Context, traceID int64, shouldBe string) error
+
+// Poller reads the configured chat and answers in it. One per daemon.
+type Poller struct {
+	sink    *Sink
+	turn    Turn
+	correct Correct
+	hc      *http.Client
+	offset  int64
+}
+
+// ValidateIntakeChatID refuses a chat id the intake half cannot use. The push
+// half accepts @channelusername as a destination. The intake half cannot: an
+// inbound update names its chat by numeric id, so an @-name would match nothing
+// and the poller would read the chat and answer none of it. Config validation
+// calls this, so the box refuses to boot rather than running a dead reach —
+// NewPoller returning an error is too late, because the daemon is already up.
+func ValidateIntakeChatID(chatID string) error {
+	id := strings.TrimSpace(chatID)
+	if id == "" {
+		return errors.New("telegramsink: intake needs a chat id")
+	}
+	digits := strings.TrimPrefix(id, "-")
+	if digits == "" || strings.TrimLeft(digits, "0123456789") != "" {
+		return fmt.Errorf("telegramsink: intake needs the numeric chat id, not %s", chatID)
+	}
+	return nil
+}
+
+// NewPoller builds the intake half around an already-validated sink, so the
+// token, the base URL and the relay are resolved in one place. turn is
+// required; correct may be nil, and then the reply carries no buttons.
+func NewPoller(s *Sink, turn Turn, correct Correct) (*Poller, error) {
+	if s == nil {
+		return nil, errors.New("telegramsink: intake needs a sink")
+	}
+	if turn == nil {
+		return nil, errors.New("telegramsink: intake needs a turn handler")
+	}
+	if err := ValidateIntakeChatID(s.cfg.ChatID); err != nil {
+		return nil, err
+	}
+	// The sink's transport already carries the relay. Only the timeout differs,
+	// and it has to clear the long poll.
+	hc := &http.Client{
+		Timeout:   (longPollSeconds + 10) * time.Second,
+		Transport: s.hc.Transport,
+	}
+	return &Poller{sink: s, turn: turn, correct: correct, hc: hc}, nil
+}
+
+// Run polls until the context ends. It never returns an error: a chat that
+// cannot be read is a degraded reach, not a reason to stop the daemon.
+func (p *Poller) Run(ctx context.Context) {
+	p.discardBacklog(ctx)
+	log.Printf("telegram intake: reading chat %s", p.sink.cfg.ChatID)
+	for ctx.Err() == nil {
+		updates, err := p.getUpdates(ctx, longPollSeconds)
+		if err != nil {
+			if ctx.Err() != nil {
+				return
+			}
+			log.Printf("telegram intake: poll: %v", err)
+			select {
+			case <-ctx.Done():
+				return
+			case <-time.After(pollBackoff):
+			}
+			continue
+		}
+		for _, u := range updates {
+			p.handle(ctx, u)
+		}
+	}
+}
+
+// discardBacklog moves the offset past whatever is already queued, without
+// acting on any of it.
+//
+// Telegram holds undelivered updates for 24 hours, so a daemon that was down
+// overnight would otherwise wake up and answer every question in order. A
+// question asked eight hours ago has been answered by the owner himself or has
+// stopped mattering, and a reminder set from it would land at the wrong time.
+// Missing it is the safe direction.
+func (p *Poller) discardBacklog(ctx context.Context) {
+	// getUpdates returns at most 100 per call, so one call is not the queue. The
+	// loop is bounded rather than "until empty": the timeout is 0, so an instance
+	// that keeps handing back a full batch would spin, and a thousand skipped
+	// messages is already a box that was down for a long time.
+	skipped := 0
+	for range 10 {
+		updates, err := p.getUpdates(ctx, 0)
+		if err != nil {
+			// Not fatal. The offset stays where it was, so the first real poll sees
+			// what is left and answers it late. Say so rather than hide it.
+			log.Printf("telegram intake: could not skip the backlog, old messages may be answered: %v", err)
+			return
+		}
+		skipped += len(updates)
+		if len(updates) == 0 {
+			break
+		}
+	}
+	if skipped > 0 {
+		log.Printf("telegram intake: skipped %d message(s) queued while the daemon was down", skipped)
+	}
+}
+
+// handle dispatches one update. Anything that is neither a message from the
+// owner's chat nor a callback on one of Maven's own keyboards is dropped in
+// silence: a reply to a stranger confirms the bot exists and who it belongs to.
+func (p *Poller) handle(ctx context.Context, u update) {
+	switch {
+	case u.CallbackQuery != nil:
+		p.onCallback(ctx, u.CallbackQuery)
+	case u.Message != nil:
+		p.onMessage(ctx, u.Message)
+	}
+}
+
+func (p *Poller) onMessage(ctx context.Context, m *message) {
+	text := strings.TrimSpace(m.Text)
+	if text == "" || !p.fromOwner(m.Chat.idString()) {
+		return
+	}
+	// The conversation id keys the dialogue, so a clarify question asked in the
+	// chat is not answered by an utterance typed on the web.
+	reply, traceID, err := p.turn(ctx, "telegram:"+m.Chat.idString(), text)
+	if err != nil {
+		log.Printf("telegram intake: turn: %v", err)
+		return
+	}
+	if strings.TrimSpace(reply) == "" {
+		return
+	}
+	if err := p.send(ctx, reply, p.correctionKeyboard(traceID)); err != nil {
+		log.Printf("telegram intake: reply: %v", err)
+	}
+}
+
+// onCallback handles a tap on a correction button. Every path from the owner
+// answers the callback: telegram spins a clock on the button until it is
+// answered, and an unanswered tap reads as a gesture that was dropped. A tap
+// from anyone else gets silence, the same as a message from a stranger.
+func (p *Poller) onCallback(ctx context.Context, cb *callbackQuery) {
+	if !p.fromOwner(cb.Message.Chat.idString()) {
+		return
+	}
+	traceID, target, kind := parseCallback(cb.Data)
+	if kind == callbackUnknown || p.correct == nil {
+		p.answerCallback(ctx, cb.ID, "")
+		return
+	}
+	// A tap on "не то" only opens the second row. Nothing is written yet: the
+	// target is worth much more than the negative, so he gets the chance to name
+	// it before the gesture is spent.
+	if kind == callbackAskTarget {
+		p.answerCallback(ctx, cb.ID, "")
+		if err := p.editKeyboard(ctx, cb.Message.Chat.idString(), cb.Message.MessageID, targetKeyboard(traceID)); err != nil {
+			log.Printf("telegram intake: open the target row: %v", err)
+		}
+		return
+	}
+	if err := p.correct(ctx, traceID, target); err != nil {
+		log.Printf("telegram intake: correct turn %d: %v", traceID, err)
+		p.answerCallback(ctx, cb.ID, "не записалось")
+		return
+	}
+	p.answerCallback(ctx, cb.ID, "записала")
+	// The buttons come off, because the correction is given and a live keyboard
+	// on an answered turn invites correcting it twice.
+	if err := p.editKeyboard(ctx, cb.Message.Chat.idString(), cb.Message.MessageID, nil); err != nil {
+		log.Printf("telegram intake: clear the keyboard: %v", err)
+	}
+}
+
+// fromOwner — one chat, and it is the one the sink already sends to. Telegram
+// chat ids are not guessable, but they are also not secret: they travel in
+// every forwarded message. So this is the whole authorisation and it is an
+// allowlist of one.
+func (p *Poller) fromOwner(chatID string) bool {
+	return chatID != "" && chatID == p.cfgChatID()
+}
+
+func (p *Poller) cfgChatID() string { return strings.TrimSpace(p.sink.cfg.ChatID) }
@@ -0,0 +1,216 @@
+package telegramsink
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+)
+
+// The turn he types in the chat is the turn the web would run, and the reply
+// carries the one gesture beside it.
+func TestIntakeRunsTheTurnAndOffersTheCorrection(t *testing.T) {
+	b := newFakeBot(t)
+	rec := &recorder{reply: "поняла", traceID: 91}
+	p := newTestPoller(t, b, rec)
+
+	p.handle(context.Background(), msg(ownerChat, "  поужинал  "))
+
+	if got := rec.took(); len(got) != 1 || got[0] != "поужинал" {
+		t.Fatalf("turns %q, want the trimmed utterance once", got)
+	}
+	// The dialogue is keyed per chat, so a clarify asked here is not answered on
+	// the web.
+	if rec.conversation != "telegram:"+ownerChat {
+		t.Errorf("conversation %q does not name the chat", rec.conversation)
+	}
+	sends := b.called("sendMessage")
+	if len(sends) != 1 {
+		t.Fatalf("%d sends, want 1", len(sends))
+	}
+	if sends[0].body["text"] != "поняла" {
+		t.Errorf("sent %v, want the reply", sends[0].body["text"])
+	}
+	if sends[0].body["protect_content"] != true {
+		t.Error("his own data went out forwardable")
+	}
+	kb, _ := json.Marshal(sends[0].body["reply_markup"])
+	if !strings.Contains(string(kb), "w:91") {
+		t.Errorf("keyboard %s does not point at the turn's trace", kb)
+	}
+}
+
+// A turn nothing persisted has no row to correct, and a button that would name
+// one reports a failure he cannot act on.
+func TestIntakeSkipsTheGestureWithNoTrace(t *testing.T) {
+	b := newFakeBot(t)
+	p := newTestPoller(t, b, &recorder{reply: "поняла", traceID: 0})
+
+	p.handle(context.Background(), msg(ownerChat, "привет"))
+
+	sends := b.called("sendMessage")
+	if len(sends) != 1 {
+		t.Fatalf("%d sends, want 1", len(sends))
+	}
+	if _, ok := sends[0].body["reply_markup"]; ok {
+		t.Error("offered a correction on a turn with no trace")
+	}
+}
+
+// One chat, and a stranger is not answered at all: a reply confirms the bot
+// exists and whose it is.
+func TestIntakeIgnoresAnyOtherChat(t *testing.T) {
+	b := newFakeBot(t)
+	rec := &recorder{reply: "поняла", traceID: 5}
+	p := newTestPoller(t, b, rec)
+
+	p.handle(context.Background(), msg("9999", "включи свет"))
+	p.handle(context.Background(), update{UpdateID: 8, CallbackQuery: &callbackQuery{
+		ID: "cb", Data: "t:5:note", Message: message{Chat: chat{ID: json.Number("9999")}},
+	}})
+
+	if got := rec.took(); len(got) != 0 {
+		t.Errorf("ran %q for a chat that is not the owner's", got)
+	}
+	if len(rec.corrections) != 0 {
+		t.Errorf("wrote %v from a chat that is not the owner's", rec.corrections)
+	}
+	if len(b.calls) != 0 {
+		t.Errorf("answered a stranger: %v", b.calls)
+	}
+}
+
+// Tapping "не то" opens the seven and writes nothing yet. The target is worth
+// much more than the negative, so it must not be spent before he can name it.
+func TestIntakeFirstTapOnlyOpensTheTargets(t *testing.T) {
+	b := newFakeBot(t)
+	rec := &recorder{}
+	p := newTestPoller(t, b, rec)
+
+	p.handle(context.Background(), update{UpdateID: 9, CallbackQuery: &callbackQuery{
+		ID: "cb", Data: "w:77", Message: message{MessageID: 11, Chat: chat{ID: json.Number(ownerChat)}},
+	}})
+
+	if len(rec.corrections) != 0 {
+		t.Fatalf("wrote %v before he named a target", rec.corrections)
+	}
+	if len(b.called("answerCallbackQuery")) != 1 {
+		t.Error("left the clock spinning on the button")
+	}
+	edits := b.called("editMessageReplyMarkup")
+	if len(edits) != 1 {
+		t.Fatalf("%d edits, want the target row", len(edits))
+	}
+	kb, _ := json.Marshal(edits[0].body["reply_markup"])
+	for _, want := range CorrectionTargets {
+		if !strings.Contains(string(kb), `"`+want+`"`) {
+			t.Errorf("target row %s is missing %s", kb, want)
+		}
+	}
+	// And the way out, because he opened the row without knowing he had to name
+	// anything.
+	if !strings.Contains(string(kb), `"t:77:"`) {
+		t.Errorf("target row %s prices out the untargeted negative", kb)
+	}
+}
+
+func TestIntakeWritesTheCorrection(t *testing.T) {
+	for _, tc := range []struct {
+		name, data, want string
+	}{
+		{"with a target", "t:77:note", "note"},
+		{"untargeted", "t:77:", ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			b := newFakeBot(t)
+			rec := &recorder{}
+			p := newTestPoller(t, b, rec)
+
+			p.handle(context.Background(), update{UpdateID: 9, CallbackQuery: &callbackQuery{
+				ID: "cb", Data: tc.data, Message: message{MessageID: 11, Chat: chat{ID: json.Number(ownerChat)}},
+			}})
+
+			if len(rec.corrections) != 1 || rec.corrections[0] != (correction{77, tc.want}) {
+				t.Fatalf("corrections %v, want trace 77 → %q", rec.corrections, tc.want)
+			}
+			// The buttons come off once the gesture is given.
+			edits := b.called("editMessageReplyMarkup")
+			if len(edits) != 1 {
+				t.Fatalf("%d edits, want the keyboard cleared", len(edits))
+			}
+			kb, _ := json.Marshal(edits[0].body["reply_markup"])
+			if strings.Contains(string(kb), "t:77") {
+				t.Errorf("keyboard %s still invites a second correction", kb)
+			}
+		})
+	}
+}
+
+// A write that failed says so on the button. Silence would read as recorded.
+func TestIntakeSaysWhenTheLabelDidNotLand(t *testing.T) {
+	b := newFakeBot(t)
+	rec := &recorder{correctErr: errors.New("no such routing trace")}
+	p := newTestPoller(t, b, rec)
+
+	p.handle(context.Background(), update{UpdateID: 9, CallbackQuery: &callbackQuery{
+		ID: "cb", Data: "t:77:fact", Message: message{MessageID: 11, Chat: chat{ID: json.Number(ownerChat)}},
+	}})
+
+	answers := b.called("answerCallbackQuery")
+	if len(answers) != 1 || answers[0].body["text"] == "" {
+		t.Fatalf("answers %v, want a toast saying it did not land", answers)
+	}
+	if len(b.called("editMessageReplyMarkup")) != 0 {
+		t.Error("cleared the buttons after a failed write, so he cannot try again")
+	}
+}
+
+// A question asked while the daemon was down has been answered by him or has
+// stopped mattering, and a reminder set from it would land at the wrong time.
+func TestIntakeDiscardsTheBacklog(t *testing.T) {
+	b := newFakeBot(t, []update{msg(ownerChat, "напомни в 7 позвонить маме")})
+	rec := &recorder{reply: "поняла", traceID: 3}
+	p := newTestPoller(t, b, rec)
+
+	p.discardBacklog(context.Background())
+
+	if got := rec.took(); len(got) != 0 {
+		t.Errorf("answered %q from the overnight queue", got)
+	}
+	// And the offset moved past it, so the next poll does not see it again.
+	if p.offset != 8 {
+		t.Errorf("offset %d, want the skipped update acknowledged", p.offset)
+	}
+}
+
+// The poller does not start without somewhere to send the turn.
+func TestNewPollerNeedsATurn(t *testing.T) {
+	sink, err := New(Config{BotToken: "t", ChatID: ownerChat})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := NewPoller(sink, nil, nil); err == nil {
+		t.Error("built a poller that reads the chat and answers nothing")
+	}
+	if _, err := NewPoller(nil, func(context.Context, string, string) (string, int64, error) {
+		return "", 0, nil
+	}, nil); err == nil {
+		t.Error("built a poller with no sink to answer through")
+	}
+}
+
+// A chat id the intake half cannot match is refused before anything reads the
+// chat. Config validation calls the same check, so this is the boot error.
+func TestValidateIntakeChatID(t *testing.T) {
+	for _, ok := range []string{"123", "-1001234567890", " 42 "} {
+		if err := ValidateIntakeChatID(ok); err != nil {
+			t.Errorf("ValidateIntakeChatID(%q): %v", ok, err)
+		}
+	}
+	for _, bad := range []string{"", "@maven", "-", "12a", "1 2"} {
+		if err := ValidateIntakeChatID(bad); err == nil {
+			t.Errorf("ValidateIntakeChatID(%q) accepted; want error", bad)
+		}
+	}
+}
@@ -0,0 +1,123 @@
+// intakeharness_test.go — a fake bot API and a recorder for what the poller
+// asked the daemon to do. Shared by the intake tests beside it.
+package telegramsink
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+)
+
+// fakeBot stands in for the bot API. It hands out queued updates once, records
+// every other call, and answers the ok=true envelope the poller checks.
+type fakeBot struct {
+	mu      sync.Mutex
+	updates [][]update // one batch per getUpdates call, then empty
+	calls   []botCall
+	srv     *httptest.Server
+}
+
+type botCall struct {
+	method string
+	body   map[string]any
+}
+
+func newFakeBot(t *testing.T, batches ...[]update) *fakeBot {
+	t.Helper()
+	b := &fakeBot{updates: batches}
+	b.srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		method := r.URL.Path[strings.LastIndex(r.URL.Path, "/")+1:]
+		raw, _ := io.ReadAll(r.Body)
+		var body map[string]any
+		_ = json.Unmarshal(raw, &body)
+
+		b.mu.Lock()
+		b.calls = append(b.calls, botCall{method: method, body: body})
+		var batch []update
+		if method == "getUpdates" && len(b.updates) > 0 {
+			batch, b.updates = b.updates[0], b.updates[1:]
+		}
+		b.mu.Unlock()
+
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{"ok": true, "result": batch})
+	}))
+	t.Cleanup(b.srv.Close)
+	return b
+}
+
+func (b *fakeBot) called(method string) []botCall {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	var out []botCall
+	for _, c := range b.calls {
+		if c.method == method {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
+// recorder collects what the poller asked the daemon to do.
+type recorder struct {
+	mu           sync.Mutex
+	turns        []string
+	conversation string
+	traceID      int64
+	corrections  []correction
+	reply        string
+	err          error
+	correctErr   error
+}
+
+type correction struct {
+	traceID  int64
+	shouldBe string
+}
+
+func (r *recorder) turn(_ context.Context, conversation, text string) (string, int64, error) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.turns = append(r.turns, text)
+	r.conversation = conversation
+	return r.reply, r.traceID, r.err
+}
+
+func (r *recorder) correct(_ context.Context, traceID int64, shouldBe string) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.corrections = append(r.corrections, correction{traceID, shouldBe})
+	return r.correctErr
+}
+
+func (r *recorder) took() []string {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	return append([]string(nil), r.turns...)
+}
+
+const ownerChat = "4242"
+
+func newTestPoller(t *testing.T, b *fakeBot, rec *recorder) *Poller {
+	t.Helper()
+	sink, err := New(Config{BotToken: "secret-token", ChatID: ownerChat, BaseURL: b.srv.URL})
+	if err != nil {
+		t.Fatal(err)
+	}
+	p, err := NewPoller(sink, rec.turn, rec.correct)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return p
+}
+
+func msg(chatID, text string) update {
+	return update{UpdateID: 7, Message: &message{
+		MessageID: 11, Text: text, Chat: chat{ID: json.Number(chatID)},
+	}}
+}
@@ -72,6 +72,13 @@ type Config struct {
 	// Timeout — per-request; 0 = DefaultTimeout. a dead relay can't hang the
 	// tick loop.
 	Timeout time.Duration
+
+	// Intake — read the chat as well as write to it (V-637). Off by default,
+	// like the search and weather blocks: a bot that only pushes cannot be
+	// talked into anything, and turning that off has to stay a deletion. When
+	// set, a message from ChatID becomes a turn and its reply carries the
+	// correction gesture. ChatID is the only accepted sender.
+	Intake bool `json:"intake,omitempty"`
 }

 // Sink — implements delivery.Sink via the telegram bot sendMessage API. one
@@ -130,6 +137,11 @@ type sendMessageReq struct {
 	Text                string `json:"text"`
 	DisableNotification bool   `json:"disable_notification"` // false = ring (always — these are alarms)
 	ProtectContent      bool   `json:"protect_content"`      // true = no forwarding out of chat
+
+	// ReplyMarkup — the inline keyboard, used only by the intake half (V-637):
+	// a reply to a turn he typed carries the correction gesture. nil on every
+	// push the sink sends, and omitted from the wire when nil.
+	ReplyMarkup *inlineKeyboard `json:"reply_markup,omitempty"`
 }

 // telegramResp — the shape telegram returns. ok=false on logical error with
@@ -172,21 +184,49 @@ func (s *Sink) Send(ctx context.Context, d delivery.Sendable) error {
 		return fmt.Errorf("telegramsink: sendMessage: %w", s.redact(err))
 	}
 	defer resp.Body.Close()
-	rb, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+	rb, _ := io.ReadAll(io.LimitReader(resp.Body, maxRespBytes))

 	// telegram returns 200 with ok=true on success; non-2xx with ok=false +
 	// error_code + description on failure. parse the body either way so a 200
 	// with ok=false (shouldn't happen, but the API reserves that) still surfaces.
 	var tr telegramResp
-	if jsonErr := json.Unmarshal(rb, &tr); jsonErr == nil && !tr.Ok {
+	jsonErr := json.Unmarshal(rb, &tr)
+	if jsonErr == nil && !tr.Ok {
 		return fmt.Errorf("telegramsink: telegram returned error %d: %s", tr.ErrorCode, strings.TrimSpace(tr.Description))
 	}
 	if resp.StatusCode/100 != 2 {
-		return fmt.Errorf("telegramsink: telegram returned %d: %s", resp.StatusCode, strings.TrimSpace(string(rb)))
+		return fmt.Errorf("telegramsink: telegram returned %d: %s", resp.StatusCode, snippet(rb))
+	}
+	// A 2xx whose body is not the bot API's envelope did not come from the bot
+	// API. The normal path here is the relay: this box reaches telegram through
+	// an HTTP/SOCKS5 proxy, and a proxy that is up but cannot reach
+	// api.telegram.org answers 200 with an HTML page of its own. Reading that as
+	// a delivered message is the worst outcome the sink has — the dispatcher
+	// writes a 'sent' outbox row, MarkSent restarts the repeat clock, and the
+	// sev4 alarm that never arrived goes quiet for a whole interval. Only
+	// ok=true is a send.
+	if jsonErr != nil {
+		return fmt.Errorf("telegramsink: telegram returned %d with a body that is not the bot API envelope (not a confirmed send): %s", resp.StatusCode, snippet(rb))
 	}
 	return nil
 }

+// maxRespBytes caps the response read — the body is wire-controlled and the
+// relay in front of it is not telegram. It is far above any sendMessage
+// envelope (a few hundred bytes; the result echoes one short away message),
+// because a truncated body no longer parses and now reads as a failed send.
+const maxRespBytes = 64 << 10
+
+// snippet trims a response body down to something an error line can carry. A
+// relay's HTML page is measured in kilobytes and none of it belongs in the log.
+func snippet(rb []byte) string {
+	s := strings.TrimSpace(string(rb))
+	if len(s) > 200 {
+		return s[:200] + "…"
+	}
+	return s
+}
+
 // sendMessageURL — the bot API path. the token is in the URL path
 // (https://api.telegram.org/bot<token>/sendMessage); telegram does not accept
 // it anywhere else. the URL is built per-send from the resolved base and never
@@ -291,6 +291,66 @@ func TestSendReturnsErrorOnTelegramError(t *testing.T) {
 	}
 }

+// A relay that is up but cannot reach api.telegram.org answers 200 with a page
+// of its own. That is not a delivered message, and calling it one silences a
+// sev4 alarm for a full repeat interval.
+func TestSendRefusesA200ThatIsNotTheBotAPIEnvelope(t *testing.T) {
+	rs := newRecordingServer(t, http.StatusOK, `<html><body>proxy: upstream unreachable</body></html>`)
+	srv := httptest.NewServer(rs.handler())
+	defer srv.Close()
+
+	sink, _ := New(sinkCfg(srv.URL))
+	err := sink.Send(context.Background(), nudgeSendable(loop.Sev4, "down"))
+	if err == nil {
+		t.Fatal("want error on a 200 that is not the bot API envelope")
+	}
+	if !strings.Contains(err.Error(), "not a confirmed send") {
+		t.Fatalf("error should say the send is unconfirmed, got: %v", err)
+	}
+}
+
+// The success path must stay a success: ok=true on 200 is a send.
+func TestSendAcceptsOkTrue(t *testing.T) {
+	rs := newRecordingServer(t, http.StatusOK, `{"ok":true,"result":{"message_id":7}}`)
+	srv := httptest.NewServer(rs.handler())
+	defer srv.Close()
+
+	sink, _ := New(sinkCfg(srv.URL))
+	if err := sink.Send(context.Background(), nudgeSendable(loop.Sev4, "down")); err != nil {
+		t.Fatalf("want success on ok=true, got: %v", err)
+	}
+}
+
+// A body long enough to have been truncated by the old 4096-byte cap still
+// parses, so a real send is not reported as a failure.
+func TestSendAcceptsAnOversizedButValidEnvelope(t *testing.T) {
+	rs := newRecordingServer(t, http.StatusOK,
+		`{"ok":true,"result":{"message_id":7,"text":"`+strings.Repeat("x", 8000)+`"}}`)
+	srv := httptest.NewServer(rs.handler())
+	defer srv.Close()
+
+	sink, _ := New(sinkCfg(srv.URL))
+	if err := sink.Send(context.Background(), nudgeSendable(loop.Sev4, "down")); err != nil {
+		t.Fatalf("want success on a large ok=true envelope, got: %v", err)
+	}
+}
+
+// The error line carries a snippet, not the relay's whole page.
+func TestSendErrorDoesNotCarryTheWholeBody(t *testing.T) {
+	rs := newRecordingServer(t, http.StatusBadGateway, strings.Repeat("z", 5000))
+	srv := httptest.NewServer(rs.handler())
+	defer srv.Close()
+
+	sink, _ := New(sinkCfg(srv.URL))
+	err := sink.Send(context.Background(), nudgeSendable(loop.Sev4, "down"))
+	if err == nil {
+		t.Fatal("want error on 502")
+	}
+	if len(err.Error()) > 500 {
+		t.Fatalf("error line should be trimmed, got %d bytes", len(err.Error()))
+	}
+}
+
 func TestSendReturnsErrorOnNon2xx(t *testing.T) {
 	rs := newRecordingServer(t, http.StatusBadGateway, "bad gateway")
 	srv := httptest.NewServer(rs.handler())
@@ -724,8 +724,15 @@ type chatReq struct {
 	Conversation string `json:"conversation,omitempty"`
 }
 type chatResp struct {
-	Reply  string `json:"reply"`
-	Source string `json:"source,omitempty"`
+	Reply   string `json:"reply"`
+	Source  string `json:"source,omitempty"`
+	TraceID int64  `json:"trace_id,omitempty"`
+}
+
+// correctTurnReq — the owner correcting one persisted turn (V-630).
+type correctTurnReq struct {
+	TraceID  int64  `json:"trace_id"`
+	ShouldBe string `json:"should_be,omitempty"`
 }

 // ChatReply — one text turn's answer plus which query source claimed it.
@@ -738,6 +745,12 @@ type chatResp struct {
 type ChatReply struct {
 	Reply  string
 	Source string
+	// TraceID is the persisted routing trace for this turn (V-629), and it is
+	// what makes a correction one gesture: the surface already has the id, so
+	// saying "that was wrong" costs a button and no lookup. 0 ⇒ nothing was
+	// persisted, which is a box with no database, and the surface offers no
+	// correction rather than a broken one.
+	TraceID int64
 }

 type proposeToolReq struct {
@@ -937,6 +950,12 @@ var ErrTaskDuplicate = errors.New("ipc: another live task already has this text"
 // is down" must not read the same to a caller deciding whether to store an id.
 var ErrNoEntity = errors.New("ipc: no such entity")

+// ErrNoSuchTrace — the turn a correction names is not in routing_traces. Given
+// a wire twin because it is the expected outcome of correcting a turn older than
+// the retention bound, and "that turn is gone" and "the database is broken" must
+// not read the same to the surface offering the gesture.
+var ErrNoSuchTrace = errors.New("ipc: no such routing trace")
+
 // ErrTaskResolved — a resolved task is not editable.
 var ErrTaskResolved = errors.New("ipc: task is resolved")

@@ -0,0 +1,192 @@
+package ipc
+
+import (
+	"context"
+	"errors"
+	"net"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+// A cancelled context has to abort a call that is already in flight. It did not
+// until V-638: call checked ctx once before sending and then blocked in
+// roundtrip with no connection deadline, so a daemon that read the frame and
+// never answered parked the caller for as long as the socket stayed open.
+//
+// The server here is that daemon: it accepts, reads nothing, replies nothing.
+
+func deafServer(t *testing.T) string {
+	t.Helper()
+	sock := filepath.Join(t.TempDir(), "deaf.sock")
+	ln, err := net.Listen("unix", sock)
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	t.Cleanup(func() { _ = ln.Close() })
+	go func() {
+		for {
+			conn, err := ln.Accept()
+			if err != nil {
+				return
+			}
+			// Hold it open and say nothing. Closed by the listener cleanup.
+			t.Cleanup(func() { _ = conn.Close() })
+		}
+	}()
+	return sock
+}
+
+func TestClientCancelAbortsAReadInFlight(t *testing.T) {
+	c, err := Dial(deafServer(t))
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+	defer c.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	go func() {
+		time.Sleep(50 * time.Millisecond)
+		cancel()
+	}()
+
+	done := make(chan error, 1)
+	go func() {
+		_, err := c.Ping(ctx)
+		done <- err
+	}()
+
+	select {
+	case err := <-done:
+		// Ping is read-only, so the cancellation is reported as itself rather
+		// than as an ambiguous mutation.
+		if !errors.Is(err, context.Canceled) {
+			t.Errorf("got %v, want context.Canceled", err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("a cancelled Ping did not return")
+	}
+}
+
+// A mutation cancelled while awaiting the reply may already have committed, so
+// it is ErrAmbiguousOutcome and never a retry. That split is the invariant
+// internal/ipc/maperr_test.go's neighbours rest on.
+func TestClientCancelLeavesAMutationAmbiguous(t *testing.T) {
+	c, err := Dial(deafServer(t))
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+	defer c.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+
+	done := make(chan error, 1)
+	go func() {
+		_, err := c.WriteFact(ctx, WriteFactReq{Key: "water", Value: "drank"})
+		done <- err
+	}()
+
+	select {
+	case err := <-done:
+		if !errors.Is(err, ErrAmbiguousOutcome) {
+			t.Errorf("got %v, want ErrAmbiguousOutcome", err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("a cancelled WriteFact did not return")
+	}
+}
+
+// The deadline itself, with no cancellation: a call on a context with no
+// deadline used to have no bound at all. This one has one and must respect it.
+func TestClientDeadlineBoundsACall(t *testing.T) {
+	c, err := Dial(deafServer(t))
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+	defer c.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	defer cancel()
+
+	start := time.Now()
+	if _, err := c.Ping(ctx); err == nil {
+		t.Fatal("a deaf server answered a Ping")
+	}
+	if elapsed := time.Since(start); elapsed > 3*time.Second {
+		t.Errorf("Ping took %v, want the context deadline to bound it", elapsed)
+	}
+}
+
+// blockingAPI parks Presence until its context is cancelled and records what
+// cancelled it. Every other method is the unimplemented floor.
+type blockingAPI struct {
+	UnimplementedCoreAPI
+	entered chan struct{}
+	err     chan error
+}
+
+func (b *blockingAPI) Presence(ctx context.Context) (Presence, error) {
+	close(b.entered)
+	<-ctx.Done()
+	b.err <- ctx.Err()
+	return Presence{}, ctx.Err()
+}
+
+// serveConn dispatched under context.Background() until V-638, so Close could
+// only abandon a dispatch in flight and never tell it to stop.
+func TestServerCloseCancelsADispatchInFlight(t *testing.T) {
+	api := &blockingAPI{entered: make(chan struct{}), err: make(chan error, 1)}
+	srv, err := Listen(filepath.Join(t.TempDir(), "core.sock"), api)
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	served := make(chan struct{})
+	go func() { _ = srv.Serve(); close(served) }()
+
+	cli, err := Dial(srv.Path())
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+	defer cli.Close()
+	go func() { _, _ = cli.Presence(context.Background()) }()
+
+	select {
+	case <-api.entered:
+	case <-time.After(5 * time.Second):
+		t.Fatal("the handler was never dispatched")
+	}
+
+	_ = srv.Close()
+	<-served
+	select {
+	case got := <-api.err:
+		if !errors.Is(got, context.Canceled) {
+			t.Errorf("handler saw %v, want context.Canceled", got)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("Close did not cancel the dispatch")
+	}
+}
+
+// The watchdog closes the conn, and it races the end of the call: a
+// cancellation landing as the reply arrives can close a conn the call was
+// already done with. That is survivable either way, because a write to a closed
+// socket is errWriteLost and errWriteLost re-dials and retries, so this test
+// passes with or without the drop in roundtrip's defer. What it pins is that
+// the recovery is real and costs one round trip at most, never an error the
+// caller sees.
+func TestClientSurvivesACancelledCall(t *testing.T) {
+	_, _, cli, _ := newServerWithStore(t)
+
+	for i := 0; i < 20; i++ {
+		ctx, cancel := context.WithCancel(context.Background())
+		go cancel() // races the reply on purpose
+		_, _ = cli.Ping(ctx)
+		cancel()
+
+		if _, err := cli.Ping(context.Background()); err != nil {
+			t.Fatalf("call %d after a cancelled one: %v", i, err)
+		}
+	}
+}
@@ -26,9 +26,20 @@ type Client struct {
 	conn net.Conn
 	path string       // the address as configured, kept for errors and logs
 	addr netaddr.Addr // parsed, so a dropped conn can be re-dialed (core restart)
-	mu   sync.Mutex
+	mu   sync.Mutex   // one request at a time, so a frame and its reply pair up
+
+	// connMu guards the conn field alone, and is held only across an assignment
+	// or a read. It exists so Close and the cancellation watchdog can reach the
+	// connection without waiting for the call that is holding c.mu (V-638).
+	connMu sync.Mutex
 }

+// defaultCallTimeout bounds a call whose context carries no deadline. It is
+// the same 120s internal/voice/client.go settles on: long enough for a model
+// call on a cold resident model, short enough that a daemon which stopped
+// answering does not park the caller forever.
+const defaultCallTimeout = 120 * time.Second
+
 // errWriteLost marks a conn drop while sending the request frame: the request
 // never reached the server (or the server never saw a complete frame), so
 // retrying is always safe regardless of method — nothing was applied to
@@ -103,11 +114,22 @@ func Dial(path string) (*Client, error) {
 	return &Client{conn: c, path: path, addr: addr}, nil
 }

+// Close closes the connection out from under a call in flight, on purpose: a
+// shutdown must not wait out a parked read. It takes connMu and never c.mu, so
+// it cannot block behind the call it is interrupting.
+//
+// The lock is taken and released by hand, around the two field accesses and
+// nothing else. The socket close happens outside it, because a close on a tcp
+// conn can block and connMu is on the path of every call.
 func (c *Client) Close() error {
-	if c.conn == nil {
+	c.connMu.Lock()
+	conn := c.conn
+	c.conn = nil
+	c.connMu.Unlock()
+	if conn == nil {
 		return nil
 	}
-	return c.conn.Close()
+	return conn.Close()
 }

 // DialWait is Dial with patience: it retries with capped backoff until the
@@ -163,16 +185,26 @@ func (c *Client) call(ctx context.Context, m Method, params, result any) error {
 	}

 	var resp Response
-	err := c.roundtrip(m, raw, &resp)
+	err := c.roundtrip(ctx, m, raw, &resp)
 	switch {
 	case errors.Is(err, errWriteLost):
 		// The request never left; a duplicate send can't double-apply.
 		// Redial (roundtrip re-dials on a nil conn) and retry exactly once.
-		err = c.roundtrip(m, raw, &resp)
+		// Not when the caller has given up — a retry would only be a second
+		// frame nobody is waiting for.
+		if ctx.Err() == nil {
+			err = c.roundtrip(ctx, m, raw, &resp)
+		}
 	case errors.Is(err, errReadLost):
 		if readOnlyMethods[m] {
+			if ctx.Err() != nil {
+				// The caller cancelled the read it was waiting for. Nothing
+				// was applied, so this is the cancellation and not an
+				// ambiguity.
+				return ctx.Err()
+			}
 			// A duplicate read can't double-apply either — safe to replay.
-			err = c.roundtrip(m, raw, &resp)
+			err = c.roundtrip(ctx, m, raw, &resp)
 		} else {
 			// The mutation may have already committed server-side. Do not
 			// retry: report the ambiguity instead of guessing.
@@ -199,19 +231,55 @@ func (c *Client) call(ctx context.Context, m Method, params, result any) error {
 // failure is wrapped in errReadLost (ambiguous — call() only retries it for
 // read-only methods). Either way a failed conn is dropped so the next call
 // re-dials clean. Caller holds c.mu.
-func (c *Client) roundtrip(m Method, raw json.RawMessage, resp *Response) error {
-	if c.conn == nil {
-		conn, err := netaddr.Dial(c.addr)
+//
+// The connection carries a deadline derived from ctx, falling back to
+// defaultCallTimeout, and a watchdog closes it if ctx is cancelled mid-call
+// (V-638). Before that a daemon which stopped answering parked the caller for
+// as long as the socket stayed open. The watchdog closes the conn rather than
+// calling drop, because drop wants c.mu and the caller is holding it — the
+// closed socket fails the read, and roundtrip drops it on the way out.
+func (c *Client) roundtrip(ctx context.Context, m Method, raw json.RawMessage, resp *Response) error {
+	conn := c.currentConn()
+	if conn == nil {
+		dialed, err := netaddr.Dial(c.addr)
 		if err != nil {
 			return fmt.Errorf("%w: dial %s: %v", errWriteLost, c.addr, err)
 		}
-		c.conn = conn
+		c.setConn(dialed)
+		conn = dialed
 	}
-	if err := writeFrame(c.conn, Request{Method: m, Params: raw}); err != nil {
+	if dl, ok := ctx.Deadline(); ok {
+		_ = conn.SetDeadline(dl)
+	} else {
+		_ = conn.SetDeadline(time.Now().Add(defaultCallTimeout))
+	}
+	defer conn.SetDeadline(time.Time{})
+
+	// The watchdog and the end of the call race by construction: a cancellation
+	// landing just as the reply arrives can close a conn this call is already
+	// done with, and c.conn would still point at the closed socket. So a call
+	// whose context ended does not leave the conn behind for the next one,
+	// whichever of the two got there first.
+	done := make(chan struct{})
+	defer func() {
+		close(done)
+		if ctx.Err() != nil {
+			c.drop()
+		}
+	}()
+	go func() {
+		select {
+		case <-ctx.Done():
+			_ = conn.Close()
+		case <-done:
+		}
+	}()
+
+	if err := writeFrame(conn, Request{Method: m, Params: raw}); err != nil {
 		c.drop()
 		return fmt.Errorf("%w: %v", errWriteLost, err)
 	}
-	if err := readFrame(c.conn, resp); err != nil {
+	if err := readFrame(conn, resp); err != nil {
 		c.drop()
 		return fmt.Errorf("%w: %v", errReadLost, err)
 	}
@@ -220,12 +288,26 @@ func (c *Client) roundtrip(m Method, raw json.RawMessage, resp *Response) error

 // drop closes and forgets the current conn so the next call re-dials.
 func (c *Client) drop() {
+	c.connMu.Lock()
+	defer c.connMu.Unlock()
 	if c.conn != nil {
 		_ = c.conn.Close()
 		c.conn = nil
 	}
 }

+func (c *Client) currentConn() net.Conn {
+	c.connMu.Lock()
+	defer c.connMu.Unlock()
+	return c.conn
+}
+
+func (c *Client) setConn(conn net.Conn) {
+	c.connMu.Lock()
+	defer c.connMu.Unlock()
+	c.conn = conn
+}
+
 // hydrate rehydrates a wire RpcError into the matching package sentinel. The
 // code↔sentinel table is the only place the wire "knows" about errors; keep it
 // in sync with codeOf in wire.go.
@@ -247,6 +329,8 @@ func hydrate(e *RpcError) error {
 		return fmt.Errorf("%w: %s", ErrReminderState, e.Message)
 	case codeToolNotFound:
 		return fmt.Errorf("%w: %s", ErrToolNotFound, e.Message)
+	case codeNoSuchTrace:
+		return fmt.Errorf("%w: %s", ErrNoSuchTrace, e.Message)
 	case codeUnknownMethod:
 		return fmt.Errorf("%w: %s", ErrUnknownMethod, e.Message)
 	case codeBadParams:
@@ -661,7 +745,11 @@ func (c *Client) Chat(ctx context.Context, conversation, text string) (ChatReply
 	if err := c.call(ctx, MethodChat, chatReq{Text: text, Conversation: conversation}, &r); err != nil {
 		return ChatReply{}, err
 	}
-	return ChatReply{Reply: r.Reply, Source: r.Source}, nil
+	return ChatReply{Reply: r.Reply, Source: r.Source, TraceID: r.TraceID}, nil
+}
+
+func (c *Client) CorrectTurn(ctx context.Context, traceID int64, shouldBe string) error {
+	return c.call(ctx, MethodCorrectTurn, correctTurnReq{TraceID: traceID, ShouldBe: shouldBe}, nil)
 }

 func (c *Client) TickTrace(ctx context.Context) (TickTrace, error) {
@@ -176,6 +176,14 @@ type SystemAPI interface {
 	// has run since the daemon started.
 	TurnDecisions(ctx context.Context, n int) ([]TurnDecision, error)

+	// CorrectTurn records that one persisted turn was routed wrongly, and what
+	// it should have been (V-630). shouldBe empty means "wrong, target
+	// unstated", which is a usable negative and must not cost more to give than
+	// the full answer. Unlike TurnDecisions this DOES reach a table, because a
+	// correction is the only supervised signal the box gets and it has to
+	// outlive the trace that carried it.
+	CorrectTurn(ctx context.Context, traceID int64, shouldBe string) error
+
 	// RecentEcosystemTraces reads the ecosystem call log, which lives in its
 	// own table so machine-rate traces never crowd out human-rate facts.
 	RecentEcosystemTraces(ctx context.Context, n int) ([]EcosystemTrace, error)
@@ -31,6 +31,7 @@ var mapErrPairs = []struct {
 	{"ErrReminderNotFound", store.ErrReminderNotFound, ErrReminderNotFound},
 	{"ErrReminderState", store.ErrReminderState, ErrReminderState},
 	{"ErrToolNotFound", store.ErrToolNotFound, ErrToolNotFound},
+	{"ErrNoSuchTrace", store.ErrNoSuchTrace, ErrNoSuchTrace},
 	{"ErrTaskNoDoneWhen", store.ErrTaskNoDoneWhen, ErrTaskNoDoneWhen},
 	{"ErrTaskDuplicate", store.ErrTaskDuplicate, ErrTaskDuplicate},
 	{"ErrTaskResolved", store.ErrTaskResolved, ErrTaskResolved},
@@ -17,9 +17,11 @@ import (
 // Server — the core side of the boundary. Listens on a unix domain socket,
 // accepts module connections, frames requests to a CoreAPI and responses back.
 // One Server per daemon process; concurrent connections are handled in their
-// own goroutine but share the single CoreAPI (and therefore the single store
-// writer — store is single-connection, SetMaxOpenConns(1), so serialization is
-// already guaranteed at the db; the Server adds no locking of its own).
+// own goroutine but share the single CoreAPI, and so the single store writer.
+// The store opens at SetMaxOpenConns(1), so serialisation is already guaranteed
+// at the database and the Server adds no locking of its own. That cap is an
+// invariant this comment depends on, measured and kept on 07-08-2026 (V-642,
+// docs/evals/2026-08-07-store-connection-cap.md).
 type Server struct {
 	api  atomic.Value // stores CoreAPI
 	path string
@@ -30,6 +32,14 @@ type Server struct {
 	done   chan struct{}
 	accept sync.Mutex // guards wg.Add vs Close's wg.Wait sequence

+	// ctx — server-scoped, cancelled by Close, and the parent of every request
+	// context. serveConn dispatched under context.Background() until V-638, so
+	// a dispatch in flight during shutdown could not be told to stop and the
+	// closeGrace below could only abandon it. Cancelling gives a handler that
+	// respects its context the chance to return instead.
+	ctx    context.Context
+	cancel context.CancelFunc
+
 	// conns — every accepted connection still being served. Close needs these
 	// because closing the listener does nothing to a connection already
 	// accepted: serveConn is parked in readFrame waiting for a peer that may
@@ -208,11 +218,14 @@ func Listen(path string, api CoreAPI) (*Server, error) {
 	if err != nil {
 		return nil, err
 	}
+	ctx, cancel := context.WithCancel(context.Background())
 	s := &Server{
-		path: path,
-		addr: addr,
-		ln:   ln,
-		done: make(chan struct{}),
+		path:   path,
+		addr:   addr,
+		ln:     ln,
+		done:   make(chan struct{}),
+		ctx:    ctx,
+		cancel: cancel,
 	}
 	s.api.Store(api)
 	return s, nil
@@ -250,7 +263,10 @@ func (s *Server) Serve() error {

 func (s *Server) serveConn(c net.Conn) {
 	caller, callerOK := peerCaller(c)
-	ctx := context.Background()
+	// Derived from the server's, so Close cancels a dispatch in flight, and
+	// cancelled when this conn ends so nothing a handler spawned outlives it.
+	ctx, cancel := context.WithCancel(s.serverContext())
+	defer cancel()
 	if callerOK {
 		ctx = WithCaller(ctx, caller)
 	}
@@ -274,6 +290,15 @@ func (s *Server) serveConn(c net.Conn) {
 	}
 }

+// serverContext is s.ctx, or Background for a Server built as a zero value
+// rather than by Listen (the wiring tests do that).
+func (s *Server) serverContext() context.Context {
+	if s.ctx == nil {
+		return context.Background()
+	}
+	return s.ctx
+}
+
 func (s *Server) safeDispatch(ctx context.Context, req Request) (result json.RawMessage, err error) {
 	defer func() {
 		if r := recover(); r != nil {
@@ -514,7 +539,10 @@ var methodTable = map[Method]handlerFunc{
 	}),
 	MethodChat: withParams(func(ctx context.Context, api CoreAPI, p chatReq) (chatResp, error) {
 		reply, err := api.Chat(ctx, p.Conversation, p.Text)
-		return chatResp{Reply: reply.Reply, Source: reply.Source}, err
+		return chatResp{Reply: reply.Reply, Source: reply.Source, TraceID: reply.TraceID}, err
+	}),
+	MethodCorrectTurn: withParams(func(ctx context.Context, api CoreAPI, p correctTurnReq) (struct{}, error) {
+		return struct{}{}, api.CorrectTurn(ctx, p.TraceID, p.ShouldBe)
 	}),
 	MethodTickTrace: withoutParams(func(ctx context.Context, api CoreAPI) (TickTrace, error) {
 		return api.TickTrace(ctx)
@@ -717,6 +745,9 @@ func (s *Server) Close() error {
 	default:
 		close(s.done)
 	}
+	if s.cancel != nil {
+		s.cancel()
+	}
 	err := s.ln.Close()
 	// Closing the listener stops new connections; it does nothing to the ones
 	// already accepted. Close those too, or every serveConn parked in readFrame
@@ -213,6 +213,13 @@ func (a *storeAPI) TickTrace(ctx context.Context) (TickTrace, error) {
 	return TickTrace{}, errors.New("store: tick trace not available via direct store API")
 }

+// CorrectTurn — unlike TickTrace and TurnDecisions this one is a table, so the
+// store adapter answers it for real (V-630). A correction has to land whether
+// the caller reached the daemon or the store directly.
+func (a *storeAPI) CorrectTurn(ctx context.Context, traceID int64, shouldBe string) error {
+	return mapErr(a.s.CorrectTurn(ctx, traceID, shouldBe, time.Now()))
+}
+
 // TurnDecisions — same story as TickTrace: the arbitration record is a daemon
 // ring, not a table, so there is nothing here to read it from (V-564).
 func (a *storeAPI) TurnDecisions(ctx context.Context, n int) ([]TurnDecision, error) {
@@ -412,6 +419,8 @@ func mapErr(err error) error {
 		return ErrReminderState
 	case errors.Is(err, store.ErrToolNotFound):
 		return ErrToolNotFound
+	case errors.Is(err, store.ErrNoSuchTrace):
+		return ErrNoSuchTrace
 	case errors.Is(err, store.ErrTaskNoDoneWhen):
 		return ErrTaskNoDoneWhen
 	case errors.Is(err, store.ErrTaskDuplicate):
@@ -144,6 +144,10 @@ func (UnimplementedCoreAPI) RevertFact(ctx context.Context, key string) (int64,
 func (UnimplementedCoreAPI) TickTrace(ctx context.Context) (TickTrace, error) {
 	return TickTrace{}, ErrNotImplemented
 }
+func (UnimplementedCoreAPI) CorrectTurn(ctx context.Context, traceID int64, shouldBe string) error {
+	return ErrNotImplemented
+}
+
 func (UnimplementedCoreAPI) TurnDecisions(ctx context.Context, n int) ([]TurnDecision, error) {
 	return nil, ErrNotImplemented
 }
@@ -49,6 +49,7 @@ const (
 	MethodRevertFact             Method = "revert_fact"
 	MethodTickTrace              Method = "tick_trace"
 	MethodTurnDecisions          Method = "turn_decisions"
+	MethodCorrectTurn            Method = "correct_turn"
 	MethodMorningStatus          Method = "morning_status"
 	MethodMCPServers             Method = "mcp_servers"
 	MethodDayPlan                Method = "day_plan"
@@ -125,6 +126,7 @@ const (
 	codeReminderMissing = "reminder_not_found"
 	codeReminderState   = "reminder_state"
 	codeToolNotFound    = "tool_not_found"
+	codeNoSuchTrace     = "no_such_trace"
 	codeUnknownMethod   = "unknown_method"
 	codeBadParams       = "bad_params"
 	codeForbidden       = "forbidden"
@@ -160,6 +162,8 @@ func codeOf(err error) string {
 		return codeReminderState
 	case errors.Is(err, ErrToolNotFound):
 		return codeToolNotFound
+	case errors.Is(err, ErrNoSuchTrace):
+		return codeNoSuchTrace
 	case errors.Is(err, ErrUnknownMethod):
 		return codeUnknownMethod
 	case errors.Is(err, ErrBadParams):
@@ -97,6 +97,11 @@ func NarrativeRequests() []string { return words("narrative_requests") }
 // the set's own note for why this one is a list and not a seed set.
 func RepairMarkers() []string { return words("repair_markers") }

+// RepairNegatives lists the ways he says the previous turn was wrong without
+// saying what it should have been. Matched against the whole utterance, never as
+// substrings — see the set's own note.
+func RepairNegatives() []string { return words("repair_negatives") }
+
 // FirstPerson lists every form of the first-person pronoun. Callers use it to
 // decide that a sentence is about him: internal/router/complaint.go keeps a
 // complaint out of the fact store unless one of these appears, because losing a
@@ -135,6 +140,30 @@ func ConfirmNo() []string { return words("confirm_no") }
 // TaskDropWords — see TaskDoneWords.
 func TaskDropWords() []string { return words("task_drop_words") }

+// WaterNouns and DrinkVerbs are the two halves of a water fact: he has to name
+// the drink and the drinking, because "вода" alone is a word about water and
+// "выпил" alone does not say what. The other four self-care sets need only one
+// word each. All six are matched over tokens by lemma — except ShowerWords, see
+// its own note.
+func WaterNouns() []string { return words("water_nouns") }
+
+// DrinkVerbs — see WaterNouns.
+func DrinkVerbs() []string { return words("drink_verbs") }
+
+// MealWords returns the nouns and verbs of having eaten.
+func MealWords() []string { return words("meal_words") }
+
+// ShowerWords returns the shower noun. Match these EXACTLY and not by lemma:
+// the dictionary makes "душ" and "душа" one word, and only one of them is a
+// shower. The set's note says why exact matching costs nothing here.
+func ShowerWords() []string { return words("shower_words") }
+
+// BreakWords returns the noun and verbs of taking a break.
+func BreakWords() []string { return words("break_words") }
+
+// SleepWords returns the verbs of having slept.
+func SleepWords() []string { return words("sleep_words") }
+
 // SlotValueFrame returns the words that can surround a bare slot value without
 // making the utterance a request of its own. A caller strips these (along with
 // the numbers and the other closed time sets) to see whether an utterance
@@ -147,6 +147,10 @@
        "got it wrong", "not a ", "that was wrong"
      ]
    },
+    "repair_negatives": {
+      "note": "The ways he says she got it wrong WITHOUT saying what it should have been. Matched against the WHOLE utterance, not as substrings, which is what keeps them apart from repair_markers: \u0022\u044d\u0442\u043e \u043d\u0435\u0022 is a fragment that needs an intent word after it, while these are complete sentences. A member that could appear inside an ordinary sentence does not belong here.",
+      "words": ["не так поняла", "неправильно поняла", "ты не поняла", "не поняла меня", "ты ошиблась", "не так", "неправильно", "это неправильно", "that was wrong", "got it wrong", "you got it wrong", "wrong"]
+    },
    "first_person": {
      "note": "Every form of the first-person pronoun, plus the English ones. Closed class in the strictest sense: the language has these and no others. A sentence carrying one is about him, which is what makes it a fact rather than a passing complaint.",
      "words": [
@@ -173,10 +177,11 @@
      ]
    },
    "reminder_verbs": {
-      "note": "The imperatives that mean \"remind me\", in the forms he speaks. The same kind of set as capture_verbs and decided the same way: it is her vocabulary, not a discovery about Russian (Vikunja #530).",
+      "note": "The imperatives that mean \"remind me\", in the forms he speaks. The same kind of set as capture_verbs and decided the same way: it is her vocabulary, not a discovery about Russian (Vikunja #530). The alarm verbs joined them in V-627. \"разбуди меня в 6:30\" is a reminder that fires at the hour he gets up, and the set knew no form of it, so an alarm reached IntentReminder only by resembling one to the embedder.",
      "words": [
        "напомни", "напомните", "напомнить", "напоминай",
-        "remind"
+        "разбуди", "разбудите", "разбудить", "буди",
+        "remind", "wake"
      ]
    },
    "half_hour": {
@@ -252,6 +257,50 @@
        "yes", "yeah", "yep", "yup", "ok", "okay", "sure", "confirm", "affirmative"
      ]
    },
+    "water_nouns": {
+      "note": "The water noun, in the forms he drinks it in, plus English (V-586). Closed because it is one noun: Russian gives it six cases and two numbers and that is the whole list. Both \"вода\" and \"водой\" are listed even though one declension covers both, because the vendored dictionary lemmatises \"воды\" to \"вод\" and \"водой\" to \"вода\" — two lemmas for one noun, so the set has to name both or a caller matching by lemma misses half of them. Matched over tokens with morph.SameWord, never as a substring: the \"вод\" this replaced fired on \"водитель\" and \"заводить\".",
+      "words": [
+        "вода", "водой", "водичка", "water"
+      ]
+    },
+    "drink_verbs": {
+      "note": "Drinking, in the aspects and prefixes he speaks (V-586). Closed in the sense that matters: these are the verbs that make a water noun a water FACT, and the list is her vocabulary rather than a discovery about Russian. \"пил\" and \"пили\" are listed as surface forms because the dictionary lemmatises them to \"пила\", the saw; the perfective forms lemmatise correctly and one member each covers them. Whole tokens only — the substring \"пил\" this replaced fired on \"пилот\".",
+      "words": [
+        "пить", "пил", "пили", "пей", "выпить", "попить", "допить", "запить",
+        "drink", "drank", "drinking"
+      ]
+    },
+    "meal_words": {
+      "note": "Eating: the meal nouns and the verbs of having one (V-586). Closed the same way capture_verbs is — these are the words that write a meal fact, decided here. The verbs are listed in the infinitive because that is the lemma the dictionary returns, so \"поужинал\" and \"позавтракал\" match without their own entries. \"есть\" and \"ел\" are deliberately ABSENT: \"есть\" is also the existential, and \"есть новости по бэкапу\" is a question rather than a meal. The English \"ate\" carried a guard against \"backup\" when this was a substring test; over tokens the guard is unnecessary.",
+      "words": [
+        "обед", "обедать", "пообедать",
+        "ужин", "ужинать", "поужинать",
+        "завтрак", "завтракать", "позавтракать",
+        "еда", "перекус", "перекусить",
+        "поесть", "кушать", "покушать",
+        "meal", "ate", "lunch", "dinner", "breakfast"
+      ]
+    },
+    "shower_words": {
+      "note": "The shower, and the one set here matched EXACTLY rather than by lemma (V-586). The dictionary lemmatises \"душ\" to \"душа\", so a lemma test cannot tell a shower from a soul, and \"на душе легко\" is not a fact about washing. The accusative of an inanimate noun is its nominative, so \"принял душ\" and \"сходил в душ\" are both the bare form and exact matching loses nothing he actually says. The substring this replaced also fired on \"душно\".",
+      "words": [
+        "душ", "душем", "shower", "showered"
+      ]
+    },
+    "break_words": {
+      "note": "Taking a break, noun and verb (V-586). Closed like meal_words and for the same reason. \"отдых\" and \"отдыхать\" are both listed because the noun and the verb are separate lemmas; the perfective \"отдохнул\" lemmatises to \"отдохнуть\".",
+      "words": [
+        "перерыв", "отдых", "отдыхать", "отдохнуть", "передохнуть",
+        "break", "rest"
+      ]
+    },
+    "sleep_words": {
+      "note": "Sleeping (V-586). The imperfective surface forms \"спал\" and \"спала\" are listed because the dictionary lemmatises them to \"спасть\", a different verb, and one entry for the pair is the honest fix; the prefixed forms lemmatise consistently and their infinitives cover them. \"сон\" is absent: the noun names a dream as readily as a night's sleep, and it was not in the pattern this replaces either.",
+      "words": [
+        "спать", "спал", "поспать", "поспал", "проспать", "выспаться",
+        "sleep", "slept", "sleeping"
+      ]
+    },
    "confirm_no": {
      "note": "The answers that decline a parked confirm. Same matching rule as confirm_yes and the same reason. The multi-word members are here rather than assembled by a caller because \"надо\" alone is not an answer and \"не надо\" is the opposite of one: the two must land on opposite sides, and only the phrase says which. \"не\" on its own is NOT a member — \"не забудь купить хлеб\" is a reminder, not a refusal.",
      "words": [
@@ -257,7 +257,16 @@ func (c *Client) call(ctx context.Context, method string, params any, out any) e
 	if resp.Error != nil {
 		return fmt.Errorf("mcp: %s: %s: %w", c.name, method, resp.Error)
 	}
-	if out == nil || len(resp.Result) == 0 {
+	// A frame carrying our id and neither result nor error is not an answer.
+	// The HTTP transport already refuses one; the stdio transport does not, and
+	// without this check the refusal depended on which door the server was
+	// behind. Letting it through is the one failure that lies: tools/call
+	// returns an empty string and a nil error, so the act is recorded as done
+	// and the tool never ran.
+	if len(resp.Result) == 0 {
+		return fmt.Errorf("mcp: %s: %s: response carries neither result nor error", c.name, method)
+	}
+	if out == nil {
 		return nil
 	}
 	if err := json.Unmarshal(resp.Result, out); err != nil {
@@ -525,10 +525,16 @@ func (m *Manager) Resources(ctx context.Context) []Resource {

 // ReadResource reads one resource from one server.
 func (m *Manager) ReadResource(ctx context.Context, server, uri string) (string, error) {
-	cl, cfg, _, _, _ := m.lookup(server, "")
-	if cl == nil {
+	cl, cfg, _, configured, _ := m.lookup(server, "")
+	if !configured {
 		return "", fmt.Errorf("%w: %s", ErrNoServer, server)
 	}
+	// A configured server that is merely down is not an unknown server. Call
+	// already keeps the two apart; reporting ErrNoServer here tells a caller
+	// the resource can never exist, when the truth is "not right now".
+	if cl == nil {
+		return "", fmt.Errorf("%w: %s", ErrNotConnected, server)
+	}
 	cctx, cancel := context.WithTimeout(ctx, cfg.Timeout)
 	defer cancel()
 	return cl.ReadResource(cctx, uri)
@@ -641,3 +641,59 @@ func TestReconnectBackoffGrows(t *testing.T) {
 		t.Fatalf("first retry = %v, want %v", c.backoff(), DefaultReconnectEvery)
 	}
 }
+
+// emptyFrameTransport answers the handshake normally and then replies to every
+// later call with a well-formed frame carrying our id and nothing else — no
+// result, no error. That is the answer a partially-implemented server gives,
+// and it is the one that lies: without a check it reads as success.
+type emptyFrameTransport struct{ handshaken bool }
+
+func (t *emptyFrameTransport) Call(ctx context.Context, req *rpcRequest) (*rpcResponse, error) {
+	id := req.ID
+	if !t.handshaken {
+		t.handshaken = true
+		raw, _ := json.Marshal(map[string]any{
+			"protocolVersion": ProtocolVersion,
+			"serverInfo":      map[string]any{"name": "empty", "version": "0"},
+		})
+		return &rpcResponse{JSONRPC: "2.0", ID: &id, Result: raw}, nil
+	}
+	return &rpcResponse{JSONRPC: "2.0", ID: &id}, nil
+}
+
+func (t *emptyFrameTransport) Notify(context.Context, string, any) error { return nil }
+func (t *emptyFrameTransport) Close() error                              { return nil }
+
+func TestResultlessResponseIsNotSuccess(t *testing.T) {
+	c := newClient("empty", &emptyFrameTransport{})
+	if err := c.Initialize(context.Background()); err != nil {
+		t.Fatalf("initialize: %v", err)
+	}
+	out, err := c.CallTool(context.Background(), "break_thing", map[string]any{"q": "x"})
+	if err == nil {
+		t.Fatalf("a frame with neither result nor error must not read as success (got %q)", out)
+	}
+	if out != "" {
+		t.Fatalf("out = %q", out)
+	}
+	if _, err := c.ListTools(context.Background()); err == nil {
+		t.Fatal("tools/list with no result must be an error, not an empty catalogue")
+	}
+}
+
+func TestReadResourceOnDownServerIsNotConnected(t *testing.T) {
+	// A url server with no poster factory: configured, validated, never dialed.
+	m, err := NewManager(nil, []ServerConfig{{
+		Name: "down", URL: "http://example.test/mcp", Enabled: true,
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	m.Connect(context.Background())
+	if _, err := m.ReadResource(context.Background(), "down", "note://one"); !errors.Is(err, ErrNotConnected) {
+		t.Fatalf("err = %v, want ErrNotConnected", err)
+	}
+	if _, err := m.ReadResource(context.Background(), "nosuch", "note://one"); !errors.Is(err, ErrNoServer) {
+		t.Fatalf("err = %v, want ErrNoServer", err)
+	}
+}
@@ -0,0 +1,90 @@
+// Package modes holds the routing mode inventory: the roughly thirty distinct
+// downstream behaviours mavend has, each mapped back to one of the seven public
+// intents (V-631, umbrella V-628).
+//
+// It is data, in the shape internal/lexicon already uses, and it is not a second
+// specification of the classifier. Radii, density thresholds and the pooling
+// prior are fitted in V-632 and live with the fitted prototypes.
+//
+// Two rules decide whether something is a mode. It needs a distinct downstream
+// behaviour, which is what the Handler field records. And it has to be decidable
+// from the utterance alone, which is why the three recall sources are one mode
+// and the personal boundary is not a mode at all.
+package modes
+
+import (
+	"embed"
+	"encoding/json"
+	"fmt"
+)
+
+//go:embed modes_v1.json
+var files embed.FS
+
+// Mode is one routing class.
+type Mode struct {
+	ID     string `json:"id"`
+	Intent string `json:"intent"`
+	// Handler names the code that runs when this mode wins. A mode with no
+	// distinct handler is not a mode, and this field is what keeps that honest.
+	Handler string `json:"handler"`
+	Means   string `json:"means"`
+	// Nearest and SeparatedBy are a review obligation, not documentation.
+	// Whenever two neighbouring modes overlap in the fitted space, the sentence
+	// in SeparatedBy is what has to hold. If nothing separates them, they were
+	// one mode and this file is wrong.
+	Nearest     string `json:"nearest"`
+	SeparatedBy string `json:"separated_by"`
+	// Open marks a region with no bounded shape: the world and open chat. Those
+	// carry RejectPolicy, and nothing else may.
+	Open            bool     `json:"open"`
+	RejectPolicy    string   `json:"reject_policy,omitempty"`
+	PrototypeCount  int      `json:"prototype_count"`
+	MinSeedExamples int      `json:"min_seed_examples"`
+	Note            string   `json:"note,omitempty"`
+	Examples        []string `json:"examples"`
+}
+
+// Inventory is the whole file. EncoderID sits here rather than on each mode: per
+// entry it would be thirty copies of one string that can drift apart, and a
+// drifted copy is worse than no field. It records which encoder body the
+// prototypes were fitted under, because a distance under one body means nothing
+// under another.
+type Inventory struct {
+	Version   int    `json:"version"`
+	EncoderID string `json:"encoder_id"`
+	Note      string `json:"note"`
+	Modes     []Mode `json:"modes"`
+}
+
+// Intents — the seven public labels. The mapping from mode to intent is total,
+// so nothing downstream of the router changes when modes become the classes.
+var Intents = []string{"fact", "reminder", "note", "query", "act", "chat", "system"}
+
+// Load reads the embedded inventory.
+func Load() (*Inventory, error) {
+	b, err := files.ReadFile("modes_v1.json")
+	if err != nil {
+		return nil, fmt.Errorf("modes: read: %w", err)
+	}
+	var inv Inventory
+	if err := json.Unmarshal(b, &inv); err != nil {
+		return nil, fmt.Errorf("modes: parse: %w", err)
+	}
+	return &inv, nil
+}
+
+// ByID indexes the inventory.
+func (inv *Inventory) ByID() map[string]Mode {
+	out := make(map[string]Mode, len(inv.Modes))
+	for _, m := range inv.Modes {
+		out[m.ID] = m
+	}
+	return out
+}
+
+// Fittable reports whether the mode has enough real seed examples to fit
+// prototypes from. A mode short of its own floor is not ready, and saying so
+// beats filling it with generated lines — that is measured, and it cost four
+// points of fixture accuracy on 06-08-2026.
+func (m Mode) Fittable() bool { return len(m.Examples) >= m.MinSeedExamples }
@@ -0,0 +1,185 @@
+package modes
+
+import (
+	"bufio"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func load(t *testing.T) *Inventory {
+	t.Helper()
+	inv, err := Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return inv
+}
+
+// The mapping back to the seven public labels must be total, ids unique, and a
+// reject policy only where the region is open.
+func TestInventoryShape(t *testing.T) {
+	inv := load(t)
+	if inv.EncoderID == "" {
+		t.Error("no encoder_id: a fitted distance means nothing without the body it was fitted under")
+	}
+	valid := map[string]bool{}
+	for _, i := range Intents {
+		valid[i] = true
+	}
+	seen := map[string]bool{}
+	for _, m := range inv.Modes {
+		if seen[m.ID] {
+			t.Errorf("%s: duplicate id", m.ID)
+		}
+		seen[m.ID] = true
+		if !valid[m.Intent] {
+			t.Errorf("%s: intent %q is not one of the seven", m.ID, m.Intent)
+		}
+		if m.Handler == "" {
+			t.Errorf("%s: no handler, so it is not a mode", m.ID)
+		}
+		if m.SeparatedBy == "" {
+			t.Errorf("%s: no separated_by, so nothing states the review obligation", m.ID)
+		}
+		if m.Open && m.RejectPolicy == "" {
+			t.Errorf("%s: open with no reject_policy", m.ID)
+		}
+		if !m.Open && m.RejectPolicy != "" {
+			t.Errorf("%s: reject_policy on a bounded mode", m.ID)
+		}
+		if m.PrototypeCount < 1 {
+			t.Errorf("%s: prototype_count %d", m.ID, m.PrototypeCount)
+		}
+	}
+	// No id is a prefix of another. act.tool.hoststats was, and it turned out to
+	// run the same handler as act.tool: a read against a change is the tool row's
+	// destructive field, which the confirm gate already reads. Handler is prose,
+	// so a duplicated behaviour hides there. A nested id is the tell that shows.
+	for _, a := range inv.Modes {
+		for _, b := range inv.Modes {
+			if a.ID != b.ID && strings.HasPrefix(b.ID, a.ID+".") {
+				t.Errorf("%s is nested under %s, so one of them is not a mode", b.ID, a.ID)
+			}
+		}
+	}
+	// Nearest names a real mode, or the review obligation points at nothing.
+	for _, m := range inv.Modes {
+		if m.Nearest != "" && !seen[m.Nearest] {
+			t.Errorf("%s: nearest %q is not in the inventory", m.ID, m.Nearest)
+		}
+		if m.Nearest == m.ID {
+			t.Errorf("%s: nearest is itself", m.ID)
+		}
+	}
+}
+
+func repoRoot(t *testing.T) string {
+	t.Helper()
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return filepath.Join(wd, "..", "..")
+}
+
+func seedRows(t *testing.T) map[string]bool {
+	t.Helper()
+	paths, err := filepath.Glob(filepath.Join(repoRoot(t), "models", "seeds", "*.txt"))
+	if err != nil || len(paths) == 0 {
+		t.Fatalf("no seed files: %v", err)
+	}
+	out := map[string]bool{}
+	for _, p := range paths {
+		f, err := os.Open(p)
+		if err != nil {
+			t.Fatal(err)
+		}
+		sc := bufio.NewScanner(f)
+		for sc.Scan() {
+			line := strings.TrimSpace(sc.Text())
+			if line == "" || strings.HasPrefix(line, "#") {
+				continue
+			}
+			out[strings.ToLower(line)] = true
+		}
+		f.Close()
+	}
+	return out
+}
+
+// Every example is a real seed row. Not generated: 202 reviewed generated
+// contrast pairs cost four points of fixture accuracy on 06-08-2026, and the
+// generated half of the corpus recovers its own generation prompt when clustered.
+func TestExamplesComeFromSeedRows(t *testing.T) {
+	inv := load(t)
+	seeds := seedRows(t)
+	for _, m := range inv.Modes {
+		if len(m.Examples) == 0 {
+			continue
+		}
+		for _, e := range m.Examples {
+			if !seeds[strings.ToLower(e)] {
+				t.Errorf("%s: example %q is not a seed row", m.ID, e)
+			}
+		}
+	}
+}
+
+// The fixture is the sole held-out measurement. An example drawn from it makes
+// every number after that unfalsifiable.
+func TestExamplesAreNotFixtureCases(t *testing.T) {
+	inv := load(t)
+	b, err := os.ReadFile(filepath.Join(repoRoot(t), "internal", "router", "eval", "ru_routing_v1.json"))
+	if err != nil {
+		t.Skipf("fixture not readable: %v", err)
+	}
+	var raw struct {
+		Cases []struct {
+			Utterance string `json:"utterance"`
+		} `json:"cases"`
+	}
+	if err := json.Unmarshal(b, &raw); err != nil {
+		t.Fatalf("fixture shape changed, and this invariant must not silently skip: %v", err)
+	}
+	held := map[string]bool{}
+	for _, c := range raw.Cases {
+		if c.Utterance != "" {
+			held[strings.ToLower(strings.TrimSpace(c.Utterance))] = true
+		}
+	}
+	if len(held) == 0 {
+		t.Fatal("read no utterances from the fixture")
+	}
+	for _, m := range inv.Modes {
+		for _, e := range m.Examples {
+			if held[strings.ToLower(e)] {
+				t.Errorf("%s: example %q is a fixture case", m.ID, e)
+			}
+		}
+	}
+}
+
+// Not a failure, a report. Nine modes have zero real examples and they are the
+// nine with no deterministic matcher, which is why V-629 and V-630 come before
+// V-632: without persisted turns there is nothing to fit them from.
+func TestFittableReport(t *testing.T) {
+	inv := load(t)
+	var ready, short, empty []string
+	for _, m := range inv.Modes {
+		switch {
+		case len(m.Examples) == 0:
+			empty = append(empty, m.ID)
+		case m.Fittable():
+			ready = append(ready, m.ID)
+		default:
+			short = append(short, m.ID)
+		}
+	}
+	t.Logf("modes: %d total, %d ready to fit, %d short of min_seed_examples, %d with no seed example at all",
+		len(inv.Modes), len(ready), len(short), len(empty))
+	t.Logf("  no examples: %s", strings.Join(empty, ", "))
+	t.Logf("  short: %s", strings.Join(short, ", "))
+}
@@ -0,0 +1,382 @@
+{
+  "version": 1,
+  "encoder_id": "e5-small-routing-v1",
+  "note": "Written from the handlers on 06-08-2026 for V-631. Examples are drawn only from train_seeds.jsonl, which is src=seed. The 91-case fixture is not touched. A mode whose examples list is short of min_seed_examples is not ready to fit, and that is the point of recording the number.",
+  "modes": [
+    {
+      "id": "query.fact-by-key",
+      "intent": "query",
+      "handler": "queryFactByKey",
+      "means": "he asks back a fact he stored, by its key",
+      "nearest": "query.recall",
+      "separated_by": "a key exists in the fact store; recall has to search",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": ["сколько я спал сегодня", "какой сегодня вес", "сколько воды я выпил сегодня", "когда последний раз поливал цветы", "когда кормил кота в последний раз", "сколько времени прошло с последней тренировки", "how many hours did I sleep this week"]
+    },
+    {
+      "id": "query.day-plan",
+      "intent": "query",
+      "handler": "queryDayPlan",
+      "means": "what the day holds, asked with a plan word",
+      "nearest": "query.calendar",
+      "separated_by": "a plan word is present; the calendar listing is the general case",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": ["что у меня сегодня по плану", "какие планы на завтра", "планы на сегодня", "какие у меня планы на завтра"]
+    },
+    {
+      "id": "query.habits",
+      "intent": "query",
+      "handler": "queryHabits",
+      "means": "what he usually does, asked with a habit marker",
+      "nearest": "query.calendar",
+      "separated_by": "обычно, каждый, по средам; not a single dated occasion",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": []
+    },
+    {
+      "id": "query.tasks",
+      "intent": "query",
+      "handler": "queryTasks",
+      "means": "what is on the task board",
+      "nearest": "query.day-plan",
+      "separated_by": "a task noun or an explicit что … сделать, with no date",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": []
+    },
+    {
+      "id": "query.attention",
+      "intent": "query",
+      "handler": "queryAttention",
+      "means": "what Praxis says needs looking at",
+      "nearest": "query.tasks",
+      "separated_by": "an attention marker; the board is Maven's, attention is Praxis's",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": []
+    },
+    {
+      "id": "query.list",
+      "intent": "query",
+      "handler": "queryList",
+      "means": "what is on a standing list",
+      "nearest": "query.tasks",
+      "separated_by": "an explicit list marker",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": []
+    },
+    {
+      "id": "query.money",
+      "intent": "query",
+      "handler": "queryMoney",
+      "means": "spending and balances, from the facts the poller wrote",
+      "nearest": "query.fact-by-key",
+      "separated_by": "a money noun plus an actual ask",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": ["какой баланс на счету", "сколько стоит свет в этом месяце", "сколько электричества мы потратили"]
+    },
+    {
+      "id": "query.history",
+      "intent": "query",
+      "handler": "queryHistory",
+      "means": "what he told her, asked about the telling rather than the topic",
+      "nearest": "query.recall",
+      "separated_by": "both halves of a history phrase and no named topic",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": []
+    },
+    {
+      "id": "query.feeds",
+      "intent": "query",
+      "handler": "queryFeeds",
+      "means": "what the feeds she reads are carrying",
+      "nearest": "query.world",
+      "separated_by": "a feed noun plus an ask; the world source would invent news",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": ["что нового"]
+    },
+    {
+      "id": "query.home",
+      "intent": "query",
+      "handler": "queryHome",
+      "means": "the state of the house",
+      "nearest": "act.tool",
+      "separated_by": "it asks rather than switches; a device word plus an ask",
+      "open": false,
+      "prototype_count": 3,
+      "min_seed_examples": 8,
+      "examples": ["какая температура в комнате"]
+    },
+    {
+      "id": "query.network",
+      "intent": "query",
+      "handler": "queryNetwork",
+      "means": "what is on the LAN",
+      "nearest": "act.tool",
+      "separated_by": "the subject is the network, not this box",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": ["что с интернетом", "какая скорость интернета", "сколько трафика сегодня"]
+    },
+    {
+      "id": "query.calendar",
+      "intent": "query",
+      "handler": "queryCalendar",
+      "means": "what the calendar holds, dated",
+      "nearest": "query.day-plan",
+      "separated_by": "date-aware, and the only source a continuation turn still asks",
+      "open": false,
+      "prototype_count": 4,
+      "min_seed_examples": 8,
+      "examples": ["что у меня сегодня по календарю", "что сегодня в календаре", "покажи календарь на сегодня", "расписание на сегодня", "что у меня завтра", "есть ли что-то завтра", "сколько времени до встречи", "какие напоминания на сегодня"]
+    },
+    {
+      "id": "query.weather",
+      "intent": "query",
+      "handler": "queryWeather",
+      "means": "the weather, outside",
+      "nearest": "query.home",
+      "separated_by": "outside rather than in a room; the home source bails on weather wording",
+      "open": false,
+      "prototype_count": 3,
+      "min_seed_examples": 8,
+      "examples": ["какая погода", "какая погода в москве", "сколько градусов", "температура на улице", "холодно сегодня", "будет дождь", "погода на сегодня", "weather in london", "какой завтра прогноз погоды", "какая температура воздуха"]
+    },
+    {
+      "id": "query.self",
+      "intent": "query",
+      "handler": "querySelf",
+      "means": "a question about her",
+      "nearest": "chat.open",
+      "separated_by": "it wants a fact about her, not a conversation",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": ["как тебя зовут", "сколько тебе лет", "у тебя есть чувства", "do you have feelings"]
+    },
+    {
+      "id": "query.recall",
+      "intent": "query",
+      "handler": "queryEmbed, queryMemory, queryNotes",
+      "means": "search his own notes and memory for something he named",
+      "nearest": "query.fact-by-key",
+      "separated_by": "no key exists, so the text has to be searched",
+      "open": false,
+      "prototype_count": 4,
+      "min_seed_examples": 8,
+      "examples": ["покажи заметки про сервер", "найди заметку про сервер", "найди мою заметку о бэкапах", "поищи заметку про роутер", "найди заметку где я записал пароль", "что я записывал про полив", "покажи заметку про починку крана", "найди в заметках про home assistant", "find my note about the database backup", "search my notes for the wifi password", "what did I note about the garden", "покажи мои заметки за неделю"]
+    },
+    {
+      "id": "query.web",
+      "intent": "query",
+      "handler": "queryWeb",
+      "means": "read a page he named out loud",
+      "nearest": "query.world",
+      "separated_by": "he supplied the URL; it is an instruction, not a question",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": []
+    },
+    {
+      "id": "query.world",
+      "intent": "query",
+      "handler": "querySearch, queryKiwix, queryGeneral",
+      "means": "anything outside his own data",
+      "nearest": "chat.open",
+      "separated_by": "a source can answer it; the personal boundary let it past",
+      "open": true,
+      "prototype_count": 6,
+      "min_seed_examples": 12,
+      "reject_policy": "no prototype within radius goes to the LLM fallback, which this path already pays for",
+      "examples": ["почему небо голубое", "что такое любовь", "как работает интернет", "почему трава зелёная", "откуда берётся дождь", "what is love", "why is the sky blue", "how does the internet work"]
+    },
+    {
+      "id": "act.tool",
+      "intent": "act",
+      "handler": "tools.Exec against the enabled allowlist",
+      "means": "switch, start, stop or read something the tool allowlist names",
+      "nearest": "query.home",
+      "separated_by": "it names a tool the allowlist carries; destructive is the tool row’s field, not a mode of its own",
+      "open": false,
+      "prototype_count": 6,
+      "min_seed_examples": 8,
+      "note": "act.tool.hoststats was a mode here until 06-08-2026 and is not one: it ran the same tools.Exec, and read against change is the tool row’s destructive field, which the confirm gate already reads. Its nine examples went with it, because they are question-shaped query seeds that no configured alias matches, so no tool answers them today. replySystem's память/загрузк/аптайм arm answers “системная статистика пока не подключена.” and always did.",
+      "examples": ["включи свет на кухне", "выключи кондиционер", "открой шторы", "закрой окно", "перезагрузи роутер", "запусти пылесос", "заблокируй дверь", "maven, restart nginx", "перезапусти nginx", "останови контейнер", "maven, сделай бэкап", "запусти обновление системы"]
+    },
+    {
+      "id": "act.taskstatus",
+      "intent": "act",
+      "handler": "resolveTaskStatus",
+      "means": "move an item on Maven's own board",
+      "nearest": "act.praxis",
+      "separated_by": "the board is Maven's; Praxis owns attention, not this",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": []
+    },
+    {
+      "id": "act.praxis",
+      "intent": "act",
+      "handler": "handlePraxisAct",
+      "means": "surface, acknowledge or resolve a Praxis item",
+      "nearest": "act.taskstatus",
+      "separated_by": "the item lives in Praxis, and the three lifecycle words differ",
+      "open": false,
+      "prototype_count": 3,
+      "min_seed_examples": 8,
+      "examples": []
+    },
+    {
+      "id": "act.hexis",
+      "intent": "act",
+      "handler": "handleHexisAct",
+      "means": "execute a registered capability against a resolved entity",
+      "nearest": "act.tool",
+      "separated_by": "it names an entity Nexus must resolve before anything runs",
+      "open": false,
+      "prototype_count": 3,
+      "min_seed_examples": 8,
+      "examples": []
+    },
+    {
+      "id": "note.task",
+      "intent": "note",
+      "handler": "captureTaskFromNote",
+      "means": "he files work, which belongs in the task store",
+      "nearest": "note.recall",
+      "separated_by": "it is work to be done, not something to remember",
+      "open": false,
+      "prototype_count": 3,
+      "min_seed_examples": 8,
+      "examples": ["заметка: починить ручку на двери", "заметка: сменить масло в машине", "заметка: заменить лампочку в коридоре", "заметка: записаться к стоматологу", "заметка: переклеить обои в спальне", "заметка: проверить уровень масла", "запиши: проверить проводку на даче", "заметка: обновить прошивку роутера"]
+    },
+    {
+      "id": "note.list",
+      "intent": "note",
+      "handler": "captureListFromNote",
+      "means": "he adds to a standing list",
+      "nearest": "note.task",
+      "separated_by": "a list marker; the item is bought, not done",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": ["запиши что нужно купить в магазине", "купить новый фильтр для аквариума", "заметка: купить новый фильтр для воды", "запиши: купить семена для огорода", "запиши: купить подарок на день рождения"]
+    },
+    {
+      "id": "note.recall",
+      "intent": "note",
+      "handler": "WriteNote plus memStore.Insert",
+      "means": "free text he wants indexed for later recall",
+      "nearest": "fact.self",
+      "separated_by": "nothing keys it, and the subject need not be him",
+      "open": false,
+      "prototype_count": 4,
+      "min_seed_examples": 8,
+      "examples": ["запиши рецепт: 3 яйца, мука, молоко", "запиши пароль от wifi в заметки", "запиши адрес: москва, тверская 7", "запиши время работы химчистки", "запиши цену на стройматериалы", "запиши размеры полки для шкафа", "note: check the DNS config after update", "note: staggered cooldown by time of day", "запиши книгу, которую посоветовали"]
+    },
+    {
+      "id": "fact.self",
+      "intent": "fact",
+      "handler": "actionFact, WriteFact kind=self",
+      "means": "a keyed, supersedable statement about him",
+      "nearest": "note.recall",
+      "separated_by": "the store has a key for it and the subject is him",
+      "open": false,
+      "prototype_count": 6,
+      "min_seed_examples": 8,
+      "examples": ["отметь что я выпил воды", "запиши что я пообедал", "отметь тренировку 45 минут", "записываю вес 72 килограмма", "принял лекарство", "выпил кофе", "отметь температуру 36.6", "записываю давление 120 на 80", "вес 73.5 килограмма", "сон 7 часов", "slept 6h", "walked 8000 steps"]
+    },
+    {
+      "id": "reminder.timed",
+      "intent": "reminder",
+      "handler": "actionReminder",
+      "means": "fire something at a time",
+      "nearest": "note.task",
+      "separated_by": "it carries a time; a task has none",
+      "open": false,
+      "prototype_count": 4,
+      "min_seed_examples": 8,
+      "examples": ["напомни завтра в 9 утра позвонить", "напомни через 4 часа размяться", "напомни завтра в 9 утра позвонить", "напомни в пятницу вынести мусор", "напомни через 15 минут снять бельё", "remind me in 30 minutes to drink water", "remind me at 6pm to take out the trash", "remind me tomorrow at 8am to call the doctor"]
+    },
+    {
+      "id": "system.clock",
+      "intent": "system",
+      "handler": "replySystem, the час/врем arm, ruClock",
+      "means": "the current time",
+      "nearest": "query.world",
+      "separated_by": "answered from the box's own clock, not from a source",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": ["который час", "сколько времени", "сколько сейчас времени", "который час у нас", "который час в Москве"]
+    },
+    {
+      "id": "system.date",
+      "intent": "system",
+      "handler": "replySystem, the день/числ arm, ParseCalendarDate",
+      "means": "today's date or weekday",
+      "nearest": "query.calendar",
+      "separated_by": "it asks what day it is, not what is on that day",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": ["какой сегодня день", "какое сегодня число", "какой сегодня день недели"]
+    },
+    {
+      "id": "system.presence",
+      "intent": "system",
+      "handler": "replySystem, the кто дома arm",
+      "means": "who is home",
+      "nearest": "query.home",
+      "separated_by": "the subject is people, not devices",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": ["кто сейчас дома", "сколько человек дома", "есть ли кто дома", "все ли дома", "кто дома сейчас"]
+    },
+    {
+      "id": "system.quiet",
+      "intent": "system",
+      "handler": "quiet_toggle.go, matched pre-route",
+      "means": "turn the quiet mode on or off",
+      "nearest": "act.tool",
+      "separated_by": "it flips a daemon-wide setting from any channel, so the match is exact",
+      "open": false,
+      "prototype_count": 2,
+      "min_seed_examples": 8,
+      "examples": ["тихий режим", "не шуми", "не беспокоить", "включи тихий режим", "выключи тихий режим", "громкий режим", "quiet mode on", "quiet off"]
+    },
+    {
+      "id": "chat.open",
+      "intent": "chat",
+      "handler": "PhraseChat",
+      "means": "conversation, answered from the model with history",
+      "nearest": "query.self",
+      "separated_by": "nothing else claimed it and no source can answer it",
+      "open": true,
+      "prototype_count": 6,
+      "min_seed_examples": 12,
+      "reject_policy": "stays a measured positive class even while acting as a fallback region, or it silently absorbs every genuine miss",
+      "examples": ["привет", "как дела", "о чём поговорим", "чем занимаешься", "расскажи историю", "пошути", "анекдот", "что ты думаешь о жизни", "i'm bored", "tell me a joke", "what's up", "how are you"]
+    }
+  ]
+}
@@ -52,10 +52,13 @@ type PlanEntry struct {
 // Plan — the ordered day. Date is the calendar day it describes. Rest marks a
 // plan trimmed by After, which changes what an empty one means: a day with
 // nothing on it and a day whose last item has passed are different answers.
+// More counts what Next dropped off the end, so the sentence can say that more
+// remains instead of implying the day ends after the third line.
 type Plan struct {
 	Date  time.Time
 	Items []PlanEntry
 	Rest  bool
+	More  int
 }

 // BuildPlan orders everything known about the day Now falls on: calendar
@@ -142,13 +145,24 @@ func checklistEntries(routines []Routine, facts map[string]store.Fact, now time.
 	return out
 }

+// NextSpoken — how many entries "что дальше?" reads aloud. Three, for the same
+// reason the feed reads three headlines: the answer is spoken once and cannot be
+// scrolled back, and a list longer than a breath is not an answer, it is a
+// recital. Asked at 04:45 on a day with 43 entries, the trim below removes
+// nothing — everything is still ahead — so the cap is what makes "дальше" mean
+// next rather than today (V-618).
+const NextSpoken = 3
+
 // After returns the part of the plan that has not happened yet — the answer to
 // "что дальше?" as opposed to "какие планы на сегодня?". The Date is kept, so an
 // empty result still knows which day it is empty for.
+//
+// Strictly after: an entry at exactly now is the thing happening, not the thing
+// next.
 func (p Plan) After(now time.Time) Plan {
 	out := Plan{Date: p.Date, Rest: true}
 	for _, it := range p.Items {
-		if it.At.Before(now) {
+		if !it.At.After(now) {
 			continue
 		}
 		out.Items = append(out.Items, it)
@@ -156,10 +170,30 @@ func (p Plan) After(now time.Time) Plan {
 	return out
 }

+// Next is After with a spoken cap — what "что дальше?" actually answers with.
+// The overflow is counted rather than dropped, because "дальше: 10:00 …" with
+// forty entries hidden behind it is a false picture of the day.
+func (p Plan) Next(now time.Time, n int) Plan {
+	out := p.After(now)
+	if n > 0 && len(out.Items) > n {
+		out.More = len(out.Items) - n
+		out.Items = out.Items[:n]
+	}
+	return out
+}
+
 // FormatRU renders the plan as maven says it. Feminine self-reference,
 // informal address, no pet names — and no exhortation: she reads the day back,
 // she does not tell him to get on with it.
+//
+// Every hour is read in the plan's own zone — Date's, which BuildPlan sets from
+// the asking clock. Printed raw, an hour read whatever zone its instant arrived
+// in: an event or a reminder comes off the store as UTC, while a checklist line
+// is built local, so one spoken sentence named two zones. This is the voice
+// path, so that is what the owner heard (V-614); the same defect on the two web
+// pages was V-612.
 func (p Plan) FormatRU() string {
+	zone := p.Date.Location()
 	if len(p.Items) == 0 {
 		// "что дальше?" after the last item of the day. The day was not empty,
 		// it is over, and saying it was empty is a false statement about a day
@@ -171,14 +205,28 @@ func (p Plan) FormatRU() string {
 	}
 	parts := make([]string, len(p.Items))
 	for i, it := range p.Items {
-		line := fmt.Sprintf("%s — %s", it.At.Format("15:04"), it.Text)
+		line := fmt.Sprintf("%s — %s", it.At.In(zone).Format("15:04"), it.Text)
 		if it.Uncertain {
 			line = say.S(say.PlanUncertain, map[string]string{"line": line})
 		}
 		parts[i] = line
 	}
+	items := strings.Join(parts, "; ")
+	// The rest of the day is a different sentence, not a shorter day plan. It
+	// carries no date — he asked what is next, and he knows which day he is in —
+	// and it says out loud when there is more behind the cap.
+	if p.Rest {
+		if p.More > 0 {
+			return say.S(say.PlanNextMore, map[string]string{
+				"items": items,
+				"n":     fmt.Sprint(p.More),
+				"word":  say.CountWord(p.More, "дело", "дела", "дел"),
+			})
+		}
+		return say.S(say.PlanNext, map[string]string{"items": items})
+	}
 	return say.S(say.PlanDay, map[string]string{
 		"date":  p.Date.Format("02.01.2006"),
-		"items": strings.Join(parts, "; "),
+		"items": items,
 	})
 }
@@ -1,6 +1,7 @@
 package morning

 import (
+	"fmt"
 	"strings"
 	"testing"
 	"time"
@@ -151,6 +152,37 @@ func TestPlanFormatRU(t *testing.T) {
 	}
 }

+// One spoken sentence names one clock. An event and a reminder come off the
+// store as UTC and a checklist line is built in the asking clock's zone, so the
+// raw Format printed the two halves of one sentence in two zones (V-614). The
+// zones here are three hours off whatever this machine runs in, so the test
+// tells "read in his clock" apart from "read in the zone the instant arrived
+// in" under TZ=UTC as well.
+func TestPlanFormatRUReadsEveryHourInThePlansZone(t *testing.T) {
+	_, off := time.Now().Zone()
+	away := time.FixedZone("away", off+3*60*60)
+
+	stored := time.Date(2026, 8, 3, 14, 0, 0, 0, time.UTC)
+	p := Plan{
+		Date: time.Date(2026, 8, 3, 0, 0, 0, 0, away),
+		Items: []PlanEntry{
+			{At: stored, Text: "Планёрка", Kind: PlanEvent},
+			{At: planAt(time.Date(2026, 8, 3, 0, 0, 0, 0, away), 10, 30),
+				Text: "утро — осталось: витамины", Kind: PlanChecklist},
+		},
+	}
+	got := p.FormatRU()
+	if want := stored.In(away).Format("15:04"); !strings.Contains(got, want) {
+		t.Errorf("the event is not read in the plan's zone (%s): %q", want, got)
+	}
+	if bad := stored.Format("15:04"); strings.Contains(got, bad) {
+		t.Errorf("the event is read in the zone it was stored in (%s): %q", bad, got)
+	}
+	if !strings.Contains(got, "10:30") {
+		t.Errorf("the checklist line moved zone: %q", got)
+	}
+}
+
 func TestPlanAfter(t *testing.T) {
 	p, now := planFixture(t)
 	rest := p.After(planAt(now, 11, 0))
@@ -171,6 +203,84 @@ func TestPlanAfter(t *testing.T) {
 	}
 }

+// nextFixture — a day with more entries than the cap, built in a zone three
+// hours off UTC so the test fails under TZ=UTC as well as under the machine's
+// own zone if the plan ever renders in the wrong one.
+func nextFixture(t *testing.T) (Plan, time.Time) {
+	t.Helper()
+	zone := time.FixedZone("MSK", 3*60*60)
+	now := time.Date(2026, 8, 3, 4, 45, 0, 0, zone)
+	var events []PlanEntry
+	for _, hhmm := range [][2]int{{5, 45}, {10, 0}, {14, 0}, {18, 30}, {21, 12}} {
+		events = append(events, PlanEntry{
+			At:   planAt(now, hhmm[0], hhmm[1]),
+			Text: fmt.Sprintf("событие %02d:%02d", hhmm[0], hhmm[1]),
+			Kind: PlanEvent,
+		})
+	}
+	return BuildPlan(nil, nil, events, nil, now), now
+}
+
+// "что дальше?" asked at 04:45 on a day with everything still ahead. The trim
+// removes nothing there, so before V-618 she read the whole day out loud.
+func TestPlanNextCapsWhatIsSpoken(t *testing.T) {
+	p, now := nextFixture(t)
+	got := p.Next(now, NextSpoken).FormatRU()
+	want := "дальше: 05:45 — событие 05:45; 10:00 — событие 10:00; " +
+		"14:00 — событие 14:00. и ещё 2 дела до конца дня."
+	if got != want {
+		t.Errorf("got  %q\nwant %q", got, want)
+	}
+	// No date: he asked what is next, not what day it is.
+	if strings.Contains(got, "03.08.2026") {
+		t.Errorf("rest-of-day answer stamps a date: %q", got)
+	}
+}
+
+// Nothing hidden means nothing claimed hidden.
+func TestPlanNextWithinTheCapSaysNoMore(t *testing.T) {
+	p, now := nextFixture(t)
+	got := p.Next(planAt(now, 15, 0), NextSpoken).FormatRU()
+	want := "дальше: 18:30 — событие 18:30; 21:12 — событие 21:12"
+	if got != want {
+		t.Errorf("got  %q\nwant %q", got, want)
+	}
+}
+
+// The whole-day question is not narrowed: same plan, no trim, no cap.
+func TestPlanWholeDayIsNotNarrowed(t *testing.T) {
+	p, _ := nextFixture(t)
+	got := p.FormatRU()
+	if n := strings.Count(got, "событие"); n != 5 {
+		t.Errorf("whole day read %d of 5 entries: %q", n, got)
+	}
+	if !strings.HasPrefix(got, "план на 03.08.2026: ") {
+		t.Errorf("whole day lost its date: %q", got)
+	}
+}
+
+// The empty case says the day is over rather than returning an empty sentence,
+// and it does not say the day was empty.
+func TestPlanNextEmptySaysSo(t *testing.T) {
+	p, now := nextFixture(t)
+	got := p.Next(planAt(now, 23, 30), NextSpoken).FormatRU()
+	if got != "на сегодня больше ничего не запланировано." {
+		t.Errorf("got %q", got)
+	}
+}
+
+// An entry at exactly the asking minute is what is happening, not what is next.
+func TestPlanNextIsStrictlyAfterNow(t *testing.T) {
+	p, now := nextFixture(t)
+	rest := p.Next(planAt(now, 5, 45), NextSpoken)
+	if len(rest.Items) != 3 || rest.Items[0].At.Hour() != 10 {
+		t.Errorf("got %+v", rest.Items)
+	}
+	if rest.More != 1 {
+		t.Errorf("More = %d, want 1", rest.More)
+	}
+}
+
 // The plan says what today still has not got done, and a closed window does not
 // make a skipped routine untrue. Evaluate reports Active only inside the
 // window, so keying the checklist line off it meant the one thing the plan can
@@ -45,6 +45,14 @@ const (
 	// is the only authority the voice path can offer, and this is the one act
 	// it is not enough for (Vikunja #449, #523).
 	ActNeedsAuthedSurface = "act_needs_authed_surface"
+	// ActUnknownTarget — the verb reached a tool and the target did not reach
+	// anything. Named rather than run, because the alias match swallowed the verb
+	// and handed on the next word of the sentence (V-634).
+	ActUnknownTarget = "act_unknown_target"
+	// RepairNoted — he said the turn was wrong and did not say what it should
+	// have been. She confirms the label landed and does not ask, because the
+	// answer would be one of her own intent names (V-636).
+	RepairNoted = "repair_noted"

 	EcoDenied        = "eco_denied"
 	EcoDown          = "eco_down"
@@ -76,7 +84,7 @@ const (
 var actKeys = []string{
 	ActDone, ActDoneOut, ActDoneEntity, ActConfirm, ActConfirmEntity, ActWhich,
 	ActFail, ActFailOut, ActFailEntity, ActServerDown, ActWithdrawn, ActNeedsArgs,
-	ActNeedsAuthedSurface,
+	ActNeedsAuthedSurface, ActUnknownTarget, RepairNoted,
 	EcoDenied, EcoDown, EcoAmbiguous, EcoUnknownEntity, EcoNoNexus, EcoAboutWhat, EcoRecall,
 	AttentionNone, AttentionList, AttentionFail,
 	AttentionNoneEntity, AttentionListEntity, AttentionFailEntity,
@@ -102,6 +110,8 @@ var actFloor = map[string]string{
 	ActServerDown:         "инструмент есть, но сервер не подключён.",
 	ActWithdrawn:          "сервер больше не отдаёт этот инструмент — сняла его с разрешённых, посмотри /tools.",
 	ActNeedsArgs:          "тут нужны аргументы, из голоса не соберу. угадывать не буду.",
+	RepairNoted:           "поняла, отметила, что ответила не так.",
+	ActUnknownTarget:      "«{name}» — не знаю такой цели. назови её как в системе.",
 	ActNeedsAuthedSurface: "это из голоса не выполню — после него ничего не вернуть. запусти сам.",

 	EcoDenied:        "{name} отклоняет доступ, проверь токен.",
@@ -60,6 +60,14 @@
      "fixed": true,
      "variants": ["тут нужны аргументы, из голоса не соберу. угадывать не буду."]
    },
+    "repair_noted": {
+      "fixed": true,
+      "variants": ["поняла, отметила, что ответила не так."]
+    },
+    "act_unknown_target": {
+      "fixed": true,
+      "variants": ["«{name}» — не знаю такой цели. назови её как в системе."]
+    },
    "act_needs_authed_surface": {
      "fixed": true,
      "variants": ["это из голоса не выполню — после него ничего не вернуть. запусти сам."]
@@ -78,3 +78,36 @@ func TestEmptyKnowledgeAnswerIsAnError(t *testing.T) {
 		t.Errorf("error = %v; want it to name the empty response", err)
 	}
 }
+
+// The other two paths, which had no such guard. The evidence branch of
+// PhraseQuery and PhraseChat both returned ("", nil) off a server that produced
+// no tokens — an empty answer reported as a successful phrasing. The daemon's
+// callers check for the empty string and paper over it; the eval does not, and
+// scored a silent model as bad phrasing rather than as a failure.
+func TestEmptyAnswerIsAnErrorOnEveryPath(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(`{"choices":[{"message":{"content":""}}]}`))
+	}))
+	t.Cleanup(srv.Close)
+	p := NewLLMPhraserAt(srv.URL, Config{})
+
+	t.Run("evidence", func(t *testing.T) {
+		got, err := p.PhraseQuery(context.Background(), "сколько воды я выпил", []string{"два литра"})
+		if err == nil {
+			t.Fatal("an empty response scored as an answer")
+		}
+		if !isFallback(t, fbQuerySources, "два литра", got) {
+			t.Errorf("fallback text = %q, want a %q variant", got, fbQuerySources)
+		}
+	})
+	t.Run("chat", func(t *testing.T) {
+		got, err := p.PhraseChat(context.Background(), "как дела", nil)
+		if err == nil {
+			t.Fatal("an empty response scored as an answer")
+		}
+		if !isFallback(t, fbChat, "", got) {
+			t.Errorf("fallback text = %q, want a %q variant", got, fbChat)
+		}
+	})
+}
@@ -299,6 +299,16 @@ func (p *LLMPhraser) PhraseQuery(ctx context.Context, utterance string, notes []
 	if text != "" {
 		return text, nil
 	}
+	if raw == "" {
+		// Same guard the knowledge branch above has had since it was written,
+		// and this branch did not: the server answered and the model wrote
+		// nothing, which returned ("", nil) — an empty answer reported as a
+		// successful phrasing. The daemon's callers happen to check for the
+		// empty string, so it read as a silent fallback there; the eval scored
+		// it as bad phrasing rather than as the failure it is, and nothing on
+		// either path logged that the model had produced no tokens.
+		return SourcesFallback(strings.Join(notes, "; ")), errEmptyResponse
+	}
 	return raw, nil
 }

@@ -375,7 +385,13 @@ func (p *LLMPhraser) PhraseChat(ctx context.Context, utterance string, history [
 	if i := strings.IndexByte(resp, '\n'); i >= 0 {
 		resp = resp[:i]
 	}
-	return strings.TrimSpace(resp), nil
+	if resp = strings.TrimSpace(resp); resp == "" {
+		// The model was up and wrote nothing. Same rule as PhraseQuery: the
+		// fallback keeps the turn alive and the failure stays visible, rather
+		// than ("", nil) telling the caller the chat path succeeded.
+		return ChatFallback(), fmt.Errorf("phrase chat: %w", errEmptyResponse)
+	}
+	return resp, nil
 }

 func (p *LLMPhraser) PhraseReminder(ctx context.Context, d loop.ReminderDecision) (delivery.PhrasedReminder, error) {
@@ -414,11 +430,9 @@ func (p *LLMPhraser) PhraseReminder(ctx context.Context, d loop.ReminderDecision
 	if mood == "" {
 		mood = "neutral"
 	}
-	summary := body
-	if len(summary) > 60 {
-		summary = summary[:57] + "..."
-	}
-	return delivery.PhrasedReminder{Decision: d, Body: body, Summary: summary, Mood: mood}, nil
+	return delivery.PhrasedReminder{
+		Decision: d, Body: body, Summary: reminderSummary(body), Mood: mood,
+	}, nil
 }

 func (p *LLMPhraser) chat(ctx context.Context, userPrompt string) (string, error) {
@@ -0,0 +1,316 @@
+package phraser
+
+// The persona guard for the Go floor strings.
+//
+// internal/phraser/eval/fallbacks_test.go already scores everything Variants()
+// returns — that is the JSON decks. What it cannot see is the floor UNDER those
+// decks: the hardFloor/ackFloor/queryFloor/actFloor/confirmFloor maps and the
+// literals in nudge_llm.go, which are what she says when the JSON is unusable or
+// when the model is unreachable. Those are exactly the moments the model is not
+// doing the talking, so leaving them unscored left the persona unchecked when it
+// was most load-bearing (Vikunja #621).
+//
+// Two tests here, and the second one is the point:
+//
+//   - TestGoFloorPersona scores the floor corpus on the same checks.
+//   - TestGoFloorCoverage walks the package source with go/ast and fails on any
+//     Russian string literal that neither reached the corpus nor sits inside a
+//     declaration declared prompt-side. A hand-written list of strings would rot
+//     the first time somebody adds one; a hand-written list of PROMPT BUILDERS
+//     does not, because the default for a new literal is "must be scored".
+
+import (
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"io/fs"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+	"unicode"
+
+	"github.com/kami/maven/internal/loop"
+	"github.com/kami/maven/internal/phraser/eval"
+	"github.com/kami/maven/internal/store"
+)
+
+// personaChecks — the checks that apply to a floor line.
+//
+// The same three the non-goals section names (feminine self-reference, how she
+// addresses him, no pet names), plus lang: an English floor line is unusable out
+// loud. No hisgender, for the reason eval/fallbacks_test.go gives — her own
+// feminine verb near "тебе" is correct and that check reads it as addressing him
+// as a woman. No length, because a floor line composed from his own data has no
+// bounded length, and no ontopic/mood, which need a fixture case.
+var personaChecks = map[string]bool{
+	eval.CheckLang:     true,
+	eval.CheckFeminine: true,
+	eval.CheckAddress:  true,
+	eval.CheckCringe:   true,
+}
+
+var floorPlaceholderRE = regexp.MustCompile(`\{[a-z_]+\}`)
+
+// formatVerbRE — the fmt verbs a floor line is composed with, so the coverage
+// test compares the Russian either side of them and not the verb.
+var formatVerbRE = regexp.MustCompile(`%[+\-# 0-9.]*[a-zA-Z]`)
+
+// floorLine — one scored string and where it came from, so a failure names the
+// map or the function to go and edit.
+type floorLine struct {
+	origin string
+	text   string
+}
+
+// floorCorpus — every line the Go floor can produce. Maps are read whole, so a
+// new entry in one is scored without touching this file; the composing functions
+// are CALLED rather than scraped, so their glue text is scored in place.
+func floorCorpus() []floorLine {
+	var out []floorLine
+	add := func(origin, text string) {
+		if strings.TrimSpace(text) != "" {
+			out = append(out, floorLine{origin, text})
+		}
+	}
+	for name, m := range map[string]map[string]string{
+		"fallbacks.go hardFloor":      hardFloor,
+		"acks.go ackFloor":            ackFloor,
+		"query.go queryFloor":         queryFloor,
+		"acts.go actFloor":            actFloor,
+		"confirm.go confirmFloor":     confirmFloor,
+		"nudge_llm.go fallbackNudges": fallbackNudges,
+	} {
+		for key, text := range m {
+			add(name+"["+key+"]", text)
+		}
+	}
+
+	// fallbackNudge composes three of its four arms in Go. Drive every rule name
+	// the maps know, one it does not, and the down-services arm.
+	rules := map[string]bool{"": true, "unknown_rule": true}
+	for name := range fallbackNudges {
+		rules[name] = true
+	}
+	for name := range ruleTopics {
+		rules[name] = true
+	}
+	for name := range ruleKeywords {
+		rules[name] = true
+	}
+	for name := range rules {
+		c := loop.Candidate{}
+		c.Rule.Name = name
+		add(fmt.Sprintf("nudge_llm.go fallbackNudge(%q)", name), fallbackNudge(c))
+	}
+	// The keyword arm again, through a rule name shaped "family:keyword", which
+	// is where ruleKeyword's second branch lives.
+	c := loop.Candidate{}
+	c.Rule.Name = "custom:зарядку"
+	add("nudge_llm.go fallbackNudge(custom)", fallbackNudge(c))
+
+	// The keywords themselves. A rule that has both a keyword and a fallback
+	// line never reaches the keyword arm, but the map is edited as one thing and
+	// the next rule may have only the keyword, so score every value.
+	for rule, kw := range ruleKeywords {
+		add("nudge_llm.go ruleKeywords["+rule+"]", "Напоминаю: "+kw+".")
+	}
+
+	// The down-services arm, which needs a service actually reading down.
+	down := loop.Candidate{}
+	down.Rule.Name = "service_down"
+	down.State.Facts = map[string]store.Fact{
+		loop.ServiceDownPrefix + "gitea": {
+			Key:    loop.ServiceDownPrefix + "gitea",
+			Value:  `"down"`,
+			Source: loop.ServiceDownSource,
+			Ts:     time.Now(),
+		},
+	}
+	add("nudge_llm.go fallbackNudge(down services)", fallbackNudge(down))
+
+	// The spoken duration words. Both functions are pure and bounded, so scoring
+	// their whole range beats scraping the literals out of the switch.
+	for m := 0; m <= 60*30; m += 7 {
+		d := time.Duration(m) * time.Minute
+		add("nudge_llm.go ruDur", ruDur(d))
+		add("nudge_templates.go ruSinceWords", ruSinceWords(d))
+	}
+	for h := 0; h <= hoursSpoken; h++ {
+		add("nudge_templates.go hourPlural", hourPlural(h))
+		add("nudge_templates.go hourWord", hourWord(h))
+	}
+	return out
+}
+
+// TestGoFloorPersona scores every line the Go floor can say.
+func TestGoFloorPersona(t *testing.T) {
+	corpus := floorCorpus()
+	if len(corpus) == 0 {
+		t.Fatal("no floor lines — the corpus builder found nothing to score")
+	}
+	for _, line := range corpus {
+		// A placeholder stands for his own words and carries no persona.
+		body := floorPlaceholderRE.ReplaceAllString(line.text, "вода")
+		for _, r := range eval.RunChecks(eval.Case{}, body, "neutral") {
+			if personaChecks[r.Name] && !r.Pass {
+				t.Errorf("%s: %q fails %s: %s", line.origin, line.text, r.Name, r.Detail)
+			}
+		}
+	}
+}
+
+// promptDecls — declarations whose Russian is written FOR the model, not for
+// him. They are excluded by name, not by string, so adding a line inside one of
+// them stays excluded and adding a line anywhere else fails the coverage test.
+//
+// Every name here is asserted to still exist, so a rename fails loudly instead
+// of silently widening the exemption.
+var promptDecls = map[string]string{
+	"ReplySystemPrompt": "the system prompt for the reply model",
+	"replyContext":      "renders the decision FOR the model, never spoken",
+	"ruleTopics":        "situation descriptions fed to the nudge prompt",
+	"ruleTopic":         "same, plus the two prefixes it composes",
+	"buildNudgePrompt":  "the nudge prompt itself",
+	"chatUserMessage":   "the history block handed to the model",
+	"PhraseReminder":    "the reminder prompt; its reply is scored, its prompt is not",
+}
+
+// promptFiles — files whose whole job is prompt text. Asserted to exist, same
+// reason as promptDecls.
+var promptFiles = map[string]string{
+	"prompts.go": "every literal in it is a prompt",
+}
+
+func hasCyrillic(s string) bool {
+	for _, r := range s {
+		if unicode.Is(unicode.Cyrillic, r) {
+			return true
+		}
+	}
+	return false
+}
+
+// TestGoFloorCoverage — the guard that survives the next person.
+//
+// It reads the package source and requires every Russian string literal to be
+// one of two things: reachable in floorCorpus (so TestGoFloorPersona scored it),
+// or inside a declaration named above as prompt-side. There is no third answer
+// and no way to add a floor string that quietly gets neither.
+func TestGoFloorCoverage(t *testing.T) {
+	var scored []string
+	for _, line := range floorCorpus() {
+		scored = append(scored, line.text)
+	}
+	// A literal is covered when every Russian piece of it shows up in something
+	// the corpus scored. Pieces, not the whole string, because a format string
+	// ("%d ч") and a concatenation fragment ("Не отвечает: ") only ever reach him
+	// with the surrounding value filled in.
+	covered := func(lit string) bool {
+		for _, part := range formatVerbRE.Split(lit, -1) {
+			part = strings.TrimSpace(part)
+			if part == "" || !hasCyrillic(part) {
+				continue
+			}
+			found := false
+			for _, s := range scored {
+				if strings.Contains(s, part) {
+					found = true
+					break
+				}
+			}
+			if !found {
+				return false
+			}
+		}
+		return true
+	}
+
+	fset := token.NewFileSet()
+	pkgs, err := parser.ParseDir(fset, ".", func(fi fs.FileInfo) bool {
+		return !strings.HasSuffix(fi.Name(), "_test.go")
+	}, 0)
+	if err != nil {
+		t.Fatalf("parse package: %v", err)
+	}
+	pkg, ok := pkgs["phraser"]
+	if !ok {
+		t.Fatal("package phraser did not parse — the coverage guard cannot run")
+	}
+
+	seenDecl := map[string]bool{}
+	seenFile := map[string]bool{}
+	for path, file := range pkg.Files {
+		base := path[strings.LastIndexByte(path, '/')+1:]
+		if _, exempt := promptFiles[base]; exempt {
+			seenFile[base] = true
+			continue
+		}
+		for _, decl := range file.Decls {
+			names := declNames(decl)
+			skip := false
+			for _, n := range names {
+				if _, ok := promptDecls[n]; ok {
+					seenDecl[n] = true
+					skip = true
+				}
+			}
+			if skip {
+				continue
+			}
+			ast.Inspect(decl, func(n ast.Node) bool {
+				bl, ok := n.(*ast.BasicLit)
+				if !ok || bl.Kind != token.STRING {
+					return true
+				}
+				lit, err := strconv.Unquote(bl.Value)
+				if err != nil || !hasCyrillic(lit) {
+					return true
+				}
+				if !covered(lit) {
+					t.Errorf("%s: Russian literal %q is spoken by nothing the persona guard scores.\n"+
+						"Either reach it from floorCorpus in persona_floor_test.go, or — if it is written "+
+						"for the model rather than for him — name its declaration in promptDecls.",
+						fset.Position(bl.Pos()), lit)
+				}
+				return true
+			})
+		}
+	}
+	for name, why := range promptDecls {
+		if !seenDecl[name] {
+			t.Errorf("promptDecls names %q (%s) and no such declaration exists — "+
+				"a rename left the exemption open", name, why)
+		}
+	}
+	for base, why := range promptFiles {
+		if !seenFile[base] {
+			t.Errorf("promptFiles names %q (%s) and no such file exists", base, why)
+		}
+	}
+}
+
+// declNames — the names a top-level declaration binds, so a prompt-side var,
+// const or func can be matched whatever kind it is.
+func declNames(decl ast.Decl) []string {
+	switch d := decl.(type) {
+	case *ast.FuncDecl:
+		return []string{d.Name.Name}
+	case *ast.GenDecl:
+		var out []string
+		for _, spec := range d.Specs {
+			switch s := spec.(type) {
+			case *ast.ValueSpec:
+				for _, n := range s.Names {
+					out = append(out, n.Name)
+				}
+			case *ast.TypeSpec:
+				out = append(out, s.Name.Name)
+			}
+		}
+		return out
+	}
+	return nil
+}
--- a/Show More
+++ b/Show More