a spoken correction lands in the label table, with or without a target (V-636)

The gesture was web-only, so the sample was skewing to the turns he happens
to type. Voice is where the hard cases are.

Half of it already existed: the repair rung has read "нет, это была заметка"
since V-455. It taught the classifier and wrote no durable label, so the two
paths disagreed about what a correction is. It now writes both. Two sinks and
not one on purpose: the classifier seed makes the next turn better today, and
the label is what a fitted head trains on after the transcript expires.

The trace id is stamped onto the remembered turn after the fact, because the
trace is written when the turn ends and recordTurn runs in the middle of it.

New: the untargeted half. "нет, не так" writes the negative and redoes
nothing, because there is no target to redo it as. Voice needs this more than
the web does — naming an intent aloud means saying "заметка" or "факт",
which is her vocabulary and not his.

repair_negatives is a new closed lexicon set matched against the WHOLE
utterance, never as a substring. That is what keeps it apart from
repair_markers, where "это не" is a fragment that needs an intent word after
it. A member that could appear inside an ordinary sentence does not belong in
the set.

cmd/mavend/actions_act.go

@@ -60,6 +60,17 @@ func (h *reactiveHandler) actionAct(ctx context.Context, dec router.Decision) st
 			phrase := actPhrase(dec.Slots.Fn, dec.Slots.Args)
 			h.park(dec.Slots.Fn, dec.Slots.Args, phrase)
 			return phraser.A(phraser.ActConfirm, map[string]string{"name": phrase})
+		case errors.Is(err, tool.ErrUnknownTarget):
+			// The verb reached a tool and the tail did not reach a target, so
+			// nothing ran. Saying which word she could not place is the whole
+			// answer: he either renames it or gives the row an alias that
+			// carries the target, and both are one turn away (V-634).
+			word := ""
+			var unknown *tool.UnknownTargetError
+			if errors.As(err, &unknown) {
+				word = unknown.Target
+			}
+			return phraser.A(phraser.ActUnknownTarget, map[string]string{"name": word})
 		case errors.Is(err, tool.ErrNeedsAuthedSurface):
 			// Irreversible (internal/tool/risk.go). A confirm turn would not
 			// help: everything that proposed this act — the STT, the router,
@@ -93,3 +104,4 @@ func (h *reactiveHandler) actionAct(ctx context.Context, dec router.Decision) st
 	}
 	return phraser.A(phraser.ActDone, nil)
 }
+

cmd/mavend/decisiontrace.go

@@ -31,7 +31,8 @@ import (
 // and nothing should: a missing name costs one line of the record, while a
 // check that walks the ladder would have to run the ladder.
 var preRouteLadder = []string{
-	"confirm", "clarify-answer", "quiet-toggle", "snooze", "ack", "repair", "ordinal",
+	"confirm", "clarify-answer", "quiet-toggle", "snooze", "ack", "repair",
+	"repair-negative", "ordinal",
 }
 
 // notePreRoute records one rung of that ladder and passes its verdict through

cmd/mavend/repair.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/kami/maven/internal/lexicon"
 	"github.com/kami/maven/internal/morph"
+	"github.com/kami/maven/internal/phraser"
 	"github.com/kami/maven/internal/router"
 )
 
@@ -35,6 +36,11 @@ type routedTurn struct {
 	utterance string
 	intent    router.Intent
 	at        time.Time
+	// traceID — the persisted trace of this turn, stamped after the fact by
+	// stampLastTurn. 0 when nothing persisted, and then a spoken correction
+	// still teaches the classifier: the durable label is the half that needs a
+	// row to point at (V-636).
+	traceID int64
 }
 
 // repairWindow — how long a turn stays correctable. Long enough that he can
@@ -54,6 +60,13 @@ const repairWindow = 5 * time.Minute
 // said. The set's note in lexicon_ru_v1.json carries the same reasoning.
 var repairMarkers = lexicon.RepairMarkers()
 
+// repairNegatives — "she got it wrong" with no target. Matched against the whole
+// utterance, because these are complete sentences and the markers above are
+// fragments: "это не" needs an intent word after it, "не так поняла" does not.
+// Substring matching here would claim "не так" out of any sentence containing it
+// (V-636).
+var repairNegatives = lexicon.RepairNegatives()
+
 // repairIntents — the words he uses for each intent, as dictionary forms. They
 // used to be prefixes ("заметк"), which is what a prefix list costs: "команд"
 // also matched "командировка", and "факт" matched "фактически". morph.SameWord
@@ -147,6 +160,18 @@ func (h *reactiveHandler) recordTurn(utterance string, intent router.Intent) {
 	h.lastRouted = &routedTurn{utterance: utterance, intent: intent, at: h.now()}
 }
 
+// stampLastTurn attaches the trace id to the turn a correction would point at.
+// It cannot be done in recordTurn: the trace is written when the turn ends, and
+// recordTurn runs in the middle of it.
+func (h *reactiveHandler) stampLastTurn(utterance string, traceID int64) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.lastRouted == nil || h.lastRouted.utterance != utterance {
+		return
+	}
+	h.lastRouted.traceID = traceID
+}
+
 func (h *reactiveHandler) takeLastTurn() *routedTurn {
 	h.mu.Lock()
 	defer h.mu.Unlock()
@@ -157,6 +182,56 @@ func (h *reactiveHandler) takeLastTurn() *routedTurn {
 	return last
 }
 
+// resolveUntargetedRepair handles the cheap half of a spoken correction: he says
+// she got it wrong and does not say what it should have been (V-636).
+//
+// It is worth having on its own. V-630 made the target optional on the web for
+// the same reason: a turn marked wrong with no target is a usable negative, and
+// requiring the target would cost the correction he was willing to give. Voice
+// needs it more than the web does — naming an intent aloud means saying
+// "заметка" or "факт", which is Maven's vocabulary and not his.
+//
+// Nothing is redone and the classifier is not taught. There is no target, so
+// there is nothing to redo it as and nothing to teach. Only the label is written,
+// and she says so, because a correction he cannot see reads as one that was
+// dropped.
+func (h *reactiveHandler) resolveUntargetedRepair(ctx context.Context, text string) (string, bool) {
+	if !isRepairNegative(text) {
+		return "", false
+	}
+	last := h.takeLastTurn()
+	if last == nil || h.now().Sub(last.at) > repairWindow {
+		return "", false
+	}
+	if last.traceID == 0 {
+		// No row to point at, so there is no label to write and nothing this
+		// resolver can do. Routing the words normally is the honest outcome.
+		return "", false
+	}
+	h.labelCorrection(ctx, last, "")
+	log.Printf("voice: repair — %q marked wrong, no target given", last.utterance)
+	return phraser.A(phraser.RepairNoted, nil), true
+}
+
+// isRepairNegative matches the whole utterance, minus a leading "нет" and any
+// trailing punctuation. "нет, не так" is the shortest one he says.
+func isRepairNegative(utterance string) bool {
+	s := strings.ToLower(strings.TrimSpace(utterance))
+	s = strings.TrimRight(s, " .!?")
+	for _, p := range []string{"нет,", "нет", "no,", "no"} {
+		if rest := strings.TrimSpace(strings.TrimPrefix(s, p)); rest != s && rest != "" {
+			s = rest
+			break
+		}
+	}
+	for _, n := range repairNegatives {
+		if s == n {
+			return true
+		}
+	}
+	return false
+}
+
 // resolveRepair handles a spoken correction of the previous turn: teach the
 // classifier, redo the request under the corrected intent, and say so.
 func (h *reactiveHandler) resolveRepair(ctx context.Context, text string) (string, bool) {
@@ -182,6 +257,7 @@ func (h *reactiveHandler) resolveRepair(ctx context.Context, text string) (strin
 		learned = false
 	}
 	log.Printf("voice: repair — %q was %s, corrected to %s (learned=%v)", last.utterance, last.intent, corrected, learned)
+	h.labelCorrection(ctx, last, string(corrected))
 
 	dec := router.Decision{
 		Utterance: last.utterance,
@@ -207,3 +283,24 @@ func repairLine(say string, learned bool) string {
 	}
 	return "поняла, это " + say + " — запомнила."
 }
+
+// labelCorrection promotes a spoken correction into routing_labels, the same
+// table the /chat gesture writes (V-630, V-636).
+//
+// Two sinks and not one, because they keep different things. CorrectMisroute
+// appends a classifier seed, which is what makes the NEXT turn better today.
+// The label is what a fitted head trains on later, it survives the 14-day
+// transcript, and until now only the web produced any. A sample that only ever
+// held typed turns would skew to whatever he happens to be at a keyboard for,
+// and voice is where the hard cases are.
+//
+// Best-effort and silent. He has already been told the correction landed, and a
+// second sink failing is not his problem to hear about.
+func (h *reactiveHandler) labelCorrection(ctx context.Context, last *routedTurn, shouldBe string) {
+	if h.api == nil || last == nil || last.traceID == 0 {
+		return
+	}
+	if err := h.api.CorrectTurn(ctx, last.traceID, shouldBe); err != nil {
+		log.Printf("voice: repair: could not label trace %d: %v", last.traceID, err)
+	}
+}

cmd/mavend/repair_test.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/kami/maven/internal/router"
+	"github.com/kami/maven/internal/store"
 )
 
 func TestParseRepairReadsTheCorrectedIntent(t *testing.T) {
@@ -149,3 +150,95 @@ func TestRepairIntentWordCollisions(t *testing.T) {
 		}
 	}
 }
+
+// V-636. A spoken correction lands in the same table the /chat gesture writes,
+// so the sample is not limited to the turns he happened to type.
+func TestSpokenCorrectionWritesTheLabel(t *testing.T) {
+	h, st, _ := newClarifyHandler(t)
+	emb := router.NewHashEmbedder(256)
+	h.recall.embedder = emb
+	h.router = router.New(router.Config{Classifier: router.NewClassifier(emb), Extractor: h.extractor})
+	ctx := context.Background()
+
+	id, err := st.WriteRoutingTrace(ctx, store.RoutingTrace{
+		Ts: h.now(), Utterance: "купить хлеб", Intent: "fact", Source: "tap:voice",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	h.recordTurn("купить хлеб", router.IntentFact)
+	h.stampLastTurn("купить хлеб", id)
+
+	if _, handled := h.resolveRepair(ctx, "нет, это заметка"); !handled {
+		t.Fatal("the correction was not handled")
+	}
+	labels, err := st.RoutingLabels(ctx, 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(labels) != 1 || labels[0].Was != "fact" || labels[0].ShouldBe != "note" {
+		t.Fatalf("labels %+v: the spoken correction did not land as a pair", labels)
+	}
+}
+
+// The cheap half, which voice needs more than the web does: naming an intent
+// aloud means saying "заметка", which is her vocabulary and not his.
+func TestUntargetedSpokenCorrection(t *testing.T) {
+	h, st, now := newClarifyHandler(t)
+	ctx := context.Background()
+	seed := func(utterance string) int64 {
+		id, err := st.WriteRoutingTrace(ctx, store.RoutingTrace{
+			Ts: h.now(), Utterance: utterance, Intent: "query", Source: "tap:voice",
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		h.recordTurn(utterance, router.IntentQuery)
+		h.stampLastTurn(utterance, id)
+		return id
+	}
+
+	seed("поужинал")
+	reply, handled := h.resolveUntargetedRepair(ctx, "нет, не так")
+	if !handled {
+		t.Fatal("«нет, не так» was not read as a correction")
+	}
+	if reply == "" {
+		t.Error("a correction he cannot hear reads as one that was dropped")
+	}
+	labels, err := st.RoutingLabels(ctx, 5)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(labels) != 1 || labels[0].ShouldBe != "" || labels[0].Was != "query" {
+		t.Fatalf("labels %+v: want one untargeted negative naming what she chose", labels)
+	}
+
+	// Outside the window it is a fresh sentence, not a verdict.
+	seed("поужинал ещё раз")
+	*now = now.Add(repairWindow + time.Minute)
+	if _, handled := h.resolveUntargetedRepair(ctx, "не так"); handled {
+		t.Error("a correction outside the window was handled")
+	}
+}
+
+// Whole-utterance, never a substring. This is the difference between the
+// negatives and the markers, and getting it wrong would claim any sentence with
+// "не так" in it.
+func TestRepairNegativeIsTheWholeUtterance(t *testing.T) {
+	for _, s := range []string{
+		"не так поняла", "нет, не так", "ты ошиблась", "неправильно", "wrong", "no, that was wrong",
+	} {
+		if !isRepairNegative(s) {
+			t.Errorf("%q is not read as a correction", s)
+		}
+	}
+	for _, s := range []string{
+		"это не важно", "напомни не так поздно", "а не завтра", "не так, а вот так — это заметка",
+		"", "нет",
+	} {
+		if isRepairNegative(s) {
+			t.Errorf("%q was read as a correction", s)
+		}
+	}
+}

cmd/mavend/routingtrace.go

@@ -134,6 +134,10 @@ func (h *reactiveHandler) persistDecision(turnCtx context.Context, rec *decision
 	// on the turn it is already showing (V-630). Noted on the ORIGINAL context,
 	// not the detached one above: the sink belongs to the caller's turn.
 	noteTraceID(turnCtx, id)
+	// And the spoken path, which has no reply to hang a badge on: a correction
+	// said out loud points at the previous turn, so it needs that turn's row
+	// (V-636, repair.go).
+	h.stampLastTurn(rec.Utterance, id)
 }
 
 // wonIntent — what the winning claimant made the turn. Read from the claim

cmd/mavend/voice.go

@@ -365,6 +365,14 @@ func (h *reactiveHandler) runTurn(ctx context.Context, text string, src turnSour
 		return withNotice(expiredNotice, reply)
 	}
 
+	// 4d-ii. and the same correction without a target — "нет, не так" (V-636).
+	// After the targeted one, which is the narrower claim: an utterance that
+	// names an intent is answered by redoing the request, and this rung only
+	// gets the ones that name nothing.
+	if reply, handled := h.resolveUntargetedRepair(ctx, text); notePreRoute(ctx, "repair-negative", handled) {
+		return withNotice(expiredNotice, reply)
+	}
+
 	// 4e. ordinal selection — "второй", "первую сделал" pick from the list she
 	// just read (ordinal.go). Before routing, and only when a list is actually
 	// bound to the session: with nothing offered, "второй" is an ordinary word

internal/lexicon/lexicon.go

@@ -97,6 +97,11 @@ func NarrativeRequests() []string { return words("narrative_requests") }
 // the set's own note for why this one is a list and not a seed set.
 func RepairMarkers() []string { return words("repair_markers") }
 
+// RepairNegatives lists the ways he says the previous turn was wrong without
+// saying what it should have been. Matched against the whole utterance, never as
+// substrings — see the set's own note.
+func RepairNegatives() []string { return words("repair_negatives") }
+
 // FirstPerson lists every form of the first-person pronoun. Callers use it to
 // decide that a sentence is about him: internal/router/complaint.go keeps a
 // complaint out of the fact store unless one of these appears, because losing a

internal/lexicon/lexicon_ru_v1.json

@@ -147,6 +147,10 @@
         "got it wrong", "not a ", "that was wrong"
       ]
     },
+    "repair_negatives": {
+      "note": "The ways he says she got it wrong WITHOUT saying what it should have been. Matched against the WHOLE utterance, not as substrings, which is what keeps them apart from repair_markers: \u0022\u044d\u0442\u043e \u043d\u0435\u0022 is a fragment that needs an intent word after it, while these are complete sentences. A member that could appear inside an ordinary sentence does not belong here.",
+      "words": ["не так поняла", "неправильно поняла", "ты не поняла", "не поняла меня", "ты ошиблась", "не так", "неправильно", "это неправильно", "that was wrong", "got it wrong", "you got it wrong", "wrong"]
+    },
     "first_person": {
       "note": "Every form of the first-person pronoun, plus the English ones. Closed class in the strictest sense: the language has these and no others. A sentence carrying one is about him, which is what makes it a fact rather than a passing complaint.",
       "words": [

internal/phraser/acts.go

@@ -45,6 +45,14 @@ const (
 	// is the only authority the voice path can offer, and this is the one act
 	// it is not enough for (Vikunja #449, #523).
 	ActNeedsAuthedSurface = "act_needs_authed_surface"
+	// ActUnknownTarget — the verb reached a tool and the target did not reach
+	// anything. Named rather than run, because the alias match swallowed the verb
+	// and handed on the next word of the sentence (V-634).
+	ActUnknownTarget = "act_unknown_target"
+	// RepairNoted — he said the turn was wrong and did not say what it should
+	// have been. She confirms the label landed and does not ask, because the
+	// answer would be one of her own intent names (V-636).
+	RepairNoted = "repair_noted"
 
 	EcoDenied        = "eco_denied"
 	EcoDown          = "eco_down"
@@ -76,7 +84,7 @@ const (
 var actKeys = []string{
 	ActDone, ActDoneOut, ActDoneEntity, ActConfirm, ActConfirmEntity, ActWhich,
 	ActFail, ActFailOut, ActFailEntity, ActServerDown, ActWithdrawn, ActNeedsArgs,
-	ActNeedsAuthedSurface,
+	ActNeedsAuthedSurface, ActUnknownTarget, RepairNoted,
 	EcoDenied, EcoDown, EcoAmbiguous, EcoUnknownEntity, EcoNoNexus, EcoAboutWhat, EcoRecall,
 	AttentionNone, AttentionList, AttentionFail,
 	AttentionNoneEntity, AttentionListEntity, AttentionFailEntity,
@@ -102,6 +110,8 @@ var actFloor = map[string]string{
 	ActServerDown:         "инструмент есть, но сервер не подключён.",
 	ActWithdrawn:          "сервер больше не отдаёт этот инструмент — сняла его с разрешённых, посмотри /tools.",
 	ActNeedsArgs:          "тут нужны аргументы, из голоса не соберу. угадывать не буду.",
+	RepairNoted:           "поняла, отметила, что ответила не так.",
+	ActUnknownTarget:      "«{name}» — не знаю такой цели. назови её как в системе.",
 	ActNeedsAuthedSurface: "это из голоса не выполню — после него ничего не вернуть. запусти сам.",
 
 	EcoDenied:        "{name} отклоняет доступ, проверь токен.",

internal/phraser/acts_ru_v1.json

@@ -60,6 +60,14 @@
       "fixed": true,
       "variants": ["тут нужны аргументы, из голоса не соберу. угадывать не буду."]
     },
+    "repair_noted": {
+      "fixed": true,
+      "variants": ["поняла, отметила, что ответила не так."]
+    },
+    "act_unknown_target": {
+      "fixed": true,
+      "variants": ["«{name}» — не знаю такой цели. назови её как в системе."]
+    },
     "act_needs_authed_surface": {
       "fixed": true,
       "variants": ["это из голоса не выполню — после него ничего не вернуть. запусти сам."]

internal/tool/tool.go

@@ -39,6 +39,7 @@ import (
 	"os/exec"
 	"strings"
 	"time"
+	"unicode"
 
 	"github.com/kami/maven/internal/ipc"
 	"github.com/kami/maven/internal/mcp"
@@ -73,8 +74,27 @@ var (
 	// confirm turn that would help: asking again would imply the second answer
 	// changes the outcome.
 	ErrNeedsAuthedSurface = errors.New("tool is irreversible and voice may not authorise it")
+	// ErrUnknownTarget — the act matched a tool and the target it carries cannot
+	// be one. A process row's args become argv for a real program, and a unit,
+	// container or host is named in ASCII on this box, so a Cyrillic tail is a
+	// word from the sentence rather than a target. Held apart from every failure
+	// above because the command never ran: forwarding it would spend a confirm
+	// turn on an act that cannot succeed, and then report the program's own
+	// confusion as if she had tried something sensible (V-634).
+	ErrUnknownTarget = errors.New("the act names a target the system cannot have")
 )
 
+// UnknownTargetError carries the word the executor could not place, because the
+// reply names it: "«роутер» — не знаю такой цели" is actionable and "не
+// получилось" sends him to the log. errors.Is(err, ErrUnknownTarget) holds.
+type UnknownTargetError struct{ Target string }
+
+func (e *UnknownTargetError) Error() string {
+	return fmt.Sprintf("%s: %q", ErrUnknownTarget, e.Target)
+}
+
+func (e *UnknownTargetError) Unwrap() error { return ErrUnknownTarget }
+
 // MCPCaller is the seam for an act that is an MCP tool call rather than a
 // process (Vikunja #251). internal/mcp.Manager satisfies it via CallPositional.
 // nil ⇒ MCP is not configured, and an MCP row refuses to run rather than
@@ -144,6 +164,16 @@ func (e *Executor) Exec(ctx context.Context, name string, args []string, confirm
 	if t.Status != "enabled" {
 		return "", ErrNotEnabled
 	}
+	// A process row's args become argv, so the target has to be able to exist.
+	// Checked before the confirm gate below, because asking "выполнить X?" about
+	// an act that cannot run spends a turn on nothing (V-634). The other two
+	// dispatches are exempt: an MCP tool may take Russian text as an argument,
+	// since a task title is not a target, and a house row drops the spoken args.
+	if !isMCPRow(t.Cmd) && !isHouseRow(t.Cmd) {
+		if bad, ok := firstUnknownTarget(args); !ok {
+			return "", &UnknownTargetError{Target: bad}
+		}
+	}
 	// The tier decides, not the column (Vikunja #449). RiskOf reads the row and
 	// answers the three questions the boolean never did: which acts are
 	// destructive, whether a confirm sticks (it never does), and what an
@@ -260,3 +290,41 @@ func (m *Matcher) Allowlist() []string { return m.names() }
 func (m *Matcher) Match(utterance string) (string, []string, bool) {
 	return router.DefaultActMatcher{Fns: m.names(), Aliases: m.aliases}.Match(utterance)
 }
+
+// firstUnknownTarget reports whether every arg could name something on this box,
+// and returns the first that could not.
+//
+// The check is the script, not a word list: this is not a fourth Russian
+// mechanism (CLAUDE.md § "Russian patterns"). A systemd unit, a container, a
+// host and a path are written in ASCII, so a non-ASCII rune in an argv element
+// means the alias match swallowed the verb and handed on the next word of the
+// sentence. "перезагрузи роутер" is the case: restart is a real tool and
+// "роутер" is a real word, and `systemctl restart роутер` is neither.
+//
+// Every process row this box enables takes a system identifier (systemctl,
+// docker, journalctl, df). A process row that legitimately wanted Russian text
+// would want a different dispatch, not a hole in this check.
+//
+// It deliberately does not try to guess the right target. Identity is Nexus's
+// (CLAUDE.md § "The ecosystem"), and a target Nexus resolves reaches Hexis
+// through handleHexisAct before this executor is asked.
+func firstUnknownTarget(args []string) (string, bool) {
+	for _, a := range args {
+		for _, r := range a {
+			if r > unicode.MaxASCII {
+				return a, false
+			}
+		}
+	}
+	return "", true
+}
+
+func isMCPRow(cmd []string) bool {
+	_, _, ok := mcp.ParseCmd(cmd)
+	return ok
+}
+
+func isHouseRow(cmd []string) bool {
+	_, _, ok := smarthome.ParseCmd(cmd)
+	return ok
+}

internal/tool/tool_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"reflect"
+	"strings"
 	"testing"
 	"time"
 
@@ -320,3 +321,55 @@ func TestExecEmptyCmdRefuses(t *testing.T) {
 		t.Fatal("a row with no cmd ran a program named by the utterance")
 	}
 }
+
+// V-634. The alias match resolves the verb and hands on the next word of the
+// sentence, so "перезагрузи роутер" became `systemctl restart роутер`: a real
+// tool, a real word, and a target that cannot exist on this box.
+func TestExecRefusesATargetTheSystemCannotHave(t *testing.T) {
+	api := fakeAPI{tools: map[string]ipc.Tool{
+		"restart": {Name: "restart", Cmd: []string{"systemctl", "restart"}, Status: "enabled"},
+		"drop": {Name: "drop", Cmd: []string{"dropdb"}, Destructive: true, Status: "enabled"},
+	}}
+	ran := false
+	e := NewExecutor(api, 0)
+	e.run = func(context.Context, []string) (string, error) { ran = true; return "ok", nil }
+
+	_, err := e.Exec(context.Background(), "restart", []string{"роутер"}, false)
+	if !errors.Is(err, ErrUnknownTarget) {
+		t.Fatalf("err = %v, want ErrUnknownTarget", err)
+	}
+	if ran {
+		t.Fatal("the program was called with a target that cannot exist")
+	}
+	// The word is in the error, because a reply naming no word sends him to the log.
+	if !strings.Contains(err.Error(), "роутер") {
+		t.Errorf("err %v does not name the word she could not place", err)
+	}
+	// Ahead of the confirm gate: asking about an act that cannot run spends a
+	// turn on nothing.
+	if _, err := e.Exec(context.Background(), "drop", []string{"база"}, false); !errors.Is(err, ErrUnknownTarget) {
+		t.Errorf("destructive row: err = %v, want ErrUnknownTarget before ErrNeedsConfirm", err)
+	}
+	// An ASCII target still runs, unchanged.
+	if _, err := e.Exec(context.Background(), "restart", []string{"nginx"}, false); err != nil {
+		t.Errorf("restart nginx: %v", err)
+	}
+}
+
+// An MCP argument is not a target. A task title is Russian and always was.
+func TestExecMCPRowKeepsRussianArgs(t *testing.T) {
+	api := fakeAPI{tools: map[string]ipc.Tool{
+		"vikunja_create": {
+			Name: "vikunja_create", Status: "enabled",
+			Cmd: []string{"mcp", "vikunja", "create_task"},
+		},
+	}}
+	m := &fakeMCP{out: "создала"}
+	e := NewExecutor(api, time.Second).WithMCP(m)
+	if _, err := e.Exec(context.Background(), "vikunja_create", []string{"купить хлеб"}, false); err != nil {
+		t.Fatalf("exec: %v", err)
+	}
+	if len(m.args) != 1 || m.args[0] != "купить хлеб" {
+		t.Fatalf("args = %v, want the Russian title forwarded", m.args)
+	}
+}