Write down the bound on suspension (V-654)

A side query suspends the parked question rather than dropping it. Nothing bounded that. No attempt is spent, so MaxAttempts never applies, and noteSuspended restarts the 90s clock, so the TTL cannot arrive while he keeps talking. Measured 2026-08-07: one unfilled time slot rode the tail of six consecutive unrelated replies.

PendingQuestion.Suspends counts the step-asides, MaxSuspends is 3, and past it she lets the request go with the same clarifyDropped line every other drop uses. The count is of consecutive step-asides and resets the moment he answers.

Also splits the re-ask off the answer into its own sentence. The comma splice buried the question in the tail of a reply about something else.

CLAUDE.md

@@ -58,16 +58,27 @@ make build-web      # single daemon (pure-Go ones: web/waked/poll/caldav build w
 make test           # go test -race across ./internal/... ./cmd/... with CGO env set
 ```
 
-Run a single test (must carry the CGO env for packages that touch STT/TTS/voice):
+Run one package or one test with `make t`. **Do not hand-write the CGO preamble.**
+Past sessions pasted it about 390 times. That is where the shell-quoting failures
+came from. This box runs zsh, so an unquoted `-run Test*` or `--include=*.go`
+dies on "no matches found" before `go` is ever reached.
 
 ```sh
-CGO_CFLAGS="-I$(pwd)/deps/include -I$(pwd)/deps/whisper.cpp/ggml/include" \
-CGO_LDFLAGS="-L$(pwd)/deps/lib -Wl,-rpath,$(pwd)/deps/lib" \
-LD_LIBRARY_PATH="$(pwd)/deps/lib" \
-deps/go/go/bin/go test -run TestName ./internal/router/
+make t PKG=./internal/router/
+make t PKG=./cmd/mavend/ RUN=TestSimulator
+make t PKG=./internal/router/eval/ RUN='TestONNX' V=1   # V=1 for -v, RACE=0 to drop -race
 ```
 
-Pure-Go packages (`router`, `memory`, `mavweb`, …) run under a plain `go test ./pkg/`.
+`t` carries `-race`, so a green `make t` cannot turn red under `make test`. It carries
+`-count=1`, so a cached PASS from before your edit is never mistaken for a result.
+
+It also sets `MAVEN_ONNX_LIB`, which the hand-written recipe did not. The four
+`TestONNX*` measurements self-skip when that variable is unset. The run still prints
+`ok`. So every targeted eval done the old way reported the hash ratchet while reading
+as a real embedder score.
+
+Pure-Go packages (`router`, `memory`, `mavweb`, …) also run under a plain `go test ./pkg/`,
+but `make t` works everywhere and is one thing to remember.
 
 ## The daemons (`cmd/`)
 

Makefile

@@ -16,7 +16,7 @@ PIPER_BIN     := $(shell pwd)/deps/piper/piper
 PIPER_MODEL   := $(shell pwd)/models/tts/ru_RU-irina-medium.onnx
 PIPER_ESPEAK  := $(shell pwd)/deps/piper/espeak-ng-data
 
-.PHONY: simulate stt-fixtures test-stt-golden all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel tidy eval-router eval-reach eval-recall eval-phrasing eval-models build-gpud
+.PHONY: t audit simulate stt-fixtures test-stt-golden all build build-stt build-tts build-daemon build-client build-waked build-web build-poll build-caldav clean test fmt-check vet run-stt run-tts run-web download-embedder deps-go deps-sentinel tidy eval-router eval-reach eval-recall eval-phrasing eval-models build-gpud
 
 all: build
 
@@ -128,6 +128,35 @@ test: fmt-check vet
 	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
 		$(GO) test -race -coverprofile=coverage.out ./internal/... ./cmd/...
 
+# t — run ONE package or ONE test with the toolchain env already wired. This is
+# the iteration target; `test` is the gate. Reach for it instead of pasting the
+# CGO_CFLAGS/CGO_LDFLAGS/LD_LIBRARY_PATH preamble by hand, which is how it was
+# done ~390 times across past sessions and is where the shell-quoting failures
+# came from -- the interactive shell here is zsh, and an unquoted `-run Test*`
+# or `--include=*.go` dies on "no matches found" before go ever starts.
+#
+#   make t                                     # whole tree (same scope as `test`)
+#   make t PKG=./internal/router/
+#   make t PKG=./cmd/mavend/ RUN=TestSimulator
+#   make t PKG=./internal/router/eval/ RUN='TestONNX' V=1
+#   make t PKG=./internal/store/ RACE=0        # drop -race when iterating hot
+#
+# -race is on by default so a green `make t` cannot turn red under `make test`.
+# -count=1 because a cached PASS from before your edit is worse than no answer.
+# MAVEN_ONNX_LIB is set for the same reason: the four TestONNX* measurements
+# self-skip when it is unset, so a targeted eval run would otherwise report the
+# deterministic hash ratchet and look like it scored the real embedder.
+PKG  ?= ./internal/... ./cmd/...
+RUN  ?=
+V    ?=
+RACE ?= 1
+
+t:
+	CGO_CFLAGS="$(CGO_CFLAGS)" CGO_LDFLAGS="$(CGO_LDFLAGS)" LD_LIBRARY_PATH="$(shell pwd)/deps/lib" \
+	MAVEN_ONNX_LIB="$(MAVEN_ONNX_LIB)" \
+		$(GO) test $(if $(V),-v,) $(if $(filter-out 0,$(RACE)),-race,) -count=1 \
+		$(if $(RUN),-run '$(RUN)',) $(PKG)
+
 # eval-router — score the held-out RU routing fixture (internal/router/eval).
 # Verbose so the report tables land in the terminal. MAVEN_ONNX_LIB points the
 # prod-representative baseline at the vendored runtime; override it or set it
@@ -189,6 +218,16 @@ eval-models:
 # scores the fixtures against ggml-small and self-skips when the model is
 # absent, and TestGoldenFixturesAreCanonical, which checks the committed audio
 # and the manifest with no model at all.
+# audit — the repo inventory: LOC per package, open TODOs, real stubs, living-doc
+# staleness, test shape, packages with no test. Read-only, prints, writes nothing.
+# Run it instead of rebuilding the same greps by hand; past sessions spent 93 of
+# them on this before their first edit. SECTION=loc|todo|stubs|docs|tests|gaps
+# narrows it.
+SECTION ?= all
+
+audit:
+	@SECTION="$(SECTION)" ./scripts/audit.sh
+
 stt-fixtures:
 	./scripts/gen-stt-fixtures.sh
 

cmd/mavend/clarify.go

@@ -6,7 +6,6 @@ import (
 	"math/rand"
 	"strings"
 	"time"
-	"unicode"
 	"unicode/utf8"
 
 	"github.com/kami/maven/internal/dialogue"
@@ -162,12 +161,13 @@ func withNotice(notice, reply string) string {
 // напоминание?" — answer first, then the open question. A question in front of
 // its own answer would read as ignoring what he asked.
 //
-// A statement's full stop is folded into a comma, so the two acts read as one
-// sentence — that is the owner's own punctuation, "в Риме сейчас ..., на какое
-// время поставить напоминание?". An answer that is ITSELF a question keeps its
-// mark and the resume starts a new sentence: she sometimes answers a side query
-// by asking him to say it again, and "переформулировать?, на какое время" folds
-// two questions into one unreadable line.
+// Two sentences, not one (V-654). This used to fold the answer's full stop into
+// a comma, on the strength of the owner having written it that way once. Spliced
+// onto a real answer it reads as one run-on thought — "вот что я нашла: вайфай
+// пароль лежит в ящике стола, на какое время поставить напоминание?" — and the
+// question disappears into the tail of a sentence about something else. A reply
+// with no terminator of its own is given one, so the join never depends on how
+// the phraser chose to end.
 //
 // A resume with no answer in front of it is just the question.
 func withResumed(reply, resumed string) string {
@@ -178,23 +178,17 @@ func withResumed(reply, resumed string) string {
 	if reply == "" {
 		return resumed
 	}
-	if strings.HasSuffix(reply, "?") {
-		return reply + " " + resumed
+	if !endsSentence(reply) {
+		reply += "."
 	}
-	if trimmed := strings.TrimRight(reply, ".!"); trimmed != "" {
-		reply = trimmed
-	}
-	return reply + ", " + lowerFirst(resumed)
+	return reply + " " + resumed
 }
 
-// lowerFirst lowercases the opening rune, so a deck line written as a standalone
-// sentence reads as the second half of one. Only the first rune: "На какое
-// время" must become "на какое время" and nothing else in it may move.
-func lowerFirst(s string) string {
-	for i, r := range s {
-		return string(unicode.ToLower(r)) + s[i+utf8.RuneLen(r):]
-	}
-	return s
+// endsSentence reports whether s already closes itself. The ellipsis counts: a
+// trailing "…" is a deliberate end, and a full stop after it reads as a typo.
+func endsSentence(s string) bool {
+	r, _ := utf8.DecodeLastRuneInString(s)
+	return strings.ContainsRune(".!?…", r)
 }
 
 // missingFor returns the slots a decision still needs, most important first.
@@ -381,6 +375,14 @@ func (h *reactiveHandler) resolveClarifyAnswer(ctx context.Context, text string)
 		return "", false
 	}
 
+	// He is answering, so the run of step-asides is over (V-654). Reset here
+	// rather than where a gap is FILLED: "позвонить маме" against a question
+	// about the time gives her nothing she asked for and still means he is in
+	// the exchange, and the retry it costs is bound enough on its own. The
+	// counter is for the case the bounds miss — he asked for other things and
+	// never came back.
+	q.Suspends = 0
+
 	merged := q.Answer(text, toDialogueSlots(answer))
 	// Fold a newly answered subject into the raw utterance. Downstream actions
 	// phrase from Utterance, not from the text slot — actionReminder stores it
@@ -467,6 +469,14 @@ func (h *reactiveHandler) noteDropped(ctx context.Context) {
 //
 // A slot with no resumed wording (clarifyResumedFor says so) resumes nothing and
 // says nothing. She must not claim to be holding a question she cannot re-ask.
+//
+// Suspension is bounded, since V-654. Neither of the two things above is a
+// limit: no attempt is spent, and restarting the clock means the TTL cannot
+// arrive while he keeps talking. So the count is the only thing that ends it,
+// and past MaxSuspends she lets the request go and says so with the same line
+// every other drop uses. The rule is unchanged — a question ends by being
+// answered or by being let go out loud — this only recognises three unrelated
+// requests in a row as the second of those.
 func (h *reactiveHandler) noteSuspended(ctx context.Context, q *dialogue.PendingQuestion) {
 	rt := turnRouteFrom(ctx)
 	if rt == nil || len(q.Missing) == 0 {
@@ -476,11 +486,18 @@ func (h *reactiveHandler) noteSuspended(ctx context.Context, q *dialogue.Pending
 	if !ok {
 		return
 	}
+	if !q.CanResume() {
+		h.clarifyStore.Delete(dialogueIDOf(ctx))
+		h.noteDropped(ctx)
+		log.Printf("voice: clarify — the question about %s stepped aside %d times; letting the request go", q.Missing[0], q.Suspends)
+		return
+	}
+	q.Suspends++
 	q.Asked = h.now()
 	h.clarifyStore.Put(dialogueIDOf(ctx), q)
 	rt.resume = question
 	rt.suspended = true
-	log.Printf("voice: clarify — is its own request; suspending the question about %s and resuming it in the same reply", q.Missing[0])
+	log.Printf("voice: clarify — is its own request; suspending the question about %s and resuming it in the same reply (suspend %d of %d)", q.Missing[0], q.Suspends, dialogue.MaxSuspends)
 }
 
 // foldAnswerIntoUtterance appends an answered subject to the original words,
@@ -520,6 +537,9 @@ func (h *reactiveHandler) askRemainingGap(ctx context.Context, q *dialogue.Pendi
 	if !ok || !q.CanAsk() {
 		return "", false
 	}
+	// Suspends is not carried, and by this point it is already zero: the answer
+	// path resets it (V-654). Left off the literal so the zero is stated where
+	// the struct is built, rather than inherited from a field nobody names.
 	h.clarifyStore.Put(dialogueIDOf(ctx), &dialogue.PendingQuestion{
 		Intent:      q.Intent,
 		Slots:       merged,

cmd/mavend/clarify_test.go

@@ -740,3 +740,53 @@ func TestACompleteTurnStillDoesNotAsk(t *testing.T) {
 		}
 	}
 }
+
+// TestTheResumedQuestionIsItsOwnSentence — V-654. The re-ask used to be spliced
+// onto the answer with a comma, so a real answer and an unrelated open question
+// read as one run-on thought and the question vanished into its tail.
+func TestTheResumedQuestionIsItsOwnSentence(t *testing.T) {
+	const resumed = "На какое время поставить напоминание?"
+	cases := []struct {
+		name  string
+		reply string
+		want  string
+	}{
+		{
+			// The measured line, shortened. Two sentences, and the question keeps
+			// its capital.
+			name:  "a statement keeps its full stop",
+			reply: "Вайфай пароль лежит в ящике стола.",
+			want:  "Вайфай пароль лежит в ящике стола. " + resumed,
+		},
+		{
+			name:  "a reply with no terminator is given one",
+			reply: "Вайфай пароль лежит в ящике стола",
+			want:  "Вайфай пароль лежит в ящике стола. " + resumed,
+		},
+		{
+			// She sometimes answers a side query by asking him to say it again.
+			// Two questions, and neither may swallow the other.
+			name:  "a question keeps its mark",
+			reply: "Можешь переформулировать?",
+			want:  "Можешь переформулировать? " + resumed,
+		},
+		{
+			name:  "an ellipsis is already an ending",
+			reply: "Не уверена…",
+			want:  "Не уверена… " + resumed,
+		},
+		{
+			name:  "a resume with no answer in front of it is just the question",
+			reply: "",
+			want:  resumed,
+		},
+	}
+	for _, tc := range cases {
+		if got := withResumed(tc.reply, resumed); got != tc.want {
+			t.Errorf("%s: withResumed(%q) = %q, want %q", tc.name, tc.reply, got, tc.want)
+		}
+	}
+	if got := withResumed("Готово.", ""); got != "Готово." {
+		t.Errorf("nothing to resume must leave the reply alone, got %q", got)
+	}
+}

cmd/mavend/turnrole_test.go

@@ -279,3 +279,97 @@ func TestTheTurnIsRoutedOnce(t *testing.T) {
 		t.Fatalf("the pipeline routed again and got something else: %+v vs %+v", second, first)
 	}
 }
+
+// TestASuspendedQuestionDoesNotRideForever — V-654, the measured failure of
+// 2026-08-07 (docs/evals/2026-08-07-week-of-usage-transcript.md, t=51 to t=58).
+//
+// A side query suspends the parked question, spends no attempt and restarts the
+// TTL. Nothing else bounded it, so one unfilled time slot came back on the end
+// of six consecutive unrelated replies and stopped only when a seventh turn
+// happened to read as a failed answer. Three step-asides, then she lets it go
+// and says so.
+func TestASuspendedQuestionDoesNotRideForever(t *testing.T) {
+	ctx := context.Background()
+	h, st := newRoutingClarifyHandler(t)
+	id := dialogueIDFor(sourceText, "web")
+	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
+
+	if reply := h.handleText(ctx, "web", "напомни позвонить маме"); !strings.Contains(reply, "?") {
+		t.Fatalf("expected the time question, got %q", reply)
+	}
+
+	// Three questions of his own. Each one is answered as itself and each one
+	// brings the open question back, exactly as V-561 asks.
+	asides := []string{
+		"о чём мы вчера говорили?",
+		"какие у меня напоминания?",
+		"сколько времени?",
+	}
+	for i, text := range asides {
+		reply := h.handleText(ctx, "web", text)
+		if !strings.HasSuffix(reply, resumed) {
+			t.Fatalf("side query %d: the question must come back, got %q", i+1, reply)
+		}
+		if strings.Contains(reply, clarifyDropped) {
+			t.Fatalf("side query %d: nothing was let go yet, so nothing may say so: %q", i+1, reply)
+		}
+		q := h.clarifyStore.Get(id, h.now())
+		if q == nil {
+			t.Fatalf("side query %d: the question was dropped early", i+1)
+		}
+		if q.Attempts != 1 {
+			t.Fatalf("side query %d: a step-aside spent an attempt: %d", i+1, q.Attempts)
+		}
+		if q.Suspends != i+1 {
+			t.Fatalf("side query %d: suspends = %d, want %d", i+1, q.Suspends, i+1)
+		}
+	}
+
+	// The fourth. She has stepped aside as often as she is willing to, so the
+	// request goes — out loud, and without the question on the tail.
+	reply := h.handleText(ctx, "web", "что у меня сегодня?")
+	if !strings.Contains(reply, clarifyDropped) {
+		t.Fatalf("the request was let go in silence: %q", reply)
+	}
+	if strings.HasSuffix(reply, resumed) {
+		t.Fatalf("a question she has let go must not be asked again: %q", reply)
+	}
+	if h.clarifyStore.Get(id, h.now()) != nil {
+		t.Fatal("the question must be gone once she has said she let it go")
+	}
+	if reminders, err := st.DueReminders(ctx, h.now().Add(48*time.Hour)); err != nil || len(reminders) != 0 {
+		t.Fatalf("a reminder was invented for a time nobody gave: %v err=%v", reminders, err)
+	}
+}
+
+// TestAnAnsweredGapResetsTheSuspendBudget — the counter measures CONSECUTIVE
+// step-asides. He filled a gap, so the run is broken and the next question
+// starts with its full allowance: a long exchange he is engaged with must not
+// run out of patience on his behalf.
+func TestAnAnsweredGapResetsTheSuspendBudget(t *testing.T) {
+	ctx := context.Background()
+	h, _ := newRoutingClarifyHandler(t)
+	id := dialogueIDFor(sourceText, "web")
+
+	// A bare "напомни" is missing both halves, so answering the subject re-parks
+	// the request with a question about the time.
+	if reply := h.handleText(ctx, "web", "напомни"); !strings.Contains(reply, "?") {
+		t.Fatalf("expected a question, got %q", reply)
+	}
+	if reply := h.handleText(ctx, "web", "какие у меня напоминания?"); reply == "" {
+		t.Fatal("the side query must be answered as itself")
+	}
+	if q := h.clarifyStore.Get(id, h.now()); q == nil || q.Suspends != 1 {
+		t.Fatalf("the side query was not counted: %+v", q)
+	}
+	if reply := h.handleText(ctx, "web", "позвонить маме"); reply == "" {
+		t.Fatal("the answer must be consumed")
+	}
+	q := h.clarifyStore.Get(id, h.now())
+	if q == nil {
+		t.Fatal("a reminder still needs its time, so a question must be parked")
+	}
+	if q.Suspends != 0 {
+		t.Fatalf("answering a gap must reset the suspend budget: suspends = %d", q.Suspends)
+	}
+}

deploy/mavend.json

@@ -25,6 +25,25 @@
     "llm_nudges": false
   },
 
+  "//ntfy": [
+    "The second reach (V-649). Until 07-08-2026 telegram was the only one, and",
+    "telegram needs api.telegram.org, the socks relay below and a matching ufw",
+    "rule — three things in series that have each failed once, and when they do",
+    "a sev4 nudge has nowhere to go. ntfy shares none of them: it is reached",
+    "directly, no relay.",
+    "It is not only a spare. The routing table sends sev3-away and away",
+    "reminders here and NOWHERE else, so with this block absent those two",
+    "routes hit a nil sink and vanish without a log or an outbox row.",
+    "The credential is an ntfy access token, scoped write-only to this one",
+    "topic, so a popped sink can push to it and cannot read it back. Set it in",
+    "deploy/telegram.env beside the telegram secrets; that file is gitignored."
+  ],
+  "ntfy": {
+    "base_url": "https://ntfy.kvmx.ru",
+    "topic": "maven",
+    "token": "${NTFY_TOKEN}"
+  },
+
   "telegram": {
     "bot_token": "${TELEGRAM_BOT_TOKEN}",
     "chat_id": "${TELEGRAM_CHAT_ID}",

deploy/telegram.env.example

@@ -1,5 +1,12 @@
-# Telegram bot token and chat ID for mavend's away-channel reach.
+# Secrets for mavend's away-channel reaches. The file is still called
+# telegram.env because compose names it that; it holds both reaches now.
 # Copy this file to deploy/telegram.env and fill in real values.
 # deploy/telegram.env is gitignored — never commit the real secrets.
 TELEGRAM_BOT_TOKEN=
 TELEGRAM_CHAT_ID=
+
+# ntfy access token for the `maven` topic, the second reach (V-649). Mint it on
+# the ntfy server with write access to that topic and nothing else:
+#   ntfy token add --expires=never maven
+# Read access is not needed — mavend publishes and never subscribes.
+NTFY_TOKEN=

docs/design.md

@@ -1,6 +1,6 @@
 # Maven — Design
 
-*Last verified: 2026-08-02 @ 7079a24. Living doc: correct it in place, do not append.*
+*Last verified: 2026-08-07 @ beb093a. Living doc: correct it in place, do not append.*
 
 > Folded 2026-07-30 from `SPEC.md` (north star, 2026-07-03), `maven.md`
 > (consolidated decisions, 2026-06-30) and `ROADMAP.md` (execution plan,
@@ -282,6 +282,39 @@ Three reasons, in the order they settle it:
 So the notice stays what it is: the in-process TTL case, where she really did
 wait and really did let go.
 
+#### A parked question may step aside three times
+
+Decided 2026-08-07 (V-654). A side query or an aside suspends the parked
+question instead of dropping it. The words are answered as themselves, and the
+question comes back on the end of the same reply.
+
+Neither bound on a question reaches that path. No attempt is spent, because a
+side query is not a failed answer, so `MaxAttempts` never applies.
+`noteSuspended` also restarts the 90s clock, since she is about to speak the
+question again. So the TTL cannot arrive while he keeps talking.
+
+Measured on 2026-08-07: one unfilled time slot rode the tail of six consecutive
+unrelated replies. It stopped only when a seventh turn happened to read as a
+failed answer. See `docs/evals/2026-08-07-week-of-usage.md`.
+
+`PendingQuestion.Suspends` counts the step-asides. `MaxSuspends` is 3, matching
+`DefaultMaxAttempts`. Past it she lets the request go, with the same
+`clarifyDropped` line every other drop uses. The owner's rule is unchanged. A
+question still ends by being answered or by being let go out loud. This only
+recognises three unrelated requests in a row as the second of those.
+
+The count is of CONSECUTIVE step-asides. It resets the moment he answers, in
+`resolveClarifyAnswer`. An answer that gives her nothing she asked for resets it
+too. "Позвонить маме" against a question about the time is still him in the
+exchange. The retry it costs is bound enough on its own.
+
+The re-ask is also two sentences rather than one. It used to be spliced onto the
+answer with a comma. On a real answer that buries the question in the tail of
+one run-on thought:
+
+> вот что я нашла: вайфай пароль лежит в ящике стола, на какое время поставить
+> напоминание?
+
 ### save-where — the two-memory routing axis
 
 One discriminator: **does the loop evaluate a predicate against it?**

docs/operations.md

@@ -1,6 +1,6 @@
 # Start Commands
 
-*Last verified: 2026-08-02 @ 7079a24. Living doc: correct it in place, do not append.*
+*Last verified: 2026-08-07 @ a4630b9. Living doc: correct it in place, do not append.*
 
 All commands assume `ROOT=/home/kami/apps/Maven` and the local Go toolchain at `$ROOT/deps/go/go/bin/go`.
 
@@ -44,7 +44,8 @@ Config path: `~/.config/maven/mavend.json`. Full example with all options.
   "repeat_interval": "5m",
   "ntfy": {
     "base_url": "https://ntfy.kvmx.ru",
-    "topic": "maven"
+    "topic": "maven",
+    "token": "${NTFY_TOKEN}"
   },
   "phraser": {
     "model_path": "/mnt/hdd1/llms/Qwen3-Maven-1.7B-Q8_0.gguf",
@@ -66,6 +67,15 @@ Config path: `~/.config/maven/mavend.json`. Full example with all options.
 
 Omit the `embedder` block entirely to use the deterministic HashEmbedder floor (no ML, no ONNX runtime dependency). Useful for testing or low-resource setups.
 
+`${NTFY_TOKEN}` and the `${TELEGRAM_*}` vars are expanded from `deploy/telegram.env`, which is gitignored. Copy `deploy/telegram.env.example` and fill it in. Mint a scoped token rather than reusing an admin one. It needs write access to the `maven` topic and nothing else:
+
+```sh
+ntfy access maven maven write-only
+ntfy token add --expires=never maven
+```
+
+Deleting the `ntfy` block turns the reach off, and that is not a no-op. The routing table sends sev3-away nudges and away reminders to ntfy and nowhere else. With no sink wired they hit a nil and vanish, leaving no log line and no `delivery_attempts` row (V-649).
+
 ## mavsttd — STT worker (optional, remote whisper.cpp)
 
 Requires `LD_LIBRARY_PATH` to include deps/lib (for libwhisper.so, libggml-vulkan.so).

internal/config/deployconfig_test.go

@@ -45,4 +45,17 @@ func TestDeployConfigLoads(t *testing.T) {
 	if cfg.Voice.RouterThreshold <= 0 {
 		t.Error("router threshold did not get its default")
 	}
+
+	// The second reach (V-649). Deleting this block is how you turn ntfy off,
+	// so its absence has to be loud: sev3-away nudges and away reminders route
+	// to ntfy and to nothing else, and a nil sink drops them with no log and no
+	// outbox row. The token is a ${VAR} that CI cannot resolve, so this checks
+	// the wiring and not the credential.
+	if cfg.Ntfy == nil {
+		t.Fatal("deploy config has no ntfy block — sev3-away and away reminders " +
+			"would have nowhere to land, and would vanish silently rather than fail")
+	}
+	if cfg.Ntfy.BaseURL == "" || cfg.Ntfy.Topic == "" {
+		t.Errorf("ntfy block is incomplete: base_url=%q topic=%q", cfg.Ntfy.BaseURL, cfg.Ntfy.Topic)
+	}
 }

internal/delivery/ntfysink/ntfysink.go

@@ -7,11 +7,17 @@
 // the relay). the dispatcher already strips detail off away sendables; the
 // sink uses the same helper so it can't leak the body on its own either.
 //
-// ntfy runs locally (docker, 127.0.0.1:8085, deny-all auth). maven publishes
-// with a dedicated user (write-only to maven-* topics) — the credential is a
-// delivery-config secret, not a db key; a popped ntfy sink can push spam to
-// your phone, nothing else. matches the module key-isolation invariant: the
-// sink never holds the sqlcipher key.
+// ntfy is a self-hosted server with deny-all auth — ntfy.kvmx.ru as of
+// 07-08-2026, reached directly, not through the socks relay telegram needs.
+// maven publishes with a write-only token scoped to its own topic; the
+// credential is a delivery-config secret, not a db key. a popped ntfy sink
+// can push spam to that one topic, nothing else — it cannot read the topic
+// back and it never holds the sqlcipher key.
+//
+// this is the second reach, and the reason there is one is that telegram was
+// the only one (V-649). telegram needs api.telegram.org, a socks relay on the
+// host and a matching ufw rule, three things in series that have each broken
+// once. ntfy shares none of them.
 package ntfysink
 
 import (
@@ -31,11 +37,29 @@ import (
 // the credential lives in the daemon's config (or a systemd credential),
 // never in the binary.
 type Config struct {
-	BaseURL  string        // e.g. http://127.0.0.1:8085 (no trailing path)
-	Topic    string        // e.g. maven (all maven notifications land here)
-	Username string        // basic auth; empty = anonymous (won't work with deny-all)
-	Password string        // basic auth
-	Timeout  time.Duration // per-request; 0 = DefaultTimeout
+	// BaseURL — the ntfy server, no trailing path. Required.
+	BaseURL string `json:"base_url"`
+
+	// Topic — where maven publishes. Required. All maven notifications land
+	// on this one topic; severity rides the Priority header, not the topic.
+	Topic string `json:"topic"`
+
+	// Token — an ntfy access token, sent as a bearer. This is the preferred
+	// credential: ntfy scopes a token to a topic and to write-only, so a
+	// popped sink can push to this one topic and cannot read it back or
+	// touch another. Revoking it does not disturb a password anyone else
+	// uses. Mutually exclusive with Username.
+	Token string `json:"token,omitempty"`
+
+	// Username, Password — basic auth, for a server that has no tokens.
+	// Empty username means no credential is sent at all, which a deny-all
+	// server rejects.
+	Username string `json:"username,omitempty"`
+	Password string `json:"password,omitempty"`
+
+	// Timeout — per-request; 0 = DefaultTimeout. A dead server must not hang
+	// the tick loop.
+	Timeout time.Duration `json:"-"`
 }
 
 const DefaultTimeout = 10 * time.Second
@@ -59,6 +83,12 @@ func New(cfg Config) (*Sink, error) {
 	if cfg.Topic == "" {
 		return nil, fmt.Errorf("ntfysink: Topic is required")
 	}
+	// Refuse rather than pick. Two credentials configured means someone
+	// intended one of them, and guessing which would send the other nowhere
+	// and leave a working config that is not the one they wrote.
+	if cfg.Token != "" && cfg.Username != "" {
+		return nil, fmt.Errorf("ntfysink: set Token or Username, not both")
+	}
 	to := cfg.Timeout
 	if to == 0 {
 		to = DefaultTimeout
@@ -84,7 +114,9 @@ func (s *Sink) Send(ctx context.Context, d delivery.Sendable) error {
 	}
 	req.Header.Set("Title", "maven")
 	req.Header.Set("Priority", priorityFor(d).String())
-	if s.cfg.Username != "" {
+	if s.cfg.Token != "" {
+		req.Header.Set("Authorization", "Bearer "+s.cfg.Token)
+	} else if s.cfg.Username != "" {
 		req.SetBasicAuth(s.cfg.Username, s.cfg.Password)
 	}
 

internal/delivery/ntfysink/ntfysink_test.go

@@ -224,6 +224,37 @@ func TestSendNoAuthWhenUsernameEmpty(t *testing.T) {
 	}
 }
 
+// TestSendSetsBearerToken — the deployed credential (V-649) is an ntfy access
+// token scoped write-only to the maven topic, not a password. A token sent as
+// basic auth is rejected by ntfy, so the header shape is the whole test.
+func TestSendSetsBearerToken(t *testing.T) {
+	rs := newRecordingServer(t, 200, "")
+	srv := httptest.NewServer(rs.handler())
+	defer srv.Close()
+
+	sink, _ := New(Config{BaseURL: srv.URL, Topic: "maven", Token: "tk_secret"})
+	if err := sink.Send(context.Background(), nudgeSendable(loop.Sev3, "down")); err != nil {
+		t.Fatalf("Send: %v", err)
+	}
+	_, _, _, auth, _, _ := rs.snapshot()
+	if auth != "Bearer tk_secret" {
+		t.Fatalf("auth: want 'Bearer tk_secret', got %q", auth)
+	}
+}
+
+// TestNewRejectsBothCredentials — configuring a token and a username means one
+// of them was meant and the other is a leftover. Picking either would leave a
+// server that authenticates against a credential nobody wrote down.
+func TestNewRejectsBothCredentials(t *testing.T) {
+	_, err := New(Config{BaseURL: "http://x", Topic: "maven", Token: "tk_x", Username: "maven"})
+	if err == nil {
+		t.Fatal("New accepted both a token and a username")
+	}
+	if !strings.Contains(err.Error(), "not both") {
+		t.Errorf("error does not say which to fix: %v", err)
+	}
+}
+
 func TestSendTitleIsMaven(t *testing.T) {
 	rs := newRecordingServer(t, 200, "")
 	srv := httptest.NewServer(rs.handler())

internal/dialogue/clarify.go

@@ -41,8 +41,33 @@ type PendingQuestion struct {
 	Attempts int // questions already asked
 	// MaxAttempts caps Attempts. 0 ⇒ DefaultMaxAttempts.
 	MaxAttempts int
+	// Suspends counts how many times this question has stepped aside for
+	// something he asked instead, and come back on the end of the answer. It is
+	// deliberately NOT an attempt: a side query is not a failed answer, and
+	// charging it a retry is the V-554 shape. See CanResume for why it is
+	// counted at all.
+	Suspends int
 }
 
+// MaxSuspends — how many times one question may step aside and come back before
+// she lets the request go (V-654).
+//
+// It exists because suspension had no bound of any kind. A side query spends no
+// attempt, so MaxAttempts never applies to it, and it restarts the 90s clock, so
+// the TTL never arrives either. Measured on 2026-08-07: one unfilled time slot
+// rode the end of six consecutive unrelated replies and stopped only when a
+// seventh turn happened to read as a failed answer.
+//
+// Three, matching DefaultMaxAttempts, and for the same reason. Once he has
+// asked for three other things without touching the question, the likely truth
+// is that he has moved on and has not said so.
+const MaxSuspends = 3
+
+// CanResume reports whether this question may step aside once more. False ⇒ the
+// caller lets the request go and says so; it must never simply stop resuming,
+// because a question dropped in silence reads as one that was answered.
+func (q *PendingQuestion) CanResume() bool { return q.Suspends < MaxSuspends }
+
 // Action reads the parked question as the typed action it is assembling
 // (pending.go). Derived rather than stored: the question's fields stay the one
 // copy of the truth, so a caller that fills them the old way cannot end up with

scripts/audit.sh

@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+# audit.sh — the repo inventory, in one command.
+#
+# Every section here was reconstructed by hand, from scratch, in session after
+# session: 93 grep sweeps across the four longest ones before a single edit was
+# made. The answers move slowly and the sweeps did not, so they are written down
+# once here instead.
+#
+# It prints and never writes. A committed inventory file goes stale silently and
+# then lies; a report you regenerate cannot.
+#
+# Read-only. Safe to run at any point, including mid-conflict.
+#
+#   make audit                # everything
+#   make audit SECTION=todo   # one section: loc, todo, stubs, docs, tests, gaps
+
+set -uo pipefail
+cd "$(dirname "$0")/.." || exit 1
+
+SECTION="${SECTION:-all}"
+want() { [ "$SECTION" = all ] || [ "$SECTION" = "$1" ]; }
+rule() { printf '\n=== %s %s\n' "$1" "$(printf '%.0s=' $(seq 1 $((66 - ${#1}))))"; }
+
+# git grep over tracked files only. deps/ and models/ are gitignored and huge,
+# and a plain grep -r walks into both.
+g() { git grep -nI "$@" 2>/dev/null; }
+
+printf 'Maven repo inventory @ %s (%s)\n' \
+  "$(git rev-parse --short HEAD 2>/dev/null || echo '?')" \
+  "$(git log -1 --format=%cs 2>/dev/null || echo '?')"
+
+# --- loc -------------------------------------------------------------------
+# Non-test Go lines per package. Size is the cheapest proxy for "where does the
+# complexity actually sit", and it is the first thing every audit asked for.
+if want loc; then
+  rule "PACKAGES BY LOC (non-test)"
+  for d in $(find ./cmd ./internal ./pkg -maxdepth 2 -type d 2>/dev/null | sort); do
+    files=$(find "$d" -maxdepth 1 -name '*.go' ! -name '*_test.go' 2>/dev/null)
+    [ -z "$files" ] && continue
+    n=$(printf '%s\n' "$files" | wc -l)
+    l=$(printf '%s\0' $files | xargs -0 cat 2>/dev/null | wc -l)
+    printf '%7d  %3d files  %s\n' "$l" "$n" "$d"
+  done | sort -rn
+fi
+
+# --- todo ------------------------------------------------------------------
+if want todo; then
+  rule "TODO / FIXME / XXX / HACK / BUG (non-test)"
+  g -E '(^|[^a-zA-Z])(TODO|FIXME|XXX|HACK|BUG:)' -- 'cmd/**/*.go' 'internal/**/*.go' 'pkg/**/*.go' \
+    | grep -v '_test\.go:' | sed 's/^/  /' || echo "  none"
+fi
+
+# --- stubs -----------------------------------------------------------------
+# Code only, never doc comments. "not wired" is this repo's design vocabulary
+# for a nil dependency and appears in ~30 comments that describe working code,
+# so searching prose here reports the architecture back as a gap. Likewise
+# internal/ipc/unimplemented.go is skipped whole: the file IS the deliberate
+# Unimplemented*Server pattern, not 60 missing methods. "placeholder" is not a
+# term here either -- it names real identifiers (SQL placeholders,
+# Deck.RequirePlaceholder, tokenPlaceholder) and matched 16 working lines.
+if want stubs; then
+  rule "STUBS / NOT IMPLEMENTED (code, non-test)"
+  g -iE 'not (yet )?implemented|unimplemented|пока не умею|panic\("TODO' \
+    -- 'cmd/**/*.go' 'internal/**/*.go' 'pkg/**/*.go' \
+    | grep -v '_test\.go:' \
+    | grep -v '^internal/ipc/unimplemented\.go:' \
+    | grep -vE '^[^:]+:[0-9]+:[[:space:]]*//' \
+    | sed 's/^/  /' || echo "  none"
+
+  # CoreAPI stub parity. A stub missing from unimplemented.go breaks the build
+  # via `var _ CoreAPI = UnimplementedCoreAPI{}`. A stub left behind after its
+  # method leaves an interface compiles forever and is caught by nothing, so it
+  # is counted here until V-652 turns it into a test.
+  printf '\n  CoreAPI stub parity:\n'
+  python3 - <<'PY' 2>/dev/null | sed 's/^/    /' || echo "    (skipped: python3 unavailable)"
+import re
+src = open('internal/ipc/coreapi.go').read()
+decl = set()
+for m in re.finditer(r'type (\w+API) interface \{(.*?)\n\}', src, re.S):
+    decl |= set(re.findall(r'^\t([A-Z]\w*)\(', m.group(2), re.M))
+stub = set(re.findall(r'func \(UnimplementedCoreAPI\) (\w+)\(',
+                      open('internal/ipc/unimplemented.go').read()))
+print(f"{len(decl)} declared, {len(stub)} stubbed")
+for name in sorted(stub - decl):
+    print(f"STALE   {name}  (stubbed, on no interface)")
+for name in sorted(decl - stub):
+    print(f"MISSING {name}  (declared, no stub)")
+PY
+fi
+
+# --- docs ------------------------------------------------------------------
+# Living tier only. docs/evals/ are dated measurements that are never edited
+# after the day, and docs/archive/ is dead by definition, so neither can be
+# stale. Age is against the recorded date, not against HEAD: every commit moves
+# HEAD, so a sha comparison would mark the whole tier stale every day.
+if want docs; then
+  rule "LIVING DOCS — Last verified"
+  today=$(date +%s)
+  for f in docs/*.md; do
+    [ -e "$f" ] || continue
+    line=$(grep -m1 -o 'Last verified: *[0-9-]\{8,10\}[^ ]*\( *@ *[0-9a-f]\{7,\}\)\?' "$f" 2>/dev/null)
+    if [ -z "$line" ]; then
+      printf '  %-44s %s\n' "$(basename "$f")" "MISSING"
+      continue
+    fi
+    d=$(printf '%s' "$line" | grep -o '[0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}' | head -1)
+    age=""
+    if [ -n "$d" ] && when=$(date -d "$d" +%s 2>/dev/null); then
+      days=$(( (today - when) / 86400 ))
+      age="${days}d"
+      [ "$days" -gt 30 ] && age="${days}d  <-- STALE"
+    fi
+    printf '  %-44s %-34s %s\n' "$(basename "$f")" "${line#Last verified: }" "$age"
+  done
+fi
+
+# --- tests -----------------------------------------------------------------
+if want tests; then
+  rule "TEST SHAPE"
+  printf '  benchmarks : %s\n' "$(g -c 'func Benchmark' -- '**/*_test.go' | awk -F: '{s+=$2} END{print s+0}')"
+  printf '  fuzz       : %s\n' "$(g -c 'func Fuzz'      -- '**/*_test.go' | awk -F: '{s+=$2} END{print s+0}')"
+  printf '  table t.Run: %s\n' "$(g -c 't.Run('         -- '**/*_test.go' | awk -F: '{s+=$2} END{print s+0}')"
+  printf '  golden files: %s\n' "$(g -l 'golden'        -- '**/*_test.go' | wc -l)"
+fi
+
+# --- gaps ------------------------------------------------------------------
+# A package with production code and no test file at all. Not a verdict — some
+# are pure wiring — but it is the list worth looking at before adding more.
+if want gaps; then
+  rule "PACKAGES WITH NO TEST FILE"
+  found=0
+  for d in $(find ./cmd ./internal ./pkg -maxdepth 2 -type d 2>/dev/null | sort); do
+    ls "$d"/*.go >/dev/null 2>&1 || continue
+    ls "$d"/*_test.go >/dev/null 2>&1 && continue
+    n=$(ls "$d"/*.go 2>/dev/null | wc -l)
+    l=$(cat "$d"/*.go 2>/dev/null | wc -l)
+    printf '  %6d lines  %2d files  %s\n' "$l" "$n" "$d"
+    found=1
+  done
+  [ "$found" = 0 ] && echo "  none"
+fi
+
+exit 0