Wire the transcription seam beside the model seam (V-486)

sttSeam is modelSeam for audio and sits at the same place in wireVoice, so
the voice path and the meeting recorder share one transcriber as they
always have.

A box with no workstation.stt block behaves byte-for-byte as it did before
this existed: the floor is handed back untouched and nothing probes. An
empty URL is normalised to no block at all, the way the model block already
works.

Health defaults to the URL's origin rather than the URL itself, because the
transcribe endpoint names a path and appending would ask for
/transcribe/health. A block with no token logs once that anything on the
LAN can post audio to that port.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013ptwopxyo3Z2kwFckHkLvN

cmd/mavend/clarify.go

@@ -489,15 +489,19 @@ func (h *reactiveHandler) noteSuspended(ctx context.Context, q *dialogue.Pending
 	if !q.CanResume() {
 		h.clarifyStore.Delete(dialogueIDOf(ctx))
 		h.noteDropped(ctx)
-		log.Printf("voice: clarify — the question about %s stepped aside %d times; letting the request go", q.Missing[0], q.Suspends)
+		log.Printf("voice: clarify — letting the question about %s go: %d asides in a row, %d rides in all", q.Missing[0], q.Suspends, q.Rides)
 		return
 	}
 	q.Suspends++
+	// Rides is the same event counted without the reset (V-663). Incremented
+	// beside Suspends and never anywhere else, so the two cannot disagree about
+	// what happened, only about how much of it they remember.
+	q.Rides++
 	q.Asked = h.now()
 	h.clarifyStore.Put(dialogueIDOf(ctx), q)
 	rt.resume = question
 	rt.suspended = true
-	log.Printf("voice: clarify — is its own request; suspending the question about %s and resuming it in the same reply (suspend %d of %d)", q.Missing[0], q.Suspends, dialogue.MaxSuspends)
+	log.Printf("voice: clarify — is its own request; suspending the question about %s and resuming it in the same reply (suspend %d of %d, ride %d of %d)", q.Missing[0], q.Suspends, dialogue.MaxSuspends, q.Rides, dialogue.MaxRides)
 }
 
 // foldAnswerIntoUtterance appends an answered subject to the original words,
@@ -540,6 +544,11 @@ func (h *reactiveHandler) askRemainingGap(ctx context.Context, q *dialogue.Pendi
 	// Suspends is not carried, and by this point it is already zero: the answer
 	// path resets it (V-654). Left off the literal so the zero is stated where
 	// the struct is built, rather than inherited from a field nobody names.
+	//
+	// Rides IS carried, and that is the whole point of it (V-663). This is the
+	// same request under a second question, not a new one, so the turns it has
+	// already ridden still count against it. Dropping the field here is exactly
+	// the re-basing that let one question ride twenty-six replies.
 	h.clarifyStore.Put(dialogueIDOf(ctx), &dialogue.PendingQuestion{
 		Intent:      q.Intent,
 		Slots:       merged,
@@ -550,6 +559,7 @@ func (h *reactiveHandler) askRemainingGap(ctx context.Context, q *dialogue.Pendi
 		TTL:         clarifyTTL,
 		Attempts:    q.Attempts + 1,
 		MaxAttempts: q.MaxAttempts,
+		Rides:       q.Rides,
 	})
 	log.Printf("voice: clarify — one gap filled, still missing %s for intent=%s, asking again (attempt %d)", remaining[0], intent, q.Attempts+1)
 	return question, true

cmd/mavend/sttseam_test.go

@@ -0,0 +1,43 @@
+package main
+
+import (
+	"testing"
+
+	"github.com/kami/maven/internal/config"
+	"github.com/kami/maven/internal/stt"
+)
+
+// A box with no workstation.stt block transcribes exactly as it did before the
+// seam existed: the floor is handed back untouched, and nothing probes.
+func TestSttSeamWithNoBlockIsTheFloor(t *testing.T) {
+	floor := stt.NewStub()
+	got, pair := sttSeam(&config.Config{}, floor)
+	if pair != nil {
+		t.Fatal("no block must build no pair")
+	}
+	if got != stt.Transcriber(floor) {
+		t.Fatal("no block must hand back the floor itself")
+	}
+}
+
+func TestSttSeamPrefersTheWorkstation(t *testing.T) {
+	cfg := &config.Config{Workstation: &config.WorkstationConfig{
+		URL: "http://127.0.0.1:1",
+		Stt: &config.WorkstationSttConfig{
+			URL:    "http://127.0.0.1:2/transcribe",
+			Health: "http://127.0.0.1:2/health",
+		},
+	}}
+	got, pair := sttSeam(cfg, stt.NewStub())
+	if pair == nil {
+		t.Fatal("a configured block must build a pair")
+	}
+	defer pair.Stop()
+	if got != stt.Transcriber(pair) {
+		t.Fatal("the pair is what callers must transcribe through")
+	}
+	// Nothing answers on port 2, so the seam is the floor until it does.
+	if pair.Available() {
+		t.Fatal("an unreachable workstation must not be available")
+	}
+}

cmd/mavend/turnrole.go

@@ -186,6 +186,28 @@ func carriesReminderVerb(text string) bool {
 	return false
 }
 
+// isPleasantry matches the WHOLE utterance against lexicon.Pleasantries, after
+// lowercasing and dropping the punctuation a greeting carries.
+//
+// Whole utterance and not tokens. Every token rule tried here was wrong on
+// something: "вечер" answers "это утра или вечера?", "нет" answers a confirm,
+// and "спокойной" alone is not an utterance at all. A greeting is a fixed
+// phrase, so matching it as one costs nothing and claims nothing else.
+func isPleasantry(text string) bool {
+	t := strings.ToLower(strings.TrimSpace(text))
+	t = strings.Trim(t, " .,!?…")
+	t = strings.Join(strings.Fields(t), " ")
+	if t == "" {
+		return false
+	}
+	for _, p := range lexicon.Pleasantries() {
+		if t == p {
+			return true
+		}
+	}
+	return false
+}
+
 // offlineOwnRequest is the shape half of the evidence: the offline token tests,
 // which cost nothing and never depend on the model that produced the routing.
 // It is also the whole answer when there is no route to read — the classifier
@@ -225,6 +247,16 @@ func classifyTurnRole(q *dialogue.PendingQuestion, text string, answer dialogue.
 	// hour, and no route saying "question" changes that. It works because the
 	// extractor no longer reads a day word as the current clock, so a sentence
 	// that names no hour now fills nothing to weigh.
+	// A pleasantry is neither (V-663). "спасибо" and "привет" fell through to
+	// roleAnswer, so a question about a reminder's DAY was re-asked at a man
+	// saying thank you, and the retry it spent was one of the three bounds
+	// meant to end the ride. It is an aside: answered as itself, the question
+	// resumed on the tail, no attempt spent, one ride counted. Placed above the
+	// content gate because "доброе утро" has content and states nothing, so
+	// neither half of the evidence below can reach it.
+	if q != nil && isPleasantry(text) {
+		return roleAside
+	}
 	own := false
 	if len(ownContent(text)) > 0 {
 		own = offlineOwnRequest(text) || (ok && carriesOwnRequest(routed, text))

cmd/mavend/turnrole_test.go

@@ -372,4 +372,69 @@ func TestAnAnsweredGapResetsTheSuspendBudget(t *testing.T) {
 	if q.Suspends != 0 {
 		t.Fatalf("answering a gap must reset the suspend budget: suspends = %d", q.Suspends)
 	}
+	// The ride it already took is carried across the re-park (V-663). Resetting
+	// both counters here is what let one question ride twenty-six replies.
+	if q.Rides != 1 {
+		t.Fatalf("the aside it already took was forgotten: rides = %d", q.Rides)
+	}
+}
+
+// TestTwoBoundsCannotRearmEachOther — V-663.
+//
+// MaxSuspends landed and the measurement did not move: twenty-six of 140 turns
+// carried a tail before it and twenty-six after. This is the shape it misses,
+// taken from the 2026-08-08 run, where one question rode turns 7 to 13.
+//
+// An aside spends no attempt, so MaxAttempts never reaches it. A turn that
+// reads as a failed answer zeroes Suspends, so MaxSuspends never reaches the
+// asides either. Alternating the two rearms each bound with the other's
+// traffic. Rides counts both kinds and is never reset, so it is what ends this.
+func TestTwoBoundsCannotRearmEachOther(t *testing.T) {
+	ctx := context.Background()
+	h, _ := newRoutingClarifyHandler(t)
+	id := dialogueIDFor(sourceText, "web")
+	resumed, _ := clarifyResumedFor(dialogue.SlotTime)
+
+	if reply := h.handleText(ctx, "web", "напомни позвонить маме"); !strings.Contains(reply, "?") {
+		t.Fatalf("expected the time question, got %q", reply)
+	}
+
+	// Two asides. Each one rides and neither spends an attempt.
+	for i := 0; i < 2; i++ {
+		reply := h.handleText(ctx, "web", "какие у меня напоминания?")
+		if !strings.HasSuffix(reply, resumed) {
+			t.Fatalf("aside %d: the question must come back, got %q", i+1, reply)
+		}
+	}
+	q := h.clarifyStore.Get(id, h.now())
+	if q == nil || q.Rides != 2 || q.Suspends != 2 {
+		t.Fatalf("after two asides: %+v", q)
+	}
+
+	// A pleasantry. It used to read as a failed answer, so she re-asked the
+	// question at a man saying thank you and spent an attempt doing it. Now it
+	// is an aside: answered as itself, question on the tail, one more ride.
+	reply := h.handleText(ctx, "web", "спасибо")
+	if !strings.HasSuffix(reply, resumed) {
+		t.Fatalf("a pleasantry lost the parked question: %q", reply)
+	}
+	q = h.clarifyStore.Get(id, h.now())
+	if q == nil || q.Attempts != 1 {
+		t.Fatalf("a pleasantry spent an attempt: %+v", q)
+	}
+	if q.Rides != 3 {
+		t.Fatalf("a pleasantry rode free: %+v", q)
+	}
+
+	// One more ride of any kind and the request goes, out loud.
+	reply = h.handleText(ctx, "web", "какие у меня напоминания?")
+	if !strings.Contains(reply, clarifyDropped) {
+		t.Fatalf("the question rode four asides and was let go in silence: %q", reply)
+	}
+	if strings.HasSuffix(reply, resumed) {
+		t.Fatalf("a question she has let go must not be asked again: %q", reply)
+	}
+	if h.clarifyStore.Get(id, h.now()) != nil {
+		t.Fatal("the question must be gone once she has said she let it go")
+	}
 }

cmd/mavend/voicewire.go

@@ -53,7 +53,11 @@ type voiceWiring struct {
 	// unless a `workstation` block names an address. Held here only so the
 	// prober is stopped on shutdown; callers were handed it at build time.
 	pair *llm.Pair
-	mcp  *mcpWiring
+	// sttPair — CrisperWhisper 2.0 on the workstation with mavsttd as the
+	// floor, nil unless the `workstation.stt` block names an address. Held for
+	// the same reason as pair: to stop its prober on shutdown.
+	sttPair *stt.Pair
+	mcp     *mcpWiring
 	// home — the Home Assistant client, nil unless the `smarthome` block is
 	// enabled (Vikunja #256). Its devices land in the same allowlist as every
 	// other act, so nothing else here has to know about it.
@@ -84,6 +88,9 @@ func (w *voiceWiring) close() {
 	if w.pair != nil {
 		w.pair.Stop()
 	}
+	if w.sttPair != nil {
+		w.sttPair.Stop()
+	}
 	w.mcp.close()
 }
 
@@ -112,6 +119,7 @@ func wireVoice(cfg *config.Config, coreAPI ipc.CoreAPI, phr phraser.Phraser, mem
 	} else {
 		transcriber = stt.NewStub()
 	}
+	transcriber, w.sttPair = sttSeam(cfg, transcriber)
 	w.transcriber = transcriber
 
 	// ----- tts (Stub in-process OR Remote) -----
@@ -366,6 +374,44 @@ func modelSeam(cfg *config.Config, resident *llm.Client) (router.Completer, *llm
 	return pair, pair
 }
 
+// sttSeam builds the transcription seam the voice path and the meeting
+// recorder share. It is modelSeam for audio and follows the same rule.
+//
+// With no `workstation.stt` block it hands back the floor untouched, which is
+// today's deploy exactly. With one, it is an stt.Pair preferring CrisperWhisper
+// 2.0 on workpc, which scores 10.4% WER in Russian against the floor's 27.5%
+// (docs/evals/2026-08-09-crisperwhisper2-russian-wer.md).
+//
+// Only the silent half of the degradation rule applies here. A worse transcript
+// is still a turn, so there is nothing to name a gap about and the fallback is
+// never spoken. That is why stt.Pair has no TranscribeRemote.
+func sttSeam(cfg *config.Config, floor stt.Transcriber) (stt.Transcriber, *stt.Pair) {
+	if cfg.Workstation == nil || cfg.Workstation.Stt == nil {
+		return floor, nil
+	}
+	s := cfg.Workstation.Stt
+	lang := ""
+	if cfg.Voice != nil {
+		lang = cfg.Voice.Lang
+		if cfg.Voice.Stt != nil && cfg.Voice.Stt.Lang != "" {
+			lang = cfg.Voice.Stt.Lang
+		}
+	}
+	pair := stt.NewPair(
+		stt.NewHTTPTranscriber(s.URL, s.Token, lang, time.Duration(s.Timeout)),
+		floor,
+		s.Health,
+		time.Duration(s.Probe),
+	)
+	pair.Start(context.Background())
+	if s.Token == "" {
+		log.Print("voice: the workstation transcriber has no token, so anything on the LAN can post audio to it")
+	}
+	log.Printf("voice: workstation transcriber at %s, probed every %s, mavsttd as the floor",
+		s.URL, time.Duration(s.Probe))
+	return pair, pair
+}
+
 func pickLLMRouter(enabled bool, c router.Completer) *router.LLMRouter {
 	if !enabled {
 		return nil

docs/design.md

@@ -308,6 +308,29 @@ The count is of CONSECUTIVE step-asides. It resets the moment he answers, in
 too. "Позвонить маме" against a question about the time is still him in the
 exchange. The retry it costs is bound enough on its own.
 
+#### And it may ride four turns in all
+
+Decided 2026-08-08 (V-663), because the bound above did not move the number it
+was written for. Twenty-six of 140 turns carried a tail before it landed and
+twenty-six carried one after.
+
+Two bounds rearm each other. An aside spends no attempt, so `MaxAttempts` never
+reaches it. A turn that reads as a failed answer zeroes `Suspends`, so
+`MaxSuspends` never reaches the asides. Alternating them, each bound is restored
+by the other's traffic. Measured on 2026-08-08: one question about a reminder's
+day rode turns 7 to 13. It ended only because turn 14 was a new request.
+
+`PendingQuestion.Rides` counts the same event as `Suspends` with the resets
+taken out. It is set once, incremented only in `noteSuspended`, carried across
+the re-park in `askRemainingGap`, and read by nothing that could lower it.
+`MaxRides` is 4, one looser than `MaxSuspends` so that the tighter statement
+about a run stays reachable.
+
+This is a bound, not a cure. It ends the measured ride one turn early. Most of
+that ride's length is attempts, spent because `classifyTurnRole` reads "спасибо"
+and "привет" as failed answers to a question about a day. That is the next
+thing to fix and it is not a bound.
+
 The re-ask is also two sentences rather than one. It used to be spliced onto the
 answer with a comma. On a real answer that buries the question in the tail of
 one run-on thought:

docs/evals/2026-08-08-parked-clarify-ride.md

@@ -0,0 +1,88 @@
+# The parked clarify ride, bounded and re-measured
+
+Date: 2026-08-08, V-663. Same 140 turns, same driver, third and fourth runs of
+the day. Before is `d6f3914`, after is that plus two changes.
+
+## What was measured before
+
+One question about a reminder's day rode turns 6 to 13. It ended only because
+turn 14 was a new request. Two of those turns are the worst replies in the
+corpus:
+
+```text
+спасибо   -> Сейчас 21:25. В какой день?
+привет    -> Сейчас 21:25. В какой день?
+```
+
+V-654 had already added `MaxSuspends` and the tail count had not moved.
+
+## Why three bounds let it happen
+
+The TTL, `MaxAttempts` and `MaxSuspends` all exist and all were rearmed.
+
+An aside spends no attempt, so `MaxAttempts` never reaches it. A turn reading as
+a failed answer zeroes `Suspends`, so `MaxSuspends` never reaches the asides.
+`спасибо` read as a failed answer. So the pleasantry both produced the reply
+above and paid for it out of the budget meant to end the ride.
+
+## The two changes
+
+`PendingQuestion.Rides` counts the same event as `Suspends` with the resets
+taken out. Set once, incremented only in `noteSuspended`, carried across the
+re-park in `askRemainingGap`. `MaxRides` is 4, one looser than `MaxSuspends` so
+that the tighter statement about a run stays reachable.
+
+A pleasantry is an aside, not a failed answer. The set is a new closed lexicon
+entry, matched as whole utterances rather than tokens. `вечер` answers `это утра
+или вечера?` and `нет` answers a confirm. Anything that could fill a slot stays
+out.
+
+## Result
+
+| | before | after |
+|---|---|---|
+| turns carrying a clarify tail | 21 | 17 |
+| turns carrying any failure string | 31 | 29 |
+| the longest ride | 8 turns | 4 turns |
+
+The turns carrying a tail, by number:
+
+```text
+before  6 7 8 9 10 11 12 13   53 54 55 56 57   99 102 103   116   136 137 138 139
+after   6 7 8 9                53 54 55 56 57   99 100 101   116   136 137 138 139
+```
+
+Turn 10 is the change. It now reads:
+
+```text
+спасибо -> Прошлую просьбу отпускаю. Пожалуйста, я всегда готова помочь тебе.
+```
+
+She lets the request go, says so, and answers the man. Turns 11 to 13 are clean.
+
+**`MaxRides` is not what fired.** The pleasantry is an aside now, so it no
+longer breaks the run. `MaxSuspends` reached three on turn 10 and ended it.
+`Rides` is the backstop for the shape where an answer really does break the run.
+No turn in this corpus reaches it.
+
+## What did not move
+
+Four rides are untouched. Turns 53 to 57 are five consecutive asides against a
+reminder missing its day. Turn 58 is a new request that drops it. Nothing
+pleasant appears in that run, so neither change applies. Turns 99 to 101 shifted
+by one, and 116 and 136 to 139 are unchanged.
+
+So the fix is worth four turns of twenty-one. What is left is asides against a
+question the owner never answers. `MaxSuspends` was written for that shape and
+does bound it, at four turns each.
+
+## Not attributable
+
+Latency moved p50 1.1s to 1.5s and p95 2.8s to 3.0s, and the 34.3s outlier in
+the earlier run is gone. Both runs had the workstation up. Read none of it as
+caused by this change.
+
+One unrelated defect appeared in the after run and is recorded here because it
+is visible in the transcript. Turn 4 answered `Я записала твою привычкуRegarding
+coffee without sugar.` That is English leaking into a Russian reply with no
+space in front of it. It is a phrasing defect and it has no task yet.

docs/evals/2026-08-08-two-weeks-after-merge.md

@@ -80,12 +80,53 @@ V-655 was never going to touch this. A parked clarify is dialogue state and not
 a query source. It remains the single worst thing about talking to her. The week test, the
 fortnight test and this re-run all report it unchanged.
 
-## A gap in the harness
+## A gap in the harness, fixed and re-run the same day
 
 `ipc.ChatReply.Source` came back empty on all 140 turns, in both runs. The
-driver reads it from the redirect query string and there is nothing there. So
-the badge that says which query source claimed a turn is invisible to the
-harness, and every finding above is read off the reply text instead.
+driver read the redirect parameter `src` and `cmd/mavweb/chat.go` writes `s`.
+So every finding above is read off the reply text instead of off the badge.
 
-That is worth fixing before the next re-run. Reading the source directly would
-have shown the two homelab misses without inferring them from the wording.
+Fixed in V-662 and the 140 turns were driven a third time. Sixty-eight of them
+name a source. The rest are not query turns and never reach `queryWalk`.
+
+| source | turns |
+|---|---|
+| search | 27 |
+| memory | 13 |
+| personal | 9 |
+| weather | 5 |
+| calendar | 3 |
+| attention | 3 |
+| list | 2 |
+| feeds | 2 |
+| tasks, money, self, habits | 1 each |
+
+## What the badge shows that the wording did not
+
+The two unfixed homelab turns are now direct evidence.
+
+```text
+какая скорость у меня сейчас?        -> weather
+хватает ли места под новые бэкапы?   -> feeds
+```
+
+Both are guessing sources claiming a turn about the box, exactly as the
+destination fixture predicted.
+
+The badge also names a defect the wording hid. **Agenda questions are being
+claimed by the personal boundary and by Praxis, not by the calendar.**
+
+```text
+во сколько у меня встреча?   -> personal    не нашла у тебя такой записи
+когда у меня встреча?        -> attention   у Praxis нет источников
+что у меня в понедельник?    -> personal    не нашла у тебя такой записи
+```
+
+Calendar claimed 3 turns of the 6 that asked about the calendar. That is the
+same 3/6 the destination fixture scores and the same 3/6 every seed of the
+routing head scores. Three measurements agree. The cause is the one V-660 named. The possessive
+agenda rules claim these at stage 0 and name no destination, so the walk
+reaches `personal` and `attention` first.
+
+This is the third independent confirmation that the possessive agenda rules
+should name the calendar. That call is still the owner's.

internal/config/workstation.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"net/url"
 	"strings"
 	"time"
 )
@@ -35,12 +36,54 @@ type WorkstationConfig struct {
 	// 0 ⇒ DefaultWorkstationTimeout. A big model on a LAN host is slower than
 	// the resident one, and a request that overruns falls back to the floor.
 	Timeout Duration `json:"timeout,omitempty"`
+
+	// Stt — CrisperWhisper 2.0 on the same machine, a separate service on its
+	// own port. Absent ⇒ every utterance goes to mavsttd, which is today.
+	Stt *WorkstationSttConfig `json:"stt,omitempty"`
+}
+
+// WorkstationSttConfig — speech-to-text on the workstation.
+//
+// It is a second service and not a second endpoint on mavgpud: whisper.cpp
+// cannot load CrisperWhisper 2.0 at all, because it derives its language count
+// from the vocabulary size and CW2's 51897 tokens shift seven special token
+// ids. So CW2 runs under transformers, and this block addresses it.
+//
+// Worth the trouble: CW2 turbo scores 10.4% WER in Russian against 27.5% for
+// the ggml-small.bin homesrv loads
+// (docs/evals/2026-08-09-crisperwhisper2-russian-wer.md).
+type WorkstationSttConfig struct {
+	// URL — the transcribe endpoint, e.g.
+	// "http://192.168.1.105:8081/transcribe". Empty ⇒ the block is normalised
+	// to nil and mavsttd takes every turn.
+	URL string `json:"url,omitempty"`
+
+	// Health — the admission endpoint. Empty ⇒ the URL's origin + "/health".
+	// It answers 503 while the card is held, and that is the signal.
+	Health string `json:"health,omitempty"`
+
+	// Token — the bearer token the service checks. Audio is the most sensitive
+	// thing that crosses this seam, so a LAN deployment should set one. Write
+	// it as ${MAVEN_STT_TOKEN} and keep the value in deploy/telegram.env, the
+	// way every other secret in this file is written.
+	Token string `json:"token,omitempty"`
+
+	// Probe — how often admission is re-checked. 0 ⇒ DefaultWorkstationProbe.
+	Probe Duration `json:"probe,omitempty"`
+
+	// Timeout — the per-request budget for one utterance. 0 ⇒
+	// DefaultWorkstationSttTimeout. A request that overruns falls back to
+	// mavsttd, which costs a worse transcript and not the turn.
+	Timeout Duration `json:"timeout,omitempty"`
 }
 
 // Workstation defaults, applied in normaliseWorkstation.
 const (
 	DefaultWorkstationProbe   = 15 * time.Second
 	DefaultWorkstationTimeout = 90 * time.Second
+	// One utterance, not one completion. A voice turn waits on this, so the
+	// budget is a few seconds and not a minute and a half.
+	DefaultWorkstationSttTimeout = 10 * time.Second
 )
 
 // normaliseWorkstation applies the block's defaults. No address, no preferred
@@ -63,4 +106,36 @@ func (c *Config) normaliseWorkstation() {
 	if w.Timeout <= 0 {
 		w.Timeout = Duration(DefaultWorkstationTimeout)
 	}
+	normaliseWorkstationStt(w)
+}
+
+// normaliseWorkstationStt applies the speech-to-text block's defaults. No
+// address, no remote: mavsttd then takes every utterance, which is today.
+func normaliseWorkstationStt(w *WorkstationConfig) {
+	if w.Stt != nil && strings.TrimSpace(w.Stt.URL) == "" {
+		w.Stt = nil
+	}
+	if w.Stt == nil {
+		return
+	}
+	s := w.Stt
+	if strings.TrimSpace(s.Health) == "" {
+		s.Health = healthOrigin(s.URL)
+	}
+	if s.Probe <= 0 {
+		s.Probe = Duration(DefaultWorkstationProbe)
+	}
+	if s.Timeout <= 0 {
+		s.Timeout = Duration(DefaultWorkstationSttTimeout)
+	}
+}
+
+// healthOrigin derives the admission endpoint from the transcribe endpoint.
+// The URL names a path, so appending to it would ask for /transcribe/health.
+func healthOrigin(raw string) string {
+	u, err := url.Parse(raw)
+	if err != nil || u.Host == "" {
+		return strings.TrimRight(raw, "/") + "/health"
+	}
+	return u.Scheme + "://" + u.Host + "/health"
 }

internal/dialogue/clarify.go

@@ -47,6 +47,11 @@ type PendingQuestion struct {
 	// charging it a retry is the V-554 shape. See CanResume for why it is
 	// counted at all.
 	Suspends int
+	// Rides counts every turn this question has ridden out on the end of
+	// someone else's reply, over the whole life of the request. Unlike Suspends
+	// it is never reset and never re-based, which is the only property that
+	// matters about it (V-663).
+	Rides int
 }
 
 // MaxSuspends — how many times one question may step aside and come back before
@@ -63,10 +68,52 @@ type PendingQuestion struct {
 // is that he has moved on and has not said so.
 const MaxSuspends = 3
 
+// MaxRides — how many turns one question may ride out on the end of an
+// unrelated reply, counted over its whole life (V-663).
+//
+// MaxSuspends did not move the measurement it was written for. Twenty-six of
+// 140 turns carried a tail before it landed and twenty-six carried one after.
+// Every bound on this question is rearmed by something ordinary:
+//
+//   - The TTL is an inactivity timer, and both noteSuspended and reaskOrGiveUp
+//     restart it, so it cannot arrive while he keeps talking.
+//   - Suspends is zeroed by any turn that reads as an answer, which is where
+//     "спасибо" and "привет" land. It resets before anything is known to have
+//     been filled.
+//   - askRemainingGap builds a fresh question for the second gap, so a reminder
+//     with two gaps gets a new allowance halfway through.
+//
+// So Suspends only bites on four strictly consecutive side queries with nothing
+// chat-like between them, which is not the shape real conversation has. Rides is
+// the same idea with the resets taken out: set once, incremented, carried
+// across a re-park, and read by nothing that could lower it.
+//
+// The shape it is aimed at is measured, not imagined. In the 2026-08-08 run one
+// question about a reminder's day rode turns 7 to 13 and ended only because
+// turn 14 was a new request. Three asides, then two turns that read as failed
+// answers, then two more asides. The asides spend no attempt and the answers
+// reset Suspends, so the two bounds take turns being rearmed by the other's
+// traffic.
+//
+// Four, not three. It has to be looser than MaxSuspends or that bound is dead
+// code, because Rides is never lower than Suspends and would always fire first.
+//
+// Do not read this as a fix for the whole ride. It ends the measured one a turn
+// early and no more. Most of that ride's length is attempts, spent by turns
+// like "спасибо" and "привет" being read as failed answers to a question about
+// a day. That is a defect in classifyTurnRole and not in any bound here.
+const MaxRides = 4
+
 // CanResume reports whether this question may step aside once more. False ⇒ the
 // caller lets the request go and says so; it must never simply stop resuming,
 // because a question dropped in silence reads as one that was answered.
-func (q *PendingQuestion) CanResume() bool { return q.Suspends < MaxSuspends }
+//
+// Two bounds, and they answer different questions. Suspends asks whether he has
+// walked away from this exchange in the last few turns. Rides asks whether this
+// question has been riding long enough that the answer is no regardless.
+func (q *PendingQuestion) CanResume() bool {
+	return q.Suspends < MaxSuspends && q.Rides < MaxRides
+}
 
 // Action reads the parked question as the typed action it is assembling
 // (pending.go). Derived rather than stored: the question's fields stay the one

internal/lexicon/lexicon.go

@@ -119,6 +119,11 @@ func PartsOfDay() []string { return words("parts_of_day") }
 // ReminderVerbs returns the imperatives that open a reminder.
 func ReminderVerbs() []string { return words("reminder_verbs") }
 
+// Pleasantries returns the whole utterances that greet, thank or say goodbye.
+// Whole utterances and not tokens: see the set's own note for why the tokens
+// are unsafe alone.
+func Pleasantries() []string { return words("pleasantries") }
+
 // TaskDoneWords returns the words that finish a task, and TaskDropWords the
 // words that abandon one. Two sets rather than one with a value, because the
 // store records which of the two happened and the caller has to say so.

internal/lexicon/lexicon_ru_v1.json

@@ -176,6 +176,19 @@
         "morning", "afternoon", "evening", "night"
       ]
     },
+    "pleasantries": {
+      "note": "Whole utterances that greet, thank or say goodbye. They ask for nothing and answer nothing, so a parked question must neither consume them as a failed answer nor be dropped by them (V-663). Matched as WHOLE utterances and never as tokens, because the tokens are not safe alone: \"вечер\" answers \"это утра или вечера?\" and \"нет\" answers a confirm. Anything that could fill a slot stays out. The control words (\"стоп\", \"отмена\") stay out too, because isCancel already owns them and they mean something stronger.",
+      "words": [
+        "привет", "приветик", "здравствуй", "здравствуйте",
+        "доброе утро", "добрый день", "добрый вечер",
+        "пока", "прощай", "до свидания", "спокойной ночи",
+        "спасибо", "спасибо тебе", "большое спасибо", "благодарю",
+        "извини", "извините", "прости", "простите",
+        "hi", "hello", "hey", "bye", "goodbye",
+        "good morning", "good evening", "good night",
+        "thanks", "thank you", "thanks a lot", "sorry"
+      ]
+    },
     "reminder_verbs": {
       "note": "The imperatives that mean \"remind me\", in the forms he speaks. The same kind of set as capture_verbs and decided the same way: it is her vocabulary, not a discovery about Russian (Vikunja #530). The alarm verbs joined them in V-627. \"разбуди меня в 6:30\" is a reminder that fires at the hour he gets up, and the set knew no form of it, so an alarm reached IntentReminder only by resembling one to the embedder.",
       "words": [

internal/stt/http.go

@@ -0,0 +1,92 @@
+package stt
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"strconv"
+	"time"
+
+	"github.com/kami/maven/internal/audio"
+)
+
+// HTTPTranscriber — speech-to-text on another host, over HTTP.
+//
+// mavsttd is whisper.cpp linked into a Go daemon and reached over a unix
+// socket. CrisperWhisper 2.0 cannot be reached that way: whisper.cpp derives
+// its language count from the vocabulary size, and CW2's 51897 tokens shift
+// seven special token ids. It runs under transformers instead, as a service
+// beside the model on workpc. See docs/evals/2026-08-09-crisperwhisper2-russian-wer.md.
+//
+// So this is the second transport for the same seam, not a second seam. The
+// caller still sees stt.Transcriber and one method.
+type HTTPTranscriber struct {
+	url   string
+	token string
+	lang  string
+	http  *http.Client
+}
+
+// NewHTTPTranscriber builds the remote client. token may be empty for a
+// service on a trusted socket, but audio is the most sensitive thing that
+// crosses this seam, so a LAN deployment should always set one.
+func NewHTTPTranscriber(url, token, lang string, timeout time.Duration) *HTTPTranscriber {
+	return &HTTPTranscriber{
+		url:   url,
+		token: token,
+		lang:  lang,
+		http:  &http.Client{Timeout: timeout},
+	}
+}
+
+// ErrFormat — the audio is not the one canonical shape. Refused at the seam
+// rather than sent to a model that expects something else.
+var ErrFormat = errors.New("stt: audio is not 16kHz mono pcm_s16le")
+
+type httpTranscript struct {
+	Text       string  `json:"text"`
+	Confidence float64 `json:"confidence"`
+}
+
+// Transcribe posts the raw PCM and reads back the text.
+//
+// The body is the PCM bytes themselves rather than JSON. A minute of 16kHz
+// mono is under 2MB raw and about 2.6MB base64, and the format is fixed by
+// audio.PCM16kMono, so a header carries it more cheaply than an envelope.
+func (t *HTTPTranscriber) Transcribe(ctx context.Context, a audio.Audio) (string, float64, error) {
+	if !a.Format.IsValid() {
+		return "", 0, ErrFormat
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, t.url, bytes.NewReader(a.Bytes))
+	if err != nil {
+		return "", 0, fmt.Errorf("stt: build request: %w", err)
+	}
+	req.Header.Set("Content-Type", "application/octet-stream")
+	req.Header.Set("X-Sample-Rate", strconv.Itoa(a.Format.SampleRate))
+	req.Header.Set("X-Channels", strconv.Itoa(a.Format.Channels))
+	req.Header.Set("X-Sample-Bits", strconv.Itoa(a.Format.SampleBits))
+	req.Header.Set("X-Language", t.lang)
+	if t.token != "" {
+		req.Header.Set("Authorization", "Bearer "+t.token)
+	}
+
+	resp, err := t.http.Do(req)
+	if err != nil {
+		return "", 0, fmt.Errorf("stt: post audio: %w", err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return "", 0, fmt.Errorf("stt: remote returned %d", resp.StatusCode)
+	}
+
+	var out httpTranscript
+	if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+		return "", 0, fmt.Errorf("stt: decode transcript: %w", err)
+	}
+	return out.Text, out.Confidence, nil
+}
+
+var _ Transcriber = (*HTTPTranscriber)(nil)

internal/stt/http_test.go

@@ -0,0 +1,89 @@
+package stt
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/audio"
+)
+
+func TestHTTPTranscriberSendsRawPCM(t *testing.T) {
+	t.Parallel()
+	var gotBody []byte
+	var gotHeader http.Header
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotBody, _ = io.ReadAll(r.Body)
+		gotHeader = r.Header.Clone()
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = io.WriteString(w, `{"text":"привет","confidence":0.82}`)
+	}))
+	defer srv.Close()
+
+	a := audio.Audio{Format: audio.PCM16kMono, Bytes: []byte("pcm-bytes")}
+	tr := NewHTTPTranscriber(srv.URL, "s3cret", "ru", 2*time.Second)
+	text, conf, err := tr.Transcribe(context.Background(), a)
+	if err != nil {
+		t.Fatalf("Transcribe: %v", err)
+	}
+	if text != "привет" || conf != 0.82 {
+		t.Fatalf("got %q %v", text, conf)
+	}
+	if string(gotBody) != "pcm-bytes" {
+		t.Fatalf("body should be the PCM itself, got %q", gotBody)
+	}
+	if got := gotHeader.Get("X-Sample-Rate"); got != strconv.Itoa(audio.PCM16kMono.SampleRate) {
+		t.Fatalf("X-Sample-Rate = %q", got)
+	}
+	if got := gotHeader.Get("X-Language"); got != "ru" {
+		t.Fatalf("X-Language = %q", got)
+	}
+	// Audio is the most sensitive thing crossing this seam.
+	if got := gotHeader.Get("Authorization"); got != "Bearer s3cret" {
+		t.Fatalf("Authorization = %q", got)
+	}
+}
+
+func TestHTTPTranscriberOmitsEmptyToken(t *testing.T) {
+	t.Parallel()
+	var auth string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		auth = r.Header.Get("Authorization")
+		_, _ = io.WriteString(w, `{"text":"x"}`)
+	}))
+	defer srv.Close()
+	a := audio.Audio{Format: audio.PCM16kMono, Bytes: []byte("x")}
+	if _, _, err := NewHTTPTranscriber(srv.URL, "", "ru", time.Second).Transcribe(context.Background(), a); err != nil {
+		t.Fatalf("Transcribe: %v", err)
+	}
+	if auth != "" {
+		t.Fatalf("Authorization should be absent, got %q", auth)
+	}
+}
+
+func TestHTTPTranscriberRefusesWrongFormat(t *testing.T) {
+	t.Parallel()
+	a := audio.Audio{Format: audio.Format{SampleRate: 44100, Channels: 2, SampleBits: 16, Encoding: "pcm_s16le"}}
+	_, _, err := NewHTTPTranscriber("http://example.invalid", "", "ru", time.Second).Transcribe(context.Background(), a)
+	if !errors.Is(err, ErrFormat) {
+		t.Fatalf("want ErrFormat, got %v", err)
+	}
+}
+
+func TestHTTPTranscriberErrorsOnBadStatus(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusUnauthorized)
+	}))
+	defer srv.Close()
+	a := audio.Audio{Format: audio.PCM16kMono, Bytes: []byte("x")}
+	_, _, err := NewHTTPTranscriber(srv.URL, "", "ru", time.Second).Transcribe(context.Background(), a)
+	if err == nil {
+		t.Fatal("a 401 must be an error, so the Pair falls back")
+	}
+}

internal/stt/pair.go

@@ -0,0 +1,157 @@
+package stt
+
+import (
+	"context"
+	"errors"
+	"log"
+	"net/http"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/kami/maven/internal/audio"
+)
+
+// Pair — a preferred transcriber on the workstation, with mavsttd as the floor.
+//
+// Same arrangement as llm.Pair and for the same reason. The microphone is at
+// workpc, the card there has 16GB, and CrisperWhisper 2.0 turbo scores 10.4%
+// WER in Russian against 27.5% for the ggml-small.bin homesrv loads
+// (docs/evals/2026-08-09-crisperwhisper2-russian-wer.md). The workstation is
+// never assumed up: it sleeps, and the card is often held by a training run.
+//
+// Speech-to-text has only the silent half of the degradation rule. A worse
+// transcript is still a turn, and there is nothing to name a gap about, so
+// Transcribe always falls back. That is the whole difference from llm.Pair,
+// which also carries CompleteRemote for callers that must refuse instead.
+type Pair struct {
+	remote Transcriber
+	floor  Transcriber
+
+	// up — the cached admission answer, written only by the prober and read by
+	// every turn. A voice turn must never wait on a machine that may be asleep.
+	up atomic.Bool
+
+	health   string
+	interval time.Duration
+	http     *http.Client
+	stop     chan struct{}
+	stopOnce sync.Once
+}
+
+const (
+	probeTimeout         = 2 * time.Second
+	defaultProbeInterval = 15 * time.Second
+)
+
+// ErrNoFloor — a Pair was built with no local transcriber to fall back to. A
+// configuration mistake: the floor is what makes the remote optional.
+var ErrNoFloor = errors.New("stt: no floor transcriber")
+
+// NewPair builds the two-transcriber arrangement. remote may be nil, which is
+// the unconfigured deploy: every turn goes to the floor and nothing probes.
+func NewPair(remote, floor Transcriber, health string, interval time.Duration) *Pair {
+	if interval <= 0 {
+		// The config normalises this, so a zero here is a caller that built the
+		// Pair directly. Panicking in a ticker is the wrong way to say so.
+		interval = defaultProbeInterval
+	}
+	return &Pair{
+		remote:   remote,
+		floor:    floor,
+		health:   health,
+		interval: interval,
+		http:     &http.Client{Timeout: probeTimeout},
+		stop:     make(chan struct{}),
+	}
+}
+
+// Start begins probing. The first probe runs before the first tick, so a
+// workstation that is already up serves the first utterance rather than the
+// second. Safe with a nil remote.
+func (p *Pair) Start(ctx context.Context) {
+	if p.remote == nil || p.health == "" {
+		return
+	}
+	go func() {
+		p.probe(ctx)
+		t := time.NewTicker(p.interval)
+		defer t.Stop()
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-p.stop:
+				return
+			case <-t.C:
+				p.probe(ctx)
+			}
+		}
+	}()
+}
+
+// Stop ends the prober. Idempotent and safe from two goroutines.
+func (p *Pair) Stop() {
+	p.stopOnce.Do(func() { close(p.stop) })
+}
+
+// Available reports whether the workstation will transcribe right now.
+func (p *Pair) Available() bool {
+	return p.remote != nil && p.up.Load()
+}
+
+func (p *Pair) probe(ctx context.Context) {
+	ctx, cancel := context.WithTimeout(ctx, probeTimeout)
+	defer cancel()
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, p.health, nil)
+	if err != nil {
+		p.set(false)
+		return
+	}
+	resp, err := p.http.Do(req)
+	if err != nil {
+		p.set(false)
+		return
+	}
+	defer resp.Body.Close()
+	p.set(resp.StatusCode == http.StatusOK)
+}
+
+// set records the admission answer and logs only transitions. A machine that
+// sleeps nightly would otherwise write one line per interval forever.
+func (p *Pair) set(up bool) {
+	if p.up.Swap(up) == up {
+		return
+	}
+	if up {
+		log.Printf("stt: workstation transcriber available at %s", p.health)
+	} else {
+		log.Print("stt: workstation transcriber unavailable, falling back to mavsttd")
+	}
+}
+
+// Transcribe sends the audio to the workstation when it will take work, and to
+// mavsttd otherwise. A remote that fails mid-request falls back too, because
+// the admission answer is a cache and can be one interval out of date.
+//
+// Killing the remote mid-session must not drop the turn. That is the whole
+// point of the floor, and it is what TestPairFallsBackWhenRemoteFails pins.
+func (p *Pair) Transcribe(ctx context.Context, a audio.Audio) (string, float64, error) {
+	if p.floor == nil {
+		return "", 0, ErrNoFloor
+	}
+	if p.Available() {
+		text, conf, err := p.remote.Transcribe(ctx, a)
+		if err == nil {
+			log.Print("stt: transcribed on the workstation")
+			return text, conf, nil
+		}
+		// The cached answer was wrong. Correct it now rather than sending the
+		// next utterance into the same hole, then fall back.
+		p.set(false)
+		log.Printf("stt: workstation failed mid-request, falling back: %v", err)
+	}
+	return p.floor.Transcribe(ctx, a)
+}
+
+var _ Transcriber = (*Pair)(nil)

internal/stt/pair_test.go

@@ -0,0 +1,143 @@
+package stt
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/kami/maven/internal/audio"
+)
+
+// scripted — a Transcriber that answers with a fixed text, or fails.
+type scripted struct {
+	text  string
+	err   error
+	calls atomic.Int32
+}
+
+func (s *scripted) Transcribe(_ context.Context, _ audio.Audio) (string, float64, error) {
+	s.calls.Add(1)
+	if s.err != nil {
+		return "", 0, s.err
+	}
+	return s.text, 0.9, nil
+}
+
+func sample() audio.Audio {
+	return audio.Audio{Format: audio.PCM16kMono, Bytes: make([]byte, 3200)}
+}
+
+// up builds a Pair whose admission answer is already true, without probing.
+func up(remote, floor Transcriber) *Pair {
+	p := NewPair(remote, floor, "", time.Minute)
+	p.up.Store(true)
+	return p
+}
+
+func TestPairPrefersTheWorkstation(t *testing.T) {
+	t.Parallel()
+	remote := &scripted{text: "с рабочей станции"}
+	floor := &scripted{text: "с homesrv"}
+	text, _, err := up(remote, floor).Transcribe(context.Background(), sample())
+	if err != nil {
+		t.Fatalf("Transcribe: %v", err)
+	}
+	if text != "с рабочей станции" {
+		t.Fatalf("want the remote transcript, got %q", text)
+	}
+	if floor.calls.Load() != 0 {
+		t.Fatalf("floor was called %d times, want 0", floor.calls.Load())
+	}
+}
+
+// The turn is what matters. A remote that dies mid-session must cost a worse
+// transcript and nothing else. This is the V-486 bar.
+func TestPairFallsBackWhenRemoteFails(t *testing.T) {
+	t.Parallel()
+	remote := &scripted{err: errors.New("connection refused")}
+	floor := &scripted{text: "с homesrv"}
+	p := up(remote, floor)
+
+	text, conf, err := p.Transcribe(context.Background(), sample())
+	if err != nil {
+		t.Fatalf("a failed remote must not fail the turn: %v", err)
+	}
+	if text != "с homesrv" {
+		t.Fatalf("want the floor transcript, got %q", text)
+	}
+	if conf != 0.9 {
+		t.Fatalf("want the floor confidence, got %v", conf)
+	}
+	if p.Available() {
+		t.Fatal("a failed request must correct the cached admission answer")
+	}
+
+	// The next utterance goes straight to the floor rather than into the
+	// same hole.
+	if _, _, err := p.Transcribe(context.Background(), sample()); err != nil {
+		t.Fatalf("second turn: %v", err)
+	}
+	if remote.calls.Load() != 1 {
+		t.Fatalf("remote called %d times, want 1", remote.calls.Load())
+	}
+}
+
+func TestPairWithNoRemoteIsTheFloor(t *testing.T) {
+	t.Parallel()
+	floor := &scripted{text: "с homesrv"}
+	p := NewPair(nil, floor, "", time.Minute)
+	p.Start(context.Background()) // no health url, so this is a no-op
+	if p.Available() {
+		t.Fatal("an unconfigured remote is never available")
+	}
+	text, _, err := p.Transcribe(context.Background(), sample())
+	if err != nil {
+		t.Fatalf("Transcribe: %v", err)
+	}
+	if text != "с homesrv" {
+		t.Fatalf("want the floor transcript, got %q", text)
+	}
+}
+
+func TestPairWithNoFloorRefuses(t *testing.T) {
+	t.Parallel()
+	_, _, err := NewPair(nil, nil, "", time.Minute).Transcribe(context.Background(), sample())
+	if !errors.Is(err, ErrNoFloor) {
+		t.Fatalf("want ErrNoFloor, got %v", err)
+	}
+}
+
+func TestPairProbeReadsHealth(t *testing.T) {
+	t.Parallel()
+	var ok atomic.Bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		if !ok.Load() {
+			w.WriteHeader(http.StatusServiceUnavailable)
+			return
+		}
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	p := NewPair(&scripted{text: "remote"}, &scripted{text: "floor"}, srv.URL, time.Minute)
+	p.probe(context.Background())
+	if p.Available() {
+		t.Fatal("a 503 means the card is busy, so the workstation is not available")
+	}
+	ok.Store(true)
+	p.probe(context.Background())
+	if !p.Available() {
+		t.Fatal("a 200 means the workstation will take work")
+	}
+}
+
+func TestPairStopIsIdempotent(t *testing.T) {
+	t.Parallel()
+	p := NewPair(nil, &scripted{}, "", time.Minute)
+	p.Stop()
+	p.Stop()
+}

scripts/usage-run.py

@@ -54,7 +54,11 @@ def turn(text):
         q = urllib.parse.parse_qs(urllib.parse.urlparse(loc).query)
         return {
             "reply": q.get("r", [""])[0],
-            "source": q.get("src", q.get("source", [""]))[0],
+            # "s", not "src". cmd/mavweb/chat.go writes the badge under that
+            # name, and reading the wrong one cost both fortnight runs their
+            # source column: every finding in those docs is inferred from the
+            # reply wording instead.
+            "source": q.get("s", [""])[0],
             "trace": q.get("t", [""])[0],
             "secs": dt,
         }