The template said "drop into your nginx sites" but listened on the
wildcard `listen 80;` with no allow/deny ACL, unlike the actual deployed
hexis.kvmx.ru config which binds only to the WireGuard (10.42.0.1) and
LAN (192.168.1.104) addresses with allow/deny all. Anyone following the
template as written would expose these unauthenticated admin UIs to the
open internet.

Bind explicitly to those two addresses and add the matching ACL block,
mirroring cmd/mavweb/nginx.conf which already does this correctly.
Added a comment naming both addresses as host-specific so a deploy on a
different box swaps the IPs instead of reverting to `listen 80` when the
bind fails.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CGeSZxh1DCtRxmFVSYVGvJ

@@ -0,0 +59,4 @@
+	router.IntentQuery:    (*reactiveHandler).actionQuery,
+}
+
+func (h *reactiveHandler) actionFact(ctx context.Context, dec router.Decision) string {

@@ -0,0 +13,4 @@
+// confirm. The confirmation is bound to the resolved capability + canonical
+// target entity so a later "да" can only execute exactly what was proposed
+// (ecosystem invariant: protected actions require bound confirmation).
+type pendingHexisExec struct {

@@ -0,0 +67,4 @@
+	// so a routine confirm doesn't get eaten by a stale tool pending).
+	pr := h.pendingRoutine
+	if pr != nil && !h.now().After(pr.expiry) {
+		switch classifyConfirm(text) {

@@ -0,0 +24,4 @@
+
+	// Map verbs and Russian aliases to Praxis tool calls.
+	// Each case: if the verb matches, call the tool and return a user-facing reply.
+	switch fn {

@@ -366,3 +276,2 @@
 	} else {
-		// locked mode: dummy CoreAPI that returns errLocked for everything
-		coreAPI = &lockedAPI{}
+		// locked mode: no real store yet, so there's no meaningful CoreAPI to

@@ -345,0 +530,4 @@
+		log.Printf("tick: drain digest entries: %v", err)
+	}
+}
+

@@ -0,0 +21,4 @@
+
+// extractWeatherLocation parses a location from the utterance, or falls back
+// to the configured default. Very basic: just checks for known city names.
+func extractWeatherLocation(u, defaultLoc string) string {

@@ -501,6 +501,239 @@ func (s *Server) safeDispatch(ctx context.Context, req Request) (result json.Raw
 	return s.dispatch(ctx, req)
 }
 

@@ -0,0 +11,4 @@
+// Digest entry statuses. pending = enqueued, waiting for a drain. drained =
+// spoken as part of a bundle. expired = the tick loop's expiry sweep found it
+// past its expires_ts before a drain happened — dropped, not delivered late.
+const (