# The world chain

*Last verified: 2026-08-09 @ a9b480a*

What happens when the answer is not his. `CLAUDE.md` carries the boundary rule.
This file carries the mechanism and the measurements behind it.

## What replaced "never phones home"

That promise was deprecated on 2026-07-31 by the owner's call. A 1.7B does not
know enough to answer world questions, so she reads external sources. Four rules
replaced it:

- **No telemetry, no cloud model, no third-party account.** That part never
  changes. Nothing about Maven is reported to anyone and inference stays on the
  box.
- **The owner's data first, then the world.** Every source reading his facts,
  notes, calendar, tasks or house runs before anything outside. The personal
  boundary sits between them. Reading beats recalling for a small model.
- **The owner's notes and facts are never search input.** Only the utterance
  goes out. Never the persona block, the history, or matched notes.
- **External search is allowed and off unless configured**, like weather and
  telegram. The code default is off. `deploy/mavend.json` ships a `search`
  block, so it is on for this box and deleting the block turns it off again.

**Live search leads and the ZIMs are the fallback** (owner's call, 2026-08-02).
A self-hosted SearXNG answers first. The Kiwix ZIMs on homesrv answer when the
search is empty, unreachable, or the line is down.

## The gate is emptiness and nothing else

`Response.Empty()` is the whole gate. There is no quality threshold in front of
it. Four signals were tried and none separates a real question from an invented
one.

Token overlap was the closest and it still fails. "столица Франции" would lose
its answer, because the answer is Париж and that word is not in the question
(`docs/evals/2026-08-05-search-quality-signals.md`).

**The embedder is not a fifth signal.** Query-to-passage cosine measures topic
and not whether the passage answers. The two sets overlap
(`docs/evals/2026-08-09-kiwix-topic-retrieval.md`).

## Timeouts

The connect phase alone is capped at `dialTimeout`, 1.5s, because a blackholed
host once cost the owner 8 seconds. A slow instance that did connect keeps the
full 8 (`docs/evals/2026-08-05-kiwix-offline-fallback.md`).

## Kiwix

**A Russian question reads `wikipedia_ru_all_maxi_2026-02` verbatim** through
`kiwix.book_ru`. The RU→EN rewriter is the workaround for an English book and is
skipped there. Kiwix catalog names come from the filename, not the `<name>`
field.

**Kiwix ranks by keyword overlap.** Never send it a whole sentence. `kiwix.Topic`
drops the narrative request, the interrogative and a verb behind one.

`kiwix.TitlePath` tries the exact article first, since a ZIM is addressable by
title and a wrong title is a 404. `TitleCandidates` tries the spoken form and
then the capitalized one. Both apply on the verbatim path alone. The rewriter
already reduces a question, and reducing twice takes the topic off its input
(V-668).

## Which source answered

**The claiming query source is readable on `/chat`** as a badge beside the
reply. It is carried on `ipc.ChatReply.Source` and noted by `noteQuerySource` in
`cmd/mavend/querysource.go`. It rides the context, so `handleText` keeps the one
string signature the mic, telegram and the web share.