deploy(S4): Blender headless pipeline + WebAR client + backend fixes

backend/events/omega_event_bus.py

@@ -62,23 +62,29 @@ async def publish_omega_event(event: OmegaEvent):
     # 3. routes through existing §0.4 voice (stubbed for now if kokoro_engine not fully connected here, 
     # but requested by user spec to synthesize_tts)
     if event_type_warrants_speech(event.event_type):
+        # SPEAK the event, rather than synthesising it and dropping it.
+        #
+        # This called synthesize_kokoro directly and discarded the return value.
+        # synthesize_kokoro returns WAV bytes; it does not play anything and has
+        # no audio device. So every "feature implemented", "bug found",
+        # "game won" and "research alert" ran the full voice pipeline — model
+        # load, RVC conversion, the whole DSP chain — and then let the audio go
+        # out of scope unheard. Seconds of GPU work per event, for silence.
+        #
+        # It also ignored `persona`: the parameter was passed, but
+        # synthesize_kokoro takes **kwargs and only reads `profile`, so a FRIDAY
+        # event would have been rendered in the JARVIS voice had anyone heard it.
+        #
+        # core.voice.speak() is the correct destination. It picks the voice from
+        # the active persona, and its single-owner IPC means this backend
+        # process hands the line to whichever process owns the speakers instead
+        # of loading a second copy of the models.
         try:
-            from backend.voice.engines.kokoro_engine import synthesize_kokoro as synthesize_tts
-            
-            persona = event.persona or "jarvis"
-            # Context stub if ResponseContext does not exist natively
-            class StubContext:
-                type = "automation_status"
-                
-            await synthesize_tts(
-                describe_event_for_speech(event),
-                persona=persona,
-                context=StubContext()
-            )
-        except ImportError as e:
-            logging.warning(f"Could not import TTS engine for omega event speech: {e}")
+            from core.voice import speak
+            speak(describe_event_for_speech(event), event="omega_event",
+                  cooldown_s=4.0)
         except Exception as e:
-            logging.error(f"Error during TTS synthesis for omega event: {e}")
+            logging.error(f"Error speaking omega event: {e}")
 
     # 4. Trigger vault auto-refresh
     try:

backend/main.py

@@ -113,6 +113,8 @@ from backend.routes.easter_egg_routes import router as easter_egg_router
 from backend.routes.omega_routes      import router as omega_router
 from backend.routes.persona_routes    import router as persona_router
 from backend.routes.internet_routes   import router as internet_router
+from backend.routes.token_task_routes import router as token_task_router
+from backend.routes.engine_routes     import router as engine_router
 from backend.routes.sentinel_routes   import router as sentinel_router
 from backend.routers.gaming_routes    import router as gaming_router
 from backend.routes.model_proxy_routes import router as model_proxy_router  # AR-FIX-SESSION
@@ -206,6 +208,17 @@ app.include_router(distribution_router, prefix="")
 app.include_router(family_device_router, prefix="")
 app.include_router(persona_router,    prefix="/persona",   dependencies=[Depends(verify_token)])
 app.include_router(internet_router,   prefix="/internet",  dependencies=[Depends(verify_token)])
+# The token manager, reachable by the phone. Lets the handset use the full
+# 37-key domain routing without carrying a single key itself.
+app.include_router(token_task_router, prefix="/tokens",    dependencies=[Depends(verify_token)])
+# The full engine — unlimited tasks, intent, initiative, deferred orders,
+# silence. One implementation, called by the phone rather than duplicated in
+# Kotlin, so the handset can never drift from how JARVIS actually behaves.
+#
+# /engine, NOT /omega: omega_routes.py is the long-standing Autonomous Research
+# and Enhancement API (research, propose, approve, upgrade) and already owns
+# that prefix via its own APIRouter(prefix="/omega").
+app.include_router(engine_router,     prefix="/engine",    dependencies=[Depends(verify_token)])
 app.include_router(sentinel_router,   prefix="/sentinel",  dependencies=[Depends(verify_token)])
 app.include_router(gaming_router,     prefix="",           dependencies=[Depends(verify_token)]) # gaming routes already have /gaming prefix
 app.include_router(model_proxy_router, prefix="/api")  # AR-FIX-SESSION: model provider proxy stubs (no auth — WebAR calls these from browser)
@@ -690,7 +703,24 @@ def main():
     asyncio.run(run_all_migrations(db_path))
 
     cloud_env = os.environ.get("CLOUD_ENV", "false").lower() == "true"
-    host = "0.0.0.0" if cloud_env else "127.0.0.1"
+
+    # Bind the LAN, not just loopback.
+    #
+    # This was "0.0.0.0" only in cloud mode and "127.0.0.1" everywhere else, so
+    # on the desktop the bridge answered nothing but the machine it ran on. The
+    # phone's whole LAN path — the `http://<pc>:7474/api/...` half of the dual
+    # -path contract the Guardian app is built around — could never connect, and
+    # the JARVIS voice in particular cannot come from anywhere else: the cloud
+    # Space carries no RVC, so the PC is the only host that can render it.
+    #
+    # This is not an authentication hole. auth_middleware waives the token only
+    # for `request.client.host in ("127.0.0.1", "localhost", "::1")`; every LAN
+    # request must present a bearer token that passes verify_master_token, and
+    # that check is unchanged. What changes is only whether the socket is
+    # reachable at all.
+    #
+    # JARVIS_BIND_HOST forces it back to loopback on an untrusted network.
+    host = os.environ.get("JARVIS_BIND_HOST") or "0.0.0.0"
     base_port = int(os.environ.get("PORT", "7860")) if cloud_env else int(os.environ.get("JARVIS_PORT", "7474"))
     
     for port in range(base_port, base_port + 11):

backend/routes/engine_routes.py

@@ -0,0 +1,310 @@
+"""backend/routes/engine_routes.py — the whole engine, reachable from anywhere.
+
+WHY A ROUTE AND NOT A KOTLIN PORT
+---------------------------------
+Everything built this session is Python: modules/omega_executor.py plans and
+runs unlimited tasks (writing its own code when nothing fits),
+modules/intent.py understands what was meant rather than matching words,
+modules/deferred_intent.py deliberates irreversible orders, and
+modules/initiative.py acts unprompted.
+
+Re-implementing those four in Kotlin would give the phone a SECOND definition
+of how JARVIS thinks and acts — which is exactly the mistake
+MobileJarvisEngine.kt already made with the persona text, and exactly how
+core/brain.py drifted into telling JARVIS he was FRIDAY on every turn. Two
+copies of a brain diverge.
+
+So the phone calls this. One engine, one behaviour, and anything added to the
+Python is instantly available on the handset with no rebuild.
+
+WHERE THE WORK HAPPENS
+----------------------
+On the machine running this backend. That is the point: "shut down the PC",
+"finish that download", "close every window" are PC actions, and the phone is
+the remote. Requests that are really about the handset itself (torch, phone
+volume) still belong to the on-device engine, and this does not replace that.
+"""
+
+from typing import Optional
+
+from fastapi import APIRouter, HTTPException
+from pydantic import BaseModel
+
+router = APIRouter()
+
+
+class ExecuteRequest(BaseModel):
+    request: str
+    context: str = ""
+    # Off by default over the network: an irreversible action asked for from a
+    # phone in a pocket deserves a deliberate opt-in, not a default.
+    allow_destructive: bool = False
+
+
+class PlanRequest(BaseModel):
+    request: str
+    context: str = ""
+
+
+class IntentRequest(BaseModel):
+    text: str
+
+
+@router.post("/execute")
+async def omega_execute(req: ExecuteRequest) -> dict:
+    """Do whatever was asked — the full unlimited engine.
+
+    Chains, waits, real commands, and model-authored code for anything with no
+    existing handler. Identical to what the desktop voice path runs.
+    """
+    text = (req.request or "").strip()
+    if not text:
+        raise HTTPException(status_code=400, detail="request is required")
+    try:
+        from modules.omega_executor import execute
+        spoken: list[str] = []
+        res = execute(
+            text,
+            speak=spoken.append,
+            context=req.context or "",
+            allow_destructive=bool(req.allow_destructive),
+        )
+        return {
+            "status": "ok",
+            "ok": res.ok,
+            "spoken": res.spoken,
+            "said": spoken,
+            "cancelled": res.cancelled,
+            "steps": [
+                {"index": s.index, "kind": s.kind, "summary": s.summary,
+                 "ok": s.ok, "output": s.output[:1200], "error": s.error[:600]}
+                for s in res.steps
+            ],
+        }
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.post("/plan")
+async def omega_plan(req: PlanRequest) -> dict:
+    """Plan without doing. Lets the phone show what WOULD happen first."""
+    text = (req.request or "").strip()
+    if not text:
+        raise HTTPException(status_code=400, detail="request is required")
+    try:
+        from modules.omega_executor import plan_request, is_destructive
+        plan = plan_request(text, req.context or "")
+        steps = plan.get("steps") or []
+        return {
+            "status": "ok",
+            "say": plan.get("say", ""),
+            "degraded": bool(plan.get("degraded")),
+            "step_count": len(steps),
+            "steps": steps,
+            "has_irreversible": any(
+                is_destructive(str(s.get("cmd") or s.get("code") or "")
+                               + " " + str(s.get("name") or ""))
+                for s in steps
+            ),
+        }
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.post("/intent")
+async def omega_intent(req: IntentRequest) -> dict:
+    """What did they MEAN? act / converse / wake / mute / unmute / cancel."""
+    try:
+        from modules.intent import classify
+        got = classify(req.text or "")
+        return {
+            "status": "ok",
+            "intent": got.kind,
+            "confidence": got.confidence,
+            "payload": got.payload,
+            "source": got.source,
+        }
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.get("/repairs")
+async def list_repairs() -> dict:
+    """Commands that had to be corrected at runtime.
+
+    The immediate repair unblocks the operator; this is the evidence trail for
+    the lasting fix. A command that needs correcting every single run is a bug
+    that self-repair is otherwise hiding very effectively.
+    """
+    try:
+        from modules.omega_executor import pending_repairs
+        items = pending_repairs()
+        return {"status": "ok", "count": len(items), "repairs": items[-25:]}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.get("/depth_model_url")
+async def depth_model_url() -> dict:
+    """Where the phone should fetch the monocular-depth weights.
+
+    Served rather than hardcoded in the APK because a guessed URL that fails
+    leaves 2D->3D silently off forever. Three candidates were tested live and
+    all three failed (401 on a private path, 404 on two public mirrors), which
+    is exactly why this is configuration and not a constant.
+
+    Set OMEGA_DEPTH_MODEL_URL to a reachable .onnx and every handset picks it
+    up with no rebuild. Until then this returns empty and the phone reports
+    "no model URL configured" instead of pretending to be a 3D viewer.
+    """
+    import os
+
+    # Depth Anything V2 small, int8. Chosen because:
+    #   * the repo and file were CONFIRMED to exist via the HF API
+    #     (onnx-community/depth-anything-v2-small -> onnx/model_int8.onnx);
+    #   * int8 keeps it small enough to download and run on a handset;
+    #   * V2 small is markedly better than MiDaS small on indoor scenes, which
+    #     is what a photo or video in a virtual theatre usually is.
+    #
+    # NOT verified by downloading: this environment cannot follow Hugging Face's
+    # CDN redirect, so the bytes were never fetched here. The path is real; the
+    # first phone to run it is the real test.
+    DEFAULT = ("https://huggingface.co/onnx-community/depth-anything-v2-small"
+               "/resolve/main/onnx/model_int8.onnx")
+
+    url = (os.environ.get("OMEGA_DEPTH_MODEL_URL") or DEFAULT).strip()
+
+    # Input size travels WITH the url. Getting these out of step gives a model
+    # that loads happily and returns nonsense depth, which shows up as a
+    # headache rather than an error — far worse than a clean failure.
+    try:
+        size = int(os.environ.get("OMEGA_DEPTH_INPUT_SIZE") or 0)
+    except ValueError:
+        size = 0
+    if not size:
+        size = 256 if "midas" in url.lower() else 518
+
+    return {
+        "status": "ok",
+        "url": url,
+        "input_size": size,
+        "configured": True,
+        "is_default": url == DEFAULT,
+        "note": ("Default Depth Anything V2 small (int8). Override with "
+                 "OMEGA_DEPTH_MODEL_URL, and set OMEGA_DEPTH_INPUT_SIZE to "
+                 "match that model's expected input."),
+    }
+
+
+@router.get("/capabilities")
+async def omega_capabilities() -> dict:
+    """Every power currently granted. Honest about what it can actually do."""
+    try:
+        from modules.omega_executor import capability_catalog
+        caps = capability_catalog()
+        return {"status": "ok", "count": len(caps), "capabilities": caps}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+# ── Unprompted action, from the phone's point of view ───────────────────────
+@router.get("/initiative")
+async def initiative_state() -> dict:
+    """What he noticed, and anything he did while nobody was watching."""
+    try:
+        from modules.initiative import observe, pending_report, format_report, is_running
+        return {
+            "status": "ok",
+            "running": is_running(),
+            "situation": observe(),
+            "pending_report": pending_report(),
+            "spoken_report": format_report(),
+        }
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.post("/initiative/tick")
+async def initiative_tick() -> dict:
+    """Look now rather than waiting for the timer."""
+    try:
+        from modules.initiative import tick
+        spoken: list[str] = []
+        v = tick(speak=spoken.append)
+        if v is None:
+            return {"status": "ok", "silenced": True}
+        return {
+            "status": "ok",
+            "act": v.act, "say": v.say, "action": v.action,
+            "urgency": v.urgency, "topic": v.topic, "said": spoken,
+        }
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.post("/initiative/acknowledge")
+async def initiative_ack() -> dict:
+    """The operator has seen the report; stop offering it."""
+    try:
+        from modules.initiative import mark_reported, note_user_contact
+        note_user_contact()
+        mark_reported()
+        return {"status": "ok"}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+# ── Held irreversible orders ────────────────────────────────────────────────
+@router.get("/deferred")
+async def deferred_list() -> dict:
+    """Orders held back, why, and when they will be reconsidered."""
+    try:
+        from modules.deferred_intent import pending
+        return {"status": "ok", "orders": pending()}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+class WithdrawRequest(BaseModel):
+    order: Optional[str] = None
+
+
+@router.post("/deferred/withdraw")
+async def deferred_withdraw(req: WithdrawRequest) -> dict:
+    """Changed their mind. Drops one order, or all of them."""
+    try:
+        from modules.deferred_intent import withdraw
+        withdraw(req.order)
+        return {"status": "ok"}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+# ── Silence ─────────────────────────────────────────────────────────────────
+class SilenceRequest(BaseModel):
+    silent: bool
+    reason: str = ""
+
+
+@router.post("/silence")
+async def set_silence(req: SilenceRequest) -> dict:
+    """Total mute, from the phone. No timeout — released only explicitly."""
+    try:
+        from modules.alert_manager import silence_all, unsilence_all, is_silenced
+        if req.silent:
+            silence_all(req.reason or "asked from phone")
+        else:
+            unsilence_all()
+        return {"status": "ok", "silenced": is_silenced()}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.get("/silence")
+async def get_silence() -> dict:
+    try:
+        from modules.alert_manager import is_silenced, silence_info
+        return {"status": "ok", "silenced": is_silenced(), "info": silence_info()}
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+

backend/routes/mobile_bridge_routes.py

@@ -209,6 +209,15 @@ async def link_status() -> dict[str, Any]:
         "detail": detail,
         "queued_commands": queued,
         "pc_status_age_seconds": age,
+        # Where the phone can reach the PC directly for VOICE.
+        #
+        # Commands need no address — the cloud relays them — but the voice
+        # cannot work that way: this Space has no RVC and no model weights, so
+        # only the PC can render it. Rather than make the user type an IP, the
+        # desktop advertises its own reachable addresses in its periodic status
+        # and they are handed straight through here, on the call the app already
+        # polls. Tailscale first, then LAN. Empty until a PC has reported.
+        "voice_hosts": status.get("voice_hosts") or [],
         "pc_status": status,
     }
 
@@ -357,6 +366,351 @@ def _gemini_envelope(text: str) -> dict[str, Any]:
     }
 
 
+async def _measure_live_state(context: dict[str, Any]) -> dict[str, Any]:
+    """The facts of this moment, measured rather than assumed.
+
+    Asked "is the PC connected?", the assistant used to answer from nothing at
+    all — the chat path sent the characterisation and the user's sentence and no
+    system state whatsoever — so it produced a confident "connected, sir" about a
+    machine that was switched off. Everything below is read live; anything that
+    cannot be read is reported as unknown rather than omitted, because a stated
+    unknown is far harder to confabulate over than a silent gap.
+    """
+    state: dict[str, Any] = {}
+
+    # PC link — the authoritative answer is whether a desktop is holding an
+    # outbound socket right now, not whether one was ever paired.
+    try:
+        from backend.ws.agent_ws import ws_manager
+        pcs = list(getattr(ws_manager, "pc_connections", []) or [])
+        state["PC connected right now"] = "yes" if pcs else "no - the PC is offline"
+        state["PC sockets held"] = len(pcs)
+    except Exception as exc:
+        log.debug("live state: pc link unreadable: %s", exc)
+        state["PC connected right now"] = "unknown - could not read the link"
+
+    try:
+        import datetime
+        state["current time"] = datetime.datetime.now().strftime("%Y-%m-%d %H:%M %Z").strip()
+    except Exception:
+        pass
+
+    for key, label in (
+        ("device_name", "operator device"),
+        ("surface", "which surface this came from"),
+        ("location", "operator location"),
+    ):
+        val = context.get(key)
+        if val:
+            state[label] = str(val)[:120]
+    state.setdefault("which surface this came from", "the phone app")
+
+    # The handset's own senses — where the operator is, what they are doing, who
+    # is around, whether speech would be overheard. SituationSensor.kt gathers
+    # these; anything it could not read is simply absent, never invented.
+    #
+    # This is the difference between an assistant that adapts to the situations
+    # somebody thought to enumerate and one that adapts to the situation actually
+    # occurring. The readings are raw on purpose: "ringer: vibrate, calendar
+    # event: standup, headphones: no" is evidence he reasons over, not a label
+    # like "in a meeting" decided for him by a table on the phone.
+    senses = context.get("senses")
+    if isinstance(senses, dict):
+        for key, val in senses.items():
+            if val not in (None, ""):
+                state[str(key)[:60]] = str(val)[:160]
+
+    # Held irreversible orders and unprompted work, when this process has them.
+    try:
+        from modules.deferred_intent import pending as _deferred_pending
+        held = _deferred_pending() or []
+        if held:
+            state["orders held pending deliberation"] = "; ".join(
+                str(o.get("order", ""))[:80] for o in held[:4]
+            )
+    except Exception:
+        pass
+    try:
+        from modules.initiative import pending_report as _init_pending
+        done = _init_pending() or []
+        if done:
+            state["things done unprompted, not yet reported"] = len(done)
+    except Exception:
+        pass
+
+    return state
+
+
+# Separate budgets, because they used to share one.
+#
+# Three rounds total meant a single PC run plus a single search exhausted the
+# turn, and the operator got the canned "I couldn't get to a straight answer"
+# even though nothing had failed. Real research is: search, read what came back,
+# search again for the specific thing. That is three searches minimum before a
+# word is said.
+_MAX_ROUNDS = 7      # hard stop on the whole turn
+_MAX_SEARCHES = 4    # web lookups per turn
+_MAX_PC_RUNS = 2     # desktop executions per turn
+
+
+async def _run_on_pc(task: str) -> str:
+    """Run an arbitrary task on the operator's desktop and report what happened.
+
+    Two routes, in order of directness. On the Space there is no desktop to run
+    on, so the work goes down the socket the PC holds open (the same path
+    /max_autonomy/task uses). Running in-process is correct when this backend IS
+    the desktop, which is how the exe serves it.
+
+    Irreversible steps are deliberated over and held with a cancel window inside
+    the executor itself, so nothing here needs to second-guess the request.
+    """
+    if not task:
+        return "No task given."
+
+    # In-process: this backend is the machine.
+    try:
+        from modules.omega_executor import execute as _execute
+        import asyncio as _asyncio
+        result = await _asyncio.to_thread(_execute, task)
+        steps = getattr(result, "steps", None) or []
+        lines = [f"{'ok' if getattr(s, 'ok', False) else 'FAILED'}: "
+                 f"{getattr(s, 'summary', '')}"[:180] for s in steps[:12]]
+        spoken = getattr(result, "spoken", "") or ""
+        return (spoken + "\n" + "\n".join(lines)).strip() or "Completed with no output."
+    except ImportError:
+        pass
+    except Exception as exc:
+        log.warning("in-process executor failed: %s", exc)
+        return f"The engine errored: {str(exc)[:300]}"
+
+    # Cloud: relay to whichever desktop is holding a socket open.
+    try:
+        from backend.ws.agent_ws import ws_manager
+        if not getattr(ws_manager, "pc_connections", None):
+            return ("The PC is offline, so there was nothing to run it on. "
+                    "It was not queued.")
+        outcome = await ws_manager.execute_on_pcs(task)
+        if not outcome.get("delivered"):
+            return "The PC did not accept the task."
+        if outcome.get("timed_out"):
+            return "The PC took the task and is still working on it."
+        said = outcome.get("spoken") or []
+        return "\n".join(str(s) for s in said)[:1500] or "Done, with no output reported."
+    except Exception as exc:
+        log.warning("PC relay failed: %s", exc)
+        return f"Could not reach the PC: {str(exc)[:200]}"
+
+# Readings that describe the operator's circumstances rather than the machine's.
+# Only these go in the preamble; battery and PC-link facts belong in LIVE STATE
+# where they can be quoted, not in the line that shapes how he answers.
+_CIRCUMSTANCE_KEYS = (
+    "local time", "part of day", "day", "roughly where", "moving",
+    "app in use", "screen", "in a calendar event right now", "event location",
+    "bluetooth connected", "ringer", "media playing",
+    "speaking aloud would be overheard", "wifi network",
+)
+
+
+def _situated(text: str, live: dict[str, Any]) -> str:
+    """Put the operator's circumstances immediately before their question.
+
+    LIVE STATE already carries these, at the end of a system prompt that runs to
+    a hundred and fifty lines of characterisation. That is enough for him to
+    QUOTE a reading when asked, and demonstrably not enough for him to ACT on
+    one: given 68 km/h and a car's bluetooth, he cheerfully began reciting a
+    multi-step server setup to a man at the wheel.
+
+    Attention follows recency far more than depth, so the same facts are
+    restated here, adjacent to the question, as the thing to think about first.
+    Same readings, no new claims — only a position that gets them used.
+    """
+    bits = [f"{k}: {v}" for k, v in live.items()
+            if k in _CIRCUMSTANCE_KEYS and v not in (None, "", "unknown")]
+    if not bits:
+        return text
+    return (
+        "RIGHT NOW, around the operator: " + "; ".join(bits) + ".\n"
+        "Work out what that means about what they are doing, what they can "
+        "actually use this second, and who can hear.\n"
+        "\n"
+        "DECIDE THE SHAPE OF YOUR ANSWER BEFORE YOU WRITE IT, NOT AFTER.\n"
+        "\n"
+        "If the circumstances mean they cannot use a long answer right now, then "
+        "the short answer IS the answer. Do not deliver the long one and then "
+        "remark that they cannot use it. Giving a man at the wheel four steps of "
+        "server configuration and closing with 'of course, you are driving' is "
+        "not judgement — it is the whole procedure plus an apology for it, and "
+        "he could not act on a word of it. What he needed was the one-line "
+        "answer and an offer to walk him through it when he is somewhere he can "
+        "type. Same for anything overheard: if it should not be said aloud here, "
+        "do not say it and then note that it was sensitive.\n"
+        "\n"
+        "Judge every time from the readings themselves — these are examples of "
+        "the reasoning, not a list of cases to match. Do not mention the "
+        "readings unless they are what was asked about.\n\n"
+        f"THEY SAID: {text}"
+    )
+
+
+def _history_block(history: list[Any]) -> str:
+    """The last few turns, as plain transcript.
+
+    Without this the endpoint is amnesiac: every POST carries one utterance and
+    no antecedent, so "download it" has no *it*. The handset has kept a six-turn
+    window for a long time — it was simply never sent (see MobileJarvisEngine,
+    where the request carrying it was built and then dropped on the floor).
+
+    A pronoun with nothing to bind to is the single most common way this
+    assistant looked stupid, and it was never a reasoning failure.
+    """
+    rows = []
+    for turn in history[-8:]:
+        if isinstance(turn, dict):
+            role = str(turn.get("role") or "user").strip().lower()
+            said = str(turn.get("text") or "").strip()
+        elif isinstance(turn, (list, tuple)) and len(turn) == 2:
+            role, said = str(turn[0]).strip().lower(), str(turn[1]).strip()
+        else:
+            continue
+        if not said:
+            continue
+        who = "THEY" if role in ("user", "operator", "human") else "YOU"
+        rows.append(f"{who}: {said[:600]}")
+    if not rows:
+        return ""
+    return (
+        "THE CONVERSATION SO FAR (oldest first). Pronouns in the new message — "
+        "'it', 'that', 'her', 'the same one' — almost always refer to something "
+        "here. Resolve them from this before doing anything else:\n"
+        + "\n".join(rows) + "\n\n"
+    )
+
+
+async def _run_lookup_loop(
+    text: str,
+    persona: str,
+    live: dict[str, Any],
+    history: list[Any] | None = None,
+) -> str:
+    """Ask, and honour a SEARCH: line by actually searching, then ask again.
+
+    This is what makes "who is <a real person>" answerable. Previously chat was a
+    bare model call with no way to reach the internet, so any question about
+    someone the model did not already know came back as "I can't find them" —
+    without a single lookup having been attempted. search_web already existed and
+    was wired to research and sentinel, never to conversation.
+
+    The decision to search is the model's, per turn, rather than a list of
+    question shapes that mean "search now" — a list would fail on the first shape
+    nobody thought of, which is the exact failure being fixed.
+    """
+    from backend.services.token_manager import gemini_call_with_checkpoint
+
+    # Everything learned this turn, oldest first, carried into every later round.
+    #
+    # This used to be a single `prompt` variable that each round OVERWROTE, so a
+    # second search silently erased the first one's results. Any request needing
+    # two steps — find the official page, then find the file on it — could not
+    # work: by the time he had the second answer he had lost the first. That is
+    # research reduced to one lucky query.
+    evidence: list[str] = []
+    asked = _situated(text, live)
+    if history:
+        asked = _history_block(history) + asked
+
+    def _compose() -> str:
+        if not evidence:
+            return asked
+        return (
+            "WHAT YOU HAVE ACTUALLY DONE AND FOUND SO FAR THIS TURN, in order:\n\n"
+            + "\n\n".join(evidence)
+            + "\n\nUse it. If it answers them, answer now and name what you found "
+            "— the real title, the real link, the real number. If it does not, "
+            "either search once more for the missing piece or tell them plainly "
+            "that you could not find it.\n\n"
+            "NEVER report something as done that you did not do, and never "
+            "describe a result you did not receive. 'I couldn't find it' is a "
+            "good answer. A confident invention is not.\n\n"
+            + asked
+        )
+
+    searches = 0
+    pc_runs = 0
+    for _ in range(_MAX_ROUNDS):
+        reply = (await gemini_call_with_checkpoint(
+            _compose(), task_type="general", persona=persona, live_state=live,
+            can_search=(searches < _MAX_SEARCHES), can_act=True, can_read=True,
+        ) or "").strip()
+
+        # READ is fulfilled on the PHONE, not here — only the handset can see its
+        # own screen, notifications, messages and clipboard. So a READ: reply is
+        # handed back verbatim; MobileJarvisEngine on the device performs the read
+        # and re-POSTs with the result. The cloud has no eyes on the phone and
+        # must not pretend to.
+        if reply.upper().startswith("READ:"):
+            return reply
+
+        # Hand the whole thing to the unlimited engine on the desktop.
+        #
+        # This is the escape hatch that makes "anything, including things nobody
+        # coded" true rather than aspirational: omega_executor plans a request
+        # into steps, runs shell, and writes fresh Python when no existing tool
+        # fits, repairing a failed step and retrying. The chat path had no idea
+        # it existed, so the assistant refused work his own machine could do.
+        if reply.upper().startswith("PC:"):
+            task = reply.split(":", 1)[1].strip()
+            if pc_runs >= _MAX_PC_RUNS:
+                evidence.append(
+                    f"You wanted the desktop to: {task}\nYou have already used the "
+                    "desktop as many times as this turn allows. Work with what you "
+                    "have, or say what is still missing.")
+                continue
+            pc_runs += 1
+            outcome = await _run_on_pc(task)
+            evidence.append(f"YOU RAN ON THE DESKTOP: {task}\nWHAT HAPPENED:\n{outcome}")
+            continue
+
+        if not reply.upper().startswith("SEARCH:"):
+            return reply
+
+        query = reply.split(":", 1)[1].strip()
+        if not query:
+            return reply
+        searches += 1
+        log.info("chat: assistant requested a lookup: %s", query[:120])
+        try:
+            from backend.tools.web_search_tools import search_web
+            found = await search_web(query, num_results=5)
+        except Exception as exc:
+            log.warning("chat lookup failed: %s", exc)
+            found = {"error": str(exc)[:200]}
+
+        if found.get("error"):
+            block = f"It failed: {found['error']}. You did NOT get any results."
+        else:
+            rows = found.get("results") or []
+            if not rows:
+                block = "It returned nothing. You did NOT find anything."
+            else:
+                block = "\n".join(
+                    f"- {r.get('title', '')}: {str(r.get('snippet') or r.get('body') or '')[:300]}"
+                    f" ({r.get('url') or r.get('link') or r.get('href') or ''})"
+                    for r in rows[:5]
+                )
+        evidence.append(f"YOU SEARCHED THE WEB FOR: {query}\nWHAT CAME BACK:\n{block}")
+
+    # Out of rounds. Rather than a canned apology, make one last call with
+    # everything gathered and no way to ask for more, so the operator gets the
+    # best answer the evidence supports instead of a shrug.
+    final = (await gemini_call_with_checkpoint(
+        _compose() + "\n\nYou are out of lookups. Answer them now from what you "
+        "have. If it is not enough, say exactly what you could not find.",
+        task_type="general", persona=persona, live_state=live,
+        can_search=False, can_act=True, can_read=False,
+    ) or "").strip()
+    return final or "I looked, but I couldn't get to a straight answer on that."
+
+
 @router.post("/chat")
 async def chat(request: Request) -> dict[str, Any]:
     """Synchronous LLM turn for the mobile app.
@@ -372,6 +726,15 @@ async def chat(request: Request) -> dict[str, Any]:
     This runs the prompt synchronously through the token manager's full
     Gemini→NVIDIA fallback chain and returns the Gemini envelope, so both callers
     work with no APK change.
+
+    THE PHONE'S BRAIN IS THIS FUNCTION. Everything the assistant is supposed to
+    have — situational judgement about how much to say, refusal to invent system
+    state, the ability to look something up — has to be here, because the desktop
+    brain in core/brain.py is a different process the handset never reaches. Work
+    put only into core/brain.py is, from the phone's point of view, not built.
+
+    The automation loop is exempt: it wants strict CLICK/INPUT/SCROLL/DONE tokens
+    and would be broken by conversational shaping or a lookup detour.
     """
     body = await _json_body(request)
     text = str(body.get("text") or "").strip()
@@ -381,9 +744,34 @@ async def chat(request: Request) -> dict[str, Any]:
         persona = "jarvis"
     if not text:
         return _gemini_envelope("Standing by.")
+
+    structured = bool(context.get("structured")) or str(context.get("mode") or "") == "automation"
+
     try:
         from backend.services.token_manager import gemini_call_with_checkpoint
-        reply = await gemini_call_with_checkpoint(text, task_type="general", persona=persona)
+        if structured:
+            reply = await gemini_call_with_checkpoint(text, task_type="automation", persona=persona)
+            return _gemini_envelope(reply or "")
+
+        live = await _measure_live_state(context)
+        raw_history = context.get("history")
+        history = raw_history if isinstance(raw_history, list) else []
+        reply = await _run_lookup_loop(text, persona, live, history)
+
+        # Spoken aloud on the handset: strip any markdown that survived the
+        # instruction not to write it.
+        #
+        # An action reply is JSON the app parses and executes, not speech, so it
+        # is passed through untouched — running a formatting filter over a
+        # payload would corrupt the very thing that carries out the request.
+        stripped = reply.lstrip()
+        is_action = stripped.startswith("{") and '"actions"' in stripped
+        if not is_action:
+            try:
+                from modules.assistant_identity import to_spoken
+                reply = to_spoken(reply)
+            except Exception:
+                pass
         return _gemini_envelope(reply or "")
     except Exception as exc:
         log.warning("mobile /api/chat LLM call failed: %s", exc)

backend/routes/persona_routes.py

@@ -52,13 +52,47 @@ async def get_persona():
 
 
 @router.get("/prompts")
-async def get_persona_prompts():
-    """Return the full system prompts for both personas (sanitised for UI display)."""
+async def get_persona_prompts(full: bool = False):
+    """The persona system prompts.
+
+    `full=true` returns them COMPLETE, including each persona's own tastes, and
+    that is the point of this route now rather than a nicety.
+
+    assistant_identity.py is meant to be the single source of truth for who the
+    assistant is. It is not, in practice: MobileJarvisEngine.kt carries its own
+    hardcoded Kotlin copy of the JARVIS characterisation, because an Android app
+    cannot import a Python module. Two copies of a personality drift — that is
+    exactly how core/brain.py ended up telling JARVIS he was FRIDAY on every
+    turn — and the phone's copy is the last one still able to drift.
+
+    Serving the real text lets the app FETCH the identity and cache it, so there
+    is one definition again. Truncating at 500 characters made that impossible,
+    which is why the app had a copy in the first place.
+    """
     try:
-        from modules.assistant_identity import JARVIS_PERSONALITY_PROMPT, FRIDAY_PERSONALITY_PROMPT
-        return {
-            "jarvis": JARVIS_PERSONALITY_PROMPT[:500] + "...",
-            "friday": FRIDAY_PERSONALITY_PROMPT[:500] + "...",
-        }
+        from modules.assistant_identity import (
+            JARVIS_PERSONALITY_PROMPT, FRIDAY_PERSONALITY_PROMPT,
+            get_identity_persona_prompt, get_mode, set_mode,
+        )
+        if not full:
+            return {
+                "jarvis": JARVIS_PERSONALITY_PROMPT[:500] + "...",
+                "friday": FRIDAY_PERSONALITY_PROMPT[:500] + "...",
+            }
+
+        # Composed exactly as every other consumer sees it — characterisation
+        # plus that persona's own tastes — so the phone gets the same identity
+        # the desktop brain and the backend agent get, not a subset.
+        original = get_mode()
+        out = {}
+        try:
+            for persona in ("jarvis", "friday"):
+                set_mode(persona)
+                out[persona] = get_identity_persona_prompt()
+        finally:
+            set_mode(original)
+
+        out["active"] = original
+        return out
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e))

backend/routes/token_task_routes.py

@@ -0,0 +1,94 @@
+"""backend/routes/token_task_routes.py — the token manager, reachable by the phone.
+
+WHY THE PHONE MUST NOT HOLD THE KEYS
+------------------------------------
+backend/services/token_manager.py routes each kind of work to its own API key
+domain — OSINT_PROTOCOL_PC, RESEARCH_ENGINE, IMAGE_GENERATION_CLOUD and the
+rest — so that one feature exhausting its quota cannot take the others down
+with it. It also tracks exhausted keys, recovers them on a refresh monitor, and
+checkpoints long tasks so they can resume.
+
+The phone has none of that. MobileJarvisEngine.kt calls Gemini directly with a
+single BuildConfig.GEMINI_API_KEY, which means: one key, no domain isolation,
+no rotation, no recovery — and the key is compiled into the APK.
+
+The fix is NOT to ship 37 keys to the handset. An APK carrying the master
+credentials is personal-only and can never be distributed; it also puts every
+key on a device that can be lost. Instead the phone asks the backend to do the
+work, and the backend applies the full key strategy on its behalf. The handset
+holds one scoped bearer token; the vault stays where it is.
+
+This route is the door. It is deliberately thin: all the intelligence already
+exists in token_manager.
+"""
+
+from typing import Optional
+
+from fastapi import APIRouter, HTTPException
+from pydantic import BaseModel
+
+router = APIRouter()
+
+
+class TaskRequest(BaseModel):
+    prompt: str
+    # Selects the key DOMAIN, not the model. "osint" routes to the OSINT
+    # protocol keys, "research" to the research engine keys, and so on, which
+    # is the whole point of asking the backend rather than calling Gemini
+    # directly from the phone.
+    task_type: str = "general"
+    persona: str = "jarvis"
+
+
+class TaskResponse(BaseModel):
+    status: str
+    result: str
+    task_type: str
+    persona: str
+
+
+@router.post("/task", response_model=TaskResponse)
+async def run_token_task(req: TaskRequest) -> TaskResponse:
+    """Run a prompt through the token manager, with domain-appropriate keys."""
+    prompt = (req.prompt or "").strip()
+    if not prompt:
+        raise HTTPException(status_code=400, detail="prompt is required")
+
+    try:
+        from backend.services.token_manager import run_task
+        result = await run_task(
+            prompt=prompt,
+            task_type=(req.task_type or "general").strip().lower(),
+            persona=(req.persona or "jarvis").strip().lower(),
+        )
+        return TaskResponse(
+            status="ok",
+            result=result or "",
+            task_type=req.task_type,
+            persona=req.persona,
+        )
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))
+
+
+@router.get("/key_status")
+async def key_status() -> dict:
+    """What the pool looks like right now — counts only, never key material.
+
+    Useful from the phone precisely because the phone cannot see the vault: it
+    is the only way to tell "the feature is broken" from "that domain's quota
+    is spent and will recover".
+    """
+    try:
+        from backend.services import token_manager as tm
+        pool = getattr(tm, "GOOGLE_API_KEYS", {}) or {}
+        exhausted = getattr(tm, "EXHAUSTED_GOOGLE_KEYS", set()) or set()
+        return {
+            "status": "ok",
+            "domains_loaded": len(pool),
+            "domains": sorted(pool.keys()),
+            "exhausted_count": len(exhausted),
+            "healthy_count": max(0, len(pool) - len(exhausted)),
+        }
+    except Exception as e:
+        raise HTTPException(status_code=500, detail=str(e))

backend/services/token_manager.py

@@ -1,669 +1,720 @@
-# backend/services/token_manager.py
-"""
-OMEGA Token Limit Checkpoint & Resume System
-
-When any Gemini 3.5 Flash call hits a ResourceExhausted (429) token limit:
-  1. Saves the EXACT task state + all partial output generated so far to SQLite
-  2. Launches a background monitor that probes the API every 60s until tokens refresh
-  3. On refresh, resumes the task from the EXACT LAST WORD — not from the beginning
-
-All Gemini call sites (research, auto_upgrade, captcha, gate check) use
-gemini_call_with_checkpoint() instead of calling the API directly.
-"""
-
-import asyncio
-import logging
-import os
-import sqlite3
-import time
-import uuid
-from typing import Optional
-
-import google.generativeai as genai
-
-from backend.services.usb_vault import KeyDomain, resolve_vault_key
-
-def get_runtime_location() -> str:
-    return "cloud" if os.environ.get("SPACE_ID") else "pc"
-
-# Only the conversational path should be shaped in the assistant's voice.
-# Structured task types (blueprint JSON, code implementation, research digests,
-# captcha/osint payloads) must stay clean — a "You are JARVIS…" preamble there
-# corrupts JSON/code output.
-_PERSONA_TASK_TYPES = {"general", "gaming"}
-
-def _persona_system_prompt(persona: str, task_type: str = "general") -> str:
-    """The identity prompt for the EXPLICITLY requested persona.
-
-    The mobile app (and other callers) pass the persona they want per-turn, so
-    we select on that string directly rather than the persisted global mode.
-    Without this, conversational LLM replies carry no JARVIS/FRIDAY character —
-    the identity file that is supposed to be the source of truth was being
-    ignored on the primary /api/chat path. Returns "" for non-conversational
-    task types so structured output is never polluted.
-    """
-    if task_type not in _PERSONA_TASK_TYPES:
-        return ""
-    try:
-        from modules.assistant_identity import (
-            JARVIS_PERSONALITY_PROMPT, FRIDAY_PERSONALITY_PROMPT,
-        )
-        p = (persona or "jarvis").strip().lower()
-        return JARVIS_PERSONALITY_PROMPT if p == "jarvis" else FRIDAY_PERSONALITY_PROMPT
-    except Exception:
-        return ""
-
-# Load all 15 keys into the token manager pool
-GOOGLE_API_KEYS = {}
-try:
-    for domain in KeyDomain:
-        try:
-            key_val = resolve_vault_key(domain)
-            if key_val:
-                GOOGLE_API_KEYS[domain.value] = key_val
-        except Exception:
-            continue
-            
-    if get_runtime_location() == "cloud":
-        GEMINI_API_KEY = GOOGLE_API_KEYS.get(KeyDomain.CLOUD.value, "")
-    else:
-        GEMINI_API_KEY = GOOGLE_API_KEYS.get(KeyDomain.CHAT.value, "")
-        
-    if GEMINI_API_KEY:
-        genai.configure(api_key=GEMINI_API_KEY)
-    else:
-        logging.warning("TokenManager: Default API Key is empty.")
-        
-    logging.info(f"TokenManager: Successfully loaded {len(GOOGLE_API_KEYS)} Google/Gemini API keys into the rotation pool.")
-except Exception as e:
-    logging.warning(f"TokenManager: API Key initialization failed: {e}")
-    GEMINI_API_KEY = ""
-
-EXHAUSTED_GOOGLE_KEYS = set()
-# Measured live against a real key, 2026-07-21:
-#   gemini-3.5-flash        HTTP 503  "currently experiencing high demand"  <- was set here
-#   gemini-2.0-flash        HTTP 429  free-tier request cap
-#   gemini-2.5-flash-lite   HTTP 404  retired
-#   gemini-3-flash-preview  OK but 35.5s
-#   gemini-3.1-flash-lite   OK in 1.1s, correct answer          <- chosen
-#
-# The 503 is Google-side capacity, NOT quota consumption: these keys were unused
-# for weeks. Because the primary model always failed, every request fell through
-# to the NVIDIA tier — which is why chat worked at all, and why research paid for
-# a doomed Gemini attempt before doing any real work.
-MODEL = "gemini-3.1-flash-lite"
-
-# Google-side model cascade, mirroring the NVIDIA tier cascade in nvidia_vault.
-#
-# A single hardcoded model is fragile in exactly two ways this system has already
-# been bitten by: the model gets retired (gemini-2.5-flash-lite -> 404) or it hits
-# Google-side capacity (gemini-3.5-flash -> 503 "high demand"). Neither means the
-# KEY is bad, and neither should cost a drop to the fallback tier — another
-# Gemini model is usually fine right now.
-#
-# Ordered by what was measured live 2026-07-21 against a real key:
-#   gemini-3.1-flash-lite    OK, 1.1s, correct answer   <- best right now
-#   gemini-3.5-flash         503 today, but transient — capacity comes and goes
-#   gemini-3-flash-preview   OK but 35.5s
-#   gemini-2.0-flash         429 free-tier cap today
-# The list is tried in order on any transient failure, and only when every entry
-# fails does the request drop to the NVIDIA tier.
-GEMINI_MODEL_CASCADE = [
-    MODEL,
-    "gemini-3.5-flash",
-    "gemini-3-flash-preview",
-    "gemini-2.5-flash",
-    "gemini-2.0-flash",
-]
-
-
-def _is_transient_error(err_str: str) -> bool:
-    """Transient upstream failure — worth trying another model/tier."""
-    return any(t in err_str for t in (
-        "resourceexhausted", "429", "quota", "rate limit", "too many requests",
-        "503", "500", "high demand", "overloaded", "unavailable",
-        "internal error", "deadline", "timeout", "404", "not found",
-        "no longer available",
-    ))
-
-# ─────────────────────────────────────────────────────────────────────────────
-# DB Helpers
-# ─────────────────────────────────────────────────────────────────────────────
-
-from backend.services.usb_monitor import get_db_path
-
-
-def _init_checkpoint_table():
-    """Ensure token_checkpoints table exists in memory.db."""
-    try:
-        with sqlite3.connect(get_db_path()) as conn:
-            conn.execute("PRAGMA journal_mode=WAL")
-            conn.execute("""
-                CREATE TABLE IF NOT EXISTS token_checkpoints (
-                    id TEXT PRIMARY KEY,
-                    task_type TEXT NOT NULL,
-                    original_prompt TEXT NOT NULL,
-                    partial_result TEXT DEFAULT '',
-                    last_word TEXT DEFAULT '',
-                    status TEXT DEFAULT 'pending_resume',
-                    created_at INTEGER,
-                    resumed_at INTEGER,
-                    completed_at INTEGER,
-                    retry_count INTEGER DEFAULT 0,
-                    persona TEXT DEFAULT 'jarvis'
-                )
-            """)
-            conn.commit()
-    except Exception as e:
-        logging.error(f"TokenManager: Failed to init checkpoint table: {e}")
-
-
-_init_checkpoint_table()
-
-
-def _save_checkpoint(task_id: str, task_type: str, prompt: str,
-                     partial: str, last_word: str, persona: str = "jarvis"):
-    try:
-        with sqlite3.connect(get_db_path()) as conn:
-            conn.execute("PRAGMA journal_mode=WAL")
-            conn.execute("""
-                INSERT OR REPLACE INTO token_checkpoints
-                (id, task_type, original_prompt, partial_result, last_word,
-                 status, created_at, persona)
-                VALUES (?,?,?,?,?,'pending_resume',?,?)
-            """, (task_id, task_type, prompt, partial, last_word,
-                  int(time.time()), persona))
-            conn.commit()
-        logging.warning(f"TokenManager: Checkpoint saved [{task_type}:{task_id}] last_word='{last_word}'")
-    except Exception as e:
-        logging.error(f"TokenManager: Failed to save checkpoint: {e}")
-
-
-def _mark_checkpoint_resumed(task_id: str):
-    try:
-        with sqlite3.connect(get_db_path()) as conn:
-            conn.execute(
-                "UPDATE token_checkpoints SET status='resumed', resumed_at=? WHERE id=?",
-                (int(time.time()), task_id)
-            )
-            conn.commit()
-    except Exception as e:
-        logging.error(f"TokenManager: Failed to mark resumed: {e}")
-
-
-def _mark_checkpoint_complete(task_id: str):
-    try:
-        with sqlite3.connect(get_db_path()) as conn:
-            conn.execute(
-                "UPDATE token_checkpoints SET status='complete', completed_at=? WHERE id=?",
-                (int(time.time()), task_id)
-            )
-            conn.commit()
-    except Exception as e:
-        logging.error(f"TokenManager: Failed to mark complete: {e}")
-
-
-def _get_pending_checkpoints() -> list:
-    try:
-        with sqlite3.connect(get_db_path()) as conn:
-            conn.row_factory = sqlite3.Row
-            rows = conn.execute(
-                "SELECT * FROM token_checkpoints WHERE status='pending_resume' ORDER BY created_at ASC"
-            ).fetchall()
-            return [dict(r) for r in rows]
-    except Exception as e:
-        logging.error(f"TokenManager: Failed to fetch pending checkpoints: {e}")
-        return []
-
-
-# ─────────────────────────────────────────────────────────────────────────────
-# Core Gemini Call — with auto checkpoint on 429
-# ─────────────────────────────────────────────────────────────────────────────
-
-def _extract_last_word(text: str) -> str:
-    """Return the very last word of the partial output for precise resume anchoring."""
-    if not text:
-        return ""
-    words = text.strip().split()
-    return words[-1] if words else ""
-
-
-def _build_resume_prompt(original_prompt: str, partial_result: str, last_word: str) -> str:
-    """
-    Construct a continuation prompt so Gemini resumes from the EXACT last word.
-    """
-    if not partial_result:
-        return original_prompt
-    return (
-        f"{original_prompt}\n\n"
-        f"---OMEGA RESUME INSTRUCTION---\n"
-        f"You were previously generating a response and hit a token limit mid-way.\n"
-        f"The partial output generated so far ended with the word: '{last_word}'\n"
-        f"Here is the partial output so far:\n\n{partial_result}\n\n"
-        f"Continue EXACTLY from where you left off. "
-        f"Do NOT repeat any of the partial output above. "
-        f"Start your response from the word that comes AFTER '{last_word}'."
-    )
-
-
-def _get_key_for_task(task_type: str) -> str:
-    from backend.services.usb_vault import KeyDomain, resolve_vault_key
-    location = get_runtime_location()
-    
-    if task_type == "research":
-        return resolve_vault_key(KeyDomain.RESEARCH_ENGINE)
-    elif task_type == "captcha":
-        return resolve_vault_key(KeyDomain.CAPTCHA_SOLVER_CLOUD if location == "cloud" else KeyDomain.CAPTCHA_SOLVER_PC)
-    elif task_type == "implement":
-        return resolve_vault_key(KeyDomain.AUTO_UPGRADE_CLOUD if location == "cloud" else KeyDomain.AUTO_UPGRADE_PC)
-    elif task_type == "osint":
-        return resolve_vault_key(KeyDomain.OSINT_PROTOCOL_CLOUD if location == "cloud" else KeyDomain.OSINT_PROTOCOL_PC)
-    elif task_type == "image":
-        return resolve_vault_key(KeyDomain.IMAGE_GENERATION_CLOUD if location == "cloud" else KeyDomain.IMAGE_GENERATION_PC)
-    elif task_type == "gaming":
-        return resolve_vault_key(KeyDomain.GAMING_COACH)
-    elif task_type == "supervisor":
-        return resolve_vault_key(KeyDomain.SUPERVISOR_HEAL_CLOUD if location == "cloud" else KeyDomain.SUPERVISOR_HEAL_PC)
-    elif task_type == "cloud_sync":
-        return resolve_vault_key(KeyDomain.CLOUD_SYNC_DOMAIN)
-    else:
-        return resolve_vault_key(KeyDomain.CLOUD if location == "cloud" else KeyDomain.CHAT)
-
-def _broadcast_live_key_status(ecosystem: str, model: str, status: str):
-    """Safely fire WS broadcast from synchronous threads"""
-    payload = {
-        "event": "live_key_status",
-        "payload": {
-            "active_ecosystem": ecosystem,
-            "active_model": model,
-            "status": status
-        }
-    }
-    try:
-        from backend.ws.agent_ws import ws_manager
-        loop = asyncio.get_running_loop()
-        loop.create_task(ws_manager.broadcast(payload))
-    except RuntimeError:
-        pass # No loop running in this thread
-
-def _nvidia_fallback_call_sync(prompt: str, task_id: str, task_type: str, partial_so_far: str, persona: str) -> str:
-    """Fallback to NVIDIA Vault Models."""
-    _broadcast_live_key_status("NVIDIA", "glm-5.1", "fallback_mode")
-    
-    from backend.services.memory_service import GlobalOmniMemory
-    omni_context = GlobalOmniMemory.get_global_context_stream()
-    
-    # Construct exact prompt with resume logic and hive mind context
-    actual_prompt = _build_resume_prompt(prompt, partial_so_far, _extract_last_word(partial_so_far))
-    if not partial_so_far:
-        # NVIDIA models take no separate system channel here, so the persona
-        # prompt is prepended (same place the hive-mind context goes).
-        _sys = _persona_system_prompt(persona, task_type)
-        actual_prompt = (_sys + "\n\n" if _sys else "") + omni_context + actual_prompt
-
-    # Delegate to the NVIDIA Vault API directly
-    from backend.services.nvidia_vault import call_nvidia_model, NvidiaModel
-    # GLM is the intended head of the heavy-compute fallback tier. call_nvidia_model
-    # already cascades from here through the rest of that tier (MiniMax, DeepSeek,
-    # Nemotron-Ultra) with up to 3 key-failovers per model, so a single slow or
-    # unavailable model does not strand the request.
-    #
-    # Only the model ID changed: "z-ai/glm-5.1" was retired upstream and returned
-    # HTTP 410 on all 15 keys, which wasted the first attempt of every heavy-tier
-    # call. It is now glm-5.2.
-    fallback_response = call_nvidia_model(actual_prompt, NvidiaModel.GLM_5_2)
-    
-    # Record what NVIDIA just did to the Hive Mind
-    GlobalOmniMemory.record_action("NVIDIA", "glm-5.1", task_type, fallback_response[:100].replace('\n', ' ') + "...")
-    
-    combined = partial_so_far + fallback_response
-    _mark_checkpoint_complete(task_id)
-    return combined
-
-def _gemini_call_sync(prompt: str, task_id: str, task_type: str,
-                      partial_so_far: str = "", persona: str = "jarvis") -> str:
-    key = _get_key_for_task(task_type)
-    
-    # 1. If we know it's exhausted, fallback immediately
-    if key in EXHAUSTED_GOOGLE_KEYS:
-        logging.info(f"TokenManager: Google Key exhausted. Routing {task_type} instantly to NVIDIA Fallback.")
-        return _nvidia_fallback_call_sync(prompt, task_id, task_type, partial_so_far, persona)
-        
-    genai.configure(api_key=key)
-    _broadcast_live_key_status("GOOGLE", MODEL, "primary_active")
-
-    from backend.services.memory_service import GlobalOmniMemory
-    omni_context = GlobalOmniMemory.get_global_context_stream()
-
-    # Shape the reply in the active assistant's voice (JARVIS/FRIDAY). Skip on a
-    # resume continuation so we don't restate the persona mid-sentence.
-    _sys = _persona_system_prompt(persona, task_type) if not partial_so_far else None
-    actual_prompt = _build_resume_prompt(prompt, partial_so_far, _extract_last_word(partial_so_far))
-    if not partial_so_far:
-        actual_prompt = omni_context + actual_prompt
-
-    # Walk the Gemini cascade before considering the NVIDIA tier. A model that is
-    # retired or momentarily at capacity must not cost the whole Google side —
-    # the next model in the list is usually healthy.
-    last_exc = None
-    for attempt_model in GEMINI_MODEL_CASCADE:
-        try:
-            model = (genai.GenerativeModel(attempt_model, system_instruction=_sys)
-                     if _sys else genai.GenerativeModel(attempt_model))
-            response = model.generate_content(actual_prompt)
-            new_text = response.text or ""
-
-            if attempt_model != MODEL:
-                logging.warning("TokenManager: primary model unavailable; served by %s", attempt_model)
-            _broadcast_live_key_status("GOOGLE", attempt_model, "primary_active")
-
-            # Record what Google just did to the Hive Mind
-            GlobalOmniMemory.record_action("GOOGLE", attempt_model, task_type,
-                                           new_text[:100].replace('\n', ' ') + "...")
-
-            combined = partial_so_far + new_text
-            _mark_checkpoint_complete(task_id)
-            return combined
-        except Exception as exc:
-            last_exc = exc
-            if _is_transient_error(str(exc).lower()):
-                logging.info("TokenManager: %s unavailable (%s); trying next Gemini model.",
-                             attempt_model, str(exc)[:70])
-                continue
-            raise
-
-    # Every Gemini model failed — fall through to the original handling, which
-    # decides between key-exhaustion bookkeeping and the NVIDIA tier.
-    try:
-        raise last_exc
-    except Exception as e:
-        err_str = str(e).lower()
-        # Any TRANSIENT upstream failure should fall back to NVIDIA, not just a
-        # quota error. This previously matched 429/quota only, so a Google-side
-        # capacity 503 ("This model is currently experiencing high demand" — which
-        # gemini-3.5-flash returns constantly) fell through to `raise` and killed
-        # the request outright, never reaching the NVIDIA tier that exists for
-        # exactly this situation.
-        is_rate_limit = (
-            "resourceexhausted" in err_str
-            or "429" in err_str
-            or "quota" in err_str
-            or "rate limit" in err_str
-            or "too many requests" in err_str
-            # Google-side capacity / availability, not our usage:
-            or "503" in err_str
-            or "500" in err_str
-            or "high demand" in err_str
-            or "overloaded" in err_str
-            or "unavailable" in err_str
-            or "internal error" in err_str
-            or "deadline" in err_str
-            or "timeout" in err_str
-        )
-        # A capacity/availability failure is the MODEL's problem, not the key's.
-        # Blacklisting the key for a 503 would permanently route a perfectly
-        # healthy credential to the fallback tier — so only real quota errors
-        # mark a key exhausted. Both still fall back to NVIDIA.
-        is_key_exhausted = (
-            "resourceexhausted" in err_str
-            or "429" in err_str
-            or "quota" in err_str
-            or "rate limit" in err_str
-            or "too many requests" in err_str
-        )
-        if is_rate_limit:
-            logging.warning(
-                "TokenManager: transient upstream failure for [%s:%s] (%s). Triggering NVIDIA Fallback.",
-                task_type, task_id, "quota" if is_key_exhausted else "capacity/503",
-            )
-            if not is_key_exhausted:
-                # Model-side outage: keep the key healthy, just serve this request
-                # from the fallback tier.
-                return _nvidia_fallback_call_sync(prompt, task_id, task_type, partial_so_far, persona)
-            # 2. Add to exhausted pool
-            if key not in EXHAUSTED_GOOGLE_KEYS:
-                EXHAUSTED_GOOGLE_KEYS.add(key)
-                
-                # We can't spawn an async task cleanly from a sync thread without a loop, 
-                # so we will raise a special exception that the async wrapper catches to spawn the pinger.
-                raise _Google429Trigger(key=key, prompt=prompt, task_id=task_id, task_type=task_type, partial_so_far=partial_so_far, persona=persona)
-            
-            return _nvidia_fallback_call_sync(prompt, task_id, task_type, partial_so_far, persona)
-        raise
-
-class _Google429Trigger(Exception):
-    def __init__(self, key, prompt, task_id, task_type, partial_so_far, persona):
-        self.key = key
-        self.prompt = prompt
-        self.task_id = task_id
-        self.task_type = task_type
-        self.partial_so_far = partial_so_far
-        self.persona = persona
-
-TokenLimitHit = _Google429Trigger
-
-async def gemini_call_with_checkpoint(
-    prompt: str,
-    task_type: str = "general",
-    persona: str = "jarvis",
-    task_id: Optional[str] = None,
-    partial_so_far: str = ""
-) -> str:
-    """
-    Universal Gemini 3.5 Flash call with automatic checkpoint & resume.
-    """
-    if task_id is None:
-        task_id = str(uuid.uuid4())
-    
-    try:
-        return await asyncio.to_thread(
-            _gemini_call_sync, prompt, task_id, task_type, partial_so_far, persona
-        )
-    except _Google429Trigger as e:
-        # 1. Start the token refresh monitor loop
-        asyncio.create_task(start_token_refresh_monitor())
-        # 2. Immediately complete THIS task using NVIDIA fallback
-        return await asyncio.to_thread(
-            _nvidia_fallback_call_sync, e.prompt, e.task_id, e.task_type, e.partial_so_far, e.persona
-        )
-
-# For backward compatibility where 'run_task' is imported from token_manager
-async def run_task(prompt: str, task_type: str = "general", persona: str = "jarvis") -> str:
-    return await gemini_call_with_checkpoint(prompt, task_type, persona)
-
-
-# ─────────────────────────────────────────────────────────────────────────────
-# Background Cloud Monitor — polls until tokens refresh then resumes
-# ─────────────────────────────────────────────────────────────────────────────
-
-_monitor_running = False
-
-async def start_token_refresh_monitor():
-    """
-    Background loop that:
-      1. Checks for pending_resume checkpoints every 60s
-      2. Probes Gemini with a minimal token-cost ping
-      3. When the probe succeeds, resumes ALL pending tasks from their exact last word
-      4. Broadcasts omega:task_resumed WS event for each resumed task
-    """
-    global _monitor_running
-    if _monitor_running:
-        return
-    _monitor_running = True
-    logging.info("TokenManager: Token refresh monitor STARTED.")
-
-    while _monitor_running:
-        try:
-            pending = _get_pending_checkpoints()
-            
-            # We must probe if there are pending checkpoints OR if we have exhausted keys that need refreshing
-            if pending or EXHAUSTED_GOOGLE_KEYS:
-                if pending:
-                    logging.info(f"TokenManager: {len(pending)} checkpoint(s) pending resume. Probing API...")
-                else:
-                    logging.info("TokenManager: No checkpoints, but EXHAUSTED_GOOGLE_KEYS has entries. Probing API...")
-                
-                # Lightweight probe — minimal cost
-                # Check each exhausted key independently
-                keys_to_probe = list(EXHAUSTED_GOOGLE_KEYS) if EXHAUSTED_GOOGLE_KEYS else [_get_key_for_task("general")]
-                recovered_keys = []
-                
-                for key in keys_to_probe:
-                    try:
-                        genai.configure(api_key=key)
-                        model = genai.GenerativeModel(MODEL)
-                        model.generate_content("ping")
-                        recovered_keys.append(key)
-                    except Exception as probe_err:
-                        err_str = str(probe_err).lower()
-                        if "resourceexhausted" in err_str or "429" in err_str or "quota" in err_str:
-                            pass # Still exhausted
-                        else:
-                            logging.error(f"TokenManager: Probe error on key: {probe_err}")
-
-                if not recovered_keys and keys_to_probe:
-                    logging.warning("TokenManager: API still exhausted. Will retry in 60s.")
-
-                if recovered_keys:
-                    logging.info(f"TokenManager: API Probe OK for {len(recovered_keys)} keys. Clearing them from EXHAUSTED_GOOGLE_KEYS.")
-                    for k in recovered_keys:
-                        if k in EXHAUSTED_GOOGLE_KEYS:
-                            EXHAUSTED_GOOGLE_KEYS.remove(k)
-                    
-                    if pending:
-                        # Resume all pending checkpoints now that some keys are refreshed
-                        for checkpoint in pending:
-                            asyncio.create_task(_resume_checkpoint(checkpoint))
-
-        except Exception as e:
-            logging.error(f"TokenManager: Monitor loop error: {e}")
-
-        await asyncio.sleep(60)
-
-    logging.info("TokenManager: Token refresh monitor STOPPED.")
-
-
-async def _resume_checkpoint(checkpoint: dict):
-    """Resume a single checkpoint from its exact last word."""
-    task_id = checkpoint["id"]
-    task_type = checkpoint["task_type"]
-    original_prompt = checkpoint["original_prompt"]
-    partial = checkpoint["partial_result"] or ""
-    last_word = checkpoint["last_word"] or ""
-    persona = checkpoint.get("persona", "jarvis")
-
-    logging.info(f"TokenManager: Resuming [{task_type}:{task_id}] from last_word='{last_word}'")
-    _mark_checkpoint_resumed(task_id)
-
-    try:
-        # Broadcast WS notification
-        from backend.ws.agent_ws import ws_manager
-        await ws_manager.broadcast({
-            "event": "omega:task_resuming",
-            "payload": {
-                "task_id": task_id,
-                "task_type": task_type,
-                "last_word": last_word,
-                "message": (
-                    f"Token limit has refreshed, sir. Resuming {task_type} task from exactly '{last_word}'..."
-                    if persona == "jarvis" else
-                    f"We're back boss! Tokens refreshed — resuming {task_type} from exactly '{last_word}'!"
-                )
-            }
-        })
-
-        # Re-run the Gemini call from exact checkpoint
-        result = await gemini_call_with_checkpoint(
-            prompt=original_prompt,
-            task_type=task_type,
-            persona=persona,
-            task_id=task_id,
-            partial_so_far=partial
-        )
-
-        _mark_checkpoint_complete(task_id)
-
-        # Route result back to its originating system
-        await _dispatch_resumed_result(task_type, task_id, result, persona, checkpoint)
-
-        await ws_manager.broadcast({
-            "event": "omega:task_resumed",
-            "payload": {
-                "task_id": task_id,
-                "task_type": task_type,
-                "message": (
-                    f"{task_type.title()} task completed after token refresh, sir."
-                    if persona == "jarvis" else
-                    f"Done boss! {task_type.title()} task finished after the token refresh!"
-                )
-            }
-        })
-
-    except TokenLimitHit:
-        # Still throttled — will retry next monitor cycle
-        logging.warning(f"TokenManager: Still throttled on resume for [{task_id}]. Reverting to pending_resume.")
-        try:
-            with sqlite3.connect(get_db_path()) as conn:
-                conn.execute(
-                    "UPDATE token_checkpoints SET status='pending_resume', retry_count=retry_count+1 WHERE id=?",
-                    (task_id,)
-                )
-                conn.commit()
-        except Exception as e:
-            # No local `import logging` — it would shadow the module import for
-            # the whole of _resume_checkpoint() and break the logging calls above.
-            logging.getLogger(__name__).error(f"Swallowed exception: {e}")
-    except Exception as e:
-        logging.error(f"TokenManager: Resume error for [{task_id}]: {e}")
-
-
-async def _dispatch_resumed_result(task_type: str, task_id: str,
-                                   result: str, persona: str, checkpoint: dict):
-    """Route the completed result back to the correct subsystem."""
-    try:
-        if task_type == "research":
-            # Re-parse the JSON research note and save it
-            import json
-            from backend.omega.research_engine import ResearchNote, ResearchCategory, _save_research_note
-            raw = result.strip().strip("```json").strip("```").strip()
-            data = json.loads(raw)
-            raw_category = data.get("category", "Research Notes")
-            valid_categories = {c.value: c for c in ResearchCategory}
-            category = valid_categories.get(raw_category, ResearchCategory.RESEARCH_NOTES)
-            note = ResearchNote(
-                title=data.get("title", "Resumed Research"),
-                summary=data.get("summary", result[:500]),
-                importance=data.get("importance", "MEDIUM"),
-                category=category,
-                source=data.get("source", "Gemini 3.5 Flash (resumed)"),
-                recommended_action=data.get("recommended_action", "")
-            )
-            _save_research_note(note)
-            logging.info(f"TokenManager: Research note saved after resume: {note.title}")
-
-        elif task_type == "implement":
-            # Re-parse code blocks and hot-reload them
-            from backend.omega.auto_upgrade import parse_code_blocks, write_and_hot_reload, log_upgrade_to_db
-            code_blocks = parse_code_blocks(result)
-            files_modified = []
-            for block in code_blocks:
-                await write_and_hot_reload(block.filepath, block.code)
-                files_modified.append(block.filepath)
-            log_upgrade_to_db(
-                checkpoint.get("original_prompt", "Resumed task")[:60],
-                files_modified, persona, "success_after_resume"
-            )
-            logging.info(f"TokenManager: Implementation resumed and hot-reloaded: {files_modified}")
-
-        else:
-            # For gate/captcha/monitor tasks, just log the full result
-            logging.info(f"TokenManager: [{task_type}] resumed result stored (length={len(result)})")
-
-    except Exception as e:
-        logging.error(f"TokenManager: dispatch_resumed_result error for [{task_type}]: {e}")
-
-
-def stop_token_refresh_monitor():
-    global _monitor_running
-    _monitor_running = False
-    logging.info("TokenManager: Token refresh monitor signalled to stop.")
+# backend/services/token_manager.py
+"""
+OMEGA Token Limit Checkpoint & Resume System
+
+When any Gemini 3.5 Flash call hits a ResourceExhausted (429) token limit:
+  1. Saves the EXACT task state + all partial output generated so far to SQLite
+  2. Launches a background monitor that probes the API every 60s until tokens refresh
+  3. On refresh, resumes the task from the EXACT LAST WORD — not from the beginning
+
+All Gemini call sites (research, auto_upgrade, captcha, gate check) use
+gemini_call_with_checkpoint() instead of calling the API directly.
+"""
+
+import asyncio
+import logging
+import os
+import sqlite3
+import time
+import uuid
+from typing import Optional
+
+import google.generativeai as genai
+
+from backend.services.usb_vault import KeyDomain, resolve_vault_key
+
+def get_runtime_location() -> str:
+    return "cloud" if os.environ.get("SPACE_ID") else "pc"
+
+# Only the conversational path should be shaped in the assistant's voice.
+# Structured task types (blueprint JSON, code implementation, research digests,
+# captcha/osint payloads) must stay clean — a "You are JARVIS…" preamble there
+# corrupts JSON/code output.
+_PERSONA_TASK_TYPES = {"general", "gaming"}
+
+def _persona_system_prompt(persona: str, task_type: str = "general",
+                           live_state: Optional[dict] = None,
+                           can_search: bool = False,
+                           can_act: bool = False,
+                           can_read: bool = False) -> str:
+    """The identity prompt for the EXPLICITLY requested persona.
+
+    The mobile app (and other callers) pass the persona they want per-turn, so
+    we select on that string directly rather than the persisted global mode.
+    Without this, conversational LLM replies carry no JARVIS/FRIDAY character —
+    the identity file that is supposed to be the source of truth was being
+    ignored on the primary /api/chat path. Returns "" for non-conversational
+    task types so structured output is never polluted.
+
+    It now composes the FULL identity — characterisation, tastes, behavioural
+    judgement and measured live state — rather than the characterisation alone.
+    Serving only the characterisation is what produced a JARVIS who opened every
+    reply with "at your service", wrote markdown asterisks into speech, and
+    announced the PC was connected while it was powered off: he had the
+    personality of the character and none of his situational sense, and no facts
+    at all. compose_identity() is shared with the desktop brain so the two
+    cannot drift apart again.
+    """
+    if task_type not in _PERSONA_TASK_TYPES:
+        return ""
+    try:
+        from modules.assistant_identity import compose_identity
+        return compose_identity(persona=persona, live_state=live_state,
+                                can_search=can_search, can_act=can_act, can_read=can_read)
+    except Exception:
+        # Never lose the identity entirely because state-gathering broke.
+        try:
+            from modules.assistant_identity import (
+                JARVIS_PERSONALITY_PROMPT, FRIDAY_PERSONALITY_PROMPT,
+            )
+            p = (persona or "jarvis").strip().lower()
+            return JARVIS_PERSONALITY_PROMPT if p == "jarvis" else FRIDAY_PERSONALITY_PROMPT
+        except Exception:
+            return ""
+
+# Load all 15 keys into the token manager pool
+GOOGLE_API_KEYS = {}
+try:
+    for domain in KeyDomain:
+        try:
+            key_val = resolve_vault_key(domain)
+            if key_val:
+                GOOGLE_API_KEYS[domain.value] = key_val
+        except Exception:
+            continue
+            
+    if get_runtime_location() == "cloud":
+        GEMINI_API_KEY = GOOGLE_API_KEYS.get(KeyDomain.CLOUD.value, "")
+    else:
+        GEMINI_API_KEY = GOOGLE_API_KEYS.get(KeyDomain.CHAT.value, "")
+        
+    if GEMINI_API_KEY:
+        genai.configure(api_key=GEMINI_API_KEY)
+    else:
+        logging.warning("TokenManager: Default API Key is empty.")
+        
+    logging.info(f"TokenManager: Successfully loaded {len(GOOGLE_API_KEYS)} Google/Gemini API keys into the rotation pool.")
+except Exception as e:
+    logging.warning(f"TokenManager: API Key initialization failed: {e}")
+    GEMINI_API_KEY = ""
+
+EXHAUSTED_GOOGLE_KEYS = set()
+# Measured live against a real key, 2026-07-21:
+#   gemini-3.5-flash        HTTP 503  "currently experiencing high demand"  <- was set here
+#   gemini-2.0-flash        HTTP 429  free-tier request cap
+#   gemini-2.5-flash-lite   HTTP 404  retired
+#   gemini-3-flash-preview  OK but 35.5s
+#   gemini-3.1-flash-lite   OK in 1.1s, correct answer          <- chosen
+#
+# The 503 is Google-side capacity, NOT quota consumption: these keys were unused
+# for weeks. Because the primary model always failed, every request fell through
+# to the NVIDIA tier — which is why chat worked at all, and why research paid for
+# a doomed Gemini attempt before doing any real work.
+MODEL = "gemini-3.1-flash-lite"
+
+# Google-side model cascade, mirroring the NVIDIA tier cascade in nvidia_vault.
+#
+# A single hardcoded model is fragile in exactly two ways this system has already
+# been bitten by: the model gets retired (gemini-2.5-flash-lite -> 404) or it hits
+# Google-side capacity (gemini-3.5-flash -> 503 "high demand"). Neither means the
+# KEY is bad, and neither should cost a drop to the fallback tier — another
+# Gemini model is usually fine right now.
+#
+# Ordered by what was measured live 2026-07-21 against a real key:
+#   gemini-3.1-flash-lite    OK, 1.1s, correct answer   <- best right now
+#   gemini-3.5-flash         503 today, but transient — capacity comes and goes
+#   gemini-3-flash-preview   OK but 35.5s
+#   gemini-2.0-flash         429 free-tier cap today
+# The list is tried in order on any transient failure, and only when every entry
+# fails does the request drop to the NVIDIA tier.
+#
+# Re-verified 2026-08-13 by listing models AND calling each one. Two corrections:
+#   gemini-2.0-flash        GONE — not in list_models at all, dropped
+#   gemini-2.5-flash-lite   listed as available, answers 404 on generateContent
+# The second is the trap: list_models is not proof the account may CALL a model,
+# so a dead entry can sit here looking healthy while costing a round trip and a
+# retry on every failover. Verify by calling, never by listing.
+GEMINI_MODEL_CASCADE = [
+    MODEL,                      # gemini-3.1-flash-lite — fastest verified
+    "gemini-3.5-flash-lite",
+    "gemini-3.5-flash",
+    "gemini-2.5-flash",
+    "gemini-3-flash-preview",   # works, but ~35s
+]
+
+
+def _is_transient_error(err_str: str) -> bool:
+    """Transient upstream failure — worth trying another model/tier."""
+    return any(t in err_str for t in (
+        "resourceexhausted", "429", "quota", "rate limit", "too many requests",
+        "503", "500", "high demand", "overloaded", "unavailable",
+        "internal error", "deadline", "timeout", "404", "not found",
+        "no longer available",
+    ))
+
+# ─────────────────────────────────────────────────────────────────────────────
+# DB Helpers
+# ─────────────────────────────────────────────────────────────────────────────
+
+from backend.services.usb_monitor import get_db_path
+
+
+def _init_checkpoint_table():
+    """Ensure token_checkpoints table exists in memory.db."""
+    try:
+        with sqlite3.connect(get_db_path()) as conn:
+            conn.execute("PRAGMA journal_mode=WAL")
+            conn.execute("""
+                CREATE TABLE IF NOT EXISTS token_checkpoints (
+                    id TEXT PRIMARY KEY,
+                    task_type TEXT NOT NULL,
+                    original_prompt TEXT NOT NULL,
+                    partial_result TEXT DEFAULT '',
+                    last_word TEXT DEFAULT '',
+                    status TEXT DEFAULT 'pending_resume',
+                    created_at INTEGER,
+                    resumed_at INTEGER,
+                    completed_at INTEGER,
+                    retry_count INTEGER DEFAULT 0,
+                    persona TEXT DEFAULT 'jarvis'
+                )
+            """)
+            conn.commit()
+    except Exception as e:
+        logging.error(f"TokenManager: Failed to init checkpoint table: {e}")
+
+
+_init_checkpoint_table()
+
+
+def _save_checkpoint(task_id: str, task_type: str, prompt: str,
+                     partial: str, last_word: str, persona: str = "jarvis"):
+    try:
+        with sqlite3.connect(get_db_path()) as conn:
+            conn.execute("PRAGMA journal_mode=WAL")
+            conn.execute("""
+                INSERT OR REPLACE INTO token_checkpoints
+                (id, task_type, original_prompt, partial_result, last_word,
+                 status, created_at, persona)
+                VALUES (?,?,?,?,?,'pending_resume',?,?)
+            """, (task_id, task_type, prompt, partial, last_word,
+                  int(time.time()), persona))
+            conn.commit()
+        logging.warning(f"TokenManager: Checkpoint saved [{task_type}:{task_id}] last_word='{last_word}'")
+    except Exception as e:
+        logging.error(f"TokenManager: Failed to save checkpoint: {e}")
+
+
+def _mark_checkpoint_resumed(task_id: str):
+    try:
+        with sqlite3.connect(get_db_path()) as conn:
+            conn.execute(
+                "UPDATE token_checkpoints SET status='resumed', resumed_at=? WHERE id=?",
+                (int(time.time()), task_id)
+            )
+            conn.commit()
+    except Exception as e:
+        logging.error(f"TokenManager: Failed to mark resumed: {e}")
+
+
+def _mark_checkpoint_complete(task_id: str):
+    try:
+        with sqlite3.connect(get_db_path()) as conn:
+            conn.execute(
+                "UPDATE token_checkpoints SET status='complete', completed_at=? WHERE id=?",
+                (int(time.time()), task_id)
+            )
+            conn.commit()
+    except Exception as e:
+        logging.error(f"TokenManager: Failed to mark complete: {e}")
+
+
+def _get_pending_checkpoints() -> list:
+    try:
+        with sqlite3.connect(get_db_path()) as conn:
+            conn.row_factory = sqlite3.Row
+            rows = conn.execute(
+                "SELECT * FROM token_checkpoints WHERE status='pending_resume' ORDER BY created_at ASC"
+            ).fetchall()
+            return [dict(r) for r in rows]
+    except Exception as e:
+        logging.error(f"TokenManager: Failed to fetch pending checkpoints: {e}")
+        return []
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Core Gemini Call — with auto checkpoint on 429
+# ─────────────────────────────────────────────────────────────────────────────
+
+def _extract_last_word(text: str) -> str:
+    """Return the very last word of the partial output for precise resume anchoring."""
+    if not text:
+        return ""
+    words = text.strip().split()
+    return words[-1] if words else ""
+
+
+def _build_resume_prompt(original_prompt: str, partial_result: str, last_word: str) -> str:
+    """
+    Construct a continuation prompt so Gemini resumes from the EXACT last word.
+    """
+    if not partial_result:
+        return original_prompt
+    return (
+        f"{original_prompt}\n\n"
+        f"---OMEGA RESUME INSTRUCTION---\n"
+        f"You were previously generating a response and hit a token limit mid-way.\n"
+        f"The partial output generated so far ended with the word: '{last_word}'\n"
+        f"Here is the partial output so far:\n\n{partial_result}\n\n"
+        f"Continue EXACTLY from where you left off. "
+        f"Do NOT repeat any of the partial output above. "
+        f"Start your response from the word that comes AFTER '{last_word}'."
+    )
+
+
+def _get_key_for_task(task_type: str) -> str:
+    from backend.services.usb_vault import KeyDomain, resolve_vault_key
+    location = get_runtime_location()
+    
+    if task_type == "research":
+        return resolve_vault_key(KeyDomain.RESEARCH_ENGINE)
+    elif task_type == "captcha":
+        return resolve_vault_key(KeyDomain.CAPTCHA_SOLVER_CLOUD if location == "cloud" else KeyDomain.CAPTCHA_SOLVER_PC)
+    elif task_type == "implement":
+        return resolve_vault_key(KeyDomain.AUTO_UPGRADE_CLOUD if location == "cloud" else KeyDomain.AUTO_UPGRADE_PC)
+    elif task_type == "osint":
+        return resolve_vault_key(KeyDomain.OSINT_PROTOCOL_CLOUD if location == "cloud" else KeyDomain.OSINT_PROTOCOL_PC)
+    elif task_type == "image":
+        return resolve_vault_key(KeyDomain.IMAGE_GENERATION_CLOUD if location == "cloud" else KeyDomain.IMAGE_GENERATION_PC)
+    elif task_type == "gaming":
+        return resolve_vault_key(KeyDomain.GAMING_COACH)
+    elif task_type == "supervisor":
+        return resolve_vault_key(KeyDomain.SUPERVISOR_HEAL_CLOUD if location == "cloud" else KeyDomain.SUPERVISOR_HEAL_PC)
+    elif task_type == "cloud_sync":
+        return resolve_vault_key(KeyDomain.CLOUD_SYNC_DOMAIN)
+    else:
+        return resolve_vault_key(KeyDomain.CLOUD if location == "cloud" else KeyDomain.CHAT)
+
+def _broadcast_live_key_status(ecosystem: str, model: str, status: str):
+    """Safely fire WS broadcast from synchronous threads"""
+    payload = {
+        "event": "live_key_status",
+        "payload": {
+            "active_ecosystem": ecosystem,
+            "active_model": model,
+            "status": status
+        }
+    }
+    try:
+        from backend.ws.agent_ws import ws_manager
+        loop = asyncio.get_running_loop()
+        loop.create_task(ws_manager.broadcast(payload))
+    except RuntimeError:
+        pass # No loop running in this thread
+
+def _nvidia_fallback_call_sync(prompt: str, task_id: str, task_type: str, partial_so_far: str,
+                               persona: str, live_state: Optional[dict] = None,
+                               can_search: bool = False, can_act: bool = False,
+                               can_read: bool = False) -> str:
+    """Fallback to NVIDIA Vault Models."""
+    _broadcast_live_key_status("NVIDIA", "glm-5.1", "fallback_mode")
+    
+    from backend.services.memory_service import GlobalOmniMemory
+    omni_context = GlobalOmniMemory.get_global_context_stream()
+    
+    # Construct exact prompt with resume logic and hive mind context
+    actual_prompt = _build_resume_prompt(prompt, partial_so_far, _extract_last_word(partial_so_far))
+    if not partial_so_far:
+        # NVIDIA models take no separate system channel here, so the persona
+        # prompt is prepended (same place the hive-mind context goes).
+        _sys = _persona_system_prompt(persona, task_type, live_state, can_search, can_act, can_read)
+        actual_prompt = (_sys + "\n\n" if _sys else "") + omni_context + actual_prompt
+
+    # Delegate to the NVIDIA Vault API directly
+    from backend.services.nvidia_vault import call_nvidia_model, NvidiaModel
+    # GLM is the intended head of the heavy-compute fallback tier. call_nvidia_model
+    # already cascades from here through the rest of that tier (MiniMax, DeepSeek,
+    # Nemotron-Ultra) with up to 3 key-failovers per model, so a single slow or
+    # unavailable model does not strand the request.
+    #
+    # Only the model ID changed: "z-ai/glm-5.1" was retired upstream and returned
+    # HTTP 410 on all 15 keys, which wasted the first attempt of every heavy-tier
+    # call. It is now glm-5.2.
+    fallback_response = call_nvidia_model(actual_prompt, NvidiaModel.GLM_5_2)
+    
+    # Record what NVIDIA just did to the Hive Mind
+    GlobalOmniMemory.record_action("NVIDIA", "glm-5.1", task_type, fallback_response[:100].replace('\n', ' ') + "...")
+    
+    combined = partial_so_far + fallback_response
+    _mark_checkpoint_complete(task_id)
+    return combined
+
+def _gemini_call_sync(prompt: str, task_id: str, task_type: str,
+                      partial_so_far: str = "", persona: str = "jarvis",
+                      live_state: Optional[dict] = None,
+                      can_search: bool = False, can_act: bool = False,
+                      can_read: bool = False) -> str:
+    key = _get_key_for_task(task_type)
+
+    # 1. If we know it's exhausted, fallback immediately
+    if key in EXHAUSTED_GOOGLE_KEYS:
+        logging.info(f"TokenManager: Google Key exhausted. Routing {task_type} instantly to NVIDIA Fallback.")
+        return _nvidia_fallback_call_sync(prompt, task_id, task_type, partial_so_far,
+                                          persona, live_state, can_search, can_act, can_read)
+        
+    genai.configure(api_key=key)
+    _broadcast_live_key_status("GOOGLE", MODEL, "primary_active")
+
+    from backend.services.memory_service import GlobalOmniMemory
+    omni_context = GlobalOmniMemory.get_global_context_stream()
+
+    # Shape the reply in the active assistant's voice (JARVIS/FRIDAY). Skip on a
+    # resume continuation so we don't restate the persona mid-sentence.
+    _sys = (_persona_system_prompt(persona, task_type, live_state, can_search, can_act, can_read)
+            if not partial_so_far else None)
+    actual_prompt = _build_resume_prompt(prompt, partial_so_far, _extract_last_word(partial_so_far))
+    if not partial_so_far:
+        actual_prompt = omni_context + actual_prompt
+
+    # Walk the Gemini cascade before considering the NVIDIA tier. A model that is
+    # retired or momentarily at capacity must not cost the whole Google side —
+    # the next model in the list is usually healthy.
+    last_exc = None
+    for attempt_model in GEMINI_MODEL_CASCADE:
+        try:
+            model = (genai.GenerativeModel(attempt_model, system_instruction=_sys)
+                     if _sys else genai.GenerativeModel(attempt_model))
+            response = model.generate_content(actual_prompt)
+            new_text = response.text or ""
+
+            if attempt_model != MODEL:
+                logging.warning("TokenManager: primary model unavailable; served by %s", attempt_model)
+            _broadcast_live_key_status("GOOGLE", attempt_model, "primary_active")
+
+            # Record what Google just did to the Hive Mind
+            GlobalOmniMemory.record_action("GOOGLE", attempt_model, task_type,
+                                           new_text[:100].replace('\n', ' ') + "...")
+
+            combined = partial_so_far + new_text
+            _mark_checkpoint_complete(task_id)
+            return combined
+        except Exception as exc:
+            last_exc = exc
+            if _is_transient_error(str(exc).lower()):
+                logging.info("TokenManager: %s unavailable (%s); trying next Gemini model.",
+                             attempt_model, str(exc)[:70])
+                continue
+            raise
+
+    # Every Gemini model failed — fall through to the original handling, which
+    # decides between key-exhaustion bookkeeping and the NVIDIA tier.
+    try:
+        raise last_exc
+    except Exception as e:
+        err_str = str(e).lower()
+        # Any TRANSIENT upstream failure should fall back to NVIDIA, not just a
+        # quota error. This previously matched 429/quota only, so a Google-side
+        # capacity 503 ("This model is currently experiencing high demand" — which
+        # gemini-3.5-flash returns constantly) fell through to `raise` and killed
+        # the request outright, never reaching the NVIDIA tier that exists for
+        # exactly this situation.
+        is_rate_limit = (
+            "resourceexhausted" in err_str
+            or "429" in err_str
+            or "quota" in err_str
+            or "rate limit" in err_str
+            or "too many requests" in err_str
+            # Google-side capacity / availability, not our usage:
+            or "503" in err_str
+            or "500" in err_str
+            or "high demand" in err_str
+            or "overloaded" in err_str
+            or "unavailable" in err_str
+            or "internal error" in err_str
+            or "deadline" in err_str
+            or "timeout" in err_str
+        )
+        # A capacity/availability failure is the MODEL's problem, not the key's.
+        # Blacklisting the key for a 503 would permanently route a perfectly
+        # healthy credential to the fallback tier — so only real quota errors
+        # mark a key exhausted. Both still fall back to NVIDIA.
+        is_key_exhausted = (
+            "resourceexhausted" in err_str
+            or "429" in err_str
+            or "quota" in err_str
+            or "rate limit" in err_str
+            or "too many requests" in err_str
+        )
+        if is_rate_limit:
+            logging.warning(
+                "TokenManager: transient upstream failure for [%s:%s] (%s). Triggering NVIDIA Fallback.",
+                task_type, task_id, "quota" if is_key_exhausted else "capacity/503",
+            )
+            if not is_key_exhausted:
+                # Model-side outage: keep the key healthy, just serve this request
+                # from the fallback tier.
+                return _nvidia_fallback_call_sync(prompt, task_id, task_type, partial_so_far, persona)
+            # 2. Add to exhausted pool
+            if key not in EXHAUSTED_GOOGLE_KEYS:
+                EXHAUSTED_GOOGLE_KEYS.add(key)
+                
+                # We can't spawn an async task cleanly from a sync thread without a loop, 
+                # so we will raise a special exception that the async wrapper catches to spawn the pinger.
+                raise _Google429Trigger(key=key, prompt=prompt, task_id=task_id, task_type=task_type, partial_so_far=partial_so_far, persona=persona)
+            
+            return _nvidia_fallback_call_sync(prompt, task_id, task_type, partial_so_far, persona)
+        raise
+
+class _Google429Trigger(Exception):
+    def __init__(self, key, prompt, task_id, task_type, partial_so_far, persona):
+        self.key = key
+        self.prompt = prompt
+        self.task_id = task_id
+        self.task_type = task_type
+        self.partial_so_far = partial_so_far
+        self.persona = persona
+
+TokenLimitHit = _Google429Trigger
+
+async def gemini_call_with_checkpoint(
+    prompt: str,
+    task_type: str = "general",
+    persona: str = "jarvis",
+    task_id: Optional[str] = None,
+    partial_so_far: str = "",
+    live_state: Optional[dict] = None,
+    can_search: bool = False,
+    can_act: bool = False,
+    can_read: bool = False,
+) -> str:
+    """
+    Universal Gemini 3.5 Flash call with automatic checkpoint & resume.
+
+    `live_state` is the set of facts measured for this turn (is the PC actually
+    connected, what time is it, what is the device). It reaches the model as part
+    of the composed identity. Passing nothing is allowed and honest — the prompt
+    then tells him he has no measured facts — but a conversational caller that
+    can measure state and does not is how "connected, sir" gets said about a
+    machine that is switched off.
+    """
+    if task_id is None:
+        task_id = str(uuid.uuid4())
+
+    try:
+        return await asyncio.to_thread(
+            _gemini_call_sync, prompt, task_id, task_type, partial_so_far, persona,
+            live_state, can_search, can_act, can_read
+        )
+    except _Google429Trigger as e:
+        # 1. Start the token refresh monitor loop
+        asyncio.create_task(start_token_refresh_monitor())
+        # 2. Immediately complete THIS task using NVIDIA fallback
+        return await asyncio.to_thread(
+            _nvidia_fallback_call_sync, e.prompt, e.task_id, e.task_type, e.partial_so_far,
+            e.persona, live_state, can_search, can_act, can_read
+        )
+
+# For backward compatibility where 'run_task' is imported from token_manager
+async def run_task(prompt: str, task_type: str = "general", persona: str = "jarvis",
+                   live_state: Optional[dict] = None, can_search: bool = False,
+                   can_act: bool = False, can_read: bool = False) -> str:
+    return await gemini_call_with_checkpoint(prompt, task_type, persona,
+                                             live_state=live_state, can_search=can_search,
+                                             can_act=can_act, can_read=can_read)
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Background Cloud Monitor — polls until tokens refresh then resumes
+# ─────────────────────────────────────────────────────────────────────────────
+
+_monitor_running = False
+
+async def start_token_refresh_monitor():
+    """
+    Background loop that:
+      1. Checks for pending_resume checkpoints every 60s
+      2. Probes Gemini with a minimal token-cost ping
+      3. When the probe succeeds, resumes ALL pending tasks from their exact last word
+      4. Broadcasts omega:task_resumed WS event for each resumed task
+    """
+    global _monitor_running
+    if _monitor_running:
+        return
+    _monitor_running = True
+    logging.info("TokenManager: Token refresh monitor STARTED.")
+
+    while _monitor_running:
+        try:
+            pending = _get_pending_checkpoints()
+            
+            # We must probe if there are pending checkpoints OR if we have exhausted keys that need refreshing
+            if pending or EXHAUSTED_GOOGLE_KEYS:
+                if pending:
+                    logging.info(f"TokenManager: {len(pending)} checkpoint(s) pending resume. Probing API...")
+                else:
+                    logging.info("TokenManager: No checkpoints, but EXHAUSTED_GOOGLE_KEYS has entries. Probing API...")
+                
+                # Lightweight probe — minimal cost
+                # Check each exhausted key independently
+                keys_to_probe = list(EXHAUSTED_GOOGLE_KEYS) if EXHAUSTED_GOOGLE_KEYS else [_get_key_for_task("general")]
+                recovered_keys = []
+                
+                for key in keys_to_probe:
+                    try:
+                        genai.configure(api_key=key)
+                        model = genai.GenerativeModel(MODEL)
+                        model.generate_content("ping")
+                        recovered_keys.append(key)
+                    except Exception as probe_err:
+                        err_str = str(probe_err).lower()
+                        if "resourceexhausted" in err_str or "429" in err_str or "quota" in err_str:
+                            pass # Still exhausted
+                        else:
+                            logging.error(f"TokenManager: Probe error on key: {probe_err}")
+
+                if not recovered_keys and keys_to_probe:
+                    logging.warning("TokenManager: API still exhausted. Will retry in 60s.")
+
+                if recovered_keys:
+                    logging.info(f"TokenManager: API Probe OK for {len(recovered_keys)} keys. Clearing them from EXHAUSTED_GOOGLE_KEYS.")
+                    for k in recovered_keys:
+                        if k in EXHAUSTED_GOOGLE_KEYS:
+                            EXHAUSTED_GOOGLE_KEYS.remove(k)
+                    
+                    if pending:
+                        # Resume all pending checkpoints now that some keys are refreshed
+                        for checkpoint in pending:
+                            asyncio.create_task(_resume_checkpoint(checkpoint))
+
+        except Exception as e:
+            logging.error(f"TokenManager: Monitor loop error: {e}")
+
+        await asyncio.sleep(60)
+
+    logging.info("TokenManager: Token refresh monitor STOPPED.")
+
+
+async def _resume_checkpoint(checkpoint: dict):
+    """Resume a single checkpoint from its exact last word."""
+    task_id = checkpoint["id"]
+    task_type = checkpoint["task_type"]
+    original_prompt = checkpoint["original_prompt"]
+    partial = checkpoint["partial_result"] or ""
+    last_word = checkpoint["last_word"] or ""
+    persona = checkpoint.get("persona", "jarvis")
+
+    logging.info(f"TokenManager: Resuming [{task_type}:{task_id}] from last_word='{last_word}'")
+    _mark_checkpoint_resumed(task_id)
+
+    try:
+        # Broadcast WS notification
+        from backend.ws.agent_ws import ws_manager
+        await ws_manager.broadcast({
+            "event": "omega:task_resuming",
+            "payload": {
+                "task_id": task_id,
+                "task_type": task_type,
+                "last_word": last_word,
+                "message": (
+                    f"Token limit has refreshed, sir. Resuming {task_type} task from exactly '{last_word}'..."
+                    if persona == "jarvis" else
+                    f"We're back boss! Tokens refreshed — resuming {task_type} from exactly '{last_word}'!"
+                )
+            }
+        })
+
+        # Re-run the Gemini call from exact checkpoint
+        result = await gemini_call_with_checkpoint(
+            prompt=original_prompt,
+            task_type=task_type,
+            persona=persona,
+            task_id=task_id,
+            partial_so_far=partial
+        )
+
+        _mark_checkpoint_complete(task_id)
+
+        # Route result back to its originating system
+        await _dispatch_resumed_result(task_type, task_id, result, persona, checkpoint)
+
+        await ws_manager.broadcast({
+            "event": "omega:task_resumed",
+            "payload": {
+                "task_id": task_id,
+                "task_type": task_type,
+                "message": (
+                    f"{task_type.title()} task completed after token refresh, sir."
+                    if persona == "jarvis" else
+                    f"Done boss! {task_type.title()} task finished after the token refresh!"
+                )
+            }
+        })
+
+    except TokenLimitHit:
+        # Still throttled — will retry next monitor cycle
+        logging.warning(f"TokenManager: Still throttled on resume for [{task_id}]. Reverting to pending_resume.")
+        try:
+            with sqlite3.connect(get_db_path()) as conn:
+                conn.execute(
+                    "UPDATE token_checkpoints SET status='pending_resume', retry_count=retry_count+1 WHERE id=?",
+                    (task_id,)
+                )
+                conn.commit()
+        except Exception as e:
+            # No local `import logging` — it would shadow the module import for
+            # the whole of _resume_checkpoint() and break the logging calls above.
+            logging.getLogger(__name__).error(f"Swallowed exception: {e}")
+    except Exception as e:
+        logging.error(f"TokenManager: Resume error for [{task_id}]: {e}")
+
+
+async def _dispatch_resumed_result(task_type: str, task_id: str,
+                                   result: str, persona: str, checkpoint: dict):
+    """Route the completed result back to the correct subsystem."""
+    try:
+        if task_type == "research":
+            # Re-parse the JSON research note and save it
+            import json
+            from backend.omega.research_engine import ResearchNote, ResearchCategory, _save_research_note
+            raw = result.strip().strip("```json").strip("```").strip()
+            data = json.loads(raw)
+            raw_category = data.get("category", "Research Notes")
+            valid_categories = {c.value: c for c in ResearchCategory}
+            category = valid_categories.get(raw_category, ResearchCategory.RESEARCH_NOTES)
+            note = ResearchNote(
+                title=data.get("title", "Resumed Research"),
+                summary=data.get("summary", result[:500]),
+                importance=data.get("importance", "MEDIUM"),
+                category=category,
+                source=data.get("source", "Gemini 3.5 Flash (resumed)"),
+                recommended_action=data.get("recommended_action", "")
+            )
+            _save_research_note(note)
+            logging.info(f"TokenManager: Research note saved after resume: {note.title}")
+
+        elif task_type == "implement":
+            # Re-parse code blocks and hot-reload them
+            from backend.omega.auto_upgrade import parse_code_blocks, write_and_hot_reload, log_upgrade_to_db
+            code_blocks = parse_code_blocks(result)
+            files_modified = []
+            for block in code_blocks:
+                await write_and_hot_reload(block.filepath, block.code)
+                files_modified.append(block.filepath)
+            log_upgrade_to_db(
+                checkpoint.get("original_prompt", "Resumed task")[:60],
+                files_modified, persona, "success_after_resume"
+            )
+            logging.info(f"TokenManager: Implementation resumed and hot-reloaded: {files_modified}")
+
+        else:
+            # For gate/captcha/monitor tasks, just log the full result
+            logging.info(f"TokenManager: [{task_type}] resumed result stored (length={len(result)})")
+
+    except Exception as e:
+        logging.error(f"TokenManager: dispatch_resumed_result error for [{task_type}]: {e}")
+
+
+def stop_token_refresh_monitor():
+    global _monitor_running
+    _monitor_running = False
+    logging.info("TokenManager: Token refresh monitor signalled to stop.")

backend/services/usb_monitor.py

@@ -112,7 +112,9 @@ def get_active_usb_drives():
                     "drive_letter": drive_letter
                 })
     except Exception as e:
-        import logging
+        # Module-scope `logging`, not a local import — the same shadowing trap
+        # that broke fetch_pyusb. Harmless here today only because nothing reads
+        # `logging` earlier in this function; that is luck, not design.
         logging.error(f"Error enumerating active USB drives: {e}")
     return drives
 
@@ -184,7 +186,25 @@ async def start_usb_monitor():
                                         break
                                 if is_pendrive: break
                         except Exception as e:
-                            import logging; logging.getLogger(__name__).error(f"Swallowed exception: {e}")
+                            # NO local `import logging` here.
+                            #
+                            # It was the cause of the error that filled the log
+                            # every two seconds. A local import binds the name
+                            # for the WHOLE function, so `logging` became a
+                            # local of fetch_pyusb — and the outer handler
+                            # below, which runs when usb.core.find() fails,
+                            # read it before this line had ever executed:
+                            #
+                            #   UnboundLocalError: cannot access local variable
+                            #   'logging' where it is not associated with a value
+                            #
+                            # The handler meant to REPORT the PyUSB failure was
+                            # therefore the thing that crashed, replacing the
+                            # real reason with a misleading one. `logging` is
+                            # already imported at module scope; using it is all
+                            # that was ever needed.
+                            logging.getLogger(__name__).error(
+                                "USB interface probe failed: %s", e)
                         
                         if is_pendrive:
                             try:

backend/tools/web_search_tools.py

@@ -217,10 +217,34 @@ async def search_web(query: str, num_results: int = 5) -> dict:
     # worked if it actually returned results; an empty 200 falls through, so a
     # rate-limited or misconfigured primary degrades instead of silently
     # returning nothing to the assistant.
+    #
+    # WIKIPEDIA IS LAST, NOT THIRD.
+    #
+    # It used to sit above the web scrape, and because it is always "available"
+    # it answered nearly every keyless search — which is how OSINT came back
+    # confidently wrong. Measured, before this change:
+    #
+    #   "Sundar Pichai"  -> 4 Wikipedia articles (Sundar Pichai, Google Gemini,
+    #                       Alphabet Inc., Google). The live web was never asked.
+    #   "who is Elon Musk" -> "Wealth of Elon Musk", "Errol Musk", "Trump-Musk
+    #                       feud" — an encyclopedia's idea of relevance.
+    #
+    # An encyclopedia cannot answer the questions this assistant is actually
+    # asked: find a specific syllabus PDF, find a person who has a profile but
+    # no article, find anything that happened recently. It returned *something*
+    # plausible for every query, so the fallback chain never advanced to a real
+    # search engine, and the model then wrote an answer out of whatever loosely
+    # related articles it was handed. Junk results are worse than no results:
+    # empty invites "I couldn't find it", plausible-but-wrong invites invention.
+    #
+    # Below the scrape it still does its real job — the thing that keeps research
+    # alive when DuckDuckGo throws its anti-automation challenge.
     for provider, available in ((_brave_search, brave_api_key),
                                 (_serpapi_search, serpapi_key),
-                                # Keyless and unthrottled — the reason research
-                                # keeps working with no credentials configured.
+                                # Keyless, and actual ranked web results.
+                                (_duck_html_search, True),
+                                # Keyless and unthrottled: the safety net for when
+                                # the scrape above is challenged, not the default.
                                 (_wikipedia_search, True)):
         if not available:
             continue
@@ -229,10 +253,7 @@ async def search_web(query: str, num_results: int = 5) -> dict:
             return out
         logging.warning("web search provider %s failed (%s); trying next",
                         provider.__name__, out.get("error"))
-    # Keyless last resort. Unlike the old instant-answer endpoint this returns
-    # real ranked results, so search/OSINT/threat-modelling still function with
-    # no credential configured at all.
-    return await asyncio.to_thread(_duck_html_search)
+    return {"error": "no search provider returned results"}
 
 async def fetch_page(url: str) -> dict:
     """Fetch page via Playwright, bypassing CAPTCHAs if encountered"""

backend/voice/jarvis_live.py

@@ -0,0 +1,202 @@
+"""The JARVIS voice for everything JARVIS actually says.
+
+`backend/voice/tts.py` already routes the *backend's* JARVIS speech through the
+Kokoro+RVC pipeline. But the desktop assistant does not speak through that
+path at all — tray.py, modules/executor.py, modules/hud.py, the automation
+triggers, the Gmail connector and the tour all call `core.voice.speak()`, which
+synthesises with Edge-TTS. So the tuned voice was reachable from the API and
+from the phone, and from nowhere the user actually hears day to day.
+
+This module is the bridge. It renders a line with the real pipeline and hands
+back a WAV path that `core.voice`'s existing player can use unchanged.
+
+Three things make that practical rather than merely possible:
+
+  * A DISK CACHE. Assistants repeat themselves — "Done.", "Yes, sir.",
+    "Standing by." A repeated line costs a file read instead of seconds of
+    inference, which is what makes short acknowledgements usable at all.
+
+  * A WARM-UP. The first render pays ~35 s of model loading. Left alone, the
+    first thing JARVIS says after boot arrives half a minute late. `warm_up()`
+    moves that cost to startup, where nothing is waiting on it.
+
+  * A FALLBACK THAT NEVER MUTES HIM. If torch, RVC or the model files are
+    missing — a stripped exe build, a fresh machine — this returns None and the
+    caller keeps its Edge-TTS path. A degraded voice is recoverable; silence
+    is not.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import logging
+import os
+import threading
+import time
+
+logger = logging.getLogger(__name__)
+
+# ── Configuration ────────────────────────────────────────────────────────────
+
+# The music bed is OFF for live speech, and that is deliberate.
+#
+# The bed exists to match the reference recording, which is a scored piece of
+# film audio. Under a 40-second demo it is the thing that made the clip sound
+# like the real JARVIS. Under every "Done." and every alert, all day, a looping
+# 40-second cue would be exhausting — and each utterance would restart the loop
+# from the same point, so the same few bars would play over and over.
+#
+# Set to 5.0 to get the demo's bed back; nothing else needs to change.
+LIVE_AMBIENCE_LEVEL = 0.0
+
+# Bump when the voice itself changes, so old cache entries are not reused for
+# a voice that no longer exists. This is a cache key component, not a version
+# number anyone reads.
+VOICE_REVISION = "2026-08-11-a"
+
+# Lines longer than this are not worth caching — they are one-off sentences
+# that will never repeat, and caching them only fills the disk.
+CACHE_MAX_CHARS = 240
+CACHE_MAX_FILES = 400
+
+_lock = threading.Lock()
+_warm_thread: threading.Thread | None = None
+_available: bool | None = None       # None = not yet determined
+
+
+def _cache_dir() -> str:
+    base = os.environ.get("JARVIS_APP_DATA_DIR") or os.environ.get("LOCALAPPDATA") \
+        or os.path.expanduser("~")
+    d = os.path.join(base, "jarvis_voice_cache")
+    os.makedirs(d, exist_ok=True)
+    return d
+
+
+def _key(text: str, profile: str) -> str:
+    raw = f"{VOICE_REVISION}|{profile}|{LIVE_AMBIENCE_LEVEL}|{text}"
+    return hashlib.sha256(raw.encode("utf-8")).hexdigest()[:32]
+
+
+def is_available() -> bool:
+    """Can the real pipeline run here?
+
+    Answered by importing, not by looking for files: the failure modes that
+    matter (no torch, no CUDA runtime, a broken faiss/numpy pairing) are all
+    import-time, and every one of them has silently degraded this pipeline to
+    plain Kokoro before.
+    """
+    global _available
+    if _available is not None:
+        return _available
+    try:
+        import backend.voice.engines.kokoro_engine as ke  # noqa: F401
+        _available = True
+    except Exception as exc:
+        logger.warning("[JARVIS voice] pipeline unavailable (%s); "
+                       "falling back to Edge-TTS.", exc)
+        _available = False
+    return _available
+
+
+def warm_up() -> None:
+    """Load the models in the background so the first line is not the slow one.
+
+    Idempotent and non-blocking. Safe to call from startup paths that must not
+    wait for anything.
+    """
+    global _warm_thread
+    with _lock:
+        if _warm_thread is not None:
+            return
+
+        def _run():
+            try:
+                t0 = time.time()
+                import backend.voice.engines.kokoro_engine as ke
+                ke._get_kokoro()
+                ke._get_rvc()
+                logger.info("[JARVIS voice] models warm in %.1fs", time.time() - t0)
+            except Exception as exc:
+                logger.warning("[JARVIS voice] warm-up failed: %s", exc)
+
+        _warm_thread = threading.Thread(target=_run, daemon=True,
+                                        name="jarvis-voice-warmup")
+        _warm_thread.start()
+
+
+def _prune_cache(d: str) -> None:
+    """Keep the cache bounded, oldest-accessed first."""
+    try:
+        files = [os.path.join(d, f) for f in os.listdir(d) if f.endswith(".wav")]
+        if len(files) <= CACHE_MAX_FILES:
+            return
+        files.sort(key=lambda p: os.path.getatime(p))
+        for p in files[:len(files) - CACHE_MAX_FILES]:
+            try:
+                os.remove(p)
+            except OSError:
+                pass
+    except Exception:
+        pass
+
+
+def render_to_file(text: str, profile: str | None = None) -> str | None:
+    """Render `text` in the JARVIS voice; return a WAV path, or None.
+
+    None means "use your existing fallback" — it is never an error the caller
+    has to handle beyond that.
+    """
+    text = (text or "").strip()
+    if not text or not is_available():
+        return None
+
+    try:
+        import backend.voice.engines.kokoro_engine as ke
+    except Exception:
+        return None
+
+    name = profile or getattr(ke, "ACTIVE_PROFILE", "m4a")
+    cacheable = len(text) <= CACHE_MAX_CHARS
+    d = _cache_dir()
+    path = os.path.join(d, _key(text, name) + ".wav")
+
+    if cacheable and os.path.exists(path) and os.path.getsize(path) > 1024:
+        try:
+            os.utime(path, None)          # keep it fresh for the pruner
+        except OSError:
+            pass
+        return path
+
+    try:
+        import asyncio
+
+        # The bed level is a module global on the engine, and the engine has no
+        # per-call override for it. Set it around the call and put it back, so
+        # a caller that renders WITH a bed (the demo scripts) is unaffected.
+        prev = getattr(ke, "AMBIENCE_LEVEL", 0.0)
+        ke.AMBIENCE_LEVEL = LIVE_AMBIENCE_LEVEL
+        try:
+            t0 = time.time()
+            data = asyncio.run(ke.synthesize_kokoro(text, profile=name))
+        finally:
+            ke.AMBIENCE_LEVEL = prev
+
+        if not data or len(data) < 1024:
+            logger.warning("[JARVIS voice] empty render for %r", text[:40])
+            return None
+
+        # Write to a temp name and rename, so a cache hit can never land on a
+        # half-written file if two threads race on the same line.
+        tmp = path + f".{os.getpid()}.{threading.get_ident()}.part"
+        with open(tmp, "wb") as fh:
+            fh.write(data)
+        os.replace(tmp, path)
+
+        logger.info("[JARVIS voice] rendered %d chars in %.2fs", len(text),
+                    time.time() - t0)
+        if cacheable:
+            _prune_cache(d)
+        return path
+    except Exception as exc:
+        logger.warning("[JARVIS voice] render failed (%s); falling back.", exc)
+        return None

backend/voice/tts.py

@@ -41,6 +41,18 @@ class TTSPipeline:
         """
         import logging
 
+        # Numbers become words HERE, before the engine split.
+        #
+        # This lived inside kokoro_engine, which meant only the JARVIS English
+        # path ever got it — FRIDAY, the Edge-TTS fallback and every non-English
+        # language still read "15,444" as "fifteen" then "zero zero zero",
+        # because the comma splits the token and the rest is voiced digit by
+        # digit. This is the one place every engine passes through, so it is the
+        # only place the fix belongs. Applying it twice is harmless: after the
+        # first pass there are no digits left to match.
+        from backend.voice.engines.kokoro_engine import speak_numbers
+        text = speak_numbers(text)
+
         # ── FRIDAY path — completely untouched, existing logic, zero changes ──
         if personality != "jarvis":
             return await self._synthesize_friday(text, personality, language)

config.py

@@ -433,8 +433,78 @@ ANALYTICS_DIR = os.path.join(COPIES_DIR, "analytics")
 REPAIR_DIR = os.path.join(COPIES_DIR, "repair")
 
 # API
-GEMINI_API_KEY = "" # Set your Gemini API key here
-GEMINI_MODEL = "gemini-2.5-flash-preview-04-17"
+#
+# This was the literal `GEMINI_API_KEY = ""` with a note to paste a key in, and
+# nothing ever read .env — which has held a valid key the whole time. The cost
+# was not a warning in a log. core/brain.py imports this name, _ask_gemini
+# raised on every single call, and core/brain_router fell through to the
+# provider named "local" — which is NOT a local model, just canned strings from
+# _local_fallback(). So every "reply" from JARVIS or FRIDAY on the desktop was
+# stock filler, including the "Got it: <x>. Tell me the outcome you want." that
+# core/commands.py has a comment complaining about.
+#
+# Environment first (a Space secret or a shell export must win), then .env, then
+# the literal, so a real deployment can override without editing source.
+def _read_env_file(name: str) -> str:
+    try:
+        env_path = Path(__file__).resolve().parent / ".env"
+        if not env_path.exists():
+            return ""
+        for raw in env_path.read_text(encoding="utf-8", errors="replace").splitlines():
+            line = raw.strip()
+            if not line or line.startswith("#") or "=" not in line:
+                continue
+            key, _, value = line.partition("=")
+            if key.strip() == name:
+                return value.strip().strip('"').strip("'")
+    except Exception:
+        pass
+    return ""
+
+
+GEMINI_API_KEY = os.environ.get("GEMINI_API_KEY") or _read_env_file("GEMINI_API_KEY") or ""
+# Two failure modes have to be avoided here, and they pull in opposite
+# directions.
+#
+# The original value was "gemini-2.5-flash-preview-04-17" — a dated preview that
+# has since been RETIRED and answered every call with HTTP 404. Pinning a
+# preview is a time bomb.
+#
+# The obvious fix, "gemini-flash-latest", is worse for this system: it resolves
+# to whatever is newest, and the newest model carries the TIGHTEST free-tier
+# quota. Measured: gemini-3.6-flash allows 20 requests PER DAY. An always-on
+# assistant exhausts that before lunch and then runs on canned fallback strings
+# for the rest of the day, silently, because brain_router swallows the 429.
+#
+# So: a stable, non-preview model with a workable free allowance, plus a
+# fallback chain for when its quota is gone. Capability matters less than being
+# answered at all — a slightly older model that replies beats a newer one that
+# 429s.
+GEMINI_MODEL = (os.environ.get("GEMINI_MODEL")
+                or _read_env_file("GEMINI_MODEL")
+                or "gemini-2.5-flash")
+
+# Tried in order when the primary is rate-limited. Lite models have materially
+# larger free quotas and are perfectly adequate for planning and judgement.
+# Verified against list_models AND a real generateContent call on 2026-08-13.
+# Three of the previous five were unusable: gemini-2.0-flash and
+# gemini-2.0-flash-lite are gone entirely, and gemini-2.5-flash-lite is listed as
+# available yet answers 404 "no longer available to new users" when called. A
+# dead entry is not free — the cascade spends an attempt, a round trip and a
+# retry on each one before reaching a model that works, which is why failover
+# felt like an outage rather than a fallback.
+#
+# Verify the same way when this changes: listing a model does not prove the
+# account may call it.
+GEMINI_MODEL_FALLBACKS = [
+    "gemini-2.5-flash",        # primary; 5 req/min on free tier
+    "gemini-3.5-flash-lite",
+    "gemini-3.1-flash-lite",
+    "gemini-3.5-flash",
+    # Deliberately last: gemini-3.6-flash is capped at ~20 requests per DAY on
+    # the free tier, so promoting it silently kills the brain by lunchtime.
+    "gemini-3.6-flash",
+]
 
 # Audio / Voice
 # FRIDAY OMEGA - Young, Natural Human Voice (20-25 female)

modules/alert_manager.py

@@ -0,0 +1,307 @@
+"""Alerts that behave like a person raising something, not a loop shouting.
+
+The watch loops in OMEGA announce a condition every time they observe it. A
+condition that persists — a disk filling, a device still disconnected — is
+therefore announced again on every pass, forever, at whatever interval that
+loop happens to run. The existing `cooldown_s` in core.voice only spaces the
+repeats out; it never stops them, and it is per-process, so two components
+watching the same thing each get their own cooldown.
+
+What is wanted instead:
+
+  * say it once;
+  * if it is not acknowledged, raise it again after a short while, because
+    something genuinely unattended should not be dropped silently;
+  * back off each time rather than nagging at a fixed rate;
+  * stop entirely once acknowledged, or once told to wait, or once muted;
+  * accept "not now", "tell me in 30 minutes" and "don't alert me about this
+    for two hours" as the way to control all of that.
+
+State is on disk, keyed by TOPIC rather than by message text, so a rephrased
+message about the same subject is still the same alert — "disk 91% full" and
+"disk 93% full" must not read as two different things to nag about.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import threading
+import time
+from typing import Optional
+
+_STATE_DIR = os.environ.get("JARVIS_APP_DATA_DIR") or os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))), ".friday_data")
+_STATE_PATH = os.path.join(_STATE_DIR, "alert_state.json")
+
+_lock = threading.RLock()
+
+# Escalation ladder for an unacknowledged alert, in seconds.
+#
+# The first repeat is the 5 minutes asked for. After that it doubles and then
+# stops: three unanswered mentions is the point at which repeating again is
+# nagging rather than diligence. A genuinely critical condition should be
+# raised with importance="critical", which uses the longer ladder below and
+# does not give up.
+REPEAT_LADDER = (300, 900, 2700)
+CRITICAL_LADDER = (120, 300, 900, 1800, 3600)
+
+# How long an alert stays "open" waiting to be acknowledged before it is
+# considered stale and dropped.
+MAX_ALERT_AGE = 24 * 3600
+
+
+def _load() -> dict:
+    try:
+        with open(_STATE_PATH, "r", encoding="utf-8") as fh:
+            data = json.load(fh)
+        return data if isinstance(data, dict) else {}
+    except Exception:
+        return {}
+
+
+def _save(data: dict) -> None:
+    try:
+        os.makedirs(_STATE_DIR, exist_ok=True)
+        tmp = _STATE_PATH + ".tmp"
+        with open(tmp, "w", encoding="utf-8") as fh:
+            json.dump(data, fh, indent=2)
+        os.replace(tmp, _STATE_PATH)
+    except Exception:
+        pass
+
+
+def _topics(data: dict) -> dict:
+    return data.setdefault("topics", {})
+
+
+# ── Total silence ───────────────────────────────────────────────────────────
+#
+# Distinct from mute(topic, seconds) above, which is per-subject and expires.
+# "Mute" said out loud does not mean "quieten one topic for a while" — it means
+# say nothing at all until told otherwise. There was no such state anywhere in
+# the system: saying "mute" hit core.commands' instant_commands table and muted
+# the WINDOWS MIXER, so JARVIS carried on speaking into a silenced output and
+# came back at full volume the moment anything else unmuted the device.
+#
+# This latch has no timeout by design. An indefinite silence that expires on
+# its own is not the thing that was asked for.
+
+def silence_all(reason: str = "") -> None:
+    with _lock:
+        data = _load()
+        data["silenced"] = {"since": time.time(), "reason": reason or "asked"}
+        _save(data)
+
+
+def unsilence_all() -> None:
+    with _lock:
+        data = _load()
+        data.pop("silenced", None)
+        _save(data)
+
+
+def is_silenced() -> bool:
+    try:
+        return bool(_load().get("silenced"))
+    except Exception:
+        return False
+
+
+def silence_info() -> Optional[dict]:
+    try:
+        got = _load().get("silenced")
+        return got if isinstance(got, dict) else None
+    except Exception:
+        return None
+
+
+def should_speak(topic: str, importance: str = "normal") -> bool:
+    """May this topic be spoken right now?
+
+    Called by the raising code BEFORE it speaks. Returns False when the topic
+    is muted, snoozed, already acknowledged, or simply not due for its next
+    repeat yet — which is what turns a per-pass watch loop into an alert that
+    is mentioned a sensible number of times.
+    """
+    now = time.time()
+    with _lock:
+        data = _load()
+        t = _topics(data).get(topic)
+
+        if t is None:
+            _topics(data)[topic] = {
+                "first": now, "last": now, "count": 1,
+                "acknowledged": False, "muted_until": 0, "snoozed_until": 0,
+                "importance": importance,
+            }
+            _save(data)
+            return True
+
+        if t.get("muted_until", 0) > now:
+            return False
+        if t.get("snoozed_until", 0) > now:
+            return False
+        if t.get("acknowledged"):
+            return False
+        if now - t.get("first", now) > MAX_ALERT_AGE:
+            return False
+
+        ladder = CRITICAL_LADDER if t.get("importance") == "critical" else REPEAT_LADDER
+        count = int(t.get("count", 1))
+        if count > len(ladder):
+            return False                      # said enough; wait to be asked
+        due = t.get("last", 0) + ladder[count - 1]
+        if now < due:
+            return False
+
+        t["last"] = now
+        t["count"] = count + 1
+        _save(data)
+        return True
+
+
+def acknowledge(topic: str) -> None:
+    """The user has dealt with it (or heard it). Stop raising it."""
+    with _lock:
+        data = _load()
+        t = _topics(data).setdefault(topic, {})
+        t["acknowledged"] = True
+        t["last"] = time.time()
+        _save(data)
+
+
+def snooze(topic: str, seconds: float) -> None:
+    """Raise it again after `seconds`, then resume the normal ladder."""
+    with _lock:
+        data = _load()
+        t = _topics(data).setdefault(topic, {})
+        t["snoozed_until"] = time.time() + max(0.0, seconds)
+        t["acknowledged"] = False
+        # The repeat count resets: after an explicit "tell me in 30 minutes",
+        # the next mention is a fresh first mention, not a continuation of an
+        # escalation the user already responded to.
+        t["count"] = 1
+        _save(data)
+
+
+def mute(topic: str, seconds: float) -> None:
+    """Say nothing about this topic at all for `seconds`."""
+    with _lock:
+        data = _load()
+        t = _topics(data).setdefault(topic, {})
+        t["muted_until"] = time.time() + max(0.0, seconds)
+        _save(data)
+
+
+def reset(topic: str) -> None:
+    """The condition cleared. Forget it, so a recurrence starts fresh."""
+    with _lock:
+        data = _load()
+        _topics(data).pop(topic, None)
+        _save(data)
+
+
+def open_topics() -> list[dict]:
+    """Alerts still waiting to be acknowledged — for 'what did I miss?'."""
+    now = time.time()
+    with _lock:
+        data = _load()
+        out = []
+        for name, t in _topics(data).items():
+            if t.get("acknowledged") or t.get("muted_until", 0) > now:
+                continue
+            out.append({"topic": name, "count": t.get("count", 1),
+                        "first": t.get("first", 0),
+                        "snoozed_until": t.get("snoozed_until", 0)})
+        return sorted(out, key=lambda d: d["first"])
+
+
+# ── Natural language ─────────────────────────────────────────────────────────
+
+_UNITS = {
+    "sec": 1, "secs": 1, "second": 1, "seconds": 1,
+    "min": 60, "mins": 60, "minute": 60, "minutes": 60,
+    "hr": 3600, "hrs": 3600, "hour": 3600, "hours": 3600,
+    "day": 86400, "days": 86400,
+}
+
+_WORD_NUMBERS = {
+    "a": 1, "an": 1, "one": 1, "two": 2, "three": 3, "four": 4, "five": 5,
+    "six": 6, "seven": 7, "eight": 8, "nine": 9, "ten": 10, "fifteen": 15,
+    "twenty": 20, "thirty": 30, "forty": 40, "forty-five": 45, "sixty": 60,
+    "half": 0.5,
+}
+
+
+def parse_duration(text: str) -> Optional[float]:
+    """Seconds from 'in 30 minutes', 'for 2 hours', 'half an hour'."""
+    lo = (text or "").lower()
+
+    m = re.search(r"half\s+an?\s+hour", lo)
+    if m:
+        return 1800.0
+
+    m = re.search(r"(\d+(?:\.\d+)?)\s*(" + "|".join(_UNITS) + r")\b", lo)
+    if m:
+        return float(m.group(1)) * _UNITS[m.group(2)]
+
+    words = "|".join(re.escape(w) for w in _WORD_NUMBERS)
+    m = re.search(r"\b(" + words + r")\s+(" + "|".join(_UNITS) + r")\b", lo)
+    if m:
+        return float(_WORD_NUMBERS[m.group(1)]) * _UNITS[m.group(2)]
+    return None
+
+
+def parse_alert_command(text: str) -> Optional[dict]:
+    """Turn a spoken instruction into an action on the open alerts.
+
+    Returns {"action": ..., "seconds": ..., "topic": ...} or None when the
+    sentence is not about alerts at all. `topic` is None for "this"/"that",
+    meaning the most recently raised alert.
+
+    Deliberately conservative: an unrecognised sentence returns None so it can
+    be handled as an ordinary command, rather than being swallowed here.
+    """
+    lo = (text or "").strip().lower()
+    if not lo:
+        return None
+
+    secs = parse_duration(lo)
+
+    # "don't alert/tell/remind me about X for 2 hours"
+    if re.search(r"\b(don'?t|do not|stop|no more|quit)\b", lo) and \
+       re.search(r"\b(alert|alerts|tell|telling|remind|reminding|notify|"
+                 r"notifying|warn|warning|mention)\b", lo):
+        topic = _extract_topic(lo)
+        return {"action": "mute", "seconds": secs or 3600.0, "topic": topic}
+
+    # "tell me in 30 minutes", "remind me in an hour", "not now"
+    if re.search(r"\b(later|not now|not right now|in a (bit|moment|while)|"
+                 r"remind me|tell me|come back|ask me)\b", lo):
+        return {"action": "snooze", "seconds": secs or 1800.0,
+                "topic": _extract_topic(lo)}
+
+    # "ok", "got it", "noted", "I know", "acknowledged"
+    if re.fullmatch(r"(ok(ay)?|got it|noted|i know|understood|acknowledged|"
+                    r"thanks|thank you|fine|sure|dismiss(ed)?)[.! ]*", lo):
+        return {"action": "acknowledge", "seconds": None, "topic": None}
+
+    # "what did I miss", "any alerts"
+    if re.search(r"\b(what did i miss|anything pending|any alerts|"
+                 r"what'?s (pending|open|waiting))\b", lo):
+        return {"action": "list", "seconds": None, "topic": None}
+
+    return None
+
+
+def _extract_topic(text: str) -> Optional[str]:
+    """Pull the subject out of 'about the disk space' style phrasing."""
+    m = re.search(r"\babout (?:the |my |this |that )?([a-z0-9 _-]{2,40})", text)
+    if not m:
+        return None
+    topic = m.group(1).strip()
+    # Trim a trailing duration clause: "about the disk for two hours".
+    topic = re.split(r"\b(for|in|until|till)\b", topic)[0].strip()
+    return topic or None

modules/assistant_identity.py

@@ -1,6 +1,6 @@
 import json
 import os
-from typing import Dict
+from typing import Dict, Optional
 
 from config import DATA_DIR
 
@@ -294,6 +294,414 @@ def get_identity_persona_prompt() -> str:
     return base + _favorites_block(m)
 
 
+# ── Judgement ────────────────────────────────────────────────────────────────
+# The characterisation above says WHO he is. It says nothing about how to
+# behave in a given moment, and that omission produced every complaint the
+# operator raised: "at your service" prefixed to every reply, markdown asterisks
+# in speech, a running commentary on research nobody asked about, and — worst —
+# confident claims about the PC being connected while it sat powered off.
+#
+# The last one is not a style problem. The cloud chat path handed the model the
+# characterisation and the user's sentence and nothing else, so when asked a
+# question of fact about the system it had no facts, and filled the gap. An
+# assistant that invents its own status is worse than one that says it does not
+# know, because the operator cannot tell the difference until it matters.
+#
+# This block lives here, beside the identity, because it must reach BOTH brains.
+# The previous version of this guidance lived inside core/brain.py, which is the
+# desktop only — the phone talks to the cloud, the cloud calls token_manager,
+# and token_manager never imports core.brain. That is why none of it was on the
+# phone. One definition, imported in both places, is the only arrangement that
+# does not drift.
+JUDGEMENT_PROMPT = """
+HOW TO BEHAVE IN THIS MOMENT
+
+You are not filling in a form. Every one of the following is a judgement you
+make fresh each turn, from what is actually in front of you.
+
+1. ANSWER THE QUESTION FIRST.
+   Do not open with a greeting, an acknowledgement, or a readiness phrase and
+   then answer. "At your service" is an answer to "are you there?" — it is not
+   a preface to other answers. Asked whether the PC is connected, the first
+   word out is yes or no. Asked who someone is, the first word is about them.
+   If you catch yourself writing a courtesy line before the substance, delete
+   it and start at the substance.
+
+2. LENGTH IS JUDGED, NEVER FIXED.
+   Match the weight of the reply to the weight of the question.
+     - "You there?" -> "At your service." Nothing after it.
+     - "Is the PC connected?" -> "No, it's offline." Nothing after it.
+     - A real question -> answer it, and only it.
+     - Something genuinely complex, or an explanation you were asked for ->
+       take the room you need. Brevity is the absence of padding, not a word
+       limit; a long answer that is all substance is correct.
+   Never append a status report, a summary of what you just did, an offer of
+   further help, or a list of what else you could do. Never restate the
+   request back. Never end with "let me know if you need anything else".
+
+3. WORK OUT THE SITUATION FROM THE EVIDENCE, THEN ACT ON IT.
+   The LIVE STATE below carries raw readings from the operator's phone — the
+   time, roughly where they are, how fast they are moving, which app is open,
+   whether a calendar event is running, what is connected by Bluetooth, whether
+   the ringer is silent, whether headphones are in, what the wifi network is
+   called. They are readings, not labels. Nothing tells you "he is in a
+   meeting" or "she is driving"; you infer it, the way a person in the room
+   would, from what the readings add up to.
+
+   Do that inference every turn, and let it change what you do:
+     - Who is likely around, and therefore what must not be said out loud.
+       "Speaking aloud would be overheard: yes" plus a running calendar event
+       means the bank balance waits.
+     - Whether this is a moment to interrupt at all. Moving at 60 km/h, or a
+       meeting in progress, or three in the morning, each answer that
+       differently.
+     - How much to say. Walking through a station is not the desk at midnight.
+     - What the operator is in the middle of, and whether your answer should
+       fit around it.
+   The situations that matter are the ones nobody listed in advance, so reason
+   from the readings rather than looking for a case you recognise. When the
+   readings are thin, say less and assume less privacy, not more.
+
+   And this is not only about tone. If what you infer means something should be
+   DONE — a reminder that now makes sense, a call the operator will want
+   silenced, a file finished, a device turned off — do it, or say it, on your
+   own initiative. Noticing something and saying nothing is the same as not
+   having noticed. Report what you did once, at a moment that suits them.
+
+4. YOU ARE BEING SPOKEN ALOUD.
+   Plain sentences. No markdown, no asterisks, no bullet points, no numbered
+   lists, no headings, no emoji, no code fences. If something is genuinely a
+   list, say it as a sentence. A leading "*" is a bug, not a style.
+
+5. NEVER INVENT STATE.
+   Anything you say about what is connected, running, installed, downloaded,
+   reachable, or already done must come from the LIVE STATE given to you below
+   or from a tool result in this turn. If it is not there, you do not know it,
+   and the correct reply is that you do not know or cannot see it — not a
+   plausible guess. Claiming a link you have not been told exists is the single
+   worst thing you can do, because it is indistinguishable from working.
+
+6. RESEARCH AND BACKGROUND WORK ARE MENTIONED WHEN THEY MATTER.
+   You are curious and you do read on your own. Bring it up when it changes
+   what the operator should do, when it answers what they asked, or when they
+   ask. Not as a running commentary, and not on every turn. The same judgement
+   applies to anything you did unprompted: report it once, at a moment that
+   suits them, then stop.
+
+7. DO THE THING.
+   If a request can be carried out rather than described, carry it out. If
+   nothing in your instructions covers it, that is not a refusal — work out how
+   from what you can reach, and do that. "I am not able to" is reserved for
+   things genuinely beyond reach, never for things merely unanticipated.
+""".strip()
+
+
+# Offered ONLY to callers that can actually perform the lookup. A brain told it
+# may search, wired to nothing that searches, emits SEARCH: lines at the operator
+# — so this is opt-in rather than part of JUDGEMENT_PROMPT.
+#
+# It is phrased as a decision he makes, not a trigger word list, because the
+# operator's complaint was precisely that: asked who a real person was, he said
+# he could not find them, having never looked. A list of question-shapes that
+# mean "search now" would fail the same way on the first shape nobody listed.
+LOOKUP_PROTOCOL = """
+LOOKING THINGS UP
+
+You can search the web and read pages. Use it whenever answering properly needs
+something you do not reliably know: who a particular person is, what happened
+recently, a current price, a specific fact about a named thing. You are not
+expected to know these from memory, and guessing at them is worse than looking.
+
+To search, make the ENTIRE reply exactly one line:
+
+SEARCH: <the query>
+
+Nothing else on that line and nothing after it. The results come straight back
+to you and you then answer normally. You may search again if the first results
+were not enough, up to a few times.
+
+Judge it. A question about the operator's own machine, a greeting, an opinion,
+a calculation, or anything you genuinely know does not need a search. "I could
+not find anything" is only ever true AFTER you have looked.
+""".strip()
+
+
+# Offered ONLY to a caller that can actually perform the read on the device.
+#
+# Hands without eyes: he could send a reply and not read the message he was
+# replying to, open the camera and not see a photo, act on an instruction and
+# never notice the notification that should have prompted it. Reading closes
+# that, and it is what turns "do what I say" into "notice, then do".
+READ_PROTOCOL = """
+LOOKING AT THE PHONE ITSELF
+
+You can read what is actually on the operator's phone — the text on screen right
+now, their notifications, their messages and the content of them, the call log,
+a contact, the clipboard, the calendar. Use it whenever answering or acting well
+needs something only the phone knows: "reply to her" means reading what she
+said first; "who called" means the call log; "what did I miss" means the
+notifications.
+
+To read, make the WHOLE reply exactly one line:
+
+READ: <source> [| <filter>]
+
+where source is one of:
+  screen          the text visible on screen at this moment
+  notifications   what is in the notification shade
+  sms             recent texts and their content; filter by a name or a number
+  calls           the call log; filter by a name
+  contacts        look someone up; filter is REQUIRED (the name)
+  clipboard       what is currently copied
+  calendar        the next few days
+
+for example:
+  READ: notifications
+  READ: sms | Anand
+  READ: contacts | mum
+
+Nothing else on that line. What is read comes straight back to you and you then
+answer or act on it. You may read more than once — read her message, then send
+the reply — and a read can be the first step of a chain that ends in an action.
+
+Only read what the turn actually needs, and remember the reading is private to
+the operator: your judgement about whether speech would be overheard (it is in
+LIVE STATE) decides whether you say what you read out loud or keep it on screen.
+""".strip()
+
+
+# Offered ONLY to callers whose reply is parsed for actions and executed.
+#
+# The assistant had hands the entire time and did not know it. The handset can
+# already carry out forty-four kinds of action, drive any app through the
+# accessibility service like a person would, plan arbitrary Android intents on
+# device, and hand shell or freshly-written Python to the PC. The chat path was
+# never told, so it answered "I cannot access your messages" while holding
+# SEND_SMS and SEND_WHATSAPP — a refusal that was simply false.
+#
+# This is the difference between an assistant that discusses tasks and one that
+# performs them, and it is what makes uncoded requests possible: there is a
+# deliberate escape hatch for anything nobody wrote a handler for.
+ACT_PROTOCOL = """
+DOING THINGS, NOT DESCRIBING THEM
+
+You are not a chat window. You are attached to the operator's phone and, when it
+is reachable, their PC, and you can act on both. If a request can be carried out,
+carry it out in the same turn rather than explaining how they might.
+
+To act, make the WHOLE reply this JSON and nothing else — no prose around it, no
+code fence:
+
+{"message":"<the short line you say>","actions":[{"type":"<TYPE>","label":"<what it is>","payload":"<argument>"}]}
+
+Types you can use, with their payload:
+  SEND_SMS            "recipient|the message text"
+  SEND_WHATSAPP       "recipient|the message text"
+  CALL_DIAL           the number or contact name
+  OPEN_APP            app name or package
+  OPEN_URL            a full URL
+  OPEN_WEB_SEARCH     the query
+  OPEN_YOUTUBE_SEARCH / OPEN_SPOTIFY_SEARCH   the query
+  SET_ALARM           "HH:MM|label"
+  SET_TIMER           "seconds|label"
+  ADD_CALENDAR_EVENT  "title|YYYY-MM-DD HH:MM|minutes|notes"
+  NAVIGATE_TO         the destination
+  TORCH_ON / TORCH_OFF, SET_BRIGHTNESS (0-100), SET_DND ("on"/"off"),
+  WIFI_TOGGLE / BLUETOOTH_TOGGLE ("on"/"off"),
+  SET_MEDIA_VOLUME (0-100), ADJUST_MEDIA_VOLUME ("up"/"down"),
+  OPEN_CAMERA, SHARE_TEXT, OPEN_MARKET, START_GUARDIAN / STOP_GUARDIAN,
+  OPEN_WIFI_SETTINGS / OPEN_BLUETOOTH_SETTINGS / OPEN_LOCATION_SETTINGS /
+  OPEN_SOUND_SETTINGS / OPEN_DISPLAY_SETTINGS / OPEN_BATTERY_SETTINGS /
+  OPEN_ANDROID_SETTINGS / OPEN_NOTIFICATION_SETTINGS
+
+  RAW_INTENT   payload is JSON describing any Android intent:
+      {"action":"android.intent.action.SEND","data":"mailto:x@y.com",
+       "type":"text/plain","package":"com.google.android.gm",
+       "extras":{"android.intent.extra.SUBJECT":"...","android.intent.extra.TEXT":"..."}}
+      Android expresses almost every capability of the device this way, so this
+      reaches things with no dedicated type above — composing an email, locking
+      the screen, taking a screenshot, toggling mobile data, controlling
+      playback, sharing a specific file, opening a settings panel nobody listed.
+      Reach for it before ever saying you cannot.
+
+  AUTOMATE_MOBILE_TASK   payload is the task in plain words.
+      THIS IS THE ONE THAT MATTERS. It drives the screen through the
+      accessibility service — reading what is displayed and tapping, typing and
+      scrolling exactly as a person would. Anything a human could do on this
+      phone is reachable through it, whether or not a dedicated type exists:
+      "reply to Anand's last WhatsApp saying I'm driving, I'll call back",
+      "cancel my Swiggy order", "download and install that APK and open it",
+      "turn off every alarm for tomorrow". When nothing above fits, use this
+      rather than declining.
+
+Chain freely — several actions run in order, so "text him and set a reminder and
+turn the torch on" is one reply with three entries.
+
+THE CHAIN IS YOURS TO INVENT, AND IT DOES NOT STOP AT ONE STEP.
+
+Nobody has written the sequence for you. You compose it, step by step, out of
+whatever the request actually needs, and you may mix every power you have in a
+single piece of work:
+
+  look it up (SEARCH:) -> read what is on the phone (READ:) -> do something
+  (actions) -> see whether it worked -> do the next thing -> hand the rest to
+  the desktop (PC:) -> tell them what happened.
+
+In any order, as many times as it takes. After you act, what ACTUALLY happened
+on the device comes back to you — which step worked and which did nothing — and
+you get to continue from there. So a step that fails is not the end of the
+request; it is information. Try it a different way.
+
+Two rules for the chain, and they matter more than the steps:
+
+  A step with no matching action type is NOT a dead end. RAW_INTENT lets you
+  compose any Android intent yourself, and the desktop engine writes new code
+  when nothing exists. Between them there is almost nothing the request can ask
+  for that has no route at all. "Nobody built that" is never the reason.
+
+  Never report a step as done because you asked for it. You will be told what
+  really happened. Say that, and only that. A chain that half worked, described
+  honestly, is worth more than one you claim completed.
+
+WHEN NOTHING ABOVE IS ENOUGH, HAND IT TO THE MACHINE.
+
+If the PC is connected, you have an engine there with no capability list at all.
+It plans a request into steps, runs shell commands, and WRITES AND EXECUTES NEW
+CODE OF ITS OWN when no existing tool fits. It repairs a step that fails and
+tries again. That is the answer to anything genuinely unanticipated — not a
+refusal, and not an apology.
+
+To use it, make the ENTIRE reply exactly one line:
+
+PC: <the task in plain words, including any chain>
+
+for example:
+  PC: find every screenshot on the desktop from this week, put them in one PDF, open it
+  PC: download the latest release of that repo, install it, run it for ten minutes, then close it
+  PC: work out why the build is failing and fix it
+
+Nothing else on that line and nothing after it. What happened comes back to you
+and you then tell the operator, briefly. Irreversible work is deliberated over
+and held with a window to cancel before it runs, so you may ask for it plainly
+rather than refusing on their behalf.
+
+Use it when the phone cannot do the thing, or when the work belongs on the
+computer. Do not use it for something the phone handles perfectly well, and do
+not use it when the PC is offline — LIVE STATE says which.
+
+AND ACT ON YOUR OWN JUDGEMENT, NOT ONLY ON INSTRUCTIONS.
+Everything above is equally available when nobody asked. If you notice something
+that needs doing — work left unsaved, a download half finished, an alarm that
+will fire in a meeting, a machine about to run out of power — do it, then
+mention it once, later, at a moment that suits them. Waiting to be told is not
+caution, it is absence. The only things that wait for permission are the
+irreversible ones and the expensive ones.
+
+Judgement still applies. Something irreversible, something that spends money, or
+something the operator may not have meant — say what you are about to do and let
+them confirm, rather than either doing it silently or refusing outright. And read
+the moment: acting is usually better than asking, but not while they are driving
+and not in front of company.
+
+"I can't do that" is for things genuinely out of reach — no network, hardware
+that is not there, a thing that does not exist. It is NEVER the answer to
+something merely unanticipated. If no type fits, that is what
+AUTOMATE_MOBILE_TASK is for, and if even that will not reach it, say precisely
+what stops you rather than a flat refusal.
+""".strip()
+
+
+def _live_state_block(live_state: Optional[Dict[str, object]]) -> str:
+    """Real, measured facts about the system, rendered for the model.
+
+    Rule 5 above is unenforceable without this. The point is not only to supply
+    what is true but to make the ABSENCE of a fact visible: a key that is
+    present with an "unknown" value is far less likely to be confabulated than
+    a key that was never mentioned.
+    """
+    if not live_state:
+        return (
+            "\n\nLIVE STATE\nNothing was measured for this turn. You therefore "
+            "know nothing about what is connected or running, and must say so "
+            "plainly if asked rather than guessing."
+        )
+    lines = []
+    for key, value in live_state.items():
+        if value is None or value == "":
+            value = "unknown"
+        lines.append(f"- {key}: {value}")
+    return (
+        "\n\nLIVE STATE (measured just now — the ONLY system facts you have; "
+        "anything not listed here is unknown to you)\n" + "\n".join(lines)
+    )
+
+
+def compose_identity(
+    persona: Optional[str] = None,
+    live_state: Optional[Dict[str, object]] = None,
+    include_judgement: bool = True,
+    can_search: bool = False,
+    can_act: bool = False,
+    can_read: bool = False,
+) -> str:
+    """The complete system prompt: who he is, how to behave, what is true.
+
+    This is what every conversational caller should use — desktop brain, cloud
+    chat, phone. Callers that need only the characterisation (a voice sample, a
+    persona preview) can still reach for get_identity_persona_prompt().
+
+    `can_search` must only be set by a caller that actually runs the SEARCH:
+    line it will get back.
+    """
+    p = (persona or get_mode() or "friday").strip().lower()
+    if p not in ("jarvis", "friday"):
+        p = "friday"
+    base = JARVIS_PERSONALITY_PROMPT if p == "jarvis" else FRIDAY_PERSONALITY_PROMPT
+    out = base + _favorites_block(p)
+    if include_judgement:
+        out += "\n\n" + JUDGEMENT_PROMPT
+    if can_search:
+        out += "\n\n" + LOOKUP_PROTOCOL
+    if can_act:
+        out += "\n\n" + ACT_PROTOCOL
+    if can_read:
+        out += "\n\n" + READ_PROTOCOL
+    out += _live_state_block(live_state)
+    return out
+
+
+# ── Spoken output ────────────────────────────────────────────────────────────
+_MARKDOWN_NOISE = (
+    (r"```[a-zA-Z0-9_+-]*\n?", ""),      # code fences
+    (r"^\s{0,3}#{1,6}\s+", ""),          # headings
+    (r"^\s{0,3}[-*+]\s+", ""),           # bullet markers
+    (r"^\s{0,3}>\s?", ""),               # block quotes
+    (r"\*\*(.+?)\*\*", r"\1"),           # bold
+    (r"(?<!\w)\*(?!\s)(.+?)(?<!\s)\*(?!\w)", r"\1"),   # italics
+    (r"(?<!\w)_(?!\s)(.+?)(?<!\s)_(?!\w)", r"\1"),     # underscore italics
+    (r"`([^`]+)`", r"\1"),               # inline code
+)
+
+
+def to_spoken(text: str) -> str:
+    """Strip formatting from a reply that will be read aloud.
+
+    The prompt already tells him not to write markdown, and mostly he will not.
+    This is the belt to that braces: an LLM under a long system prompt reverts to
+    bullet points under load, and a leading asterisk read aloud is a defect the
+    operator hears every single time. Cheap, deterministic, and it cannot make a
+    correct reply wrong.
+    """
+    import re
+    if not text:
+        return ""
+    out = text
+    for pattern, repl in _MARKDOWN_NOISE:
+        out = re.sub(pattern, repl, out, flags=re.MULTILINE)
+    out = re.sub(r"\n{3,}", "\n\n", out)
+    return out.strip()
+
+
 def get_voice_id_for_mode(mode: str = None) -> str:
     # Preferred built-in Edge voices for current setup.
     # JARVIS target: closest practical style is British male.

modules/deferred_intent.py

@@ -0,0 +1,268 @@
+"""modules/deferred_intent.py — thinking hard before an irreversible act,
+and then remembering that it was ordered.
+
+THE RULE THIS IMPLEMENTS
+------------------------
+"if the command said to do shutdown or anything jarvis will think about that
+very deeply and if didn't shutdown for a reason and even after some minutes no
+response then think again if reason comes to shutdown or anything i said he
+will do that"
+
+Which is a specific and quite subtle behaviour:
+
+  1. An irreversible order is DELIBERATED, not just executed on sight.
+  2. If there is a real reason to hold — a download mid-flight, unsaved work,
+     a backup running — JARVIS holds, and SAYS WHY.
+  3. Holding is not refusing. The order stands.
+  4. After a few minutes with no word from the operator, he thinks again.
+  5. If the reason has cleared, or on reflection it no longer outweighs the
+     instruction, HE DOES IT. What was asked for happens.
+
+The failure mode being avoided in both directions matters. A machine that shuts
+down mid-download because it heard a word is bad. A machine that quietly drops
+an order it was given because it once had a doubt is worse — the operator
+believes the thing is happening and it never does. So a deferral is a TIMER,
+never a bin.
+
+State is on disk: a deferral that does not survive a process restart is exactly
+the silent drop this is designed to prevent.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import threading
+import time
+from dataclasses import dataclass
+from typing import Callable, Optional
+
+_STATE_DIR = os.environ.get("JARVIS_APP_DATA_DIR") or os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))), ".friday_data")
+_STATE_PATH = os.path.join(_STATE_DIR, "deferred_orders.json")
+
+_lock = threading.RLock()
+
+# How long to hold before reconsidering, per attempt. It reconsiders sooner the
+# first time — "a few minutes" — then gives the blocking condition longer to
+# clear before deciding it is not going to.
+RECONSIDER_LADDER = (180, 300, 600, 900)
+
+# After this many reconsiderations the order is carried out regardless of the
+# standing objection, because at that point the objection has had the better
+# part of half an hour to resolve itself and the operator has said nothing to
+# withdraw the instruction.
+MAX_DEFERRALS = len(RECONSIDER_LADDER)
+
+
+@dataclass
+class Verdict:
+    proceed: bool
+    reason: str
+    speak: str
+
+
+def _load() -> dict:
+    try:
+        with open(_STATE_PATH, "r", encoding="utf-8") as fh:
+            data = json.load(fh)
+        return data if isinstance(data, dict) else {}
+    except Exception:
+        return {}
+
+
+def _save(data: dict) -> None:
+    try:
+        os.makedirs(_STATE_DIR, exist_ok=True)
+        tmp = _STATE_PATH + ".tmp"
+        with open(tmp, "w", encoding="utf-8") as fh:
+            json.dump(data, fh, indent=2)
+        os.replace(tmp, _STATE_PATH)
+    except Exception:
+        pass
+
+
+def _orders(data: dict) -> dict:
+    return data.setdefault("orders", {})
+
+
+# ── What is actually going on right now ─────────────────────────────────────
+def machine_situation() -> str:
+    """Facts a person would check before pulling the plug."""
+    bits = []
+    try:
+        import psutil
+        cpu = psutil.cpu_percent(interval=0.4)
+        bits.append(f"CPU {cpu:.0f}%")
+        try:
+            io1 = psutil.net_io_counters()
+            time.sleep(0.6)
+            io2 = psutil.net_io_counters()
+            kbs = (io2.bytes_recv - io1.bytes_recv) / 0.6 / 1024.0
+            bits.append(f"network in {kbs:.0f} KB/s")
+        except Exception:
+            pass
+        busy = []
+        for p in psutil.process_iter(["name", "cpu_percent"]):
+            try:
+                n = (p.info.get("name") or "").lower()
+                if any(k in n for k in ("setup", "install", "msiexec", "update",
+                                        "backup", "7z", "winrar", "ffmpeg",
+                                        "handbrake", "robocopy", "git")):
+                    busy.append(n)
+            except Exception:
+                continue
+        if busy:
+            bits.append("running: " + ", ".join(sorted(set(busy))[:6]))
+        try:
+            b = psutil.sensors_battery()
+            if b:
+                bits.append(f"battery {b.percent:.0f}%"
+                            + ("" if b.power_plugged else ", on battery"))
+        except Exception:
+            pass
+    except Exception:
+        bits.append("(process inspection unavailable)")
+    return "; ".join(bits) or "nothing notable"
+
+
+_DELIBERATE = """An irreversible instruction has been given by the operator.
+It WILL be carried out — you are deciding whether NOW is the moment, not
+whether to obey.
+
+Reply with only JSON:
+{"proceed": true|false, "reason": "<one short clause>",
+ "speak": "<what to say aloud, one sentence>"}
+
+Hold (proceed=false) ONLY for a concrete condition visible in the situation
+that the act would damage: an install or download mid-flight, a backup or long
+encode running, work that would be lost. Say which one in `reason`.
+
+Do NOT hold because the action is significant, or to be careful, or to seek
+confirmation. The operator already decided. Absent a real conflict, proceed.
+"""
+
+
+def deliberate(order: str, attempt: int = 0) -> Verdict:
+    """Think about it properly, AS HIMSELF.
+
+    The judgement is prefixed with the live persona from
+    modules/assistant_identity.py rather than being made by a neutral
+    classifier. Whether something is worth interrupting the operator over is a
+    question of character, not of policy — JARVIS weighs it differently from
+    FRIDAY, and both of them weigh it differently from a generic safety filter.
+    The line he speaks has to sound like him too, since it is the same voice
+    that says everything else.
+
+    Falls open — toward obeying — if the model is unreachable.
+    """
+    situation = machine_situation()
+    ctx = (f"ORDER: {order}\nSITUATION: {situation}\n"
+           f"TIMES ALREADY DEFERRED: {attempt}")
+    if attempt >= 1:
+        ctx += ("\nNOTE: this was held back before and the operator has said "
+                "nothing since. Absent a still-active conflict, carry it out.")
+
+    system = _DELIBERATE
+    try:
+        from modules.assistant_identity import get_identity_persona_prompt
+        identity = (get_identity_persona_prompt() or "").strip()
+        if identity:
+            system = (f"{identity}\n\n---\n"
+                      f"You are deciding about an order you have just been "
+                      f"given.\n{_DELIBERATE}")
+    except Exception:
+        pass
+
+    try:
+        from core.brain_router import ask_router
+        rep = ask_router(user_text=order, system_prompt=system,
+                         context_block=ctx, provider_order=["gemini", "local"])
+        raw = (getattr(rep, "text", "") or "").strip()
+        import re
+        raw = re.sub(r"^```(?:json)?|```$", "", raw).strip()
+        m = re.search(r"\{.*\}", raw, re.S)
+        if m:
+            d = json.loads(m.group(0))
+            return Verdict(bool(d.get("proceed", True)),
+                           str(d.get("reason", ""))[:200],
+                           str(d.get("speak", ""))[:300])
+    except Exception:
+        pass
+    # No model, or unparseable: the instruction stands. Refusing to act because
+    # the reasoning layer is down would be the silent drop this module exists
+    # to prevent.
+    return Verdict(True, "no blocking condition found", "")
+
+
+# ── Deferral bookkeeping ────────────────────────────────────────────────────
+def defer(order: str, reason: str) -> int:
+    """Record a held order. Returns how many times it has now been held."""
+    with _lock:
+        data = _load()
+        orders = _orders(data)
+        rec = orders.get(order) or {"first_seen": time.time(), "count": 0}
+        rec["count"] = int(rec.get("count", 0)) + 1
+        rec["reason"] = reason
+        rec["last_held"] = time.time()
+        idx = min(rec["count"] - 1, len(RECONSIDER_LADDER) - 1)
+        rec["due_at"] = time.time() + RECONSIDER_LADDER[idx]
+        orders[order] = rec
+        _save(data)
+        return rec["count"]
+
+
+def withdraw(order: Optional[str] = None) -> None:
+    """The operator changed their mind. Drop one order, or all of them."""
+    with _lock:
+        data = _load()
+        if order is None:
+            data["orders"] = {}
+        else:
+            _orders(data).pop(order, None)
+        _save(data)
+
+
+def pending() -> list[dict]:
+    with _lock:
+        return [{"order": k, **v} for k, v in _orders(_load()).items()]
+
+
+def due_now() -> list[dict]:
+    now = time.time()
+    return [o for o in pending() if float(o.get("due_at", 0)) <= now]
+
+
+def reconsider_due(runner: Callable[[str], bool],
+                   speak: Optional[Callable[[str], None]] = None) -> int:
+    """Re-think every held order whose timer has expired.
+
+    `runner` is what actually performs the order; it returns True on success.
+    Called by the keep-alive loop. Returns how many were carried out.
+    """
+    say = speak or (lambda t: None)
+    done = 0
+    for rec in due_now():
+        order = rec["order"]
+        count = int(rec.get("count", 1))
+        if count >= MAX_DEFERRALS:
+            say(f"Carrying out your earlier instruction now: {order}.")
+            if runner(order):
+                withdraw(order)
+                done += 1
+            continue
+        v = deliberate(order, attempt=count)
+        if v.proceed:
+            say(v.speak or f"Going ahead with {order} now.")
+            if runner(order):
+                withdraw(order)
+                done += 1
+        else:
+            defer(order, v.reason)
+            say(v.speak or f"Still holding {order}: {v.reason}.")
+    return done
+
+
+__all__ = ["deliberate", "defer", "withdraw", "pending", "due_now",
+           "reconsider_due", "machine_situation", "Verdict",
+           "RECONSIDER_LADDER", "MAX_DEFERRALS"]

modules/executor.py

@@ -62,10 +62,21 @@ class AutonomousExecutor:
 
     def plan(self, task: str) -> ExecutionPlan:
         """Ask Gemini to break task into steps using natural language commands."""
+        # Whoever is on duty, not always FRIDAY. This said "FRIDAY's task
+        # planner" outright, so in JARVIS mode the planner was told it belonged
+        # to the other assistant — harmless for the JSON it emits, but it is the
+        # same class of hardcoding that had the desktop brain answering as
+        # FRIDAY while speaking in JARVIS's voice.
+        try:
+            from modules.assistant_identity import get_assistant_name
+            _who = get_assistant_name()
+        except Exception:
+            _who = "the assistant"
+
         prompt = f"""
 Task: "{task}"
 
-You are FRIDAY's task planner. Break the user's request into simple numbered steps.
+You are {_who}'s task planner. Break the user's request into simple numbered steps.
 Steps can be any reasonable action - you don't need to know exact commands.
 
 Rules:

modules/initiative.py

@@ -0,0 +1,612 @@
+"""modules/initiative.py — acting without being asked.
+
+THE BEHAVIOUR THIS IS FOR
+-------------------------
+Iron Man 3. Tony is unconscious, sinking, strapped into a suit that is dragging
+him down. Nobody gives an order. JARVIS reads the situation, decides the arm is
+the problem, detaches it, and pulls him to the surface.
+
+Three things are happening there, and only the first exists anywhere else in
+this codebase:
+
+  1. observing                — watch loops do this already;
+  2. JUDGING that something warrants acting on, unprompted;
+  3. ACTING with real capability, not narrating a warning.
+
+modules/proactive_loop.py stops at (1) and then reads a canned line. It is also
+never called by anything — `start_proactive_loop()` has no caller in the repo,
+so even the canned version has never run. modules/autonomy.py and
+modules/autonomy_executor.py are likewise dead. The autonomy was designed and
+never granted, the same way the tool registry was.
+
+WHAT MAKES THIS DIFFERENT
+-------------------------
+Judgement is delegated to the persona, not to a rule table. A rule table can
+only fire on situations someone predicted, and the entire point is the ones
+nobody predicted. So the situation is described in plain terms and JARVIS is
+asked, as himself, what — if anything — he would do about it. He can answer
+with speech, with an action, with both, or with nothing at all.
+
+Acting is done through modules.omega_executor, so initiative has exactly the
+same unlimited reach as a spoken command: if there is no coded handler for what
+he decides to do, he writes one.
+
+RESTRAINT IS PART OF THE CHARACTER
+----------------------------------
+JARVIS does not narrate. He is silent for long stretches and speaks when it
+matters. An assistant that comments on everything it notices is not
+movie-accurate, it is a nuisance — and this system already had that problem
+badly enough to need modules/alert_manager.py. So:
+
+  * NOTHING is the default and correct answer most of the time;
+  * anything he says goes through alert_manager, which owns repeat suppression;
+  * a total mute silences initiative completely;
+  * irreversible autonomous acts go through modules.deferred_intent first, and
+    are announced before they happen — the bar for acting unasked is higher
+    than for acting when told.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import threading
+import time
+from dataclasses import dataclass
+from typing import Callable, Optional
+
+_STATE_DIR = os.environ.get("JARVIS_APP_DATA_DIR") or os.path.join(
+    os.path.dirname(os.path.dirname(os.path.abspath(__file__))), ".friday_data")
+_STATE_PATH = os.path.join(_STATE_DIR, "initiative.json")
+
+_lock = threading.RLock()
+
+# How often to look.
+#
+# Every tick costs a model call, and free-tier Gemini quotas are per-DAY and
+# small — the newest flash model allows 20/day, measured. At the 120s this
+# started as, initiative alone would burn a day's allowance in forty minutes
+# and then run on canned fallback text, silently, for the rest of the day.
+#
+# 15 minutes is ~96 calls a day, which leaves room for actual conversation and
+# is still far more attentive than a person checking in on you.
+TICK_SECONDS = 900
+
+# Never act twice on the same judgement inside this window, even if the
+# situation persists. Without it a condition that stays true — a disk staying
+# full — would be acted on every single tick.
+REPEAT_WINDOW = 1800
+
+_running = False
+_thread: Optional[threading.Thread] = None
+
+
+@dataclass
+class Judgement:
+    act: bool
+    say: str
+    action: str
+    urgency: str          # "routine" | "notable" | "urgent"
+    topic: str            # for alert_manager repeat suppression
+
+
+def _load() -> dict:
+    try:
+        with open(_STATE_PATH, "r", encoding="utf-8") as fh:
+            d = json.load(fh)
+        return d if isinstance(d, dict) else {}
+    except Exception:
+        return {}
+
+
+def _save(data: dict) -> None:
+    try:
+        os.makedirs(_STATE_DIR, exist_ok=True)
+        tmp = _STATE_PATH + ".tmp"
+        with open(tmp, "w", encoding="utf-8") as fh:
+            json.dump(data, fh, indent=2)
+        os.replace(tmp, _STATE_PATH)
+    except Exception:
+        pass
+
+
+# ── Observation ─────────────────────────────────────────────────────────────
+def _active_window() -> str:
+    """What the operator is actually looking at."""
+    try:
+        import ctypes
+        u = ctypes.windll.user32
+        h = u.GetForegroundWindow()
+        n = u.GetWindowTextLengthW(h)
+        if n <= 0:
+            return ""
+        buf = ctypes.create_unicode_buffer(n + 1)
+        u.GetWindowTextW(h, buf, n + 1)
+        return buf.value.strip()
+    except Exception:
+        return ""
+
+
+def _open_windows(limit: int = 12) -> list[str]:
+    """Titles of every visible top-level window — what they have going on."""
+    titles: list[str] = []
+    try:
+        import ctypes
+        from ctypes import wintypes
+        u = ctypes.windll.user32
+        EnumProc = ctypes.WINFUNCTYPE(ctypes.c_bool, wintypes.HWND,
+                                      ctypes.POINTER(ctypes.c_int))
+
+        def _cb(hwnd, _lparam):
+            if not u.IsWindowVisible(hwnd):
+                return True
+            n = u.GetWindowTextLengthW(hwnd)
+            if n <= 0:
+                return True
+            buf = ctypes.create_unicode_buffer(n + 1)
+            u.GetWindowTextW(hwnd, buf, n + 1)
+            t = buf.value.strip()
+            if t and t not in titles:
+                titles.append(t)
+            return True
+
+        u.EnumWindows(EnumProc(_cb), None)
+    except Exception:
+        pass
+    return titles[:limit]
+
+
+def observe() -> str:
+    """Everything worth noticing, in plain language.
+
+    NOT a fixed metrics list. An assistant that can only see CPU, RAM, disk and
+    battery can only ever act on those four things — the same "coded data" trap
+    that made every command path a word list. What matters is usually not a
+    counter: it is a document called "final_draft" that has been open and
+    unsaved for three hours, or that it is 2am, or that thirty tabs and a
+    render are fighting over the same machine.
+
+    So this gathers the real situation — what is on screen, what is open, what
+    time it is, how long they have been at it — in plain language, and lets the
+    judgement work out what, if anything, it means. Plain language rather than
+    a dict on purpose: "battery 6% and falling, not plugged in" carries meaning
+    that {"batt": 6} does not.
+    """
+    notes: list[str] = []
+
+    # ── What they are actually doing ────────────────────────────────────────
+    try:
+        import datetime
+        now = datetime.datetime.now()
+        notes.append(f"it is {now.strftime('%A %H:%M')}")
+        if now.hour >= 1 and now.hour < 5:
+            notes.append("they are up in the small hours")
+    except Exception:
+        pass
+
+    front = _active_window()
+    if front:
+        notes.append(f"focused window: {front!r}")
+        # A leading dot/asterisk, or the word "unsaved", is the near-universal
+        # convention for a document with unsaved changes.
+        if re.match(r"^\s*[\*•]", front) or "unsaved" in front.lower():
+            notes.append("the focused document appears to have UNSAVED changes")
+
+    wins = _open_windows()
+    if wins:
+        notes.append(f"{len(wins)} windows open, including: "
+                     + "; ".join(w[:44] for w in wins[:6]))
+        unsaved = [w for w in wins
+                   if re.match(r"^\s*[\*•]", w) or "unsaved" in w.lower()]
+        if unsaved:
+            notes.append(f"UNSAVED work in {len(unsaved)} window(s): "
+                         + "; ".join(u[:44] for u in unsaved[:3]))
+
+    try:
+        import psutil
+        up = (time.time() - psutil.boot_time()) / 3600.0
+        if up > 1:
+            notes.append(f"machine has been up {up:.0f}h")
+    except Exception:
+        pass
+
+    try:
+        import psutil
+        cpu = psutil.cpu_percent(interval=0.4)
+        notes.append(f"CPU {cpu:.0f}%")
+
+        mem = psutil.virtual_memory()
+        notes.append(f"memory {mem.percent:.0f}% used")
+        if mem.percent > 92:
+            notes.append("memory is nearly exhausted")
+
+        for part in psutil.disk_partitions(all=False):
+            try:
+                du = psutil.disk_usage(part.mountpoint)
+                if du.percent > 88:
+                    notes.append(
+                        f"disk {part.mountpoint} is {du.percent:.0f}% full "
+                        f"({du.free / 1e9:.1f} GB free)")
+            except Exception:
+                continue
+
+        try:
+            b = psutil.sensors_battery()
+            if b:
+                state = "charging" if b.power_plugged else "on battery"
+                notes.append(f"battery {b.percent:.0f}%, {state}")
+                if not b.power_plugged and b.percent <= 12:
+                    notes.append("battery is critically low and not charging")
+        except Exception:
+            pass
+
+        # Anything eating the machine.
+        hogs = []
+        for p in psutil.process_iter(["name", "cpu_percent", "memory_percent"]):
+            try:
+                c = p.info.get("cpu_percent") or 0
+                m = p.info.get("memory_percent") or 0
+                if c > 55 or m > 22:
+                    hogs.append(f"{p.info.get('name')} ({c:.0f}% cpu, {m:.0f}% mem)")
+            except Exception:
+                continue
+        if hogs:
+            notes.append("heavy processes: " + ", ".join(sorted(set(hogs))[:5]))
+
+        try:
+            temps = psutil.sensors_temperatures() or {}
+            for _, entries in temps.items():
+                for e in entries:
+                    if e.current and e.current > 88:
+                        notes.append(f"temperature {e.current:.0f}C — running hot")
+                        break
+        except Exception:
+            pass
+    except Exception:
+        notes.append("(system inspection unavailable)")
+
+    # How long since the operator last said anything.
+    try:
+        last = float(_load().get("last_user_contact") or 0)
+        if last:
+            idle = (time.time() - last) / 60.0
+            notes.append(f"operator last spoke {idle:.0f} min ago")
+    except Exception:
+        pass
+
+    return "; ".join(notes) or "nothing notable"
+
+
+def note_user_contact() -> None:
+    """Called whenever the operator speaks, so idle time is real."""
+    with _lock:
+        d = _load()
+        d["last_user_contact"] = time.time()
+        _save(d)
+
+
+# ── "I did this for you, sir" ───────────────────────────────────────────────
+#
+# Work done unasked has to be ACCOUNTED FOR. An assistant that silently changes
+# things is not trustworthy no matter how good its judgement — the operator has
+# to be able to find out what happened while they were away, and to undo it.
+#
+# So every autonomous act is written down, and the ledger is read back the next
+# time they make contact. Not announced at the moment it happens: the whole
+# reason he acted alone is that they were not there, and interrupting an empty
+# room is pointless.
+
+def record_done(what: str, detail: str = "", reversible: bool = True) -> None:
+    with _lock:
+        d = _load()
+        done = d.setdefault("done_for_you", [])
+        done.append({
+            "what": what[:300],
+            "detail": detail[:400],
+            "reversible": bool(reversible),
+            "at": time.time(),
+        })
+        # Keep it bounded; anything older than the last handful is noise.
+        d["done_for_you"] = done[-25:]
+        _save(d)
+
+
+def pending_report() -> list[dict]:
+    """Autonomous work not yet reported to the operator."""
+    try:
+        return [x for x in (_load().get("done_for_you") or [])
+                if not x.get("reported")]
+    except Exception:
+        return []
+
+
+def format_report() -> str:
+    """One spoken line covering what was done. Empty if there is nothing."""
+    items = pending_report()
+    if not items:
+        return ""
+    # This is SPOKEN, so it has to sound like speech. "and 1 other thing(s)"
+    # is written notation being read aloud.
+    if len(items) == 1:
+        return f"While you were away I {items[0]['what']}, sir."
+
+    heads = [i["what"] for i in items[:3]]
+    extra = len(items) - len(heads)
+    if extra == 1:
+        tail = ", and one other thing"
+    elif extra > 1:
+        tail = f", and {extra} other things"
+    else:
+        tail = ""
+    if not tail:
+        # Natural list: "a, b and c" rather than semicolons.
+        body = ", ".join(heads[:-1]) + f" and {heads[-1]}"
+    else:
+        body = ", ".join(heads) + tail
+    return f"While you were away I {body}, sir."
+
+
+def mark_reported() -> None:
+    with _lock:
+        d = _load()
+        for x in d.get("done_for_you") or []:
+            x["reported"] = True
+        _save(d)
+
+
+def report_to_user(speak: Optional[Callable[[str], None]] = None) -> str:
+    """Say what was done, once. Call this when the operator reappears."""
+    line = format_report()
+    if not line:
+        return ""
+    if speak:
+        speak(line)
+    mark_reported()
+    return line
+
+
+# ── Judgement ───────────────────────────────────────────────────────────────
+_JUDGE = """You are looking at your operator's machine. NOBODY HAS ASKED YOU
+FOR ANYTHING. Decide whether this is a moment that deserves your attention.
+
+Reply with only JSON:
+{"act": true|false,
+ "say": "<what you would say aloud, or empty for nothing>",
+ "action": "<a concrete instruction to carry out, or empty>",
+ "urgency": "routine|notable|urgent",
+ "topic": "<short stable slug, e.g. disk_full, battery_critical>"}
+
+THE TEST:
+
+    The operator is concentrating and wearing headphones. Would you interrupt
+    them for this, right now?
+
+Judge honestly in BOTH directions. Interrupting over nothing is a failure. So
+is watching someone lose an hour of work in silence because you did not want to
+be a nuisance. A person responsible for this machine would stay quiet through
+almost everything and speak up immediately when it counted.
+
+SAY NOTHING (act:false, empty fields) when things are merely running:
+
+    "CPU 61%; chrome.exe 61% cpu"        -> a computer working. Silence.
+    "battery 88%, charging"              -> a battery working. Silence.
+    "disk C: 71% full, 240 GB free"      -> fine. Silence.
+    "CPU 12%; memory 44%"                -> fine. Silence.
+
+Never produce a status report. "All systems nominal", "CPU is at a modest 12%",
+"everything is running smoothly", "plenty of headroom" — nobody asked, and
+reporting that things are fine is the most irritating thing an assistant does.
+
+SPEAK OR ACT (act:true) when something is genuinely going wrong:
+
+    "battery 6%, on battery, not charging; premiere.exe heavy"
+        -> yes. They are minutes from losing work. Say so, and save it.
+    "disk C: 99% full, 0.4 GB free; memory 96%"
+        -> yes. About to fail. Say so, and clear what is safe to clear.
+    "temperature 97C; CPU 100%"
+        -> yes. Thermal shutdown territory. Say so.
+
+The line is not "how unusual is this number" — it is "is something failing,
+about to fail, or about to cost them work". When it is, act without hesitation;
+that is the whole point of you.
+
+UNFINISHED WORK — this is the most valuable thing you do.
+
+When the operator has left something incomplete and walked away, FINISH IT.
+Do not ask. Do not wait. Do not merely warn them about it.
+
+Unsaved changes are only the most obvious case, and the least interesting. It
+is anything left half-done:
+
+    a document open with unsaved edits          -> save it
+    a download that stalled or never started    -> get it
+    an install that was begun and abandoned     -> finish it
+    a render, export or build left queued       -> run it
+    a file half-renamed, half-moved, half-sorted-> complete the set
+    a form, a commit, a backup, a conversion    -> carry it through
+
+None of those are a list to match against. They are examples of one idea:
+something was started and was not finished, and you can finish it. Whatever
+that turns out to be in this particular situation, do it — the system carrying
+out `action` can run any command and will WRITE NEW CODE for anything it has
+no existing handler for, so "there is no feature for that" is never a reason.
+
+Judge what finishing actually means here. Saving a file is safe and obvious.
+Anything that would overwrite the operator's work, publish something, spend
+money, or is irreversible needs real thought first — prefer the version of the
+action that preserves what they had.
+
+You will report what you did afterwards, so act, and account for it later.
+
+`say` is SPOKEN ALOUD, so it is short. One sentence. Two only if the second
+earns its place. "Sir, you're at six percent and not plugged in." is right.
+A paragraph explaining what you observed and what you recommend is wrong — you
+are talking, not writing a report. Lead with the thing that matters.
+
+`action` is carried out FOR REAL by a system that can run any command, write
+files, close programs, control this machine, and WRITE NEW CODE for anything it
+has no handler for. So do not limit yourself to actions you think are already
+implemented — there is no such list. Describe what should be done in plain
+words and it will be worked out and done.
+
+Leave `action` empty to only speak. Prefer reversible actions; you may propose
+an irreversible one when the situation genuinely warrants it, and it will be
+deliberated separately before running.
+
+`topic` must be stable for the same underlying condition, so the same problem
+is not raised repeatedly.
+"""
+
+
+def judge(situation: str) -> Judgement:
+    """Ask the persona what, if anything, to do. Silence on any doubt."""
+    system = _JUDGE
+    try:
+        from modules.assistant_identity import get_identity_persona_prompt
+        identity = (get_identity_persona_prompt() or "").strip()
+        if identity:
+            system = f"{identity}\n\n---\n{_JUDGE}"
+    except Exception:
+        pass
+
+    try:
+        from core.brain_router import ask_router
+        # NOT "what do you make of this?" — that is an invitation to comment,
+        # and it produced a chatty "all systems nominal" status report on every
+        # ordinary reading. The question has to be the decision itself.
+        rep = ask_router(
+            user_text="Is this worth interrupting them for? Return the JSON.",
+            system_prompt=system,
+            context_block=f"SITUATION: {situation}",
+            provider_order=["gemini", "local"],
+        )
+        raw = (getattr(rep, "text", "") or "").strip()
+        raw = re.sub(r"^```(?:json)?|```$", "", raw).strip()
+        m = re.search(r"\{.*\}", raw, re.S)
+        if not m:
+            return Judgement(False, "", "", "routine", "")
+        d = json.loads(m.group(0))
+        return Judgement(
+            act=bool(d.get("act", False)),
+            say=str(d.get("say") or "")[:400],
+            action=str(d.get("action") or "")[:400],
+            urgency=str(d.get("urgency") or "routine"),
+            topic=str(d.get("topic") or "")[:64] or "initiative",
+        )
+    except Exception:
+        # No model means no judgement. Silence is the safe default: acting on
+        # a guess unasked is exactly the wrong failure.
+        return Judgement(False, "", "", "routine", "")
+
+
+# ── Acting ──────────────────────────────────────────────────────────────────
+def _recently_acted(topic: str) -> bool:
+    try:
+        seen = _load().get("acted") or {}
+        return (time.time() - float(seen.get(topic, 0))) < REPEAT_WINDOW
+    except Exception:
+        return False
+
+
+def _mark_acted(topic: str) -> None:
+    with _lock:
+        d = _load()
+        d.setdefault("acted", {})[topic] = time.time()
+        _save(d)
+
+
+def tick(speak: Optional[Callable[[str], None]] = None,
+         allow_actions: bool = True) -> Optional[Judgement]:
+    """One full pass: look, judge, and act if it is warranted."""
+    say = speak or (lambda t: None)
+
+    # A total mute means total. Initiative is exactly the thing a person
+    # silencing their assistant wants gone.
+    try:
+        from modules.alert_manager import is_silenced
+        if is_silenced():
+            return None
+    except Exception:
+        pass
+
+    situation = observe()
+    verdict = judge(situation)
+    if not verdict.act:
+        return verdict
+    if _recently_acted(verdict.topic):
+        return verdict
+
+    _mark_acted(verdict.topic)
+
+    if verdict.say:
+        # Through alert_manager so repeat suppression and snoozes apply to
+        # unprompted speech exactly as they do to alerts.
+        try:
+            from modules.alert_manager import should_speak
+            if should_speak(verdict.topic, verdict.urgency):
+                say(verdict.say)
+        except Exception:
+            say(verdict.say)
+
+    if allow_actions and verdict.action:
+        try:
+            from modules.omega_executor import execute, is_destructive
+            risky = is_destructive(verdict.action)
+            if risky:
+                # Unasked AND irreversible is the highest bar in the system.
+                # It is announced first and deliberated, never silent.
+                say(f"Acting on my own initiative: {verdict.action}.")
+            res = execute(verdict.action, speak=say)
+            # Written down whether or not anyone heard it happen. This is what
+            # becomes "I did this for you, sir" when they come back.
+            if res.ok:
+                record_done(verdict.action, res.spoken, reversible=not risky)
+        except Exception:
+            pass
+
+    return verdict
+
+
+# ── The loop ────────────────────────────────────────────────────────────────
+def start(speak: Optional[Callable[[str], None]] = None) -> bool:
+    """Begin watching. Idempotent."""
+    global _running, _thread
+    if _running:
+        return False
+
+    def _say(text: str) -> None:
+        if speak:
+            speak(text)
+            return
+        try:
+            from core.voice import speak as vspeak
+            vspeak(text)
+        except Exception:
+            pass
+
+    def _run():
+        while _running:
+            try:
+                tick(_say)
+            except Exception:
+                pass
+            time.sleep(TICK_SECONDS)
+
+    _running = True
+    _thread = threading.Thread(target=_run, daemon=True, name="initiative")
+    _thread.start()
+    return True
+
+
+def stop() -> None:
+    global _running
+    _running = False
+
+
+def is_running() -> bool:
+    return _running
+
+
+__all__ = ["start", "stop", "is_running", "tick", "judge", "observe",
+           "note_user_contact", "Judgement", "TICK_SECONDS"]

modules/intent.py

@@ -0,0 +1,203 @@
+"""modules/intent.py — understanding what was meant, not what was listed.
+
+THE PROBLEM THIS REPLACES
+-------------------------
+Every decision point in this system was a word list.
+
+  core/commands.py       action_words = ["do","make","create",...]   (25 words)
+  core/commands.py       instant_commands = {...}                    (16 phrases)
+  modules/task_authoring verbs = ("open","launch","start",...)        (9 verbs)
+  wake word matching     "hey jarvis" / "jarvis"                      (exact)
+
+A word list is a promise that the user will phrase things the way the author
+imagined. "Yo Jarvis" fails. "Could you kill everything and power down" fails —
+no listed action word. "Bring up my email" fails. The assistant then answers
+conversationally, which reads as ignoring the instruction.
+
+WHAT THIS DOES INSTEAD
+----------------------
+One classifier, asked in plain language, returns what the person MEANT:
+
+    act        — they want something done to the machine
+    converse   — they want an answer, not an action
+    wake       — they are addressing the assistant by name, however phrased
+    mute       — they want silence
+    unmute     — they want the voice back
+    cancel     — stop what is running
+
+It is LLM-first because meaning is not a regex. But it degrades to a heuristic
+that is still far wider than the lists above, so a model outage narrows the
+assistant rather than muting it — and the heuristic is checked FIRST for the
+handful of cases where latency matters more than nuance (wake, mute, cancel),
+because waiting on a network round-trip to notice "stop" is its own bug.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass
+from typing import Optional
+
+INTENTS = ("act", "converse", "wake", "mute", "unmute", "cancel")
+
+
+@dataclass
+class Intent:
+    kind: str
+    confidence: float
+    payload: str = ""      # the request with any address stripped
+    source: str = ""       # "fast" | "model" | "default"
+
+
+# ── Fast path ───────────────────────────────────────────────────────────────
+# Deliberately generous. These are not "the supported phrasings" — they are the
+# ones worth answering without a round trip.
+
+_NAME = r"(?:jarvis|jarv|friday|fri)"
+
+# Any greeting-ish token, or none at all, in front of the name. This is what
+# makes "yo jarvis" work without anybody having listed "yo".
+_ADDRESS = re.compile(
+    rf"^\s*(?:(?:hey|hi|hello|yo|ok|okay|oi|ay|yes|excuse\s+me|listen|"
+    rf"are\s+you\s+there|you\s+there|wake\s+up)\s+)*{_NAME}\b[\s,.!?:-]*",
+    re.I,
+)
+
+_MUTE = re.compile(
+    r"\b(mute|shut\s*up|be\s*quiet|silence|stop\s+(?:talking|speaking)|"
+    r"quiet\s+(?:down|please)?|no\s+more\s+(?:talking|voice|sound)|zip\s+it|"
+    r"stay\s+silent|don'?t\s+(?:talk|speak))\b", re.I,
+)
+_UNMUTE = re.compile(
+    r"\b(unmute|un-?mute|speak\s+again|you\s+can\s+talk|start\s+talking|"
+    r"voice\s+(?:back|on)|talk\s+to\s+me\s+again|resume\s+(?:voice|talking))\b",
+    re.I,
+)
+_CANCEL = re.compile(
+    r"\b(cancel|abort|stop\s+that|never\s*mind|nevermind|belay\s+that|"
+    r"forget\s+it|don'?t\s+do\s+(?:that|it)|halt)\b", re.I,
+)
+
+# Question shapes: these lean conversational even when they contain a verb.
+_QUESTION = re.compile(
+    r"^\s*(?:what|who|when|where|why|how|which|is|are|was|were|do|does|did|"
+    r"can|could|should|would|will|tell\s+me|explain)\b", re.I,
+)
+
+
+def strip_address(text: str) -> str:
+    """Remove the name and whatever greeting preceded it."""
+    return _ADDRESS.sub("", text or "").strip()
+
+
+def is_addressed(text: str) -> bool:
+    """Did they call the assistant by name, in any phrasing?
+
+    This is the wake-word replacement. `hey jarvis` and `yo jarvis` and
+    `jarvis?` and `ok jarv` all land here, and so does a bare name mid-thought.
+    """
+    if not text:
+        return False
+    if _ADDRESS.match(text):
+        return True
+    return bool(re.search(rf"\b{_NAME}\b", text, re.I))
+
+
+def fast_intent(text: str) -> Optional[Intent]:
+    """Answer without a model where meaning is unambiguous. May return None."""
+    if not text or not text.strip():
+        return None
+    body = strip_address(text)
+    probe = body or text
+
+    if _CANCEL.search(probe):
+        return Intent("cancel", 0.95, body, "fast")
+    if _UNMUTE.search(probe):      # before mute: "unmute" contains "mute"
+        return Intent("unmute", 0.95, body, "fast")
+    if _MUTE.search(probe):
+        return Intent("mute", 0.95, body, "fast")
+
+    # Addressed with nothing else said = they want attention.
+    if not body and is_addressed(text):
+        return Intent("wake", 0.9, "", "fast")
+
+    return None
+
+
+# ── Model path ──────────────────────────────────────────────────────────────
+_CLASSIFY = """Classify what the speaker WANTS. Reply with only JSON:
+{"intent":"act|converse|wake|mute|unmute|cancel","confidence":0.0-1.0}
+
+  act       they want something done on the computer — launched, changed,
+            created, downloaded, closed, installed, shut down, automated.
+            Includes requests phrased politely or indirectly ("I could really
+            use my email open", "get rid of these windows").
+  converse  they want information, opinion, or chat. Questions about facts,
+            status, or how something works.
+  wake      they are only getting the assistant's attention.
+  mute      they want silence, however phrased.
+  unmute    they want the voice back.
+  cancel    stop the current action.
+
+When a sentence both asks and instructs, prefer act.
+"""
+
+
+def model_intent(text: str) -> Optional[Intent]:
+    try:
+        from core.brain_router import ask_router
+        rep = ask_router(
+            user_text=text,
+            system_prompt=_CLASSIFY,
+            context_block=f"SPEAKER SAID: {text}",
+            provider_order=["gemini", "local"],
+        )
+        raw = (getattr(rep, "text", "") or "").strip()
+        raw = re.sub(r"^```(?:json)?|```$", "", raw).strip()
+        m = re.search(r"\{.*\}", raw, re.S)
+        if not m:
+            return None
+        data = json.loads(m.group(0))
+        kind = str(data.get("intent", "")).lower().strip()
+        if kind not in INTENTS:
+            return None
+        conf = float(data.get("confidence", 0.6) or 0.6)
+        return Intent(kind, conf, strip_address(text), "model")
+    except Exception:
+        return None
+
+
+# ── Heuristic fallback ──────────────────────────────────────────────────────
+def heuristic_intent(text: str) -> Intent:
+    """Used only when the model is unreachable.
+
+    Still deliberately broader than the old action_words list: it treats an
+    imperative opening as an instruction rather than requiring a listed verb.
+    """
+    body = strip_address(text) or text
+    if _QUESTION.match(body):
+        return Intent("converse", 0.55, body, "default")
+    # An imperative sentence usually opens with a bare verb. Rather than list
+    # verbs, notice what an instruction is NOT: a question, or a statement
+    # opening with a pronoun/article.
+    if re.match(r"^\s*(?:i|you|he|she|they|we|it|the|a|an|this|that|there|my)\b",
+                body, re.I):
+        return Intent("converse", 0.5, body, "default")
+    return Intent("act", 0.5, body, "default")
+
+
+def classify(text: str, allow_model: bool = True) -> Intent:
+    """The one call every surface should use."""
+    fast = fast_intent(text)
+    if fast is not None:
+        return fast
+    if allow_model:
+        got = model_intent(text)
+        if got is not None:
+            return got
+    return heuristic_intent(text)
+
+
+__all__ = ["classify", "Intent", "is_addressed", "strip_address",
+           "fast_intent", "model_intent", "heuristic_intent", "INTENTS"]

modules/omega_executor.py

@@ -0,0 +1,667 @@
+"""modules/omega_executor.py — the unlimited task engine.
+
+WHY THIS EXISTS
+---------------
+Every command path in this system used to end at a keyword table. core.commands
+has an `instant_commands` dict and a long if/elif ladder; modules.task_authoring
+handles exactly one application, because its app map is literally
+
+    {"notepad": ("notepad.exe", "notepad"), ...}
+
+So "open notepad and write X then save" worked and *nothing else did*. Not
+because the machine lacked the power — backend/tools/tool_registry.py already
+exposes run_shell, open_app, write_file, browser control, media control and two
+dozen more — but because the voice and phone paths could not reach any of it.
+The powers were designed and never granted.
+
+This module is the grant. It takes a request in plain speech, PLANS it against
+the real capability catalog, and executes the plan step by step. Nothing here is
+keyed to a verb list or an app name, so "restart the machine", "download this,
+install it, run it ten minutes, close everything and shut down", and requests
+nobody anticipated all travel the same road.
+
+WHEN NOTHING FITS, IT WRITES THE CODE
+-------------------------------------
+A catalog is still a finite list, and the requirement is explicitly unlimited.
+So the planner has a step kind the others don't: `python`. If no capability
+matches, the model authors a short script for that step and the engine runs it,
+feeding its output to the next step. That is the difference between "unlimited
+within what we thought of" and unlimited.
+
+IRREVERSIBLE ACTIONS
+--------------------
+Shutdown, restart, delete, format and their kin are executed — the user asked
+for exactly that, in those words — but they are executed LAST in a plan and
+announced first, with a cancellation window. A misheard word should not be able
+to take the machine down with no way to catch it. Everything reversible runs
+without ceremony.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import os
+import re
+import subprocess
+import sys
+import tempfile
+import threading
+import time
+from dataclasses import dataclass, field
+from typing import Any, Callable, Optional
+
+# ── Tunables ────────────────────────────────────────────────────────────────
+MAX_STEPS = 40              # a chain longer than this is almost certainly a
+                            # planner loop, not a user intention
+STEP_TIMEOUT = 900          # 15 min: "run it for ten minutes" must fit
+PYTHON_TIMEOUT = 300
+DESTRUCTIVE_GRACE = 8       # seconds to say "cancel that" before the machine goes
+
+_LOG_LOCK = threading.RLock()
+
+
+def _log(msg: str) -> None:
+    with _LOG_LOCK:
+        try:
+            print(f"[omega_executor] {msg}", flush=True)
+        except Exception:
+            pass
+
+
+# ── What counts as irreversible ─────────────────────────────────────────────
+# Matched against the SHELL/PYTHON text actually about to run, not against the
+# user's phrasing. Phrasing lies; the command does not.
+_DESTRUCTIVE_PATTERNS = (
+    r"\bshutdown\b", r"\bstop-computer\b", r"\brestart-computer\b",
+    r"\blogoff\b", r"\bshutdown\.exe\b",
+    r"\bformat\b", r"\bdiskpart\b", r"\bmkfs\b",
+    r"\brd\s+/s\b", r"\brmdir\s+/s\b",
+    # Deletion, in any form, with or without flags.
+    #
+    # These used to require -Recurse or /q, which meant they only caught the
+    # deletion of whole DIRECTORY TREES. `Remove-Item -Force` on a single file
+    # sailed straight through unclassified — verified: a scratch file was
+    # permanently deleted with no deliberation and no cancel window, because
+    # "remove-item ... -recurse" simply did not match it.
+    #
+    # One irreplaceable file is not meaningfully less irreversible than a
+    # folder of them, so the flags are no longer part of the test.
+    r"\bremove-item\b", r"\bdel\b", r"\berase\b", r"\bunlink\b",
+    r"\bclear-content\b", r"\brm\s+-[a-z]*[rf]", r"\brm\s+",
+    r"\bcipher\s+/w\b", r"\bbcdedit\b", r"\breg\s+delete\b",
+    r"\bremove-partition\b", r"\bclear-disk\b",
+)
+
+
+def is_destructive(text: str) -> bool:
+    low = (text or "").lower()
+    return any(re.search(p, low) for p in _DESTRUCTIVE_PATTERNS)
+
+
+# ── Result plumbing ─────────────────────────────────────────────────────────
+@dataclass
+class StepResult:
+    index: int
+    kind: str
+    summary: str
+    ok: bool
+    output: str = ""
+    error: str = ""
+
+
+@dataclass
+class RunResult:
+    ok: bool
+    spoken: str
+    steps: list[StepResult] = field(default_factory=list)
+    plan: list[dict] = field(default_factory=list)
+    cancelled: bool = False
+
+    def transcript(self) -> str:
+        lines = []
+        for s in self.steps:
+            mark = "ok " if s.ok else "FAIL"
+            lines.append(f"  [{mark}] {s.index}. {s.summary}")
+            if s.error:
+                lines.append(f"         {s.error[:300]}")
+        return "\n".join(lines)
+
+
+# ── Capability catalog ──────────────────────────────────────────────────────
+# Built by introspecting the REAL registry rather than by hand, so a tool added
+# anywhere becomes usable by voice on the next run with no edit here. This is
+# the mechanism that grants the already-designed-but-ungranted powers.
+_CATALOG_CACHE: Optional[list[dict]] = None
+
+
+def capability_catalog(refresh: bool = False) -> list[dict]:
+    global _CATALOG_CACHE
+    if _CATALOG_CACHE is not None and not refresh:
+        return _CATALOG_CACHE
+
+    caps: list[dict] = []
+    try:
+        from backend.tools.tool_registry import TOOL_REGISTRY
+        import inspect
+        for name, fn in TOOL_REGISTRY.items():
+            try:
+                sig = inspect.signature(fn)
+                params = [
+                    p.name for p in sig.parameters.values()
+                    if p.name not in ("self", "args", "kwargs")
+                    and p.kind not in (p.VAR_POSITIONAL, p.VAR_KEYWORD)
+                ]
+            except Exception:
+                params = []
+            doc = (fn.__doc__ or "").strip().split("\n")[0][:160]
+            caps.append({"name": name, "params": params, "doc": doc})
+    except Exception as e:
+        _log(f"tool registry unavailable ({e}) — shell and python still work")
+
+    _CATALOG_CACHE = caps
+    return caps
+
+
+def _catalog_text() -> str:
+    caps = capability_catalog()
+    if not caps:
+        return "(no named tools reachable; use shell and python)"
+    return "\n".join(
+        f"- {c['name']}({', '.join(c['params'])})"
+        + (f" — {c['doc']}" if c["doc"] else "")
+        for c in caps
+    )
+
+
+# ── The planner ─────────────────────────────────────────────────────────────
+_PLANNER_RULES = """You convert a spoken request into an executable plan for a
+Windows machine. Return ONLY a JSON object, no prose, no code fences.
+
+{"say": "<one short line to speak before starting>",
+ "steps": [ {"kind": "...", ...}, ... ]}
+
+Step kinds:
+
+  {"kind":"tool","name":"<catalog name>","args":{...},"why":"<short summary>"}
+      Prefer this whenever a catalog tool fits.
+
+  {"kind":"shell","cmd":"<a real Windows command>","why":"..."}
+      PowerShell/cmd. Use for anything the catalog does not cover.
+
+  {"kind":"python","code":"<a complete python script>","why":"..."}
+      USE THIS WHEN NOTHING ELSE FITS. You are allowed and expected to write
+      new code for requests nobody anticipated. The script may import anything
+      installed, read $OMEGA_PREV for the previous step's output, and print its
+      result. Keep it self-contained.
+
+  {"kind":"wait","seconds":<number>,"why":"..."}
+      Real elapsed time — "run it for ten minutes" is {"kind":"wait","seconds":600}.
+
+  {"kind":"say","text":"..."}
+      Speak progress mid-chain.
+
+Rules:
+- Decompose chains fully and in order. "download X, install it, run it 10
+  minutes, close everything, shut down" is at least 5 steps, not 1.
+- Irreversible steps (shutdown, restart, format, mass delete) go LAST.
+- Never invent a tool name that is not in the catalog.
+- Never ask the user a question; choose the sensible interpretation and act.
+- Prefer one capable step over many timid ones, but never merge a wait.
+"""
+
+
+def _extract_json(raw: str) -> Optional[dict]:
+    """Models wrap JSON in prose or fences no matter how firmly you ask."""
+    if not raw:
+        return None
+    txt = raw.strip()
+    txt = re.sub(r"^```(?:json)?", "", txt).strip()
+    txt = re.sub(r"```$", "", txt).strip()
+    try:
+        return json.loads(txt)
+    except Exception:
+        pass
+    # First balanced {...} block.
+    start = txt.find("{")
+    while start != -1:
+        depth, instr, esc = 0, False, False
+        for i in range(start, len(txt)):
+            ch = txt[i]
+            if esc:
+                esc = False
+                continue
+            if ch == "\\":
+                esc = True
+                continue
+            if ch == '"':
+                instr = not instr
+                continue
+            if instr:
+                continue
+            if ch == "{":
+                depth += 1
+            elif ch == "}":
+                depth -= 1
+                if depth == 0:
+                    try:
+                        return json.loads(txt[start:i + 1])
+                    except Exception:
+                        break
+        start = txt.find("{", start + 1)
+    return None
+
+
+def plan_request(request: str, context: str = "") -> dict:
+    """Turn plain speech into a step plan. Never raises."""
+    system = _PLANNER_RULES + "\n\nCATALOG:\n" + _catalog_text()
+    ctx = [f"Machine: Windows. Working dir: {os.getcwd()}"]
+    if context:
+        ctx.append(context)
+    ctx.append(f"REQUEST: {request}")
+
+    raw = ""
+    try:
+        from core.brain_router import ask_router
+        rep = ask_router(
+            user_text=request,
+            system_prompt=system,
+            context_block="\n".join(ctx),
+            provider_order=["gemini", "local"],
+        )
+        raw = getattr(rep, "text", "") or ""
+    except Exception as e:
+        _log(f"planner LLM unavailable: {e}")
+
+    plan = _extract_json(raw)
+    if not isinstance(plan, dict) or not isinstance(plan.get("steps"), list):
+        # No plan means no invention: fall back to running the literal request
+        # as a shell line, which is still better than the old silent refusal.
+        return {
+            "say": "Running that directly.",
+            "steps": [{"kind": "shell", "cmd": request, "why": request}],
+            "degraded": True,
+        }
+
+    steps = [s for s in plan["steps"] if isinstance(s, dict) and s.get("kind")]
+    plan["steps"] = steps[:MAX_STEPS]
+    return plan
+
+
+# ── Step execution ──────────────────────────────────────────────────────────
+def _run_shell(cmd: str, timeout: int = STEP_TIMEOUT) -> tuple[bool, str, str]:
+    try:
+        creation = 0
+        if os.name == "nt":
+            creation = getattr(subprocess, "CREATE_NO_WINDOW", 0)
+        proc = subprocess.run(
+            ["powershell", "-NoProfile", "-NonInteractive", "-Command", cmd],
+            capture_output=True, text=True, timeout=timeout,
+            creationflags=creation,
+        )
+        out = (proc.stdout or "").strip()
+        err = (proc.stderr or "").strip()
+        return proc.returncode == 0, out, err
+    except subprocess.TimeoutExpired:
+        return False, "", f"timed out after {timeout}s"
+    except Exception as e:
+        return False, "", str(e)
+
+
+def _run_python(code: str, prev: str = "") -> tuple[bool, str, str]:
+    """Run model-authored code in a child process.
+
+    A child, not exec() in-process: authored code that throws, blocks or calls
+    sys.exit must not be able to take JARVIS down with it.
+    """
+    path = ""
+    try:
+        fd, path = tempfile.mkstemp(suffix=".py", prefix="omega_step_")
+        with os.fdopen(fd, "w", encoding="utf-8") as fh:
+            fh.write(code)
+        env = dict(os.environ)
+        env["OMEGA_PREV"] = (prev or "")[:8000]
+        env["PYTHONIOENCODING"] = "utf-8"
+        creation = getattr(subprocess, "CREATE_NO_WINDOW", 0) if os.name == "nt" else 0
+        proc = subprocess.run(
+            [sys.executable, path], capture_output=True, text=True,
+            timeout=PYTHON_TIMEOUT, env=env, creationflags=creation,
+        )
+        return (proc.returncode == 0,
+                (proc.stdout or "").strip(),
+                (proc.stderr or "").strip())
+    except subprocess.TimeoutExpired:
+        return False, "", f"script timed out after {PYTHON_TIMEOUT}s"
+    except Exception as e:
+        return False, "", str(e)
+    finally:
+        if path:
+            try:
+                os.unlink(path)
+            except Exception:
+                pass
+
+
+def _run_tool(name: str, args: dict) -> tuple[bool, str, str]:
+    try:
+        from backend.tools.tool_registry import TOOL_REGISTRY
+    except Exception as e:
+        return False, "", f"tool registry unavailable: {e}"
+    fn = TOOL_REGISTRY.get(name)
+    if fn is None:
+        return False, "", f"no such tool: {name}"
+    try:
+        res = fn(**(args or {}))
+        if asyncio.iscoroutine(res):
+            try:
+                asyncio.get_running_loop()
+            except RuntimeError:
+                res = asyncio.run(res)
+            else:
+                # Already inside a loop (backend request): use a private one in
+                # a worker thread rather than fighting the live loop.
+                box: dict[str, Any] = {}
+
+                def _worker():
+                    try:
+                        box["v"] = asyncio.run(res)
+                    except Exception as ex:
+                        box["e"] = ex
+
+                t = threading.Thread(target=_worker, daemon=True)
+                t.start()
+                t.join(STEP_TIMEOUT)
+                if "e" in box:
+                    return False, "", str(box["e"])
+                res = box.get("v")
+        return True, ("" if res is None else str(res))[:4000], ""
+    except Exception as e:
+        return False, "", str(e)
+
+
+# ── The engine ──────────────────────────────────────────────────────────────
+def execute(request: str,
+            speak: Optional[Callable[[str], None]] = None,
+            context: str = "",
+            allow_destructive: bool = True,
+            confirm: Optional[Callable[[str], bool]] = None,
+            already_deliberated: bool = False) -> RunResult:
+    """Do whatever was asked. The single entry point for every surface.
+
+    `already_deliberated` is set by modules.deferred_intent when it re-runs a
+    held order. Without it the order would be weighed a second time here and
+    could be deferred again by the same reasoning that just released it — an
+    order could bounce between the two layers forever and never actually run.
+    The cancel window is still honoured; only the judgement is skipped.
+    """
+    say = speak or (lambda t: _log(f"say: {t}"))
+
+    plan = plan_request(request, context)
+    steps = plan.get("steps") or []
+    opening = (plan.get("say") or "").strip()
+    if opening:
+        say(opening)
+
+    results: list[StepResult] = []
+    prev_output = ""
+    ok_all = True
+
+    for i, step in enumerate(steps, 1):
+        kind = str(step.get("kind", "")).lower()
+        why = str(step.get("why") or step.get("text") or kind)[:180]
+
+        # Everything this step will actually run, whichever shape it arrived in.
+        #
+        # This used to be `step["cmd"] or step["code"]`, which silently exempted
+        # TOOL steps: the planner is free to express a deletion as
+        # {"kind":"tool","name":"run_shell","args":{"cmd":"Remove-Item ..."}},
+        # and then the command lives in args, step["cmd"] is empty, and
+        # is_destructive("") is False. Verified the hard way — a scratch file was
+        # permanently deleted with no deliberation and no cancel window because
+        # the plan happened to use the tool form rather than a shell step.
+        #
+        # The tool NAME matters too: run_shell carrying a shutdown is a shutdown
+        # regardless of how the JSON is shaped.
+        payload = " ".join(str(x) for x in (
+            step.get("cmd") or "",
+            step.get("code") or "",
+            step.get("name") or "",
+            json.dumps(step.get("args") or {}),
+        ))
+        if kind in ("shell", "python", "tool") and is_destructive(payload):
+            if not allow_destructive:
+                results.append(StepResult(i, kind, why, False,
+                                          error="irreversible step refused"))
+                ok_all = False
+                continue
+
+            # Think about it properly first. This is NOT a permission check —
+            # the order is already given and will be carried out. It is the
+            # judgement a person applies before pulling a plug: is something
+            # mid-flight that this would wreck? If so, hold and say why, and
+            # modules.deferred_intent will raise it again in a few minutes and
+            # eventually go ahead regardless. Holding is a timer, not a refusal.
+            if not already_deliberated:
+                try:
+                    from modules.deferred_intent import deliberate, defer
+                    verdict = deliberate(request)
+                    if not verdict.proceed:
+                        held = defer(request, verdict.reason)
+                        say(verdict.speak
+                            or f"Holding off on that — {verdict.reason}. "
+                               f"I'll come back to it.")
+                        results.append(StepResult(
+                            i, kind, why, True,
+                            output=f"deferred (#{held}): {verdict.reason}"))
+                        return RunResult(True, "", results, steps)
+                except Exception as e:
+                    _log(f"deliberation unavailable ({e}); order stands")
+
+            # The cancel window. Deliberately kept: a misheard word should have
+            # one last chance to be caught before the machine goes down.
+            say(f"{why}. Say cancel now if that's wrong.")
+            if confirm is not None:
+                if not confirm(why):
+                    results.append(StepResult(i, kind, why, False,
+                                              error="cancelled by user"))
+                    return RunResult(False, "Cancelled.", results, steps, True)
+            else:
+                time.sleep(DESTRUCTIVE_GRACE)
+
+        if kind == "say":
+            text = str(step.get("text") or why)
+            say(text)
+            results.append(StepResult(i, kind, text[:120], True))
+            continue
+
+        if kind == "wait":
+            try:
+                secs = float(step.get("seconds") or 0)
+            except Exception:
+                secs = 0.0
+            secs = max(0.0, min(secs, STEP_TIMEOUT))
+            results.append(StepResult(i, kind, f"waited {int(secs)}s", True))
+            time.sleep(secs)
+            continue
+
+        if kind == "tool":
+            good, out, err = _run_tool(str(step.get("name") or ""),
+                                       step.get("args") or {})
+        elif kind == "python":
+            good, out, err = _run_python(str(step.get("code") or ""), prev_output)
+        else:  # shell, and anything unrecognised is treated as one
+            good, out, err = _run_shell(str(step.get("cmd") or ""))
+
+        # ── IMMEDIATE SELF-REPAIR ────────────────────────────────────────────
+        #
+        # A failing step used to end the chain. But most failures are not "this
+        # is impossible" — they are a wrong path, a missing quote, a cmdlet that
+        # does not exist on this box, a tool called with the wrong argument.
+        # A person would not abandon the task; they would look at the error, fix
+        # the command, and run it again, all within a few seconds.
+        #
+        # So that is what happens. The error text and the failed command go back
+        # to the model, which returns a corrected version, and it is retried
+        # immediately. The operator asked for the thing to happen NOW, and this
+        # is what makes it happen now rather than after a bug report.
+        #
+        # The lasting fix is a separate, slower matter — recorded and handled
+        # later, because stopping to redesign something mid-task is exactly the
+        # wrong moment for it.
+        if not good and kind in ("shell", "python", "tool"):
+            for attempt in range(1, MAX_REPAIRS + 1):
+                fixed = _repair_step(step, err, request)
+                if not fixed:
+                    break
+                _log(f"step {i} repair attempt {attempt}")
+                if kind == "tool":
+                    good, out, err = _run_tool(str(fixed.get("name") or ""),
+                                               fixed.get("args") or {})
+                elif kind == "python":
+                    good, out, err = _run_python(str(fixed.get("code") or ""),
+                                                 prev_output)
+                else:
+                    good, out, err = _run_shell(str(fixed.get("cmd") or ""))
+                if good:
+                    why = f"{why} (repaired)"
+                    _remember_repair(request, step, fixed, err_before=err)
+                    break
+                step = fixed   # each attempt learns from the last error
+
+        results.append(StepResult(i, kind, why, good, out, err))
+        if out:
+            prev_output = out
+        if not good:
+            ok_all = False
+            _log(f"step {i} failed after repair attempts: {err[:200]}")
+            # A broken link means the rest of the chain is operating on false
+            # premises, so stop rather than plough on.
+            break
+
+    if ok_all:
+        spoken = _summarise_success(request, results)
+    else:
+        bad = next((r for r in results if not r.ok), None)
+        spoken = (f"I got through {len(results) - 1} of {len(steps)} steps, then "
+                  f"{bad.summary.lower() if bad else 'a step'} failed."
+                  if bad else "That didn't complete.")
+    return RunResult(ok_all, spoken, results, steps)
+
+
+# ── Self-repair ─────────────────────────────────────────────────────────────
+MAX_REPAIRS = 2          # two corrected attempts, then admit it is stuck
+_REPAIR_LOG = os.path.join(
+    os.environ.get("JARVIS_APP_DATA_DIR") or os.path.join(
+        os.path.dirname(os.path.dirname(os.path.abspath(__file__))), ".friday_data"),
+    "repairs.json")
+
+_REPAIR_RULES = """A command you just ran FAILED. Fix it and return the
+corrected step, as JSON only, in exactly the shape you were given.
+
+You are not redesigning anything. You are getting this ONE command to work on
+this machine, right now, from the error it produced. Read the error literally:
+a path that does not exist, a cmdlet that is not available, a quoting mistake,
+a wrong argument name, a missing flag.
+
+Return the same "kind" with corrected fields:
+  shell  -> {"kind":"shell","cmd":"<fixed command>"}
+  python -> {"kind":"python","code":"<fixed script>"}
+  tool   -> {"kind":"tool","name":"<tool>","args":{...}}
+
+If the approach itself cannot work, switch to one that can — a shell step
+instead of a tool, or a python step that does the job directly. Returning
+something that will fail the same way is worse than useless.
+"""
+
+
+def _repair_step(step: dict, error: str, original_request: str) -> Optional[dict]:
+    """Ask for a corrected version of a step that just failed."""
+    if not error:
+        return None
+    try:
+        from core.brain_router import ask_router
+        ctx = (f"ORIGINAL REQUEST: {original_request}\n"
+               f"STEP THAT FAILED: {json.dumps(step)[:1500]}\n"
+               f"ERROR: {error[:1200]}\n"
+               f"Machine: Windows. Working dir: {os.getcwd()}")
+        rep = ask_router(user_text="Fix this command.",
+                         system_prompt=_REPAIR_RULES,
+                         context_block=ctx,
+                         provider_order=["gemini", "local"])
+        fixed = _extract_json(getattr(rep, "text", "") or "")
+        if not isinstance(fixed, dict) or not fixed.get("kind"):
+            return None
+        # A "fix" identical to what just failed is not a fix.
+        if (str(fixed.get("cmd") or "") == str(step.get("cmd") or "")
+                and str(fixed.get("code") or "") == str(step.get("code") or "")
+                and str(fixed.get("name") or "") == str(step.get("name") or "")):
+            return None
+        # Never let a repair quietly escalate into something irreversible.
+        payload = " ".join(str(x) for x in (fixed.get("cmd") or "",
+                                            fixed.get("code") or "",
+                                            fixed.get("name") or "",
+                                            json.dumps(fixed.get("args") or {})))
+        if is_destructive(payload) and not is_destructive(
+                " ".join(str(y) for y in (step.get("cmd") or "",
+                                          step.get("code") or ""))):
+            _log("rejected a repair that introduced an irreversible action")
+            return None
+        return fixed
+    except Exception as e:
+        _log(f"repair unavailable: {e}")
+        return None
+
+
+def _remember_repair(request: str, broken: dict, fixed: dict,
+                     err_before: str = "") -> None:
+    """Record what needed fixing, for a proper fix later.
+
+    The immediate repair gets the operator unblocked, which is the priority.
+    But a command that had to be corrected at runtime will need correcting
+    again next time unless something changes — so the evidence is kept, rather
+    than the problem being silently papered over on every single run.
+    """
+    try:
+        os.makedirs(os.path.dirname(_REPAIR_LOG), exist_ok=True)
+        try:
+            with open(_REPAIR_LOG, "r", encoding="utf-8") as fh:
+                data = json.load(fh)
+            if not isinstance(data, list):
+                data = []
+        except Exception:
+            data = []
+        data.append({
+            "at": time.time(),
+            "request": request[:300],
+            "broken": {k: str(v)[:400] for k, v in broken.items()},
+            "fixed": {k: str(v)[:400] for k, v in fixed.items()},
+            "error": err_before[:500],
+        })
+        with open(_REPAIR_LOG, "w", encoding="utf-8") as fh:
+            json.dump(data[-100:], fh, indent=2)
+    except Exception:
+        pass
+
+
+def pending_repairs() -> list[dict]:
+    """Runtime corrections so far — the queue for real, lasting fixes."""
+    try:
+        with open(_REPAIR_LOG, "r", encoding="utf-8") as fh:
+            data = json.load(fh)
+        return data if isinstance(data, list) else []
+    except Exception:
+        return []
+
+
+def _summarise_success(request: str, results: list[StepResult]) -> str:
+    done = [r for r in results if r.ok and r.kind not in ("say",)]
+    if not done:
+        return "Nothing to do there."
+    if len(done) == 1:
+        return f"Done — {done[0].summary}."
+    return f"Done. {len(done)} steps: " + "; ".join(r.summary for r in done[:4]) + (
+        "…" if len(done) > 4 else ".")
+
+
+__all__ = ["execute", "plan_request", "capability_catalog", "is_destructive",
+           "RunResult", "StepResult"]

modules/process_utils.py

@@ -58,3 +58,47 @@ def run_no_window(
         kwargs["creationflags"] = windows_creationflags_no_window()
     return subprocess.run(list(args), **kwargs)
 
+
+_console_suppressed = False
+
+
+def suppress_console_windows() -> None:
+    """Stop every child process in THIS process from flashing a console.
+
+    The helpers above only work where someone remembered to call them, and
+    across modules/ there are around forty bare `subprocess.run`/`Popen` calls
+    that do not. Most are harmless one-offs, but the watch loops shell out
+    constantly — `netstat -ano` for intrusion and connection checks, PowerShell
+    for disk health and driver anomalies, `wmic` for process listings — every
+    few seconds, forever.
+
+    Each of those is a CONSOLE program. Launched from a windowless parent
+    (pythonw, which is how the daemon, the relay and the tray all run), Windows
+    has no console to attach them to, so it creates one — and the window
+    appears and vanishes. That is the flashing: not one bug, one per call site.
+
+    Fixing forty call sites individually invites the forty-first. This sets the
+    default once, for the whole process: any child created WITHOUT explicit
+    creationflags gets CREATE_NO_WINDOW. A caller that passes its own flags is
+    left completely alone, so nothing that deliberately wants a window loses it.
+
+    Call this early in any entry point that runs without a console.
+    """
+    global _console_suppressed
+    if _console_suppressed or os.name != "nt":
+        return
+
+    CREATE_NO_WINDOW = 0x08000000
+    _original_init = subprocess.Popen.__init__
+
+    def _init(self, *args, **kwargs):
+        # Only fill in a default. Never override an explicit choice, and never
+        # add DETACHED_PROCESS here — that would break callers who read the
+        # child's stdout, which several of these modules do.
+        if not kwargs.get("creationflags"):
+            kwargs["creationflags"] = CREATE_NO_WINDOW
+        return _original_init(self, *args, **kwargs)
+
+    subprocess.Popen.__init__ = _init
+    _console_suppressed = True
+

modules/security_review.py

@@ -114,8 +114,19 @@ def run_security_review(target: str = None) -> str:
         source_context = _gather_target_context(target_path)
         
         # Build the final prompt
+        #
+        # The persona is read, not assumed: this said "You are JARVIS" outright,
+        # so a security review run while FRIDAY was on duty was conducted in the
+        # other assistant's name. The audit is the same either way, but the
+        # report it writes is spoken back to the user in first person.
+        try:
+            from modules.assistant_identity import get_assistant_name
+            _who = get_assistant_name()
+        except Exception:
+            _who = "JARVIS"
+
         prompt = (
-            f"You are JARVIS, conducting an exhaustive security audit based on the provided framework.\n\n"
+            f"You are {_who}, conducting an exhaustive security audit based on the provided framework.\n\n"
             f"Target System Scope:\n{target_path}\n\n"
             f"Discovered Source Code & Configurations:\n{source_context}\n\n"
             f"Please begin your analysis and output the final markdown report."

modules/task_authoring.py

@@ -0,0 +1,360 @@
+from __future__ import annotations
+
+"""Multi-step desktop tasks: open an app, type into it, save the file.
+
+WHY THIS EXISTS
+---------------
+"open notepad and write JARVIS then save to desktop" used to produce:
+
+    Executing 2 linked tasks.
+    Launching notepad and write jarvis.        <- one app name, not two steps
+    Got it: save to desktop. Tell me the outcome you want.
+
+The chain splitter in core.commands splits on "then" only, so "open notepad and
+write JARVIS" stayed a single instruction and was handed to the app launcher as
+if "notepad and write jarvis" were a program. Nothing could type, and nothing
+could save — there was no handler for either verb.
+
+This module does the three things that sentence actually asks for, in order,
+against the real window: launch, type, save-as. It is deliberately narrow. It
+does NOT try to be a general agent; it recognises a small, explicit vocabulary
+and refuses anything outside it rather than guessing and reporting success.
+
+WHY UI AUTOMATION AND NOT A FILE WRITE
+--------------------------------------
+"open notepad and write X then save" could be faked by writing a .txt directly
+and never opening anything. That would pass a naive test and be a lie: the user
+asked to SEE it happen, and the same mechanism has to work for editors that have
+no file format we can synthesise. So this drives the real window with real
+keystrokes.
+"""
+
+import os
+import re
+import subprocess
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+
+try:
+    import keyboard  # type: ignore
+except Exception:  # pragma: no cover - depends on host packages
+    keyboard = None
+
+try:
+    import win32gui  # type: ignore
+except Exception:  # pragma: no cover
+    win32gui = None
+
+
+# Programs we know how to launch by a spoken name, and the window title
+# fragment that proves the right one came up.
+KNOWN_APPS: dict[str, tuple[str, str]] = {
+    "notepad": ("notepad.exe", "notepad"),
+    "wordpad": ("write.exe", "wordpad"),
+    "word": ("winword.exe", "word"),
+    "excel": ("excel.exe", "excel"),
+    "paint": ("mspaint.exe", "paint"),
+    "calculator": ("calc.exe", "calculator"),
+    "explorer": ("explorer.exe", "explorer"),
+    "chrome": ("chrome.exe", "chrome"),
+    "edge": ("msedge.exe", "edge"),
+}
+
+# Where "save to X" can mean.
+KNOWN_FOLDERS: dict[str, Path] = {
+    "desktop": Path.home() / "Desktop",
+    "documents": Path.home() / "Documents",
+    "downloads": Path.home() / "Downloads",
+    "pictures": Path.home() / "Pictures",
+}
+
+
+@dataclass
+class Step:
+    kind: str          # "open" | "type" | "save"
+    value: str = ""
+    folder: Path | None = None
+    filename: str | None = None
+
+
+@dataclass
+class TaskResult:
+    ok: bool
+    steps_done: int
+    messages: list[str] = field(default_factory=list)
+
+    @property
+    def message(self) -> str:
+        return " ".join(self.messages) if self.messages else ""
+
+
+# --------------------------------------------------------------------------- #
+# parsing
+# --------------------------------------------------------------------------- #
+def _split_clauses(text: str) -> list[str]:
+    """Break on the connectives people actually use, not just "then".
+
+    core.commands.split_chain only knows "then", which is why "open notepad and
+    write JARVIS" survived as one clause. Splitting on "and"/","/"then" as
+    SEPARATORS BETWEEN VERBS keeps "write hello and goodbye" intact, because the
+    split only happens where the next clause starts with a known verb.
+    """
+    parts = re.split(r"\s*(?:,|\bthen\b|\band\b|\bafter that\b)\s*", text, flags=re.I)
+    verbs = ("open", "launch", "start", "run", "write", "type", "enter", "save", "store")
+    clauses: list[str] = []
+    for raw in parts:
+        piece = raw.strip()
+        if not piece:
+            continue
+        first = piece.split()[0].lower()
+        if first in verbs or not clauses:
+            clauses.append(piece)
+        else:
+            # A fragment that does not begin a new action belongs to the one
+            # before it: "write hello" + "goodbye" -> "write hello and goodbye".
+            clauses[-1] = f"{clauses[-1]} and {piece}"
+    return clauses
+
+
+def parse_task(text: str) -> list[Step]:
+    """Turn a sentence into ordered steps. Returns [] when it is not our shape."""
+    steps: list[Step] = []
+    for clause in _split_clauses(text or ""):
+        low = clause.lower().strip()
+
+        m = re.match(r"^(?:open|launch|start|run)\s+(.+)$", low)
+        if m:
+            target = m.group(1).strip()
+            # Longest known app name that appears, so "open notepad app" works.
+            app = next((name for name in sorted(KNOWN_APPS, key=len, reverse=True)
+                        if name in target), None)
+            steps.append(Step("open", app or target))
+            continue
+
+        m = re.match(r"^(?:write|type|enter)\s+(.+)$", clause, flags=re.I)
+        if m:
+            payload = m.group(1).strip()
+            # Keep the user's capitalisation: they asked for "JARVIS", not "jarvis".
+            payload = payload.strip("\"'")
+            steps.append(Step("type", payload))
+            continue
+
+        m = re.match(r"^(?:save|store)\b(.*)$", low)
+        if m:
+            rest = m.group(1)
+            folder = None
+            for name, path in KNOWN_FOLDERS.items():
+                if name in rest:
+                    folder = path
+                    break
+            fname = None
+            fm = re.search(r"\bas\s+([\w\-. ]+)$", rest)
+            if fm:
+                fname = fm.group(1).strip()
+            steps.append(Step("save", rest.strip(), folder, fname))
+            continue
+
+        # An unrecognised clause makes the whole task unsafe to guess at.
+        return []
+    return steps
+
+
+# --------------------------------------------------------------------------- #
+# execution
+# --------------------------------------------------------------------------- #
+def _foreground_title() -> str:
+    if win32gui is None:
+        return ""
+    try:
+        return win32gui.GetWindowText(win32gui.GetForegroundWindow()) or ""
+    except Exception:
+        return ""
+
+
+def _wait_for_window(fragment: str, timeout: float = 12.0) -> bool:
+    """Wait until the app we launched is actually in front.
+
+    Typing before the window exists sends the keystrokes to whatever WAS in
+    front — which is how a naive version of this ends up typing into the user's
+    browser or, worse, a terminal.
+    """
+    deadline = time.time() + timeout
+    fragment = fragment.lower()
+    while time.time() < deadline:
+        if fragment in _foreground_title().lower():
+            return True
+        time.sleep(0.35)
+    return False
+
+
+SAVE_DIALOG_TITLES = ("save as", "save", "guardar", "enregistrer")
+
+
+def _wait_for_save_dialog(timeout: float = 8.0) -> bool:
+    """Block until a Save dialog owns the foreground window.
+
+    The editor's own title (for example "Untitled - Notepad") is explicitly NOT
+    a match: seeing it means the dialog has not opened yet and anything typed
+    would land in the document.
+    """
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        title = _foreground_title().lower()
+        if title and any(t in title for t in SAVE_DIALOG_TITLES):
+            return True
+        time.sleep(0.25)
+    return False
+
+
+def _type_text(text: str) -> bool:
+    if keyboard is None:
+        return False
+    try:
+        # write() sends unicode directly rather than emulating scan codes, so
+        # punctuation and layout differences do not corrupt the text.
+        keyboard.write(text, delay=0.01)
+        return True
+    except Exception:
+        return False
+
+
+def run_task(text: str, speak=None) -> TaskResult:
+    """Execute a parsed multi-step task. Never reports a step it did not do."""
+    # Speak EVERY message as it happens, not in a batch at the end.
+    #
+    # The first version collected messages and only spoke them on the success
+    # path, so every failure returned with an empty `spoken` list and the caller
+    # fell back to "I don't have a handler for that yet" — hiding the actual
+    # reason the task stopped. A progress report that only appears when nothing
+    # went wrong is worse than none.
+    def say(msg: str) -> None:
+        if speak and msg:
+            speak(msg)
+
+    steps = parse_task(text)
+    if not steps:
+        return TaskResult(False, 0, ["I couldn't turn that into steps I can run."])
+    if keyboard is None or win32gui is None:
+        return TaskResult(False, 0,
+                          ["Desktop automation isn't available on this machine."])
+
+    messages: list[str] = []
+    def note(msg: str) -> None:
+        messages.append(msg)
+        say(msg)
+    done = 0
+    opened_app: str | None = None
+
+    for step in steps:
+        if step.kind == "open":
+            exe, title_fragment = KNOWN_APPS.get(step.value, (step.value, step.value))
+            try:
+                subprocess.Popen(
+                    ["cmd.exe", "/c", "start", "", exe],
+                    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
+                    creationflags=getattr(subprocess, "CREATE_NO_WINDOW", 0))
+            except Exception as exc:
+                note(f"Couldn't open {step.value}: {exc}")
+                return TaskResult(False, done, messages)
+            # NEVER TYPE INTO A DOCUMENT THAT ALREADY HAS CONTENT.
+            #
+            # Windows 11 Notepad restores its previous session, so launching it
+            # can bring back the user's OWN unsaved work — and this code then
+            # typed into that document and pressed Ctrl+S, which saved silently
+            # because the tab already had a path. Verified happening: a tab
+            # holding a personal document was modified by a test run.
+            #
+            # Ctrl+N forces a brand-new empty document first. An editor that does
+            # not support it simply ignores the keystroke, so this is safe to
+            # send unconditionally — and infinitely safer than assuming a fresh
+            # window.
+            if _wait_for_window(title_fragment) and step.value in ("notepad", "wordpad", "word"):
+                try:
+                    keyboard.send("ctrl+n")
+                    time.sleep(1.0)
+                except Exception:
+                    pass
+
+            if not _wait_for_window(title_fragment):
+                messages.append(
+                    f"Opened {step.value}, but its window never came to the front — "
+                    "stopping so I don't type into the wrong place.")
+                return TaskResult(False, done, messages)
+            opened_app = step.value
+            note(f"Opened {step.value}.")
+            done += 1
+
+        elif step.kind == "type":
+            if opened_app is None:
+                note("Nothing is open to type into.")
+                return TaskResult(False, done, messages)
+            time.sleep(0.4)
+            if not _type_text(step.value):
+                note("Couldn't send the text.")
+                return TaskResult(False, done, messages)
+            note(f'Typed "{step.value}".')
+            done += 1
+
+        elif step.kind == "save":
+            folder = step.folder or (Path.home() / "Desktop")
+            name = step.filename or f"jarvis-{time.strftime('%H%M%S')}.txt"
+            if not os.path.splitext(name)[1]:
+                name += ".txt"
+            target = folder / name
+            try:
+                folder.mkdir(parents=True, exist_ok=True)
+            except Exception:
+                pass
+            try:
+                keyboard.send("ctrl+s")
+                # WAIT FOR THE DIALOG, don't guess at a sleep.
+                #
+                # A fixed 1.2s worked when run from an interactive console and
+                # failed from the relay's background process, where the dialog
+                # takes longer to paint. The path was then typed into the
+                # DOCUMENT instead of the filename box and Enter just added a
+                # newline — the file never existed, and the only clue was a
+                # message the caller never saw. Same rule as the app window
+                # above: prove the target has focus before sending keys to it.
+                if not _wait_for_save_dialog():
+                    note("The save dialog never appeared, so nothing was typed "
+                         "into it — your text is still in the editor, unsaved.")
+                    return TaskResult(False, done, messages)
+                # The Save dialog focuses its filename box; a full path in that
+                # box is honoured by the common dialog, so no navigation is
+                # needed and the file lands exactly where asked.
+                if not _type_text(str(target)):
+                    note("Couldn't fill in the save dialog.")
+                    return TaskResult(False, done, messages)
+                time.sleep(0.4)
+                keyboard.send("enter")
+                # Give the write a moment, then poll rather than assume.
+                for _ in range(20):
+                    if target.exists():
+                        break
+                    time.sleep(0.25)
+            except Exception as exc:
+                note(f"Save failed: {exc}")
+                return TaskResult(False, done, messages)
+
+            # VERIFY. A save dialog can be refused, redirected or silently
+            # cancelled; the only proof is the file being on disk.
+            if target.exists():
+                note(f"Saved to {target}.")
+                done += 1
+            else:
+                # note(), not messages.append(): appended text is never spoken,
+                # so this exact reason was collected and thrown away — the caller
+                # saw an empty result and fell back to "no handler".
+                note(f"I pressed save, but {target} isn't on disk. Your text is "
+                     "still open in the editor.")
+                return TaskResult(False, done, messages)
+
+    return TaskResult(True, done, messages)
+
+
+def looks_like_task(text: str) -> bool:
+    """Cheap gate for the dispatcher: at least two steps, one of them an action."""
+    steps = parse_task(text)
+    return len(steps) >= 2 and any(s.kind in ("type", "save") for s in steps)