Streaming replies and STT, amplitude lip-sync, one place for speaking

Latency: replies are spoken sentence-by-sentence off the desk API's NDJSON
endpoint, so the wait is time-to-first-sentence rather than the whole model
call, and Deepgram's live websocket transcribes while you're still talking
instead of uploading the WAV afterwards. Both fall back invisibly — a stream
that fails before anything was said drops to converse(), and a socket that
never opens just means the old one-shot path.

Speaking lived in four near-copies in the controller (a reply, a holding line,
a streamed sentence, a dialogue scene) that had already drifted: one didn't arm
barge-in, another skipped the follow-up rule. It's now speech.Speaker plus an
Utterance describing the policy differences, with collaborators injected so the
whole of it tests without Qt or audio.

The mouth follows the audio rather than a timer: tts.level_of reduces each PCM
frame to a 0..1 loudness on a sqrt curve (speech sits well below peak, and a
linear map leaves the mouth barely open during normal talking) and that indexes
the talking frames, which the sprite script now draws as an openness ramp.
Offline pyttsx3 has no waveform, so stale levels hand control back to the timed
loop instead of freezing the mouth mid-syllable.

Also: the pet starts where you left it (ignoring positions on monitors that are
no longer connected, since restoring those faithfully is how it ends up
somewhere unreachable), and `python -m bolt_pet --doctor` is a preflight that
says what to do about each problem rather than only what's wrong.

tests/test_pipeline_smoke.py breaks the pure-logic rule on purpose. Every unit
test passed all week while notifications sat unspoken for minutes, the pet said
things twice and [laughing] got read aloud — each an interaction between two
individually-correct units. It drives whole turns against a real HTTP server on
a loopback port, faking only the mic and the speakers. It found a NameError in
the paint path that would have fired on every repaint while talking.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.claude/settings.local.json

@@ -52,7 +52,44 @@
       "Bash(docker exec bolt *)",
       "Bash(QT_QPA_PLATFORM=offscreen /root/Documents/bolt-pet/.venv/bin/pytest /home/themajesticmagician/Documents/Bolt-Pet/tests/test_file_ops.py -q)",
       "Bash(grep -rn *)",
-      "Bash(git ls-tree *)"
+      "Bash(git ls-tree *)",
+      "Bash(QT_QPA_PLATFORM=offscreen .venv/bin/pytest tests/test_controller_features.py -q)",
+      "Read(//home/maji/Documents/tmn-api/**)",
+      "Bash(timeout 300 .venv/bin/python -m pytest tests/test_desk_voice.py -q)",
+      "Bash(echo \"exit=$?\")",
+      "Bash(timeout 300 /home/maji/Documents/tmn-api/.venv/bin/python -m pytest /home/maji/Documents/tmn-api/tests/test_desk_voice.py -q -p no:cacheprovider --rootdir=/home/maji/Documents/tmn-api)",
+      "Bash(echo \"EXIT=$?\")",
+      "Bash(/home/maji/Documents/tmn-api/.venv/bin/python -c \"import ast,pathlib; ast.parse\\(pathlib.Path\\('/home/maji/Documents/tmn-api/ai/desk_api.py'\\).read_text\\(\\)\\); print\\('desk_api.py parses OK'\\)\")",
+      "Bash(ps -eo pid,etime,cmd)",
+      "Bash(systemctl --user list-units --type=service)",
+      "Read(//run/user/1000/gvfs/sftp:host=192.168.2.231,user=root/Main/Docker-Compose/TMN-API/tmn-api/ai/**)",
+      "Bash(findmnt -T /home/maji/Documents/tmn-api -o TARGET,SOURCE,FSTYPE)",
+      "Bash(echo \"rc=$?\")",
+      "Bash(timeout 600 /home/maji/Documents/Bolt-Pet/.venv/bin/python -m pytest tests/test_temporal_core.py tests/test_temporal_episodes.py -q -p no:cacheprovider)",
+      "Bash(timeout 600 /home/maji/Documents/Bolt-Pet/.venv/bin/python -m pytest tests/test_temporal_core.py tests/test_temporal_episodes.py tests/test_temporal_stream.py tests/test_temporal_facade.py -q -p no:cacheprovider)",
+      "Bash(awk 'NR>=1150 && NR<=1310 && \\(/return / || /def /\\)' ai/agents/default.py)",
+      "Bash(/home/maji/Documents/Bolt-Pet/.venv/bin/python -c ' *)",
+      "Bash(timeout 900 /home/maji/Documents/Bolt-Pet/.venv/bin/python -m pytest tests/test_temporal_core.py tests/test_temporal_episodes.py tests/test_temporal_stream.py tests/test_temporal_facade.py tests/test_proactive.py -q -p no:cacheprovider)",
+      "Bash(timeout 300 /home/maji/Documents/Bolt-Pet/.venv/bin/python -m pytest tests/test_proactive.py::test_send_trims_swallowed_tool_lines -q -p no:cacheprovider)",
+      "Bash(/home/maji/Documents/Bolt-Pet/.venv/bin/python *)",
+      "Bash(./tmnvenv/bin/pip install *)",
+      "Bash(./tmnvenv/bin/python -c \"import pytest,dotenv,yaml; print\\('scratch venv ready'\\)\")",
+      "Bash(/tmp/claude-1000/-home-maji-Documents-Bolt-Pet/58f4a7c3-6a92-47ed-9e43-bb2216d8b135/scratchpad/tmnvenv/bin/pip install *)",
+      "Bash(timeout 1800 /tmp/claude-1000/-home-maji-Documents-Bolt-Pet/58f4a7c3-6a92-47ed-9e43-bb2216d8b135/scratchpad/tmnvenv/bin/python -m pytest tests -q -p no:cacheprovider --ignore=tests/test_tool_markers.py --ignore=tests/test_tts_sanitization.py --ignore=tests/test_speaker_matching.py --ignore=tests/test_recent_speaker_fallback.py --ignore=tests/test_assistant_cli_call_proxy.py --ignore=tests/test_assistant_cli_permissions.py)",
+      "Bash(timeout 1800 /tmp/claude-1000/-home-maji-Documents-Bolt-Pet/58f4a7c3-6a92-47ed-9e43-bb2216d8b135/scratchpad/tmnvenv/bin/python -m pytest tests -q -p no:cacheprovider)",
+      "Bash(timeout 1800 /tmp/claude-1000/-home-maji-Documents-Bolt-Pet/58f4a7c3-6a92-47ed-9e43-bb2216d8b135/scratchpad/tmnvenv/bin/python -m pytest tests -q -p no:cacheprovider --ignore=tests/test_tool_markers.py --ignore=tests/test_tts_sanitization.py --ignore=tests/test_speaker_matching.py --ignore=tests/test_recent_speaker_fallback.py --ignore=tests/test_assistant_cli_call_proxy.py --ignore=tests/test_assistant_cli_permissions.py --ignore=tests/test_memory_store.py --ignore=tests/test_default_agent.py)",
+      "Bash(timeout 900 /tmp/claude-1000/-home-maji-Documents-Bolt-Pet/58f4a7c3-6a92-47ed-9e43-bb2216d8b135/scratchpad/tmnvenv/bin/python -m pytest tests/test_default_agent.py -q -p no:cacheprovider)",
+      "Bash(timeout 900 /tmp/claude-1000/-home-maji-Documents-Bolt-Pet/58f4a7c3-6a92-47ed-9e43-bb2216d8b135/scratchpad/tmnvenv/bin/python -m pytest tests/test_emotional_memory.py tests/test_inner_monologue.py -q -p no:cacheprovider)",
+      "Bash(timeout 900 /tmp/claude-1000/-home-maji-Documents-Bolt-Pet/58f4a7c3-6a92-47ed-9e43-bb2216d8b135/scratchpad/tmnvenv/bin/python -m pytest tests/test_emotional_memory.py tests/test_inner_monologue.py tests/test_temporal_core.py tests/test_temporal_episodes.py tests/test_temporal_stream.py tests/test_temporal_facade.py tests/test_proactive.py tests/test_desk_api.py tests/test_main_helpers.py -q -p no:cacheprovider)",
+      "Bash(timeout 1800 /tmp/claude-1000/-home-maji-Documents-Bolt-Pet/58f4a7c3-6a92-47ed-9e43-bb2216d8b135/scratchpad/tmnvenv/bin/python -m pytest tests -q -p no:cacheprovider --ignore=tests/test_tool_markers.py --ignore=tests/test_tts_sanitization.py --ignore=tests/test_speaker_matching.py --ignore=tests/test_recent_speaker_fallback.py --ignore=tests/test_assistant_cli_call_proxy.py --ignore=tests/test_assistant_cli_permissions.py --ignore=tests/test_memory_store.py --ignore=tests/test_default_agent.py --ignore=tests/test_billing_web.py)",
+      "WebFetch(domain:elevenlabs.io)",
+      "Bash(QT_QPA_PLATFORM=offscreen .venv/bin/pytest tests/test_dialogue.py -q)",
+      "Bash(timeout 900 /tmp/claude-1000/-home-maji-Documents-Bolt-Pet/58f4a7c3-6a92-47ed-9e43-bb2216d8b135/scratchpad/tmnvenv/bin/python -m pytest tests/test_system_index.py tests/test_initiative.py tests/test_self_experiments.py -q -p no:cacheprovider)",
+      "Bash($V *)",
+      "Bash(dig +short themajesticnetwork.com)",
+      "Bash(dig +short api.themajesticnetwork.com)",
+      "Bash(timeout 900 /tmp/claude-1000/-home-maji-Documents-Bolt-Pet/58f4a7c3-6a92-47ed-9e43-bb2216d8b135/scratchpad/tmnvenv/bin/python -m pytest tests/test_site.py -q -p no:cacheprovider)",
+      "Bash(curl -s -o /dev/null -w 'HTTP %{http_code}  bytes=%{size_download}\\\\n' -m 15 -H 'X-Forwarded-For: 1.2.3.4' -H 'X-Real-IP: 1.2.3.4' -A 'Mozilla/5.0 \\(X11; Linux x86_64\\) Firefox/152.0' https://themajesticnetwork.com/?claude-probe-__TRACKED_VAR__)"
     ]
   }
 }

.env.example

@@ -31,6 +31,36 @@ ELEVENLABS_VOICE_ID=
 #ELEVENLABS_MODEL_ID=eleven_flash_v2
 #TTS_SAMPLE_RATE=24000
 
+# Ask Bolt to use a different voice (or another language) and the server
+# picks one from the ElevenLabs voice library and tags the reply with it.
+# It only tags one reply, and it can't remember the id afterwards — so the
+# pet keeps using that voice until a new one is picked or you choose "Use
+# default voice" in the tray. VOICE_STICKY=false makes each pick last for
+# exactly the one reply it came with instead.
+#VOICE_STICKY=true
+
+# ── Multi-voice dialogue (ElevenLabs Text to Dialogue) ──────────────────────
+# Lets Bolt play a short scene in several voices with delivery tags the v3
+# model acts on ("[cheerfully] Hello", "[whispering] He is lying"), driven by
+# the server through a relayed `dialoguectl` command. Name the cast here —
+# "self" always means whatever voice the pet is currently using.
+#DIALOGUE=true
+#DIALOGUE_MODEL_ID=eleven_v3
+#DIALOGUE_VOICES=narrator:9BWtsMINqrJLrRacOk9x,villain:IKne3meq5aSn9XLyUdCD
+
+# ── Self-restart (optional) ─────────────────────────────────────────────────
+# `petctl self_restart <why>` lets Bolt reload the pet after editing its own
+# code, so he can check the change live. The code is import-checked first, the
+# restart waits for the current turn to finish, and the reason is carried
+# across so the new process reports back. The guard refuses more than
+# SELF_RESTART_MAX restarts within SELF_RESTART_WINDOW_SECONDS.
+#SELF_RESTART=true
+#SELF_RESTART_MAX=5
+#SELF_RESTART_WINDOW_SECONDS=900
+# Used instead of ELEVENLABS_MODEL_ID whenever the server picked the voice
+# or the reply has non-ASCII in it — the flash_v2 default is English-only.
+#ELEVENLABS_MULTILINGUAL_MODEL_ID=eleven_flash_v2_5
+
 # ── Audio devices (optional — leave blank for the system default) ──────────
 #MIC_DEVICE=
 #SPEAKER_DEVICE=
@@ -73,6 +103,9 @@ ELEVENLABS_VOICE_ID=
 #PET_CLICK_THROUGH=false
 #PET_EDGE_SNAP=true
 #PET_SNAP_MARGIN=48
+# Start where you last dragged it. A position on a monitor that's no longer
+# connected is ignored, so unplugging a screen can't hide the pet off-desktop.
+#PET_REMEMBER_POSITION=true
 
 # ── Barge-in (optional) — interrupt the pet mid-sentence ────────────────────
 # BARGE_IN_MODE decides what counts as an interruption:
@@ -108,6 +141,16 @@ ELEVENLABS_VOICE_ID=
 # ── Streaming TTS (optional) — starts talking on the first chunk ────────────
 #TTS_STREAMING=true
 
+# ── Latency: streaming the reply and the transcript ─────────────────────────
+# STREAMING_REPLIES speaks each sentence as the server generates it, instead of
+# waiting out the whole model call before the first word. STT_STREAMING sends
+# mic frames to Deepgram as you talk, so the transcript is ready the moment you
+# stop. Both fall back to the old path automatically if anything goes wrong.
+# VAD_SILENCE_END_SEC is the other half: it is dead air on every single turn,
+# so 0.8-1.0 feels markedly snappier than the 1.2 default.
+#STREAMING_REPLIES=true
+#STT_STREAMING=true
+
 # ── Screen context (optional) ───────────────────────────────────────────────
 # Sends the focused window's title along with what you said, so "what's this
 # error?" has a referent. Text only — no screenshots leave the machine.

CLAUDE.md

@@ -14,7 +14,8 @@ Pipeline: `mic → openWakeWord ("thunderbolt", on-device) / push-to-talk /
 click → record utterance → Deepgram STT → + active-window + screen-layout
 context → POST /desk/converse → [server may relay a shell command to run on
 this machine, or a `petctl` pseudo-command that moves/emotes the pet, jumps it
-to another monitor, or reads a screen's text back instead] → reply →
+to another monitor, reads a screen's text back, or plays a multi-voice scene
+instead] → reply (optionally tagged with a voice the server picked for it) →
 ElevenLabs streaming TTS (or offline pyttsx3 fallback) → speakers`, with the
 pet sprite/speech bubble reflecting state throughout, and playback
 interruptible by talking over it (barge-in).
@@ -34,6 +35,10 @@ all suppressed while it's napping (quiet hours / fullscreen DND).
 ./run.sh          # macOS/Linux
 run.bat           # Windows
 
+# Preflight: is this install actually going to work? (config, mic, keys, sprites…)
+python -m bolt_pet --doctor          # shallow: no network, no mic
+python -m bolt_pet --doctor --deep   # contacts the server and opens the microphone
+
 # Run tests (no pytest config file — tests self-insert repo root via sys.path).
 # QT_QPA_PLATFORM=offscreen avoids a QApplication segfault on headless/no-display hosts.
 QT_QPA_PLATFORM=offscreen .venv/bin/pytest tests/
@@ -79,7 +84,10 @@ logs a missing-config message and exits its thread instead of starting.
   `/desk/tool_result` until the server sends a final `reply` (capped at
   `_MAX_RELAY_HOPS`). This is the same "full desktop control" trust model as
   the server repo's other desk clients — commands only ever originate from
-  the user's own voice/click requests in their own session. `list_outbox_files`
+  the user's own voice/click requests in their own session. A final reply is
+  returned as a `Reply(text, voice_id, voice_name)` rather than a bare string,
+  because the server can tag it with a voice — see "Voices" below.
+  `list_outbox_files`
   / `download_outbox_file` hit the same `/desk/files` and `/desk/files/<id>`
   endpoints the server's `deliver_files` tool queues onto — see `file_delivery.py`.
 - **`file_delivery.py`** — the filesystem half of receiving files the server
@@ -104,7 +112,11 @@ logs a missing-config message and exits its thread instead of starting.
   `play_stream()` start playback on the first chunk; `chunks_to_int16()`
   carries odd bytes across HTTP chunk boundaries, without which everything
   after the first split sample plays as static — falling back to whole-clip
-  PCM then offline `pyttsx3`), `barge_in.py` (two detectors behind one
+  PCM then offline `pyttsx3`; every entry point takes an optional `voice_id`
+  overriding `ELEVENLABS_VOICE_ID`, and `model_for()` picks the multilingual
+  model whenever there's an override or non-ASCII text, since the default
+  `eleven_flash_v2` is English-only and would read either as garbled
+  phonetic English rather than failing), `barge_in.py` (two detectors behind one
   `reset()`/`check()` shape, chosen by `BARGE_IN_MODE` via `make_detector`:
   **wake** (default) scores every frame with the same openWakeWord model the
   idle listener uses, so only the wake phrase cuts playback; **energy** is the
@@ -115,8 +127,8 @@ logs a missing-config message and exits its thread instead of starting.
   accepts an injectable stream/model/protocol so tests don't need real audio
   hardware or a display.
 - **`pet_actions.py`** — `petctl` pseudo-commands (`petctl move top-left`,
-  `petctl emote wave`, `say`/`wander`/`nap`, plus the screen verbs
-  `jump`/`monitors`/`read`). The desk API has no "move the pet" payload type
+  `petctl emote wave`, `say`/`wander`/`nap`, the screen verbs
+  `jump`/`monitors`/`read`, and `voice reset`). The desk API has no "move the pet" payload type
   and this repo can't change the server, so these ride the existing
   shell-command relay: `controller._handle_command` parses them and they never
   reach `subprocess`; anything else is a real shell command exactly as before.
@@ -125,7 +137,51 @@ logs a missing-config message and exits its thread instead of starting.
   module doesn't have, so the spec passes through to `monitors.resolve()`.
   Query verbs (`monitors`, `read`) are answered in `_handle_command` rather
   than by `pet_actions.describe()`, because their output *is* the point: it
-  goes back up the tool-result relay for Bolt to use in his reply.
+  goes back up the tool-result relay for Bolt to use in his reply — as is
+  `voice reset`, which reports what it dropped since the server can't see
+  which voice is in use. `voice` only ever resets: picking one is the
+  server's job (`speak_as`, which it already knows how to use), so a
+  `petctl voice <name>` attempt is an error pointing back at that marker.
+- **`self_restart.py`** — `petctl self_restart`, the pet restarting itself so
+  Bolt can *see* a code change he just made instead of waiting for a human to
+  restart it. Three problems shape it, and all three are the interesting part.
+  (1) The restart can't happen inline: killing the process mid-turn would drop
+  the HTTP tool relay before the result was posted, leaving the server to wait
+  out its timeout on a turn that can never finish — so the command only
+  *arms* it (`controller._arm_self_restart`) and
+  `controller._maybe_self_restart` fires it after the reply is spoken, the
+  same "only between turns" rule the updater follows. (2) A broken edit must
+  not be fatal, so `preflight()` imports the package in a **subprocess**
+  before arming — this process holds the old modules, so an in-process import
+  would pass on a file that no longer parses — and a SyntaxError comes back as
+  the command's output, in the same turn, with the pet still running. (3) The
+  reason has to outlive the process, so it's written to
+  `~/.cache/bolt-pet/restart_context.json` (never inside the repo Bolt is
+  editing) and read on the way back up by `controller._report_self_restart`,
+  which posts it to the server as an ordinary turn — that's what makes
+  "restart and check the sprites load" finish as a spoken sentence rather than
+  a silence. `check_loop_guard` refuses after `SELF_RESTART_MAX` restarts in
+  `SELF_RESTART_WINDOW_SECONDS`, so an edit-restart-crash cycle stops itself.
+  Off switch: `SELF_RESTART=false`.
+- **`dialogue.py`** — `dialoguectl` pseudo-commands: a multi-voice *scene*
+  through ElevenLabs' Text to Dialogue endpoint (`audio/tts.
+  synthesize_dialogue`), checked in `_handle_command` between petctl and
+  filectl. Same single-line-JSON wire format as filectl and for the same
+  reason (the server's `command` marker captures only up to the next
+  newline), and it accepts the ElevenLabs field names (`inputs`/`voice_id`)
+  as well as its own (`lines`/`voice`) because the model has read that API
+  and copying its shape is the obvious thing to try. Voices are *named*
+  (`DIALOGUE_VOICES` maps names to ids) rather than pasted as raw ids, and
+  `self` resolves to whatever voice the pet is speaking with right now —
+  including a `speak_as` pick — so Bolt sounds like himself in his own
+  scenes. The API's limits (10 distinct voices, ~2000 characters) are
+  enforced *before* the request so a mistake comes back up the tool-result
+  relay as a sentence Bolt can act on rather than an HTTP 422 he can't see.
+  Unlike the normal reply path there is no streaming variant, so a scene is
+  whole-clip: `controller._play_dialogue` plays it with the same bubble,
+  transcript and barge-in handling a spoken reply gets, and returns to
+  THINKING afterwards (not IDLE) because the server is still waiting on the
+  tool result — that leg is why `state.py` allows TALKING -> THINKING.
 - **`file_ops.py`** — `filectl` pseudo-commands, checked in `_handle_command`
   right after petctl and before falling through to a real shell command.
   Executing arbitrary commands already worked via the shell relay
@@ -187,7 +243,18 @@ logs a missing-config message and exits its thread instead of starting.
 - **`quiet.py`** — quiet-hours spec parsing (`23:00-08:00`, wraps midnight,
   comma-separated). Napping suppresses *proactive* noise and wandering only;
   wake word / click / push-to-talk still work.
-- **`notifications.py`** — Linux/D-Bus notification bridge: tails
+- **`notifications.py`** — Linux/D-Bus notification bridge. Two latency/loss bugs
+  fixed 2026-08-02, both in `controller._maybe_heartbeat`: draining was wired to the
+  60s heartbeat interval rather than the ~1.2s wake tick, and a heartbeat that landed
+  mid-conversation stamped its own clock *before* checking — burning the slot and
+  waiting another full interval, repeatedly, which is how a notification could go
+  unspoken for five or ten minutes. Draining now runs on every tick while IDLE, and the
+  heartbeat clock only advances when the heartbeat actually runs. Separately, the rate
+  limit used to *drop* notifications inside its window (a second text a minute later was
+  silently lost); the filter still gates at queue time but the limit is gone — a burst
+  is **batched into one turn** instead, same single round trip, no lost messages, capped
+  by `_MAX_PENDING_NOTIFICATIONS`.
+- **`notifications.py` internals** — tails
   `dbus-monitor`, parses Notify calls (pure `iter_notifications()`), filters
   and rate-limits them (`NotificationGate`), and the controller forwards
   survivors through `converse()`. Off by default — each one is a round trip.
@@ -223,6 +290,81 @@ logs a missing-config message and exits its thread instead of starting.
 - **`hotkey.py`** — global push-to-talk via `pynput`; soft-fails with a logged
   reason (Wayland, missing package, macOS permissions) since the wake word is
   the primary trigger.
+- **`audio/stt_stream.py`** — streaming speech-to-text. The one-shot path waits for
+  the utterance to end, uploads the whole WAV, then waits again; that second wait is
+  dead time that grows with how long you spoke. Deepgram's live websocket removes it:
+  `record_utterance(on_frame=...)` hands each captured frame to a
+  `StreamingTranscriber`, so by the time the VAD decides you stopped the transcript is
+  essentially already there. Three deliberate limits: `open()` returning **None is an
+  ordinary outcome** (no websocket-client, no network, no key) because the full audio is
+  still buffered and `controller._transcribe` just falls back; the **local VAD still
+  decides when you stopped** rather than Deepgram's endpointing, since barge-in,
+  follow-up listening and the grace period are all built on it and coupling them to the
+  network is not a first-pass change; and the socket is **per-utterance**, because
+  holding one open across an idle pet bills for silence and dies on the first blip.
+  Off: `STT_STREAMING=false`.
+- **Streamed replies** — `server_client.converse_stream()` reads NDJSON from the desk
+  API's `/desk/converse_stream` and speaks each sentence as it arrives
+  (`controller._speak_stream_chunk`), so the wait is time-to-first-sentence instead of
+  the whole model call. `Reply.spoken` marks a reply whose sentences were already said:
+  the text is still carried, because the follow-up rule needs to see whether it ended on
+  a question, but it must not be read out again. A stream that fails *before* anything
+  was spoken falls back to `converse()` invisibly; one that fails after ends the turn
+  quietly rather than repeating the first half. Off: `STREAMING_REPLIES=false`.
+- **`speech.py`** — everything the pet says, and the policy differences between
+  kinds of saying. There were four near-copies of this in `controller.py` (a
+  reply, a holding line, a streamed sentence, a dialogue scene), each repeating
+  the same dance — transition state, show the bubble, maybe record history,
+  reset barge-in, call TTS, reset barge-in *again*, resume state, decide
+  whether to keep the mic open — and they had already drifted apart: one forgot
+  to arm barge-in, another skipped the follow-up rule. Now the dance is
+  `Speaker.say()` and the differences are data on a frozen `Utterance`
+  (`record`, `resume`, `hold_talking`, `follow_up`, `interruptible`), built by
+  the four classmethods `reply`/`holding`/`stream_chunk`/`scene`. Notable
+  policies: a holding line is **not** recorded (it's filler; the transcript
+  should keep the answer) and **not** interruptible (cutting off "give me a
+  sec" strands the tool already running), and it resumes the state it
+  interrupted rather than dropping to IDLE, because the turn isn't over. A
+  streamed chunk stays TALKING so the sprite doesn't flicker between sentences.
+  Collaborators are injected, so all of this is tested without Qt, audio or a
+  real state machine. Two subtleties that are bugs waiting to happen: the
+  barge-in detector is read through a **callable**, not held (it's built after
+  the Speaker — it needs the mic stream — and swapped when the mode changes; two
+  copies drifting apart is invisible until the wake model starts hearing the
+  pet), and `last_detail` is captured *before* the post-playback reset, since
+  reading it after means every interruption reports zeroed counters.
+  `follow_up_decision()` is the mic-open rule as a pure function.
+- **Lip-sync** — the mouth is driven by the audio, not a timer.
+  `audio/tts.level_of(frame)` reduces a PCM frame to 0..1 loudness on a **sqrt
+  curve** (speech sits well below peak most of the time, so a linear map leaves
+  the mouth barely open during normal talking), `envelope()` does the same for a
+  whole clip, and playback calls the `on_level` hook per chunk. That travels
+  `Speaker` → `controller.mouth` (a Signal) → `PetWindow.set_mouth`, and
+  `_mouth_frame()` indexes the talking frames directly — which works because
+  `generate_bolt_sprites.py` draws them as an **openness ramp** (closed first,
+  widest last) rather than an arbitrary loop. Levels going stale
+  (`_MOUTH_STALE_SECONDS`) hands control back to the ordinary animation, so
+  offline TTS — which has no envelope — degrades to the timed loop instead of
+  freezing the mouth mid-syllable.
+- **`window_state.py`** — where the pet was left, so it starts there.
+  `~/.cache/bolt-pet/window.json`, atomic write on drag-end, every function
+  swallows its own errors (a corrupt state file must mean the default corner,
+  never a pet that won't start). `is_visible_on()` re-validates against the
+  *current* screen layout on load, because the common case for a stale position
+  is exactly the dangerous one: the pet was last on a monitor that is now
+  unplugged, and restoring it faithfully puts it somewhere unreachable. Takes
+  plain rectangles rather than importing Qt. Off: `PET_REMEMBER_POSITION=false`.
+- **`doctor.py`** — `python -m bolt_pet --doctor`, a preflight, written after a
+  week of debugging things one command would have shown: a venv whose python
+  was a zero-byte file, an OCR engine never installed, a wrong proxy header.
+  Twelve independent checks, each reporting ok / warn (degraded but working) /
+  fail, and each saying **what to do about it** — `screen reading: warn` is
+  useless alone, `apt install tesseract-ocr` is the whole point. Nothing raises:
+  a doctor that crashes on a broken install is diagnosing the wrong patient, so
+  `run()` catches per-check and a failed check becomes a FAIL row rather than a
+  traceback. Shallow by default (no network, no mic) since it's the first thing
+  you reach for when the network is what's broken; `--deep` actually contacts
+  the server and opens the microphone.
 - **`speech_text.py`** — sanitizes server replies before they're heard/shown.
   `for_speech()` (called inside `tts.speak()`, so every path to the speakers is
   covered) strips markdown, emoji, URLs and stray symbols the voice would read
@@ -232,7 +374,7 @@ logs a missing-config message and exits its thread instead of starting.
   whether a reply leaves the pet waiting on an answer: it tests the *spoken*
   form (so a '?' inside a stripped code block or URL doesn't count) and only a
   trailing one counts, since a question asked in passing isn't awaiting a
-  reply. `controller._should_follow_up` uses it to keep listening without the
+  reply. `speech.follow_up_decision` uses it to keep listening without the
   wake word, capped by `FOLLOW_UP_MAX_TURNS` so a server that ends every reply
   with a question can't loop forever off mic noise. Pure string logic, no
   Qt/audio imports.
@@ -274,9 +416,38 @@ logs a missing-config message and exits its thread instead of starting.
   name rather than by `PetState`, with `has()` reporting whether a key is
   backed by real art so callers can decline a placeholder instead of trotting
   a blob across the desktop; `tray.py` is the system tray menu (talk now / mute / nap / wander /
-  click-through / history / wake-word tuning / quit) — the pet window has no
-  title bar or taskbar entry; `history_window.py` and `wake_tuner.py` are the
-  two dialogs it opens.
+  click-through / history / wake-word tuning / use-default-voice / quit) — the
+  pet window has no title bar or taskbar entry; `history_window.py` and
+  `wake_tuner.py` are the two dialogs it opens.
+
+### Voices (the server's `speak_as`)
+
+Ask Bolt to talk like someone else, or in another language, and the *server*
+does the picking: its desk-only `voice_search` marker browses the ElevenLabs
+voice library, and `speak_as: <voice_id>` on the final reply tags that reply
+with the chosen voice (adding a Voice Library pick to the ElevenLabs account
+first, so the id is usable by the time it reaches us). Nothing about that is
+this repo's to decide — all the client owes it is actually speaking in the
+voice it was handed: `converse()` returns it on `Reply`, `_apply_voice()`
+records it, and `_speak()` passes it to `tts.speak(voice_id=...)`.
+
+Two things are decided *here*, though, because the server can't:
+
+- **The voice sticks** (`VOICE_STICKY`, default on). The server tags one
+  reply and strips the marker before storing the turn, so it never sees the
+  id again — "keep talking like that" would send it searching for a voice all
+  over again, and it'd likely land on a different one. Holding the id
+  client-side is what makes the rest of the conversation stay in that voice.
+  An untagged reply therefore never *changes* the voice; only a new
+  `speak_as`, `VOICE_STICKY=false`, or a reset does.
+- **There's a way back.** Since the server was never told Bolt's own voice
+  id, it can't ask for it back with `speak_as` — so reverting is local: the
+  tray's **Use default voice** entry (enabled only while a picked voice is
+  in use, kept in sync by the `voice_changed` signal), a restart, or
+  `petctl voice reset`, which is what lets Bolt honour "go back to your
+  normal voice" out loud. That last one needs the server's pet prompt block
+  (`ai/desk_api.py`, `pet_tools`) to mention the verb, or the model never
+  emits it — the desk API's prompt is where petctl is advertised.
 
 ### Wake-word detection
 
@@ -333,6 +504,20 @@ HTTP chunk reassembly by `chunks_to_int16`, emote motion by
 `screen_context.context_for` / `is_fullscreen_active`, otherwise they shell
 out to xprop on a headless box.
 
+**`test_pipeline_smoke.py` is the exception, deliberately.** Unit tests inject
+a fake at the seam they care about, and a run of production bugs — notifications
+sitting unspoken for minutes, the pet saying things twice, `[laughing]` read
+aloud, a device command arriving as prose — got through with every one of them
+green, because each was an *interaction* between two individually-correct
+units. So that file stands up a real threaded HTTP server on a loopback port,
+speaks the desk protocol at it, and drives whole turns through the real
+`server_client` (including NDJSON streaming), the real controller and the real
+state machine, faking only the mic stream and the speakers. When a bug crosses
+a module boundary, add the case there; when it lives inside one module, the
+pure-function pattern above is still the cheaper test. It is also worth
+mutation-checking a new case — break the source line it is meant to catch and
+confirm it actually goes red.
+
 ## Security notes
 
 The server can relay a shell command back to this machine to execute as the

README.md

@@ -69,8 +69,8 @@ limitations).
   speaks, and barging in starts your next turn immediately (`BARGE_IN`).
 - Right-click the tray icon for **Talk now**, **Mute mic**, **Nap**,
   **Wander around**, **Click through the pet**, **History…**, **Wake word
-  tuning…** and **Quit** — the pet window itself has no title bar or taskbar
-  entry.
+  tuning…**, **Use default voice** and **Quit** — the pet window itself has
+  no title bar or taskbar entry.
 - **Click the speech bubble** to copy what it just said; the tray's
   **History…** window keeps the last `HISTORY_LIMIT` turns.
 
@@ -80,8 +80,8 @@ limitations).
   listening/thinking/talking or while a bubble is up.
 - **Moves and emotes on command.** Bolt can relay `petctl move top-left`,
   `petctl emote wave|hop|spin|nod|shake`, `petctl say ...`, `petctl wander
-  on|off`, `petctl nap on|off`. These are intercepted here and never reach a
-  shell.
+  on|off`, `petctl nap on|off`, `petctl voice reset`, and `dialoguectl` for a
+  multi-voice scene. These are intercepted here and never reach a shell.
 - **Naps** during `QUIET_HOURS` (e.g. `23:00-08:00`) or while a fullscreen
   app is focused (`DND_ON_FULLSCREEN`) — it dims, stops wandering, and makes
   no proactive noise. It still answers when you speak to it.
@@ -90,6 +90,41 @@ limitations).
   notifications get forwarded to the server, so it can tell you the deploy
   went green. Off by default: each one costs a round trip.
 
+## Speaking in another voice
+
+Ask for a different voice — "use a clearer voice", "talk like a pirate", "say
+that in Japanese" — and Bolt searches the ElevenLabs voice library on the
+server, picks one, and tags his reply with it (`speak_as`); the pet is what
+actually speaks in it. A Voice Library pick is added to your ElevenLabs
+account automatically the first time it's used, and non-English replies (or
+any picked voice) go through `ELEVENLABS_MULTILINGUAL_MODEL_ID` rather than
+the English-only `eleven_flash_v2` default.
+
+The new voice **stays on** for the rest of the conversation, because the
+server tags a single reply and doesn't remember which voice it chose — so
+"keep talking like that" would otherwise send it hunting for a voice again.
+To get his own voice back: ask him ("use your normal voice" — he relays
+`petctl voice reset`), use **Use default voice** in the tray menu (greyed
+out unless a picked voice is active), or restart the pet. Set
+`VOICE_STICKY=false` in `.env` if you'd rather each pick lasted exactly one
+reply.
+
+## Multi-voice dialogue
+
+Ask for a scene — "do the argument between the two of them", "read that back
+as a radio play" — and Bolt can relay a `dialoguectl` command that the pet
+renders through ElevenLabs' Text to Dialogue endpoint: several voices in one
+take, with delivery tags the v3 model acts on (`[cheerfully]`, `[whispering]`,
+`[stuttering]`). One request per scene, so the voices actually react to each
+other instead of sounding like clips glued together.
+
+Name the cast in `.env` (`DIALOGUE_VOICES=narrator:9BWts…,villain:IKne3…`);
+the name `self` always means whatever voice the pet is currently using, so
+Bolt sounds like himself in his own scenes — including after a `speak_as`
+switch. Scenes show up in the speech bubble with the tags stripped, count as
+normal speech for the transcript, and can be talked over like any other reply.
+`DIALOGUE=false` turns the whole thing off on this device.
+
 ## Wake-word detection
 
 `bolt_pet/audio/wake_word.py` feeds every mic frame into `thunderbolt.onnx`
@@ -105,6 +140,33 @@ near misses — frames that scored just under the threshold — and the slider
 takes effect immediately, mid-listen. Set the threshold just below the peak
 you can hit reliably, then write it into `.env` as `WAKE_WORD_THRESHOLD`.
 
+## Something not working?
+
+```bash
+python -m bolt_pet --doctor
+```
+
+Checks the things that make the pet look broken in ways that don't point at
+themselves — missing server config (the controller exits its thread at startup,
+so the pet appears alive and simply never answers), no input device, no OCR
+engine behind `petctl read`, a wake model that isn't where `.env` says, a
+silence timeout long enough to feel like lag. Each line says what to do about
+it, not just what's wrong. It doesn't touch the network or open the microphone
+unless you add `--deep`, so it's safe to run when the network is the suspect.
+
+## Little things
+
+The pet **remembers where you left it** — drag it somewhere deliberate and
+that's where it starts next time. If that position is on a monitor you've since
+unplugged it goes back to the default corner rather than restoring itself
+somewhere off-screen. `PET_REMEMBER_POSITION=false` to always start in the
+corner.
+
+Its **mouth moves with the actual audio** rather than flapping on a timer: the
+PCM going to the speakers is reduced to a loudness per frame and that picks the
+talking sprite, so the pet shuts up when the voice pauses. Offline `pyttsx3`
+playback has no waveform to follow, so it falls back to the timed loop.
+
 ## Project layout
 
 ```
@@ -113,6 +175,7 @@ bolt_pet/
   state.py            PetState enum + a small transition-checked state machine
   server_client.py    /desk/converse, /desk/tool_result, /desk/report_status
   controller.py        the pipeline: wake word -> STT -> server -> TTS, on a QThread
+  speech.py             what the pet says and how each kind of saying behaves
   speech_text.py         strips markdown/emoji/URLs so the voice never says "asterisk"
   pet_actions.py         petctl move/emote/say/wander/nap parsing
   screen_context.py       active-window title + fullscreen detection
@@ -120,11 +183,15 @@ bolt_pet/
   notifications.py          desktop notification bridge (Linux/D-Bus)
   history.py                 rolling conversation transcript
   hotkey.py                   global push-to-talk (pynput, optional)
+  window_state.py              remembers where you left the pet
+  doctor.py                     `--doctor` preflight: is this install going to work?
   audio/
     mic.py             input stream + energy-based VAD utterance capture
     wake_word.py        openWakeWord thunderbolt.onnx detection (see above)
-    stt.py               Deepgram
-    tts.py                ElevenLabs streaming PCM, offline pyttsx3 fallback
+    stt.py               Deepgram (one-shot)
+    stt_stream.py         Deepgram live websocket — transcribes while you speak
+    tts.py                 ElevenLabs streaming PCM, offline pyttsx3 fallback,
+                            plus the loudness envelope that drives the mouth
     barge_in.py            "you started talking" detector, to cut playback short
   ui/
     app.py              wires QApplication + window + tray + controller thread together
@@ -137,8 +204,10 @@ bolt_pet/
 scripts/
   slice_spritesheet.py  cuts a grid sprite sheet into the per-frame convention
 tests/                  pure-logic unit tests (state machine, wake-phrase
-                         matching, HTTP client against mocks) — nothing here
-                         needs real audio hardware or a display
+                         matching, HTTP client against mocks) plus one
+                         end-to-end smoke test that drives whole turns against
+                         a real local HTTP server — nothing here needs real
+                         audio hardware or a display
 ```
 
 ## Security notes
@@ -162,7 +231,6 @@ notifications. No screenshots or images are ever sent.
 
 ## Known limitations / not-yet-done
 
-- Pet screen position isn't persisted across restarts.
 - Wandering is a straight walk to a random point — no Shimeji-style physics,
   wall-climbing or falling.
 - Push-to-talk and the notification bridge are platform-limited: the hotkey

bolt_pet/__init__.py

@@ -4,4 +4,4 @@ __version__ is what the auto-updater compares against the newest tag on the
 Gitea releases page (see updater.py), so bump it in the same commit you tag.
 """
 
-__version__ = "0.2.2"
+__version__ = "0.2.3"

bolt_pet/__main__.py

@@ -1,8 +1,15 @@
-"""Entry point: python -m bolt_pet"""
+"""Entry point: python -m bolt_pet [--doctor [--deep]]"""
 
 import sys
 
+if __name__ == "__main__":
+    if "--doctor" in sys.argv:
+        # Imported inside the branch, not at module scope: the doctor exists to
+        # diagnose installs where importing the UI would itself blow up.
+        from .doctor import main as doctor
+
+        sys.exit(doctor(sys.argv[1:]))
+
     from .ui.app import run
 
-if __name__ == "__main__":
     sys.exit(run())

bolt_pet/audio/mic.py

@@ -37,6 +37,20 @@ def rms(frame: np.ndarray) -> float:
     return float(np.sqrt(np.mean(frame.astype(np.float64) ** 2)))
 
 
+def _emit(on_frame, frame) -> None:
+    """Hand a frame to a listener without letting it break the capture.
+
+    Streaming STT is an optimisation riding along with recording; if its
+    socket dies mid-utterance the recording must carry on untouched, because
+    the one-shot fallback is about to need the full buffer."""
+    if on_frame is None:
+        return
+    try:
+        on_frame(frame)
+    except Exception:
+        pass
+
+
 def record_utterance(
     stream: AudioStream,
     should_continue=lambda: True,
@@ -47,6 +61,7 @@ def record_utterance(
     grace_s: float = None,
     frame_len: int = config.FRAME_LEN,
     sample_rate: int = config.SAMPLE_RATE,
+    on_frame=None,
 ) -> Optional[np.ndarray]:
     """Capture one utterance from *stream*: wait for speech to start, stop
     after trailing silence. Returns None if nothing usable was heard.
@@ -55,6 +70,11 @@ def record_utterance(
     (e.g. the pet window was closed) without needing threading primitives
     baked into this function.
 
+    *on_frame*, if given, is called with each captured frame while speech is
+    in progress — that is how streaming STT transcribes as you talk rather
+    than after (see audio/stt_stream.py). It is fire-and-forget: this function
+    still returns the full buffer, so a failed stream costs nothing.
+
     *grace_s* is how long to wait for speech to *begin* before giving up.
     The controller stretches it for follow-up questions, where you're being
     asked something and need a moment to think rather than having just said
@@ -83,10 +103,12 @@ def record_utterance(
             if frame_rms >= rms_threshold:
                 started = True
                 frames.append(frame)
+                _emit(on_frame, frame)
             elif waited > grace_frames:
                 return None  # woke it up but said nothing
             continue
         frames.append(frame)
+        _emit(on_frame, frame)
         if frame_rms < rms_threshold:
             silence_frames += 1
             if silence_frames >= silence_limit:

bolt_pet/audio/stt_stream.py

@@ -0,0 +1,181 @@
+"""Streaming speech-to-text — transcribing *while* you talk, not after.
+
+The one-shot path (`stt.transcribe`) waits for the utterance to finish, then
+uploads the whole WAV and waits again. That second wait is dead time between
+you stopping and the pet reacting, and it grows with the length of what you
+said — a thirty-second question costs noticeably more than a five-second one.
+
+Deepgram's live endpoint removes it: frames go up as they are captured, so by
+the time the VAD decides you have stopped, the transcript is essentially
+already there. Same model, same account, same accuracy — the difference is
+purely when the work happens.
+
+Design constraints that shaped this:
+
+- **Failure must be invisible.** No websocket, no network, a mid-utterance
+  disconnect — all of it falls back to the one-shot path, which still has the
+  full audio buffered. Streaming is an optimisation, never a dependency, so
+  `open()` returning None is an ordinary outcome rather than an error.
+- **The VAD still decides when you stopped.** Deepgram has its own endpointing
+  and using it would save more, but it would also move a decision the rest of
+  the pipeline is built around (barge-in, follow-up listening, the grace
+  period) into a remote service. Not worth coupling those to the network on
+  the first pass.
+- **The socket is per-utterance.** Holding one open across an idle pet would
+  bill for silence and drop on the first network blip; opening one takes
+  ~100ms, which is already inside the time it takes a person to start talking.
+
+The websocket client is injectable, so the whole protocol — send frames, read
+`is_final` transcripts, close, take the result — is tested without a network.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import threading
+from typing import Callable, Optional
+
+import numpy as np
+
+from .. import config
+
+logger = logging.getLogger("bolt_pet.stt_stream")
+
+_ENDPOINT = (
+    "wss://api.deepgram.com/v1/listen"
+    "?encoding=linear16&channels=1&sample_rate={rate}&model={model}"
+    "&language=en&smart_format=true&interim_results=false"
+)
+
+
+def available() -> bool:
+    """Whether streaming STT can even be attempted in this install."""
+    if not config.STT_STREAMING or not config.DEEPGRAM_API_KEY:
+        return False
+    try:
+        import websocket  # noqa: F401  (websocket-client)
+        return True
+    except Exception:
+        return False
+
+
+class StreamingTranscriber:
+    """One utterance's worth of live transcription.
+
+    Usage mirrors how the capture loop already works — feed frames as they
+    arrive, then ask what was said:
+
+        session = StreamingTranscriber.open()
+        ...
+        session.feed(frame)      # per mic frame, non-blocking
+        text = session.finish()  # after the VAD says you stopped
+    """
+
+    def __init__(self, socket, *, sample_rate: int = None):
+        self._socket = socket
+        self._sample_rate = sample_rate or config.SAMPLE_RATE
+        self._transcript: list[str] = []
+        self._lock = threading.Lock()
+        self._closed = False
+        self._reader = threading.Thread(
+            target=self._read_loop, name="stt-stream-reader", daemon=True)
+        self._reader.start()
+
+    # -- lifecycle ----------------------------------------------------------
+
+    @classmethod
+    def open(cls, *, connect: Optional[Callable] = None,
+             sample_rate: int = None) -> Optional["StreamingTranscriber"]:
+        """Connect, or return None if streaming isn't possible right now.
+
+        None is a normal outcome, not a failure: the caller keeps the audio and
+        falls back to the one-shot upload."""
+        if connect is None and not available():
+            return None
+        rate = sample_rate or config.SAMPLE_RATE
+        try:
+            if connect is not None:
+                socket = connect()
+            else:
+                import websocket
+
+                socket = websocket.create_connection(
+                    _ENDPOINT.format(rate=rate, model=config.DEEPGRAM_MODEL),
+                    header={"Authorization": f"Token {config.DEEPGRAM_API_KEY}"},
+                    timeout=10,
+                )
+            return cls(socket, sample_rate=rate)
+        except Exception as exc:
+            logger.info("Streaming STT unavailable (%s) — using the one-shot path.", exc)
+            return None
+
+    def feed(self, frame: np.ndarray) -> None:
+        """Send one captured frame. Never raises — a dead socket just means the
+        fallback will do the work."""
+        if self._closed:
+            return
+        try:
+            self._socket.send_binary(np.asarray(frame, dtype=np.int16).tobytes())
+        except Exception:
+            logger.debug("Streaming STT send failed; abandoning the stream", exc_info=True)
+            self._closed = True
+
+    def finish(self, timeout: float = 3.0) -> str:
+        """Close the stream and return whatever was transcribed.
+
+        Deepgram flushes its final results after the close frame, so this waits
+        briefly for the reader — bounded, because a hung socket must not hold
+        up the reply."""
+        if not self._closed:
+            try:
+                self._socket.send(json.dumps({"type": "CloseStream"}))
+            except Exception:
+                pass
+        self._closed = True
+        self._reader.join(timeout=timeout)
+        try:
+            self._socket.close()
+        except Exception:
+            pass
+        with self._lock:
+            return " ".join(part for part in self._transcript if part).strip()
+
+    # -- the reader ---------------------------------------------------------
+
+    def _read_loop(self) -> None:
+        while not self._closed:
+            try:
+                message = self._socket.recv()
+            except Exception:
+                break
+            if not message:
+                break
+            text, is_final = self._parse(message)
+            if text and is_final:
+                with self._lock:
+                    self._transcript.append(text)
+
+    @staticmethod
+    def _parse(message) -> tuple[str, bool]:
+        """Pull (text, is_final) out of a Deepgram results frame.
+
+        Tolerant on purpose: anything unrecognised is ignored rather than
+        raising on the reader thread, where an exception would silently kill
+        transcription for the rest of the utterance."""
+        try:
+            if isinstance(message, bytes):
+                message = message.decode("utf-8", "ignore")
+            data = json.loads(message)
+        except (TypeError, ValueError):
+            return "", False
+        if not isinstance(data, dict):
+            return "", False
+        alternatives = (
+            ((data.get("channel") or {}).get("alternatives") or [])
+            if data.get("type") in (None, "Results") else []
+        )
+        if not alternatives:
+            return "", False
+        text = str((alternatives[0] or {}).get("transcript") or "").strip()
+        return text, bool(data.get("is_final") or data.get("speech_final"))

bolt_pet/audio/tts.py

@@ -5,11 +5,17 @@ desk_client/bolt_desk.py which shells out because it only targets Linux.
 Falls back to pyttsx3 (offline, cross-platform: SAPI5 on Windows, NSSpeech
 on macOS, espeak on Linux) if ElevenLabs isn't configured or the request
 fails, so the pet can still talk with zero cloud config.
+
+Every entry point takes an optional *voice_id* that overrides
+`ELEVENLABS_VOICE_ID` for that call — that's how the server's `speak_as`
+reply marker reaches the speakers (see controller._apply_voice). The offline
+fallback has no such concept and always sounds like itself.
 """
 
 from __future__ import annotations
 
-from typing import Iterable, Iterator
+import time
+from typing import Iterable, Iterator, Optional
 
 import numpy as np
 import requests
@@ -21,18 +27,40 @@ class TtsError(Exception):
     pass
 
 
-def synthesize_pcm(text: str) -> tuple[np.ndarray, int]:
+def voice_for(voice_id: Optional[str] = None) -> str:
+    """The voice this call should use: an override (server `speak_as`) if
+    given, else the configured default."""
+    return (voice_id or "").strip() or config.ELEVENLABS_VOICE_ID
+
+
+def model_for(text: str, voice_id: Optional[str] = None) -> str:
+    """Which ElevenLabs model to synthesize with.
+
+    The default (`eleven_flash_v2`) is English-only, and both things that
+    reach this branch mean the reply probably isn't English: a voice the
+    server picked mid-conversation is nearly always about a language or an
+    accent, and non-ASCII text can't be English at all. Rendering either one
+    through the English model gets you a mangled phonetic reading rather
+    than a failure, which is worse — so those go through the multilingual
+    model instead."""
+    if (voice_id or "").strip() or not text.isascii():
+        return config.ELEVENLABS_MULTILINGUAL_MODEL_ID
+    return config.ELEVENLABS_MODEL_ID
+
+
+def synthesize_pcm(text: str, voice_id: Optional[str] = None) -> tuple[np.ndarray, int]:
     """Returns (pcm_int16_mono, sample_rate). Raises TtsError on failure —
     callers should fall back to speak_offline() rather than treating this
     as fatal."""
-    if not (config.ELEVENLABS_API_KEY and config.ELEVENLABS_VOICE_ID):
+    voice = voice_for(voice_id)
+    if not (config.ELEVENLABS_API_KEY and voice):
         raise TtsError("ELEVENLABS_API_KEY / ELEVENLABS_VOICE_ID not set")
     try:
         response = requests.post(
-            f"https://api.elevenlabs.io/v1/text-to-speech/{config.ELEVENLABS_VOICE_ID}",
+            f"https://api.elevenlabs.io/v1/text-to-speech/{voice}",
             headers={"xi-api-key": config.ELEVENLABS_API_KEY},
             params={"output_format": f"pcm_{config.TTS_SAMPLE_RATE}"},
-            json={"text": text, "model_id": config.ELEVENLABS_MODEL_ID},
+            json={"text": text, "model_id": model_for(text, voice_id)},
             timeout=60,
         )
         response.raise_for_status()
@@ -44,20 +72,23 @@ def synthesize_pcm(text: str) -> tuple[np.ndarray, int]:
     return pcm, config.TTS_SAMPLE_RATE
 
 
-def stream_pcm(text: str, chunk_bytes: int = 4096) -> Iterator[np.ndarray]:
+def stream_pcm(
+    text: str, chunk_bytes: int = 4096, voice_id: Optional[str] = None
+) -> Iterator[np.ndarray]:
     """Same audio as synthesize_pcm(), but yielded as it arrives from
     ElevenLabs' /stream endpoint so playback can start on the first chunk
     (~300ms) instead of after the whole clip is synthesized. Raises TtsError
     before yielding anything if the request itself fails, so callers can fall
     back cleanly; a mid-stream failure just ends the generator."""
-    if not (config.ELEVENLABS_API_KEY and config.ELEVENLABS_VOICE_ID):
+    voice = voice_for(voice_id)
+    if not (config.ELEVENLABS_API_KEY and voice):
         raise TtsError("ELEVENLABS_API_KEY / ELEVENLABS_VOICE_ID not set")
     try:
         response = requests.post(
-            f"https://api.elevenlabs.io/v1/text-to-speech/{config.ELEVENLABS_VOICE_ID}/stream",
+            f"https://api.elevenlabs.io/v1/text-to-speech/{voice}/stream",
             headers={"xi-api-key": config.ELEVENLABS_API_KEY},
             params={"output_format": f"pcm_{config.TTS_SAMPLE_RATE}"},
-            json={"text": text, "model_id": config.ELEVENLABS_MODEL_ID},
+            json={"text": text, "model_id": model_for(text, voice_id)},
             timeout=60,
             stream=True,
         )
@@ -83,32 +114,130 @@ def chunks_to_int16(byte_chunks: Iterable[bytes]) -> Iterator[np.ndarray]:
             yield np.frombuffer(data[:usable], dtype=np.int16)
 
 
-def play_pcm(pcm: np.ndarray, sample_rate: int, blocking: bool = True, should_stop=None) -> bool:
+def synthesize_dialogue(
+    inputs: list, model_id: Optional[str] = None, stability: Optional[float] = None
+) -> tuple[np.ndarray, int]:
+    """Multi-voice scene via ElevenLabs Text to Dialogue.
+
+    One request, one take: the whole exchange is synthesized together, which
+    is the point — the model hears the previous line, so reactions and timing
+    land instead of sounding like separately-rendered clips.
+
+    Same PCM-over-`requests` posture as the rest of this module (no SDK, no
+    `play()` shelling out to ffplay), so playback is the same sounddevice path
+    everything else uses and barge-in works on it unchanged. There is no
+    documented streaming variant, and a scene is a short set piece anyway, so
+    this is whole-clip only.
+    """
+    if not (config.ELEVENLABS_API_KEY and inputs):
+        raise TtsError("ELEVENLABS_API_KEY not set (or no dialogue lines)")
+    body: dict = {
+        "inputs": [
+            {"text": str(entry.get("text") or ""), "voice_id": str(entry.get("voice_id") or "")}
+            for entry in inputs
+        ],
+        "model_id": model_id or config.DIALOGUE_MODEL_ID,
+    }
+    if stability is not None:
+        body["settings"] = {"stability": float(stability)}
+    try:
+        response = requests.post(
+            "https://api.elevenlabs.io/v1/text-to-dialogue",
+            headers={"xi-api-key": config.ELEVENLABS_API_KEY},
+            params={"output_format": f"pcm_{config.TTS_SAMPLE_RATE}"},
+            json=body,
+            timeout=120,  # a multi-voice take is slower to render than one line
+        )
+        response.raise_for_status()
+    except Exception as exc:
+        detail = ""
+        # The API explains refusals (character limit, unknown voice) in the
+        # body; surfacing it is what lets Bolt fix the call and retry.
+        body_text = getattr(getattr(exc, "response", None), "text", "")
+        if body_text:
+            detail = f" — {body_text[:300]}"
+        raise TtsError(f"ElevenLabs dialogue request failed: {exc}{detail}") from exc
+    pcm = np.frombuffer(response.content, dtype=np.int16)
+    if pcm.size == 0:
+        raise TtsError("ElevenLabs returned no dialogue audio")
+    return pcm, config.TTS_SAMPLE_RATE
+
+
+# ── how loud is it right now ────────────────────────────────────────────────
+# The PCM is already decoded here on its way to the speakers, so the amplitude
+# envelope is free — and it is exactly what a mouth needs to move in time with
+# speech. Throwing it away and animating the mouth on a timer instead is why
+# most talking sprites look dubbed.
+
+# int16 RMS that counts as "mouth fully open". Speech peaks around 8-12k;
+# 6000 keeps normal talking in the upper half of the range without clipping
+# every syllable to wide-open.
+_LOUD_RMS = 6000.0
+
+
+def level_of(frame: np.ndarray) -> float:
+    """0..1 loudness for one chunk of PCM.
+
+    Square-rooted because perceived loudness is not linear in amplitude — a
+    linear mapping leaves the mouth barely moving through ordinary speech."""
+    if frame is None or len(frame) == 0:
+        return 0.0
+    rms = float(np.sqrt(np.mean(np.square(frame.astype(np.float32)))))
+    return float(min(1.0, (rms / _LOUD_RMS) ** 0.5))
+
+
+def envelope(pcm: np.ndarray, sample_rate: int, fps: int = 30) -> list:
+    """Per-frame loudness for a whole clip, for playback that isn't streamed."""
+    if pcm is None or len(pcm) == 0:
+        return []
+    window = max(1, int(sample_rate / max(1, fps)))
+    return [level_of(pcm[start:start + window]) for start in range(0, len(pcm), window)]
+
+
+def play_pcm(pcm: np.ndarray, sample_rate: int, blocking: bool = True, should_stop=None,
+             on_level=None) -> bool:
     """Play a whole clip. Returns True if it finished, False if *should_stop*
     (barge-in) cut it short. *should_stop* is polled while audio plays — each
     poll consumes one mic frame, which is what paces this loop."""
     import sounddevice as sd
 
+    levels = envelope(pcm, sample_rate) if on_level is not None else []
+    started = time.monotonic()
     sd.play(pcm, samplerate=sample_rate, device=config.SPEAKER_DEVICE)
     if not blocking:
         return True
-    if should_stop is None:
+    if should_stop is None and on_level is None:
         sd.wait()
         return True
     while True:
+        if levels:
+            # Indexed by elapsed time rather than by chunk, because this path
+            # hands the whole clip to the device at once and never sees it
+            # again — wall clock is the only position we have.
+            index = int((time.monotonic() - started) * 30)
+            if index < len(levels):
+                try:
+                    on_level(levels[index])
+                except Exception:
+                    levels = []
         try:
             if not sd.get_stream().active:
                 break
         except Exception:
             break  # stream already torn down — playback is over
-        if should_stop():
+        if should_stop is not None and should_stop():
             sd.stop()
             return False
     return True
 
 
-def play_stream(chunks: Iterable[np.ndarray], sample_rate: int, should_stop=None) -> bool:
-    """Play int16 chunks as they arrive. Returns False if interrupted."""
+def play_stream(chunks: Iterable[np.ndarray], sample_rate: int, should_stop=None,
+                on_level=None) -> bool:
+    """Play int16 chunks as they arrive. Returns False if interrupted.
+
+    *on_level* receives each chunk's loudness (0..1) just before it is written,
+    which is what drives the mouth: the sprite is animated by the same audio
+    the speakers are getting, not by a guess about how long a word takes."""
     import sounddevice as sd
 
     with sd.OutputStream(
@@ -120,6 +249,11 @@ def play_stream(chunks: Iterable[np.ndarray], sample_rate: int, should_stop=None
                 # now, not at the end of the buffered chunk.
                 out.abort()
                 return False
+            if on_level is not None:
+                try:
+                    on_level(level_of(chunk))
+                except Exception:
+                    on_level = None  # a broken listener must not stop playback
             out.write(chunk)
     return True
 
@@ -134,11 +268,13 @@ def speak_offline(text: str) -> None:
     engine.runAndWait()
 
 
-def speak(text: str, on_error=None, should_stop=None) -> bool:
+def speak(text: str, on_error=None, should_stop=None, voice_id: Optional[str] = None,
+          on_level=None) -> bool:
     """Speak *text*, preferring streaming ElevenLabs, then whole-clip
     ElevenLabs, then offline TTS. *on_error*, if given, is called with the
     exception when ElevenLabs fails (useful for logging) — a fallback still
     runs either way. Returns False if barge-in interrupted playback.
+    *voice_id* overrides the configured voice for this line only.
 
     The text is sanitized first (speech_text.for_speech): server replies are
     written for a chat window, and a voice reads markdown/emoji literally
@@ -149,13 +285,18 @@ def speak(text: str, on_error=None, should_stop=None) -> bool:
         return True
     if config.TTS_STREAMING:
         try:
-            return play_stream(stream_pcm(text), config.TTS_SAMPLE_RATE, should_stop=should_stop)
+            return play_stream(
+                stream_pcm(text, voice_id=voice_id),
+                config.TTS_SAMPLE_RATE,
+                should_stop=should_stop,
+                on_level=on_level,
+            )
         except TtsError as exc:
             if on_error is not None:
                 on_error(exc)
     try:
-        pcm, sample_rate = synthesize_pcm(text)
-        return play_pcm(pcm, sample_rate, should_stop=should_stop)
+        pcm, sample_rate = synthesize_pcm(text, voice_id=voice_id)
+        return play_pcm(pcm, sample_rate, should_stop=should_stop, on_level=on_level)
     except TtsError as exc:
         if on_error is not None:
             on_error(exc)

bolt_pet/config.py

@@ -58,6 +58,11 @@ WAKE_CHECK_INTERVAL_SECONDS = float(os.environ.get("WAKE_CHECK_INTERVAL_SECONDS"
 
 DEEPGRAM_API_KEY = os.environ.get("DEEPGRAM_API_KEY", "")
 DEEPGRAM_MODEL = os.environ.get("DEEPGRAM_MODEL", "nova-3")
+# Transcribe *while* you talk instead of uploading the finished clip: frames go
+# up as they are captured, so the transcript is ready the moment the VAD says
+# you stopped. Needs `websocket-client`; falls back to the one-shot upload
+# whenever it can't connect, so turning it on can only help.
+STT_STREAMING = os.environ.get("STT_STREAMING", "true").lower() in ("1", "true", "yes", "on")
 
 # ── TTS (ElevenLabs, requested as raw PCM so playback needs no external
 # player binary — cross-platform via sounddevice instead of shelling out to
@@ -66,9 +71,38 @@ DEEPGRAM_MODEL = os.environ.get("DEEPGRAM_MODEL", "nova-3")
 ELEVENLABS_API_KEY = os.environ.get("ELEVENLABS_API_KEY", "")
 ELEVENLABS_VOICE_ID = os.environ.get("ELEVENLABS_VOICE_ID", "")
 ELEVENLABS_MODEL_ID = os.environ.get("ELEVENLABS_MODEL_ID", "eleven_flash_v2")
+# eleven_flash_v2 is English-only, and the two cases that swap the voice
+# (server-picked `speak_as`, or a reply with non-ASCII in it) are usually
+# exactly the cases where the reply isn't English — see tts.model_for().
+ELEVENLABS_MULTILINGUAL_MODEL_ID = os.environ.get(
+    "ELEVENLABS_MULTILINGUAL_MODEL_ID", "eleven_flash_v2_5"
+)
 # ElevenLabs PCM output formats are named pcm_<sample_rate>.
 TTS_SAMPLE_RATE = int(os.environ.get("TTS_SAMPLE_RATE", "24000"))
 
+# Does a voice the server picks (its speak_as marker — "talk like a pirate",
+# "say that in Japanese") stay on for later replies, or last one reply only?
+# Sticky by default: the server tags a single reply and does *not* keep the
+# voice id in its history, so a one-reply-only voice can't be re-used when
+# you say "keep talking like that" — it would have to search for a voice
+# again. Reset it from the tray ("Use default voice") or by restarting.
+VOICE_STICKY = os.environ.get("VOICE_STICKY", "true").lower() in ("1", "true", "yes", "on")
+
+# ── multi-voice dialogue (ElevenLabs Text to Dialogue) ──────────────────────
+# Lets Bolt play a short scene in several voices with delivery tags the v3
+# model acts on ("[cheerfully] Hello"), instead of one voice reading a line.
+# Driven by the server through the `dialoguectl` relayed command — see
+# dialogue.py. Costs a separate (slower, whole-clip) request per scene, so
+# it's a set piece, not the normal reply path.
+#
+# DIALOGUE_VOICES names the cast: "narrator:9BWtsMINqrJLrRacOk9x,villain:IKne3meq5aSn9XLyUdCD".
+# The name "self" always resolves to the voice the pet is currently using,
+# including one the server picked with speak_as.
+
+DIALOGUE = os.environ.get("DIALOGUE", "true").lower() in ("1", "true", "yes", "on")
+DIALOGUE_MODEL_ID = os.environ.get("DIALOGUE_MODEL_ID", "eleven_v3")
+DIALOGUE_VOICES = os.environ.get("DIALOGUE_VOICES", "")
+
 # ── mic / VAD (same tuning knobs as bolt_desk.py) ───────────────────────────
 
 MIC_DEVICE = os.environ.get("MIC_DEVICE", "") or None  # sounddevice name/index
@@ -91,7 +125,7 @@ GRACE_SECONDS = float(os.environ.get("VAD_GRACE_SECONDS", "4"))
 # keeps feeding it noise. 0 means no cap.
 
 FOLLOW_UP_LISTEN = os.environ.get("FOLLOW_UP_LISTEN", "true").lower() in ("1", "true", "yes", "on")
-FOLLOW_UP_MAX_TURNS = int(os.environ.get("FOLLOW_UP_MAX_TURNS", "3"))
+FOLLOW_UP_MAX_TURNS = int(os.environ.get("FOLLOW_UP_MAX_TURNS", "10"))
 FOLLOW_UP_GRACE_SECONDS = float(os.environ.get("FOLLOW_UP_GRACE_SECONDS", "7"))
 
 COMMAND_TIMEOUT_SECONDS = int(os.environ.get("COMMAND_TIMEOUT_SECONDS", "30"))
@@ -110,6 +144,14 @@ SUDO_ASKPASS_HELPER = os.environ.get("SUDO_ASKPASS_HELPER", "")  # blank = auto-
 SUDO_COMMAND_TIMEOUT_SECONDS = int(os.environ.get("SUDO_COMMAND_TIMEOUT_SECONDS", "180"))
 HEARTBEAT_INTERVAL_SECONDS = float(os.environ.get("HEARTBEAT_INTERVAL_SECONDS", "60"))
 
+# ── self-restart ────────────────────────────────────────────────────────────
+# `petctl self_restart` lets Bolt restart the pet after editing its code, so
+# he can see his own change running instead of waiting for someone to restart
+# it by hand. The code is import-checked in a subprocess first, and the reason
+# is carried across the restart so the new process can report back — see
+# self_restart.py. SELF_RESTART_MAX/_WINDOW_SECONDS bound the crash-loop case.
+SELF_RESTART = os.environ.get("SELF_RESTART", "true").lower() in ("1", "true", "yes", "on")
+
 # ── barge-in (interrupt playback while the pet is talking) ──────────────────
 # The mic stays live while the pet talks. BARGE_IN_MODE decides what counts
 # as an interruption:
@@ -131,6 +173,13 @@ BARGE_IN_FRAMES = int(os.environ.get("BARGE_IN_FRAMES", "4"))  # consecutive lou
 # waking the pet from idle (useful if Bolt's own voice trips the model).
 BARGE_IN_WAKE_THRESHOLD = float(os.environ.get("BARGE_IN_WAKE_THRESHOLD") or 0) or None
 
+# ── streaming the reply ─────────────────────────────────────────────────────
+# Speak each sentence as the server produces it, instead of waiting out the
+# whole model call before the first word. Falls back to the ordinary
+# request/response path automatically if the server has no streaming endpoint
+# or the stream fails before anything has been spoken.
+STREAMING_REPLIES = os.environ.get("STREAMING_REPLIES", "true").lower() in ("1", "true", "yes", "on")
+
 # ── streaming TTS ───────────────────────────────────────────────────────────
 # ElevenLabs' /stream endpoint + chunked playback: the pet starts talking
 # after the first PCM chunk instead of after the whole clip is synthesized.
@@ -270,6 +319,10 @@ PET_WANDER_MARGIN = int(os.environ.get("PET_WANDER_MARGIN", "20"))  # keep off s
 PET_SHAPED_INPUT = os.environ.get("PET_SHAPED_INPUT", "true").lower() in ("1", "true", "yes", "on")
 PET_CLICK_THROUGH = os.environ.get("PET_CLICK_THROUGH", "false").lower() in ("1", "true", "yes", "on")
 # Snap flush to a screen edge when dropped/parked within this many pixels of it.
+# Start where it was left rather than in the bottom-right corner. Ignored when
+# PET_START_X/Y pin it explicitly, and a saved position on a monitor that is no
+# longer plugged in is discarded rather than hiding the pet offscreen.
+PET_REMEMBER_POSITION = os.environ.get("PET_REMEMBER_POSITION", "true").lower() in ("1", "true", "yes", "on")
 PET_EDGE_SNAP = os.environ.get("PET_EDGE_SNAP", "true").lower() in ("1", "true", "yes", "on")
 PET_SNAP_MARGIN = int(os.environ.get("PET_SNAP_MARGIN", "48"))
 

bolt_pet/controller.py

@@ -20,13 +20,20 @@ from typing import Optional
 from PySide6.QtCore import QObject, Signal
 
 from . import (
-    config, file_delivery, file_ops, history as history_mod,
-    monitors as monitors_mod, notifications, pet_actions, quiet,
-    screen_context, screen_text, server_client, speech_text, updater,
+    config, dialogue as dialogue_mod, speech, file_delivery, file_ops,
+    history as history_mod, monitors as monitors_mod, notifications,
+    pet_actions, quiet, screen_context, screen_text, self_restart,
+    server_client, speech_text, updater,
 )
-from .audio import barge_in, mic, stt, tts, wake_word
+from . import __version__
+from .audio import barge_in, mic, stt, stt_stream, tts, wake_word
 from .state import PetState, PetStateMachine
 
+# A burst while the pet is busy is batched into one turn, but the queue still
+# needs a ceiling — a notification storm must not become an unbounded backlog
+# that gets read out minutes later.
+_MAX_PENDING_NOTIFICATIONS = 12
+
 # How often to re-check whether the pet should be napping. The fullscreen
 # probe shells out to xprop, so this deliberately isn't every heartbeat tick.
 _NAP_CHECK_INTERVAL_SECONDS = 10.0
@@ -38,6 +45,8 @@ class PetController(QObject):
     log = Signal(str)
     action = Signal(dict)  # parsed petctl action for the UI to perform
     napping = Signal(bool)  # quiet hours / fullscreen do-not-disturb
+    voice_changed = Signal(str)  # name of the server-picked voice ("" = default)
+    mouth = Signal(float)  # 0..1 speech loudness, for lip-sync while talking
     restart_requested = Signal(str)  # version we just updated to
     finished = Signal()
 
@@ -66,7 +75,25 @@ class PetController(QObject):
         self._wake_threshold = config.WAKE_WORD_THRESHOLD
         self._near_misses = wake_word.NearMissLog()
 
+        # The voice the server last picked for us with `speak_as` ("" = the
+        # configured default). Held here rather than passed straight through
+        # to one tts.speak() call because it's sticky by default — see
+        # _apply_voice for why.
+        self._voice_id = ""
+        self._voice_name = ""
+
         self._barge_in: Optional[barge_in.BargeInDetector] = None
+        # Everything the pet says goes through here; see speech.py for why the
+        # four hand-rolled copies of this became one.
+        self._speaker = speech.Speaker(
+            state=self._state, tts=tts,
+            history=lambda text: self.history.add(history_mod.PET, text, time.time()),
+            on_said=self.said.emit, on_log=self.log.emit,
+            barge_in=lambda: self._barge_in,
+            detail_of=self._barge_in_detail,
+            voice_id=lambda: self._voice_id,
+            on_level=self.mouth.emit,
+        )
         self._napping = False
         self._nap_forced: Optional[bool] = None  # petctl nap on/off overrides the schedule
         self._last_nap_check = 0.0
@@ -80,6 +107,9 @@ class PetController(QObject):
 
         self._last_update_check = 0.0
         self._update_pending = False  # applied on disk, waiting for the restart
+        # Armed by `petctl self_restart`, fired after the turn it was asked in
+        # (see _arm_self_restart for why it can't happen inline).
+        self._restart_context = None
 
         self._notification_watcher: Optional[notifications.NotificationWatcher] = None
         self._notification_gate = notifications.NotificationGate(
@@ -117,6 +147,20 @@ class PetController(QObject):
     def reset_wake_stats(self) -> None:
         self._near_misses.clear()
 
+    def current_voice(self) -> str:
+        """Name (or id) of the server-picked voice in use, "" for the default."""
+        return self._voice_name or self._voice_id
+
+    def reset_voice(self) -> None:
+        """Drop a server-picked voice and go back to Bolt's own. The tray's
+        way out of a voice you didn't want to keep — the server has no way to
+        ask for the default back, since it never learns what it is."""
+        if not self._voice_id:
+            return
+        self._voice_id = self._voice_name = ""
+        self.log.emit("Voice: back to the default.")
+        self.voice_changed.emit("")
+
     def stop(self) -> None:
         self._running = False
         self._talk_now.set()  # wake up anything blocked waiting on it
@@ -167,6 +211,7 @@ class PetController(QObject):
             except Exception as exc:
                 self.log.emit(f"Server not reachable yet ({exc}) — will keep trying per-request.")
             self._start_notification_bridge()
+            self._report_self_restart()
             self._loop()
         if self._notification_watcher is not None:
             self._notification_watcher.stop()
@@ -221,21 +266,28 @@ class PetController(QObject):
             self._follow_ups = 0
 
         self._state.transition(PetState.LISTENING)
+        # Transcribe while they talk rather than after: frames go to Deepgram
+        # as they are captured, so the text is ready the moment the VAD says
+        # they stopped. None here just means the one-shot path will do it.
+        streamed = stt_stream.StreamingTranscriber.open()
         pcm = mic.record_utterance(
             self._stream,
             should_continue=self._should_continue,
             # Answering a question deserves longer than saying the wake word
             # on purpose does — you were just asked something.
             grace_s=config.FOLLOW_UP_GRACE_SECONDS if following_up else None,
+            on_frame=streamed.feed if streamed is not None else None,
         )
         if pcm is None:
+            if streamed is not None:
+                streamed.finish()
             self._follow_ups = 0  # silence ends the chain
             self._state.transition(PetState.IDLE)
             return
 
         self._state.transition(PetState.THINKING)
         try:
-            text = stt.transcribe(pcm)
+            text = self._transcribe(pcm, streamed)
         except stt.SttError as exc:
             self.log.emit(f"STT failed: {exc}")
             self._state.transition(PetState.ERROR)
@@ -250,9 +302,7 @@ class PetController(QObject):
         try:
             # What's focused right now rides along, so "what's this error?"
             # has a referent without you having to describe the window.
-            reply = server_client.converse(
-                self._with_context(text), on_command=self._handle_command
-            )
+            reply = self._ask_server(self._with_context(text))
         except server_client.ServerError as exc:
             self.log.emit(f"Server error: {exc}")
             self._state.transition(PetState.ERROR)
@@ -260,8 +310,34 @@ class PetController(QObject):
             return
 
         self._check_deliveries()
-        self._speak(reply)
+        self._apply_voice(reply)
+        if reply.spoken:
+            # Streamed: every sentence was spoken and logged as it arrived.
+            # The text still matters — a reply ending on a question should keep
+            # the mic open — but saying it again would repeat the whole answer.
+            self._after_speaking(reply.text, completed=True)
+        else:
+            self._speak(reply.text)
         self._state.transition(PetState.IDLE)
+        self._maybe_self_restart()
+
+    def _transcribe(self, pcm, streamed) -> str:
+        """The transcript, from the live stream if it produced one.
+
+        The fallback is not a rare path to be tolerated — it is the safety net
+        that lets streaming be switched on at all. Whatever happened to the
+        socket, the full audio is still buffered here, so a failed stream costs
+        one ordinary upload and nothing else."""
+        if streamed is not None:
+            try:
+                text = streamed.finish()
+            except Exception:
+                self.log.emit("Streaming STT failed — falling back.")
+                text = ""
+            if text:
+                self.log.emit("(transcribed while you spoke)")
+                return text
+        return stt.transcribe(pcm)
 
     def _with_context(self, text: str) -> str:
         """Everything the server gets alongside what you actually said: the
@@ -307,6 +383,18 @@ class PetController(QObject):
             kind = action["action"]
             if kind == "monitors":
                 return monitors_mod.describe(self._monitors, self._pet_monitor)
+            if kind == "self_restart":
+                return self._arm_self_restart(action.get("reason") or "")
+            if kind == "voice":
+                # Answered here, not by describe(): the UI has no part in it,
+                # and the server needs to hear whether there was anything to
+                # drop — it can't see which voice we're using.
+                previous = self.current_voice()
+                self.reset_voice()
+                return (
+                    f"[pet] back to your own voice (was {previous})" if previous
+                    else "[pet] already using your own voice"
+                )
             if kind == "read":
                 return self._read_screen(action["target"])
             if kind == "jump":
@@ -327,6 +415,14 @@ class PetController(QObject):
             self.action.emit(action)
             return pet_actions.describe(action)
 
+        try:
+            scene = dialogue_mod.parse(command)
+        except dialogue_mod.DialogueError as exc:
+            self.log.emit(f"dialoguectl: {exc}")
+            return f"[dialogue] {exc}"
+        if scene is not None:
+            return self._play_dialogue(scene)
+
         try:
             file_action = file_ops.parse(command)
         except file_ops.FileOpError as exc:
@@ -365,32 +461,192 @@ class PetController(QObject):
         self.log.emit(f"Reading monitor {monitor.number} ({monitor.name})…")
         return screen_text.read_monitor(monitor, limit)
 
-    def _speak(self, text: str) -> None:
-        self._state.transition(PetState.TALKING)
-        # Bubble gets the markdown stripped but emoji kept (it can't render
-        # **bold** but draws emoji fine); tts.speak() does its own, stricter
-        # sanitizing for the voice.
-        self.said.emit(speech_text.for_display(text))
-        self.log.emit(f"Bolt: {text}")
-        self.history.add(history_mod.PET, text, time.time())
+    def _arm_self_restart(self, reason: str) -> str:
+        """`petctl self_restart` — check the code, then arm a restart.
 
-        should_stop = None
-        if self._barge_in is not None:
-            self._barge_in.reset()
-            should_stop = self._barge_in.check
-        completed = tts.speak(
-            text,
-            on_error=lambda exc: self.log.emit(f"TTS failed: {exc}"),
-            should_stop=should_stop,
+        Nothing restarts here. The tool result has to get back up the relay
+        before this process can die (otherwise the server waits out its
+        timeout on a turn that will never finish), so the restart is armed and
+        `_maybe_self_restart` fires it once the turn has been spoken. The
+        preflight import runs *now*, in this turn, so a syntax error Bolt just
+        introduced comes back as something he can read and fix rather than as
+        a pet that never comes back."""
+        if not config.SELF_RESTART:
+            return "[pet] self-restart is disabled on this device (SELF_RESTART=false)"
+        if self._restart_context is not None:
+            return "[pet] a restart is already armed for the end of this turn"
+        try:
+            self_restart.check_loop_guard(self_restart.load())
+            self.log.emit("Self-restart requested — checking the code imports first…")
+            self_restart.preflight()
+        except self_restart.RestartError as exc:
+            self.log.emit(f"Self-restart refused: {exc}")
+            return f"[pet] restart refused — {exc}"
+
+        recent = [entry.text[:120] for entry in self.history.entries()[-4:]]
+        self._restart_context = self_restart.arm(
+            reason or "no reason given",
+            verify=reason,
+            version=__version__,
+            session=config.SESSION_ID,
+            recent=recent,
         )
-        # Read the scoring history *before* resetting, or the log reports the
-        # blank counters instead of what actually fired.
-        detail = self._barge_in_detail()
-        if self._barge_in is not None:
-            # Playback fed the pet's own voice into the wake model's rolling
-            # window. Clear it before the idle listener starts scoring again,
-            # or Bolt's last sentence is still in there being re-scored.
-            self._barge_in.reset()
+        self.log.emit("Self-restart armed; it happens after this turn.")
+        return (
+            "[pet] code imports cleanly; restarting as soon as this turn finishes. "
+            "I'll come back and tell you what version I'm on and what I found — "
+            "wrap up your reply now, the next thing you hear from me is the report."
+        )
+
+    def _maybe_self_restart(self) -> bool:
+        """Fire an armed restart, once the turn is over and the reply spoken.
+
+        Returns True if a restart was requested, so the caller can stop
+        driving the pipeline — the process is on its way out."""
+        if self._restart_context is None:
+            return False
+        self._update_pending = True  # same latch the updater uses: no double restart
+        self.log.emit("Restarting now.")
+        self._state.force(PetState.IDLE)
+        self.restart_requested.emit(f"self-restart: {self._restart_context.reason[:60]}")
+        return True
+
+    def _report_self_restart(self) -> None:
+        """On the way up: tell the server we're back, and why we left.
+
+        Runs once, before the listen loop starts, and only when a context file
+        was left behind. The report goes through the ordinary conversation
+        path, so Bolt's answer is spoken out loud like any other turn — which
+        is what makes "restart and check the sprites load" finish as a
+        sentence instead of a silence."""
+        context = self_restart.load()
+        if context is None:
+            return
+        self_restart.clear()
+        message = self_restart.report(context, version=__version__)
+        self.log.emit(f"Back from a self-restart ({context.reason[:80]}).")
+        self.history.add(history_mod.SYSTEM, message, time.time())
+        try:
+            reply = server_client.converse(message, on_command=self._handle_command)
+        except server_client.ServerError as exc:
+            # The restart still worked; only the report failed. Say so locally
+            # rather than pretending nothing happened.
+            self.log.emit(f"Couldn't report the restart to the server: {exc}")
+            return
+        self._apply_voice(reply)
+        if reply.text.strip() and not self._napping:
+            self._speak(reply.text)
+        self._state.force(PetState.IDLE)
+
+    def _ask_server(self, text: str):
+        """One turn with the server, streamed when possible.
+
+        Streaming speaks each sentence as it is generated, so the wait is
+        time-to-first-sentence rather than the whole model call. It falls back
+        to the ordinary request/response path when the server has no streaming
+        endpoint, or when a stream dies *before* anything was spoken — after
+        that, retrying would say the first half twice."""
+        if config.STREAMING_REPLIES:
+            try:
+                return server_client.converse_stream(
+                    text, on_say=self._speak_stream_chunk,
+                    on_command=self._handle_command,
+                )
+            except server_client.ServerError as exc:
+                self.log.emit(f"Streaming unavailable ({exc}) — using the plain path.")
+        return server_client.converse(
+            text, on_command=self._handle_command, on_say=self._speak_holding,
+        )
+
+    def _play_dialogue(self, scene: dict) -> str:
+        """Play a `dialoguectl` scene and report back up the relay.
+
+        This runs *mid-turn* (the server is still waiting on the tool result),
+        so the pet has to look like it's talking and then go back to waiting —
+        hence the TALKING → THINKING leg rather than the usual return to IDLE.
+        Everything a normal reply gets, a scene gets too: the bubble, the
+        transcript, and barge-in, so a long scene can be talked over exactly
+        like a long answer."""
+        if not config.DIALOGUE:
+            return "[dialogue] disabled on this device (DIALOGUE=false)"
+        try:
+            inputs = dialogue_mod.resolve(
+                scene,
+                voices=dialogue_mod.parse_voice_map(config.DIALOGUE_VOICES),
+                self_voice=self._voice_id or config.ELEVENLABS_VOICE_ID,
+            )
+        except dialogue_mod.DialogueError as exc:
+            self.log.emit(f"dialoguectl: {exc}")
+            return f"[dialogue] {exc}"
+
+        text = dialogue_mod.spoken_text(scene)
+        self.log.emit(f"Dialogue ({len(inputs)} lines): {text[:120]}")
+        try:
+            pcm, sample_rate = tts.synthesize_dialogue(
+                inputs, model_id=scene.get("model"), stability=scene.get("stability")
+            )
+        except tts.TtsError as exc:
+            self.log.emit(f"Dialogue failed: {exc}")
+            # Reported, not raised: the server can read this, shorten the
+            # scene or fix the voice, and try again inside the same turn.
+            return f"[dialogue] couldn't synthesize it: {exc}"
+
+        completed = self._speaker.say_pcm(
+            speech.Utterance.scene(text), pcm=pcm, sample_rate=sample_rate)
+
+        if not completed:
+            return dialogue_mod.describe(scene) + " (interrupted — they talked over it)"
+        return dialogue_mod.describe(scene)
+
+    def _apply_voice(self, reply) -> None:
+        """Adopt (or drop) the voice the server tagged this reply with.
+
+        The server's `speak_as` marker names an ElevenLabs voice it just
+        picked — and it adds a Voice Library pick to the account first, so by
+        the time the id gets here it's usable for TTS. It tags *one* reply,
+        but the voice sticks by default: the server strips the marker before
+        storing the turn, so it can't recall the id later, and "keep talking
+        like that" would otherwise send it searching for a voice all over
+        again. `VOICE_STICKY=false` makes each pick last exactly one reply.
+
+        Untagged replies never *change* the voice — with stickiness on they
+        just keep whatever's in use, which is what makes the rest of the
+        conversation stay in the requested voice."""
+        voice_id = getattr(reply, "voice_id", "")
+        if voice_id:
+            if voice_id != self._voice_id:
+                self._voice_id = voice_id
+                self._voice_name = getattr(reply, "voice_name", "") or ""
+                self.log.emit(f"Voice: {self.current_voice()}")
+                self.voice_changed.emit(self.current_voice())
+        elif not config.VOICE_STICKY:
+            self.reset_voice()
+
+    def _speak(self, text: str) -> None:
+        """The answer: transcript, bubble, and the follow-up rule."""
+        completed = self._speaker.say(speech.Utterance.reply(text))
+        self._after_speaking(text, completed=completed,
+                             detail=self._speaker.last_detail)
+
+    def _speak_holding(self, text: str) -> None:
+        """"Give me a sec" while a tool runs — filler, so no transcript, and it
+        resumes the state it interrupted because the turn isn't over."""
+        self._speaker.say(speech.Utterance.holding(text))
+
+    def _speak_stream_chunk(self, text: str) -> None:
+        """One sentence of a streamed answer, spoken the moment it arrives."""
+        completed = self._speaker.say(speech.Utterance.stream_chunk(text))
+        if not completed:
+            self.log.emit("Interrupted — listening.")
+            self._follow_ups = 0
+            self._talk_now.set()
+
+    def _after_speaking(self, text: str, *, completed: bool, detail: str = "") -> None:
+        """What happens once an answer has been said, however it was said.
+
+        Shared by the plain and streamed paths: a streamed reply is spoken
+        sentence by sentence, but it still has to obey the same rules about
+        keeping the mic open when it ended on a question."""
         if not completed:
             # You talked over it — take that as the start of the next turn
             # rather than making you say the wake word again.
@@ -410,20 +666,22 @@ class PetController(QObject):
     def _should_follow_up(self, text: str) -> bool:
         """Whether *text* leaves the pet waiting on an answer.
 
-        Muted is excluded because mute means "don't listen to me" — an
-        automatic turn would walk straight past it. Napping isn't: quiet
-        hours suppress the pet *starting* something, and a question is only
-        ever asked in reply to you."""
-        if not config.FOLLOW_UP_LISTEN or self._muted:
-            return False
-        if not speech_text.is_question(text):
+        The rule itself — question, cap, off switch — is
+        `speech.follow_up_decision`, because it is a rule with an off-by-one in
+        it and deserves a test that needs no audio. What stays here is the part
+        that is genuinely the controller's: mute, and the log line. Muted is
+        excluded because mute means "don't listen to me" and an automatic turn
+        would walk straight past it. Napping isn't: quiet hours suppress the
+        pet *starting* something, and a question is only ever asked in reply to
+        you."""
+        if self._muted:
             return False
+        keep, why = speech.follow_up_decision(text, completed=True, follow_ups=self._follow_ups)
+        if not keep and "cap" in why:
             # Only worth mentioning the cap on a reply that would otherwise have
             # kept listening, or it fires on every statement the pet makes.
-        if config.FOLLOW_UP_MAX_TURNS > 0 and self._follow_ups >= config.FOLLOW_UP_MAX_TURNS:
             self.log.emit("Follow-up limit reached — say the wake word to keep going.")
-            return False
-        return True
+        return keep
 
     def _barge_in_detail(self) -> str:
         """Why the interruption fired, for the log. How far into playback it
@@ -481,31 +739,53 @@ class PetController(QObject):
 
     def _queue_notification(self, notification: notifications.Notification) -> None:
         """Called on the watcher thread — just queue it; forwarding happens on
-        the pipeline thread where it can't collide with a live conversation."""
-        if not self._notification_gate.should_forward(notification, time.monotonic()):
+        the pipeline thread where it can't collide with a live conversation.
+
+        Only the *filter* applies here. The rate limit used to as well, which
+        meant a second message arriving inside the window was silently thrown
+        away — with NOTIFICATION_MIN_INTERVAL_SECONDS=60, two texts a minute
+        apart and you only ever heard about one of them. Losing a message from
+        a person to save a round trip is the wrong trade; they are batched at
+        the far end instead, which costs the same one round trip and keeps
+        them all."""
+        if not self._notification_gate.matches(notification):
             return
         with self._notification_lock:
+            if len(self._pending_notifications) >= _MAX_PENDING_NOTIFICATIONS:
+                self._pending_notifications.pop(0)  # bound it; oldest goes first
             self._pending_notifications.append(notification)
 
     def _drain_notifications(self) -> None:
+        """Forward everything waiting as ONE turn.
+
+        Batching is what makes it safe to keep every notification: five that
+        arrived while the pet was mid-conversation become one message and one
+        round trip, instead of five separate interruptions queued up to fire
+        back to back."""
         with self._notification_lock:
             pending, self._pending_notifications = self._pending_notifications, []
-        for notification in pending:
-            if not self._running or self._napping:
+        if not pending or not self._running or self._napping:
             return
+        for notification in pending:
             self.log.emit(f"Notification: {notification.as_text()}")
             self.history.add(history_mod.SYSTEM, notification.as_text(), time.time())
+
+        if len(pending) == 1:
+            message = f"[desktop notification] {pending[0].as_text()}"
+        else:
+            lines = "\n".join(f"- {n.as_text()}" for n in pending)
+            message = f"[{len(pending)} desktop notifications]\n{lines}"
         try:
             reply = server_client.converse(
-                    f"[desktop notification] {notification.as_text()}",
-                    on_command=self._handle_command,
+                message, on_command=self._handle_command, on_say=self._speak_holding,
             )
         except server_client.ServerError as exc:
             self.log.emit(f"Couldn't forward notification: {exc}")
             return
         self._check_deliveries()
-            if reply.strip():
-                self._speak(reply)
+        self._apply_voice(reply)
+        if reply.text.strip() and not reply.spoken:
+            self._speak(reply.text)
         self._state.transition(PetState.IDLE)
 
     # ── file delivery ────────────────────────────────────────────────────
@@ -579,20 +859,36 @@ class PetController(QObject):
     # ── heartbeat ────────────────────────────────────────────────────────
 
     def _maybe_heartbeat(self) -> None:
+        """Called from the wake listener's tick (~every WAKE_CHECK_INTERVAL_SECONDS).
+
+        Two different cadences live here, and conflating them was costing
+        minutes. A *notification* is an event that already happened — it should
+        go out as soon as the pet is free, which is the next tick. The
+        *heartbeat* is a poll, and polling the server every 1.2s would be
+        absurd, so it stays on its own interval."""
         self._refresh_nap_state()
         self._maybe_update()
         if self._update_pending:
             return  # on the way out — don't start a conversation now
+
+        # Notifications: every tick, not every heartbeat.
+        if self._state.state == PetState.IDLE and not self._napping:
+            self._drain_notifications()
+
         now = time.monotonic()
         if now - self._last_heartbeat < config.HEARTBEAT_INTERVAL_SECONDS:
             return
-        self._last_heartbeat = now
         if self._state.state != PetState.IDLE:
+            # Mid-conversation. Do NOT stamp the clock — an earlier version
+            # did, so a heartbeat that landed while the pet was talking burned
+            # its slot and waited another full interval. With follow-up
+            # listening that could repeat for several cycles, which is why a
+            # notification could sit unspoken for five or ten minutes.
             return
         if self._napping:
             return  # quiet hours: still answers when spoken to, just doesn't start
+        self._last_heartbeat = now
         self._check_deliveries()
-        self._drain_notifications()
         if self._state.state != PetState.IDLE:
             return
         try:

bolt_pet/dialogue.py

@@ -0,0 +1,235 @@
+"""`dialoguectl` — multi-voice dialogue playback (ElevenLabs Text to Dialogue).
+
+Normal replies are one voice saying one thing (audio/tts.py). This is the
+other mode: a short *scene* — two or more voices, with delivery tags the v3
+model acts on (`[cheerfully]`, `[stuttering]`, `[whispering]`) — synthesized
+as a single take so the timing and reactions between lines actually sound
+like a conversation rather than clips glued together.
+
+Wire format, the same discipline as file_ops.py and for the same reason: it
+rides the server's ordinary `command` tool marker, whose extractor only
+captures up to the next newline, so the payload is a **single-line compact
+JSON object**.
+
+    dialoguectl {"lines": [{"voice": "self", "text": "[cheerfully] Morning!"},
+                           {"voice": "narrator", "text": "[whispering] He lies."}]}
+
+The ElevenLabs field names are accepted too (`inputs` / `voice_id`), because
+the model has read that API and copying its shape is the obvious thing to
+try:
+
+    dialoguectl {"inputs": [{"voice_id": "9BWtsMINqrJLrRacOk9x", "text": "hi"}]}
+
+Voices are *named*, not pasted as ids. `DIALOGUE_VOICES` in .env maps names
+to ids (`narrator:9BWts…,villain:IKne3…`), and `self` always means the voice
+the pet is speaking with right now — including a voice the server picked
+mid-conversation with `speak_as`, so a scene featuring Bolt sounds like
+whoever Bolt currently is.
+
+Pure parsing and validation here; the HTTP call is
+`audio/tts.synthesize_dialogue` and the playback/state handling is
+`controller._play_dialogue`, matching the parse/execute split used by
+pet_actions.py and file_ops.py.
+
+The API's own limits are enforced *here*, before the request goes out, so a
+mistake comes back through the tool-result relay as a sentence Bolt can act
+on ("too many characters, split it") rather than as an HTTP 422 he can't see.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from typing import Iterable, Optional
+
+from . import relay_json
+
+_PREFIXES = ("dialoguectl", "dialogue", "scene")
+
+# ElevenLabs Text to Dialogue limits (docs, 2026-07): at most 10 distinct
+# voice ids per request and ~2000 characters across all inputs.
+MAX_VOICES = 10
+MAX_CHARS = 2000
+
+# Names that always mean "the voice the pet is using right now".
+SELF_NAMES = ("self", "bolt", "me", "pet")
+
+# A raw ElevenLabs voice id: 20 URL-safe characters, no separators. Used to
+# tell "the model pasted an id" from "the model used a name".
+_VOICE_ID_RE = re.compile(r"^[A-Za-z0-9]{20}$")
+
+
+class DialogueError(Exception):
+    """Bad dialoguectl syntax or an unusable request — reported back to the
+    server as this command's output."""
+
+
+def is_dialogue_command(command: str) -> bool:
+    parts = (command or "").strip().split(None, 1)
+    return bool(parts) and parts[0].lower() in _PREFIXES
+
+
+def parse(command: str) -> Optional[dict]:
+    """Parse `dialoguectl <json>` into {"lines": [{"voice", "text"}], ...}.
+
+    Returns None if this isn't a dialogue command at all (the caller then
+    tries filectl, then a real shell command). Raises DialogueError on a
+    dialogue command that doesn't make sense."""
+    if not is_dialogue_command(command):
+        return None
+    _, _, payload = (command or "").strip().partition(" ")
+    payload = payload.strip()
+    if not payload:
+        raise DialogueError(
+            'dialoguectl needs a JSON argument, e.g. dialoguectl {"lines": '
+            '[{"voice": "self", "text": "[cheerfully] hello"}]}'
+        )
+    # Same lenient parse as filectl (see relay_json): machine-written JSON
+    # fails in a handful of repeatable ways, and a stray quote shouldn't cost
+    # a turn — but the repair is reported back rather than hidden.
+    try:
+        data, repairs = relay_json.loads(payload)
+    except relay_json.RelayJsonError as exc:
+        raise DialogueError(
+            f"couldn't parse the JSON — {exc}\nIt must be one line of compact "
+            "JSON — put line breaks inside text as \\n, never as real newlines."
+        ) from exc
+    if not isinstance(data, dict):
+        raise DialogueError("the argument must be a JSON object, not a list or a bare value")
+
+    raw_lines = data.get("lines")
+    if raw_lines is None:
+        raw_lines = data.get("inputs")  # the ElevenLabs field name
+    if not isinstance(raw_lines, list) or not raw_lines:
+        raise DialogueError('needs a non-empty "lines" array of {"voice", "text"} objects')
+
+    lines: list[dict] = []
+    for index, entry in enumerate(raw_lines, start=1):
+        if not isinstance(entry, dict):
+            raise DialogueError(f"line {index} must be an object with 'voice' and 'text'")
+        text = str(entry.get("text") or "").strip()
+        if not text:
+            raise DialogueError(f"line {index} has no text")
+        voice = str(entry.get("voice") or entry.get("voice_id") or "self").strip()
+        lines.append({"voice": voice, "text": text})
+
+    action = {"action": "dialogue", "lines": lines}
+    if repairs:
+        action["_repairs"] = repairs
+    model = str(data.get("model") or data.get("model_id") or "").strip()
+    if model:
+        action["model"] = model
+    stability = data.get("stability")
+    if stability is not None:
+        try:
+            action["stability"] = min(1.0, max(0.0, float(stability)))
+        except (TypeError, ValueError):
+            raise DialogueError("stability must be a number between 0 and 1") from None
+    return action
+
+
+def parse_voice_map(spec: str) -> dict[str, str]:
+    """Parse DIALOGUE_VOICES ("narrator:9BWts…, villain:IKne3…") into a map.
+
+    Malformed entries are skipped rather than raising: a typo in .env should
+    cost that one voice, not the whole feature."""
+    voices: dict[str, str] = {}
+    for chunk in str(spec or "").split(","):
+        name, separator, voice_id = chunk.partition(":")
+        name, voice_id = name.strip().lower(), voice_id.strip()
+        if separator and name and voice_id:
+            voices[name] = voice_id
+    return voices
+
+
+def resolve(
+    action: dict,
+    *,
+    voices: Optional[dict] = None,
+    self_voice: str = "",
+) -> list[dict]:
+    """Turn parsed lines into the API's `inputs`, resolving names to ids.
+
+    *self_voice* is the pet's current voice (which may be a `speak_as` pick,
+    not the configured default), so "self" tracks whoever Bolt sounds like
+    right now."""
+    known = dict(voices or {})
+    resolved: list[dict] = []
+    for index, line in enumerate(action.get("lines") or [], start=1):
+        name = str(line.get("voice") or "self")
+        key = name.lower()
+        if key in SELF_NAMES:
+            voice_id = self_voice
+            if not voice_id:
+                raise DialogueError(
+                    "no voice is configured for the pet itself — set "
+                    "ELEVENLABS_VOICE_ID, or name a voice from DIALOGUE_VOICES"
+                )
+        elif key in known:
+            voice_id = known[key]
+        elif _VOICE_ID_RE.match(name):
+            voice_id = name  # a raw id pasted straight from the voice library
+        else:
+            available = ", ".join(sorted(known) + list(SELF_NAMES[:1])) or "self"
+            raise DialogueError(
+                f"line {index}: unknown voice {name!r}. Known names: {available}. "
+                "Use one of those, 'self' for your own voice, or a raw voice id."
+            )
+        resolved.append({"text": str(line.get("text") or ""), "voice_id": voice_id})
+
+    check_limits(resolved)
+    return resolved
+
+
+def check_limits(inputs: Iterable[dict], *, max_voices: int = MAX_VOICES,
+                 max_chars: int = MAX_CHARS) -> None:
+    """Enforce the API's own limits before spending a request on a 422."""
+    entries = list(inputs)
+    if not entries:
+        raise DialogueError("no lines to speak")
+    distinct = {entry["voice_id"] for entry in entries}
+    if len(distinct) > max_voices:
+        raise DialogueError(
+            f"{len(distinct)} different voices — the limit is {max_voices} per scene"
+        )
+    total = sum(len(entry["text"]) for entry in entries)
+    if total > max_chars:
+        raise DialogueError(
+            f"{total} characters — the limit is {max_chars} per scene. "
+            "Split it into two dialoguectl calls."
+        )
+
+
+def spoken_text(action: dict) -> str:
+    """The scene as readable text, for the speech bubble and the transcript.
+
+    Delivery tags are stripped: `[cheerfully]` is a stage direction for the
+    model, not something to show (or, via tts.speak's sanitizer, to read out)."""
+    parts = []
+    for line in action.get("lines") or []:
+        text = re.sub(r"\[[^\]]{1,40}\]", " ", str(line.get("text") or ""))
+        text = " ".join(text.split())
+        if text:
+            parts.append(text)
+    return " ".join(parts)
+
+
+def describe(action: dict, *, played: bool = True) -> str:
+    """The tool-result string handed back to the server."""
+    lines = action.get("lines") or []
+    voices = sorted({str(line.get("voice") or "self") for line in lines})
+    note = relay_json.repair_note(action.get("_repairs") or [])
+    if not played:
+        return f"[dialogue] not played ({len(lines)} lines){note}"
+    return (
+        f"[dialogue] played {len(lines)} line{'s' if len(lines) != 1 else ''} "
+        f"in {len(voices)} voice{'s' if len(voices) != 1 else ''}: {', '.join(voices)}{note}"
+        # The scene was spoken out loud before this result got back to the
+        # server, and the model has no other way to know that. Without saying
+        # so it writes a final reply summarising what the user just heard, and
+        # the pet says the same thing twice in a row (observed 2026-07-31).
+        # An instruction delivered here, at the moment it applies, lands far
+        # better than a rule buried in a long system prompt.
+        "\nThe user HEARD this already. Do not repeat, summarise or narrate it "
+        "in your reply — answer with at most one short line, or nothing new."
+    )

bolt_pet/doctor.py

@@ -0,0 +1,272 @@
+"""`python -m bolt_pet --doctor` — is this install actually going to work?
+
+Written after a week of debugging things a preflight would have shown in one
+command: a missing port publish, a wrong reverse-proxy header, a venv whose
+python was a zero-byte file, an OCR engine that was never installed. Every one
+of those presented as "the pet is being weird" and took a conversation to find.
+
+Each check is independent and reports one of three things — ok, a warning
+(works, but degraded), or a failure (this will not do what you expect) — and
+says *what to do about it* rather than just what is wrong. Nothing here raises:
+a doctor that crashes on a broken install is diagnosing the wrong patient.
+
+Deliberately does not open the mic or call a paid API by default. It checks
+that the door is unlocked, not that the room is furnished; `--deep` is there
+when you want it to actually knock.
+"""
+
+from __future__ import annotations
+
+import importlib
+import shutil
+import sys
+from dataclasses import dataclass
+from typing import Callable, Optional
+
+from . import config
+
+OK, WARN, FAIL = "ok", "warn", "fail"
+
+_MARKS = {OK: "  ok  ", WARN: " warn ", FAIL: " FAIL "}
+
+
+@dataclass
+class Check:
+    name: str
+    status: str
+    detail: str = ""
+    fix: str = ""
+
+    def line(self) -> str:
+        text = f"[{_MARKS[self.status]}] {self.name:22} {self.detail}"
+        if self.fix and self.status != OK:
+            text += f"\n{'':32}→ {self.fix}"
+        return text
+
+
+def _module(name: str) -> bool:
+    try:
+        importlib.import_module(name)
+        return True
+    except Exception:
+        return False
+
+
+# ── the checks ──────────────────────────────────────────────────────────────
+
+def check_config() -> Check:
+    missing = config.missing_config()
+    if missing:
+        return Check("server config", FAIL, f"missing {', '.join(missing)}",
+                     "set them in .env — without these the controller exits at startup")
+    return Check("server config", OK, f"{config.SERVER_URL} as {config.SESSION_ID}")
+
+
+def check_server(deep: bool = False) -> Check:
+    if not config.SERVER_URL:
+        return Check("server", FAIL, "no BOLT_SERVER_URL",
+                     "cp .env.example .env and set BOLT_SERVER_URL to your Bolt server")
+    if not deep:
+        return Check("server", OK, f"{config.SERVER_URL} (not contacted; --deep to try)")
+    try:
+        from . import server_client
+
+        health = server_client.check_health(timeout=8)
+        return Check("server", OK, f"reachable — {health}")
+    except Exception as exc:
+        return Check("server", FAIL, f"unreachable: {exc}",
+                     "check the URL, the key, and that the container is up")
+
+
+def check_streaming_endpoint(deep: bool = False) -> Check:
+    """The streamed-reply endpoint is newer than some deployed servers."""
+    if not config.STREAMING_REPLIES:
+        return Check("streamed replies", WARN, "disabled (STREAMING_REPLIES=false)")
+    if not deep:
+        return Check("streamed replies", OK, "enabled (endpoint not probed)")
+    try:
+        import requests
+
+        response = requests.post(
+            f"{config.SERVER_URL}/desk/converse_stream",
+            json={"session_id": config.SESSION_ID, "text": ""},
+            headers={"X-Desk-Api-Key": config.API_KEY}, timeout=8, stream=True,
+        )
+        if response.status_code == 404:
+            return Check("streamed replies", WARN, "server has no /desk/converse_stream",
+                         "update the server, or set STREAMING_REPLIES=false to skip the probe")
+        return Check("streamed replies", OK, f"endpoint answered {response.status_code}")
+    except Exception as exc:
+        return Check("streamed replies", WARN, f"probe failed: {exc}")
+
+
+def check_microphone(deep: bool = False) -> Check:
+    if not _module("sounddevice"):
+        return Check("microphone", FAIL, "sounddevice is not installed",
+                     "pip install -r requirements.txt")
+    try:
+        import sounddevice as sd
+
+        devices = [d for d in sd.query_devices() if d.get("max_input_channels", 0) > 0]
+        if not devices:
+            return Check("microphone", FAIL, "no input devices",
+                         "on Linux check PipeWire/PulseAudio is running as your user")
+        chosen = config.MIC_DEVICE or "system default"
+        if not deep:
+            return Check("microphone", OK, f"{len(devices)} input device(s), using {chosen}")
+        with sd.InputStream(samplerate=config.SAMPLE_RATE, channels=1, dtype="int16",
+                            device=config.MIC_DEVICE, blocksize=config.FRAME_LEN):
+            pass
+        return Check("microphone", OK, f"opened at {config.SAMPLE_RATE} Hz ({chosen})")
+    except Exception as exc:
+        return Check("microphone", FAIL, f"could not open: {exc}",
+                     "don't run the pet as root — PortAudio can't reach your PipeWire socket")
+
+
+def check_wake_model() -> Check:
+    from pathlib import Path
+
+    path = Path(config.WAKE_MODEL_PATH)
+    if not path.exists():
+        return Check("wake word", FAIL, f"{path.name} is missing",
+                     "it ships in the project root; check WAKE_MODEL_FILE")
+    if not _module("openwakeword"):
+        return Check("wake word", FAIL, "openwakeword is not installed",
+                     "pip install -r requirements.txt")
+    return Check("wake word", OK, f"{path.name}, threshold {config.WAKE_WORD_THRESHOLD}")
+
+
+def check_stt() -> Check:
+    if not config.DEEPGRAM_API_KEY:
+        return Check("speech-to-text", FAIL, "no DEEPGRAM_API_KEY",
+                     "set it in .env — nothing you say can be transcribed without it")
+    if config.STT_STREAMING and not _module("websocket"):
+        return Check("speech-to-text", WARN, "streaming on, but websocket-client is missing",
+                     "pip install websocket-client — it falls back to one-shot uploads")
+    mode = "streaming" if config.STT_STREAMING else "one-shot"
+    return Check("speech-to-text", OK, f"Deepgram {config.DEEPGRAM_MODEL}, {mode}")
+
+
+def check_tts() -> Check:
+    if not (config.ELEVENLABS_API_KEY and config.ELEVENLABS_VOICE_ID):
+        if _module("pyttsx3"):
+            return Check("text-to-speech", WARN, "no ElevenLabs key/voice — offline voice only",
+                         "set ELEVENLABS_API_KEY and ELEVENLABS_VOICE_ID for the real voice")
+        return Check("text-to-speech", FAIL, "no ElevenLabs config and no pyttsx3 fallback")
+    return Check("text-to-speech", OK,
+                 f"ElevenLabs {config.ELEVENLABS_MODEL_ID}, voice …{config.ELEVENLABS_VOICE_ID[-6:]}")
+
+
+def check_dialogue() -> Check:
+    if not config.DIALOGUE:
+        return Check("multi-voice scenes", WARN, "disabled (DIALOGUE=false)")
+    from . import dialogue
+
+    cast = dialogue.parse_voice_map(config.DIALOGUE_VOICES)
+    if not cast:
+        return Check("multi-voice scenes", WARN, "no cast configured — only 'self' works",
+                     'set DIALOGUE_VOICES=narrator:<id>,villain:<id>')
+    return Check("multi-voice scenes", OK, f"{len(cast)} voice(s): {', '.join(sorted(cast))}")
+
+
+def check_screen_text() -> Check:
+    if not config.SCREEN_TEXT:
+        return Check("screen reading", WARN, "disabled (SCREEN_TEXT=false)")
+    if not _module("mss"):
+        return Check("screen reading", WARN, "mss is not installed — petctl read will decline",
+                     "pip install mss (and note it cannot capture on Wayland)")
+    engine = "pytesseract" if _module("pytesseract") else (
+        "rapidocr" if _module("rapidocr_onnxruntime") else "")
+    if not engine:
+        return Check("screen reading", WARN, "no OCR engine",
+                     "pip install pytesseract && apt install tesseract-ocr, "
+                     "or pip install rapidocr-onnxruntime")
+    if engine == "pytesseract" and not shutil.which("tesseract"):
+        return Check("screen reading", WARN, "pytesseract is installed but tesseract is not",
+                     "apt install tesseract-ocr")
+    return Check("screen reading", OK, f"mss + {engine}")
+
+
+def check_hotkey() -> Check:
+    if not _module("pynput"):
+        return Check("push-to-talk", WARN, "pynput is not installed",
+                     "the wake word still works; pip install pynput for the hotkey")
+    import os
+
+    if os.environ.get("WAYLAND_DISPLAY") and not os.environ.get("DISPLAY"):
+        return Check("push-to-talk", WARN, "Wayland session — global hotkeys usually blocked",
+                     "use the wake word, or click the pet")
+    return Check("push-to-talk", OK, config.PUSH_TO_TALK_HOTKEY)
+
+
+def check_sprites() -> Check:
+    from pathlib import Path
+
+    root = Path(__file__).resolve().parent / "assets" / "sprites"
+    if not root.exists():
+        return Check("sprites", WARN, "no art — the placeholder blob will be drawn",
+                     "python scripts/generate_bolt_sprites.py")
+    counts = {d.name: len(list(d.glob("*.png"))) for d in sorted(root.iterdir()) if d.is_dir()}
+    empty = [name for name, count in counts.items() if count == 0]
+    if empty:
+        return Check("sprites", WARN, f"no frames for: {', '.join(empty)}",
+                     "python scripts/generate_bolt_sprites.py")
+    return Check("sprites", OK, ", ".join(f"{n} {c}" for n, c in counts.items()))
+
+
+def check_latency() -> Check:
+    """The setting most likely to make it feel slow, and the least obvious."""
+    silence = config.SILENCE_END_SEC
+    if silence >= 1.5:
+        return Check("turn latency", WARN, f"VAD_SILENCE_END_SEC={silence:g}s of dead air per turn",
+                     "0.8-1.0 feels markedly snappier; it is pure wait before anything starts")
+    return Check("turn latency", OK, f"silence timeout {silence:g}s, "
+                 f"streaming {'on' if config.STREAMING_REPLIES else 'off'}")
+
+
+CHECKS: tuple[tuple[str, Callable], ...] = (
+    ("config", check_config),
+    ("server", check_server),
+    ("stream", check_streaming_endpoint),
+    ("mic", check_microphone),
+    ("wake", check_wake_model),
+    ("stt", check_stt),
+    ("tts", check_tts),
+    ("dialogue", check_dialogue),
+    ("screen", check_screen_text),
+    ("hotkey", check_hotkey),
+    ("sprites", check_sprites),
+    ("latency", check_latency),
+)
+
+
+def run(deep: bool = False) -> list[Check]:
+    results = []
+    for _name, check in CHECKS:
+        try:
+            try:
+                results.append(check(deep))
+            except TypeError:
+                results.append(check())
+        except Exception as exc:  # a broken check must not hide the others
+            results.append(Check(_name, FAIL, f"the check itself failed: {exc}"))
+    return results
+
+
+def main(argv: Optional[list] = None) -> int:
+    argv = list(argv if argv is not None else sys.argv[1:])
+    deep = "--deep" in argv
+    print(f"Bolt pet preflight{' (deep: contacting the server and opening the mic)' if deep else ''}\n")
+    results = run(deep=deep)
+    for check in results:
+        print(check.line())
+    failures = [c for c in results if c.status == FAIL]
+    warnings = [c for c in results if c.status == WARN]
+    print()
+    if failures:
+        print(f"{len(failures)} problem(s) will stop this working. Fix those first.")
+    elif warnings:
+        print(f"Ready. {len(warnings)} thing(s) degraded but working.")
+    else:
+        print("Everything checks out.")
+    return 1 if failures else 0

bolt_pet/file_ops.py

@@ -52,6 +52,8 @@ import json
 from pathlib import Path
 from typing import Optional
 
+from . import relay_json
+
 _PREFIXES = ("filectl", "file")
 
 # Keeps a runaway read/write/list from blowing up the tool_result relay (and,
@@ -95,17 +97,23 @@ def parse(command: str) -> Optional[dict]:
     if not rest or rest.lower() in ("help", "-h", "--help"):
         return {"action": "help"}
 
+    # Lenient on purpose — see relay_json. A stray quote in machine-written
+    # JSON should not cost a turn, but the repair is reported back so the model
+    # is told it sent something broken while it can still learn from it.
     try:
-        payload = json.loads(rest)
-    except json.JSONDecodeError as exc:
-        raise FileOpError(f"couldn't parse filectl JSON ({exc}); usage:\n{HELP}") from exc
+        payload, repairs = relay_json.loads(rest)
+    except relay_json.RelayJsonError as exc:
+        raise FileOpError(f"couldn't parse filectl JSON — {exc}\nusage:\n{HELP}") from exc
     if not isinstance(payload, dict):
         raise FileOpError(f"filectl payload must be a JSON object; usage:\n{HELP}")
 
     op = str(payload.get("op") or "help").lower()
+    # Carried on the action so execute() can tell the model what it got wrong;
+    # a silent repair would fix today's call and guarantee tomorrow's.
+    tag = {"_repairs": repairs} if repairs else {}
 
     if op == "help":
-        return {"action": "help"}
+        return {"action": "help", **tag}
 
     if op == "list":
         path = _required_str(payload, "path")
@@ -114,7 +122,7 @@ def parse(command: str) -> Optional[dict]:
             raise FileOpError('"pattern" must be a non-empty string')
         return {
             "action": "list", "path": path,
-            "pattern": pattern, "recursive": bool(payload.get("recursive")),
+            "pattern": pattern, "recursive": bool(payload.get("recursive")), **tag,
         }
 
     if op == "read":
@@ -122,14 +130,14 @@ def parse(command: str) -> Optional[dict]:
         return {
             "action": "read", "path": path,
             "start": _line_number(payload.get("start"), "start"),
-            "end": _line_number(payload.get("end"), "end"),
+            "end": _line_number(payload.get("end"), "end"), **tag,
         }
 
     if op == "write":
         path = _required_str(payload, "path")
         if payload.get("content") is None:
             raise FileOpError('write needs "content"')
-        return {"action": "write", "path": path, "content": str(payload["content"])}
+        return {"action": "write", "path": path, "content": str(payload["content"]), **tag}
 
     if op == "edit":
         path = _required_str(payload, "path")
@@ -138,7 +146,7 @@ def parse(command: str) -> Optional[dict]:
         old, new = str(payload["old"]), str(payload["new"])
         if old == new:
             raise FileOpError("old and new text are identical — nothing to edit")
-        return {"action": "edit", "path": path, "old": old, "new": new}
+        return {"action": "edit", "path": path, "old": old, "new": new, **tag}
 
     raise FileOpError(f"unknown filectl op {op!r}; usage:\n{HELP}")
 
@@ -175,14 +183,16 @@ def execute(action: dict) -> str:
     if kind == "help":
         return HELP
     if kind == "list":
-        return _do_list(action)
-    if kind == "read":
-        return _do_read(action)
-    if kind == "write":
-        return _do_write(action)
-    if kind == "edit":
-        return _do_edit(action)
-    return "[filectl] ok"
+        output = _do_list(action)
+    elif kind == "read":
+        output = _do_read(action)
+    elif kind == "write":
+        output = _do_write(action)
+    elif kind == "edit":
+        output = _do_edit(action)
+    else:
+        output = "[filectl] ok"
+    return output + relay_json.repair_note(action.get("_repairs") or [])
 
 
 def _resolve(path_str: str) -> Path:

bolt_pet/pet_actions.py

@@ -44,9 +44,17 @@ HELP = (
     "petctl emote <" + "|".join(EMOTES) + ">\n"
     "petctl say <text>\n"
     "petctl wander on|off\n"
-    "petctl nap on|off"
+    "petctl nap on|off\n"
+    "petctl voice reset\n"
+    "petctl self_restart [why]"
 )
 
+# `petctl voice` only ever goes one way: back to the configured voice. Picking
+# a *different* one is the server's job (its speak_as reply marker), and it
+# already knows how — what it has no way to say is "never mind, be yourself
+# again", because it was never told which voice that is.
+VOICE_RESETS = ("reset", "default", "normal", "own", "back", "mine", "yours")
+
 
 class ActionError(Exception):
     """Bad petctl syntax — reported back to the server as command output."""
@@ -129,6 +137,22 @@ def parse(command: str) -> Optional[dict]:
             raise ActionError("wander needs on or off")
         return {"action": "wander", "enabled": _bool_arg(args[0])}
 
+    if verb == "voice":
+        target = (args[0].lower() if args else "reset").lstrip("-")
+        if target not in VOICE_RESETS:
+            raise ActionError(
+                f"can't set a voice from petctl (got {args[0]!r}); "
+                "use the speak_as reply marker to pick one. "
+                "petctl voice reset goes back to the default voice."
+            )
+        return {"action": "voice", "voice": "default"}
+
+    if verb in ("self_restart", "restart", "reboot"):
+        # Free text, not a fixed grammar: the argument is a note to the pet's
+        # *next* process about why it died and what to look at when it comes
+        # back, so anything the model wants to tell future-itself is valid.
+        return {"action": "self_restart", "reason": " ".join(args).strip()}
+
     if verb in ("nap", "sleep", "dnd"):
         if not args:
             raise ActionError("nap needs on or off")

bolt_pet/relay_json.py

@@ -0,0 +1,148 @@
+"""Lenient JSON for the relayed command channel — and honest about it.
+
+`filectl` and `dialoguectl` both take a single line of compact JSON, hand-typed
+by a language model into a tool marker. Models get that *nearly* right and then
+get it wrong in a small, boringly repeatable set of ways:
+
+    {"op":"list","path":"/home/x","recursive":false"}    ← stray quote after a literal
+    {"op": "read", "path": "/tmp/a.txt",}                ← trailing comma
+    {'op': 'read', 'path': '/tmp/a.txt'}                 ← single quotes
+    {“op”: “read”, “path”: “/tmp/a.txt”}                 ← smart quotes
+    {"op": "list", "recursive": False}                   ← Python literals
+    ```json {"op": "list"} ```                           ← fenced
+
+Observed live (2026-07-30): a stray quote after `false` cost an entire desk
+turn — the call was rejected, the model re-sent the *identical* line, was
+rejected again, and then gave up and told the user "I'll check now" without
+ever calling anything. The user got a promise instead of an answer because of
+one character.
+
+Strict parsing is the wrong trade here. Nothing about a misplaced quote is
+ambiguous, the payload is machine-written and machine-read, and the cost of
+refusing is a wasted round trip that the model has already demonstrated it
+won't recover from. So: try strict first, then apply narrow repairs, and
+accept a repair **only if the result parses**.
+
+Two rules keep this from becoming "guess what they meant":
+
+1. **Repairs are conservative and named.** Each one fixes a known malformation,
+   is applied in isolation, and is reported by name.
+2. **Repairs are never silent.** The caller appends the repair note to the tool
+   result, so the model is told it sent broken JSON *while it still has the
+   turn* — the fix works today and teaches within the conversation. Hiding it
+   would trade a visible failure for an invisible one.
+
+When nothing parses, the error points at the exact character with a caret,
+because "Expecting ',' delimiter: char 74" is not something a model can act on
+and a pointed-at fragment is.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from typing import Any, Callable
+
+# Ordered, cheapest and safest first. Each entry is (name, transform); after
+# each one the payload is re-parsed, so the first repair that works wins and
+# nothing more aggressive gets applied than the input actually needed.
+_REPAIRS: tuple[tuple[str, Callable[[str], str]], ...] = (
+    (
+        "stripped a markdown code fence",
+        lambda text: re.sub(r"^\s*```(?:json)?\s*|\s*```\s*$", "", text),
+    ),
+    (
+        "replaced smart quotes with straight ones",
+        lambda text: text.translate(str.maketrans({"“": '"', "”": '"',
+                                                   "‘": "'", "’": "'"})),
+    ),
+    (
+        "removed a stray quote after a bare value",
+        # {"recursive":false"}  ->  {"recursive":false}
+        lambda text: re.sub(
+            r"(:\s*(?:true|false|null|-?\d+(?:\.\d+)?))\s*\"(\s*[,}\]])", r"\1\2", text),
+    ),
+    (
+        "removed a trailing comma",
+        lambda text: re.sub(r",(\s*[}\]])", r"\1", text),
+    ),
+    (
+        "converted Python literals (True/False/None) to JSON",
+        lambda text: re.sub(r"(:\s*)(True|False|None)\b",
+                            lambda m: m.group(1) + {"True": "true", "False": "false",
+                                                    "None": "null"}[m.group(2)], text),
+    ),
+    (
+        "converted single-quoted strings to double-quoted",
+        lambda text: re.sub(r"'([^'\"]*)'", r'"\1"', text),
+    ),
+)
+
+
+class RelayJsonError(ValueError):
+    """Unparseable even after repairs — carries a pointed-at fragment."""
+
+
+def loads(payload: str) -> tuple[Any, list[str]]:
+    """Parse *payload*, repairing common model mistakes.
+
+    Returns (data, repairs) where *repairs* names what had to be fixed — empty
+    when the input was already valid. Raises RelayJsonError with a caret at the
+    offending character when nothing works."""
+    text = str(payload or "").strip()
+    if not text:
+        raise RelayJsonError("empty payload")
+    try:
+        return json.loads(text), []
+    except json.JSONDecodeError as exc:
+        # Bound to a plain name: Python deletes the `as` target at the end of
+        # the except block, so referring to it further down would raise
+        # UnboundLocalError instead of reporting the parse failure.
+        first_error = exc
+
+    applied: list[str] = []
+    candidate = text
+    for name, repair in _REPAIRS:
+        repaired = repair(candidate)
+        if repaired == candidate:
+            continue
+        candidate = repaired
+        applied.append(name)
+        try:
+            return json.loads(candidate), applied
+        except json.JSONDecodeError:
+            continue  # keep going: a payload can be broken in more than one way
+
+    raise RelayJsonError(point_at(text, first_error))
+
+
+def point_at(text: str, error: json.JSONDecodeError, width: int = 28) -> str:
+    """Show the failure where it happened.
+
+    A model can act on "you wrote `false\"}` here"; it cannot act on
+    "Expecting ',' delimiter: line 1 column 75"."""
+    position = max(0, min(len(text), getattr(error, "pos", 0)))
+    start = max(0, position - width)
+    end = min(len(text), position + width)
+    fragment = text[start:end]
+    caret = " " * (position - start) + "^"
+    lead = "…" if start > 0 else ""
+    tail = "…" if end < len(text) else ""
+    return (
+        f"{error.msg} at character {position}:\n"
+        f"  {lead}{fragment}{tail}\n"
+        f"  {' ' * len(lead)}{caret}"
+    )
+
+
+def repair_note(repairs: list[str]) -> str:
+    """The line appended to a tool result when repairs were needed.
+
+    Phrased as feedback rather than an apology: the model is the author of the
+    broken JSON and is the one who can stop sending it."""
+    if not repairs:
+        return ""
+    return (
+        " (note: your JSON was malformed — I " + "; ".join(repairs)
+        + " and ran it anyway. Send valid single-line JSON next time.)"
+    )

bolt_pet/self_restart.py

@@ -0,0 +1,235 @@
+"""`petctl self_restart` — the pet restarting itself, and remembering why.
+
+Bolt can already edit this repo through `filectl` and run commands through the
+shell relay, which means he can change the pet's own code. What he could not
+do is *see the result*: the running process keeps the old modules in memory,
+so an edit is invisible until somebody restarts the pet by hand, and by then
+the conversation that motivated it is over. That makes the edit-test-review
+loop a human errand.
+
+This closes the loop. The tricky part is that the thing being asked to report
+back is the thing that dies, so the mechanism is built around three problems:
+
+1. **The turn must survive.** A restart mid-turn would kill the HTTP tool
+   relay before the result was posted, and the server would sit waiting until
+   it timed out — the conversation lost, with no explanation. So the command
+   only *arms* the restart: it returns immediately, the turn finishes and Bolt
+   speaks his reply, and the restart happens after (see
+   `controller._maybe_self_restart`), exactly like the updater's "only between
+   turns" rule.
+2. **A broken edit must not be fatal.** Before anything is armed, the new code
+   is imported in a *subprocess* (`preflight`) — this process still holds the
+   old modules, so importing here would prove nothing. A syntax error comes
+   back as the command's output, in the same turn, and nothing restarts. That
+   is the difference between "Bolt broke the pet and lost his own way to fix
+   it" and "Bolt got a traceback and tried again".
+3. **The reason must outlive the process.** The context (why, what to check,
+   which version, when) is written to disk before exec and read on the way
+   back up, so the new process can open with "I'm back — you asked me to check
+   X" instead of amnesia. That report goes to the server as a normal turn, so
+   Bolt sees the result of his own change and can carry on.
+
+A loop guard bounds the worst case: `MAX_RESTARTS` inside `WINDOW_SECONDS`
+and further self-restarts are refused with a reason, so an edit-restart-crash
+cycle stops on its own rather than spinning the process forever.
+
+Pure-ish and injectable throughout (paths, clock, subprocess runner) so the
+whole thing is testable without ever restarting anything.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+import time
+from dataclasses import asdict, dataclass, field
+from pathlib import Path
+from typing import Any, Callable, Optional
+
+from . import config
+
+# Lives in the cache dir, not the repo: it is transient state about *this*
+# machine's process, and it must never end up in a git diff of the checkout
+# Bolt is editing.
+DEFAULT_STATE_PATH = Path.home() / ".cache" / "bolt-pet" / "restart_context.json"
+
+# Loop guard. Deliberately small: a healthy edit-check cycle is one restart
+# per change, and anything hammering past this is a crash loop, not work.
+MAX_RESTARTS = int(os.environ.get("SELF_RESTART_MAX", "5"))
+WINDOW_SECONDS = float(os.environ.get("SELF_RESTART_WINDOW_SECONDS", "900"))
+
+# What the preflight subprocess imports. `ui.app` pulls in the widest slice of
+# the package (Qt, controller, audio, every helper), so if this imports, a
+# restart will at least reach the event loop.
+_PREFLIGHT_IMPORT = "import bolt_pet, bolt_pet.controller, bolt_pet.ui.app"
+
+
+class RestartError(Exception):
+    """A refused restart — reported back to the server as command output."""
+
+
+@dataclass
+class RestartContext:
+    """What the dying process wants the next one to know."""
+
+    reason: str = ""
+    verify: str = ""
+    armed_at: float = 0.0
+    version: str = ""
+    session: str = ""
+    recent: list = field(default_factory=list)
+    restarts: list = field(default_factory=list)  # timestamps, for the loop guard
+
+    def as_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+def _now() -> float:
+    return time.time()
+
+
+def load(path: Optional[Path] = None) -> Optional[RestartContext]:
+    """Read the context left by a previous process, or None."""
+    target = Path(path or DEFAULT_STATE_PATH)
+    try:
+        data = json.loads(target.read_text(encoding="utf-8"))
+    except (FileNotFoundError, json.JSONDecodeError, OSError):
+        return None
+    if not isinstance(data, dict):
+        return None
+    known = {field_name for field_name in RestartContext().as_dict()}
+    return RestartContext(**{k: v for k, v in data.items() if k in known})
+
+
+def save(context: RestartContext, path: Optional[Path] = None) -> None:
+    """Persist the context atomically — a half-written file on the way out
+    would make the next process start confused instead of oriented."""
+    target = Path(path or DEFAULT_STATE_PATH)
+    target.parent.mkdir(parents=True, exist_ok=True)
+    descriptor, temp_path = tempfile.mkstemp(dir=target.parent, prefix=".restart_", suffix=".tmp")
+    try:
+        with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+            json.dump(context.as_dict(), handle, ensure_ascii=False, indent=1)
+        os.replace(temp_path, target)
+    except BaseException:
+        try:
+            os.unlink(temp_path)
+        except OSError:
+            pass
+        raise
+
+
+def clear(path: Optional[Path] = None) -> None:
+    """Consume the context. Called once it has been reported, so the pet
+    doesn't announce the same restart every time it starts."""
+    try:
+        Path(path or DEFAULT_STATE_PATH).unlink()
+    except (FileNotFoundError, OSError):
+        pass
+
+
+def recent_restarts(context: Optional[RestartContext], *, now: Optional[float] = None) -> list:
+    current = now if now is not None else _now()
+    stamps = list((context.restarts if context else []) or [])
+    return [stamp for stamp in stamps if current - float(stamp) <= WINDOW_SECONDS]
+
+
+def check_loop_guard(context: Optional[RestartContext], *, now: Optional[float] = None) -> None:
+    """Refuse to restart if we've already done it too many times recently."""
+    stamps = recent_restarts(context, now=now)
+    if len(stamps) >= MAX_RESTARTS:
+        raise RestartError(
+            f"refusing: {len(stamps)} self-restarts in the last "
+            f"{int(WINDOW_SECONDS / 60)} minutes. Something is looping — fix the "
+            "cause, or wait for the window to clear before trying again."
+        )
+
+
+def preflight(
+    repo: Optional[Path] = None,
+    run: Optional[Callable[..., Any]] = None,
+    timeout: float = 120.0,
+) -> None:
+    """Import the current source in a subprocess; raise if it's broken.
+
+    This process has the *old* modules loaded, so importing in-process would
+    happily succeed on a file that no longer parses. Mirrors
+    `updater._smoke_test`, and exists for the same reason: never hand the
+    session to code that can't start."""
+    runner = run or subprocess.run
+    root = Path(repo or config.HERE)
+    try:
+        completed = runner(
+            [sys.executable, "-c", _PREFLIGHT_IMPORT],
+            cwd=str(root), capture_output=True, text=True, timeout=timeout,
+            env={**os.environ, "QT_QPA_PLATFORM": "offscreen"},  # no display needed to import
+        )
+    except Exception as exc:  # subprocess itself failed to run
+        raise RestartError(f"couldn't run the preflight import check: {exc}") from exc
+    if completed.returncode != 0:
+        detail = (completed.stderr or completed.stdout or "").strip()
+        raise RestartError(
+            "the current code does not import, so restarting would leave you with "
+            f"nothing running. Fix this first:\n{detail[-800:]}"
+        )
+
+
+def arm(
+    reason: str,
+    *,
+    verify: str = "",
+    version: str = "",
+    session: str = "",
+    recent: Optional[list] = None,
+    path: Optional[Path] = None,
+    now: Optional[float] = None,
+) -> RestartContext:
+    """Record why we're about to die, carrying the restart history forward."""
+    current = now if now is not None else _now()
+    previous = load(path)
+    context = RestartContext(
+        reason=" ".join(str(reason or "").split())[:400],
+        verify=" ".join(str(verify or "").split())[:400],
+        armed_at=current,
+        version=str(version or ""),
+        session=str(session or ""),
+        recent=list(recent or [])[-6:],
+        restarts=recent_restarts(previous, now=current) + [current],
+    )
+    save(context, path)
+    return context
+
+
+def report(
+    context: RestartContext,
+    *,
+    version: str = "",
+    now: Optional[float] = None,
+) -> str:
+    """The message the new process sends the server on the way up.
+
+    Phrased as Bolt reporting to himself, because that is what it is: the
+    server sees it as an ordinary turn, and the reply comes back through the
+    normal pipeline — which is what lets "restart and check X" finish as a
+    sentence spoken out loud."""
+    current = now if now is not None else _now()
+    took = max(0.0, current - float(context.armed_at or current))
+    lines = [
+        "[pet self-restart] I restarted myself and I'm back up.",
+        f"- reason: {context.reason or 'not recorded'}",
+        f"- took: {took:.1f}s",
+        f"- version now running: {version or 'unknown'}"
+        + (f" (was {context.version})" if context.version and context.version != version else ""),
+    ]
+    if context.verify:
+        lines.append(f"- you wanted to check: {context.verify}")
+    if context.recent:
+        lines.append("- what we were doing before: " + " | ".join(str(x)[:120] for x in context.recent))
+    lines.append(
+        "The new code is loaded and running. If you wanted to verify something, "
+        "check it now (filectl to read, command to test) and tell the user what you found."
+    )
+    return "\n".join(lines)

bolt_pet/server_client.py

@@ -9,14 +9,20 @@ memory, tools, and persona as Discord chat and the Linux voice client:
     ...   -> POST /desk/tool_result (repeat until the server sends a reply)
     reply <- returned to caller
 
+A reply can also carry a voice (`voice_id`/`voice_name`), which is how the
+server's `speak_as` marker reaches us: Bolt searched the ElevenLabs voice
+library, picked one, and tagged the reply with it — the client is what
+actually speaks in it. See `Reply` and controller._apply_voice.
+
 Kept dependency-free beyond `requests` so it's easy to unit test with mocks.
 """
 
 from __future__ import annotations
 
+import json
 import subprocess
 from pathlib import Path
-from typing import Callable, Optional
+from typing import Callable, NamedTuple, Optional
 
 import requests
 
@@ -29,6 +35,21 @@ class ServerError(Exception):
     """Raised when the server responds with an error payload or unreachable."""
 
 
+class Reply(NamedTuple):
+    """One final reply from the desk API. *voice_id* is set only when the
+    server tagged this reply with a `speak_as` voice; *voice_name* is the
+    human-readable name that came with it (may be empty even when the id
+    isn't). Both empty means "say it in the usual voice"."""
+
+    text: str
+    voice_id: str = ""
+    voice_name: str = ""
+    # True when the sentences were already spoken as they streamed in. The
+    # text is still carried — the follow-up rule needs to see whether the
+    # answer ended on a question — it just must not be read out again.
+    spoken: bool = False
+
+
 def _headers() -> dict:
     return {"X-Desk-Api-Key": config.API_KEY}
 
@@ -74,12 +95,20 @@ def converse(
     text: str,
     on_command: Callable[[str], str] = run_local_command,
     timeout: float = 120.0,
-) -> str:
+    on_say: Optional[Callable[[str], None]] = None,
+) -> Reply:
     """Send one turn of conversation to the desk API, relaying any commands
     the server sends back until it produces a final reply.
 
     *on_command* is injectable for tests; defaults to actually running the
     command locally (matching bolt_desk.py's behavior).
+
+    *on_say* is called with a short holding line ("give me a sec") when the
+    server sends one alongside a command. It is the difference between silence
+    and an answer while a tool runs: the model's acknowledgement used to be
+    discarded server-side, so the whole round trip was dead air and the model
+    then repeated itself in the final reply. Optional, so an older pet against
+    a newer server simply stays quiet as before.
     """
     headers = _headers()
     try:
@@ -95,6 +124,13 @@ def converse(
     for _ in range(_MAX_RELAY_HOPS):
         if payload.get("type") != "command":
             break
+        holding = str(payload.get("say") or "").strip()
+        if holding and on_say is not None:
+            # Spoken *before* the command runs — that is the whole point.
+            try:
+                on_say(holding)
+            except Exception:
+                pass  # a failed acknowledgement must not cost the tool call
         output = on_command(str(payload.get("command") or ""))
         try:
             response = requests.post(
@@ -111,7 +147,109 @@ def converse(
             raise ServerError(f"couldn't reach the server during tool relay: {exc}") from exc
 
     if payload.get("type") == "reply":
-        return str(payload.get("text") or "")
+        return Reply(
+            text=str(payload.get("text") or ""),
+            voice_id=str(payload.get("voice_id") or ""),
+            voice_name=str(payload.get("voice_name") or ""),
+        )
+    raise ServerError(str(payload.get("error") or "unknown server response"))
+
+
+def converse_stream(
+    text: str,
+    on_say: Callable[[str], None],
+    on_command: Callable[[str], str] = run_local_command,
+    timeout: float = 180.0,
+) -> Reply:
+    """Same turn as converse(), but speaking each sentence as it arrives.
+
+    Without this the pet waits out the *entire* model call before a single
+    word is heard; with it the wait is time-to-first-sentence, which on a
+    multi-sentence answer is most of the difference.
+
+    Falls back by raising ServerError before anything has been spoken — the
+    caller then retries the ordinary path and the user never finds out. Once a
+    sentence *has* been spoken there is no going back, so late failures end the
+    turn with whatever was said rather than repeating it.
+    """
+    spoke_anything = False
+    try:
+        response = requests.post(
+            f"{config.SERVER_URL}/desk/converse_stream",
+            json={"session_id": config.SESSION_ID, "text": text},
+            headers=_headers(), timeout=timeout, stream=True,
+        )
+        response.raise_for_status()
+        for raw in response.iter_lines(decode_unicode=True):
+            if not raw:
+                continue
+            try:
+                event = json.loads(raw)
+            except (TypeError, ValueError):
+                continue
+            kind = str(event.get("type") or "")
+
+            if kind == "say":
+                line = str(event.get("text") or "").strip()
+                if line:
+                    spoke_anything = True
+                    on_say(line)
+            elif kind == "command":
+                # The tool loop is request/response, so the rest of the turn
+                # finishes through the ordinary relay rather than inside the
+                # stream — one protocol for tools, not two.
+                response.close()
+                return _finish_relay(event, on_command, on_say)
+            elif kind == "reply":
+                return Reply(
+                    text=str(event.get("text") or ""),
+                    voice_id=str(event.get("voice_id") or ""),
+                    voice_name=str(event.get("voice_name") or ""),
+                    spoken=bool(event.get("already_spoken")),
+                )
+            elif kind == "error":
+                raise ServerError(str(event.get("error") or "stream failed"))
+    except ServerError:
+        raise
+    except Exception as exc:
+        if spoke_anything:
+            # Half a reply is out loud already; ending quietly beats saying it
+            # all again through the fallback path.
+            return Reply(text="", spoken=True)
+        raise ServerError(f"streaming failed: {exc}") from exc
+    raise ServerError("stream ended without a reply")
+
+
+def _finish_relay(event: dict, on_command, on_say) -> Reply:
+    """Run the tool the stream handed over, then continue the classic relay."""
+    payload = dict(event)
+    headers = _headers()
+    for _ in range(_MAX_RELAY_HOPS):
+        if payload.get("type") != "command":
+            break
+        holding = str(payload.get("say") or "").strip()
+        if holding and on_say is not None:
+            try:
+                on_say(holding)
+            except Exception:
+                pass
+        output = on_command(str(payload.get("command") or ""))
+        try:
+            response = requests.post(
+                f"{config.SERVER_URL}/desk/tool_result",
+                json={"session_id": config.SESSION_ID,
+                      "token": payload.get("token"), "output": output},
+                headers=headers, timeout=180,
+            )
+            payload = response.json()
+        except Exception as exc:
+            raise ServerError(f"couldn't reach the server during tool relay: {exc}") from exc
+    if payload.get("type") == "reply":
+        return Reply(
+            text=str(payload.get("text") or ""),
+            voice_id=str(payload.get("voice_id") or ""),
+            voice_name=str(payload.get("voice_name") or ""),
+        )
     raise ServerError(str(payload.get("error") or "unknown server response"))
 
 

bolt_pet/speech.py

@@ -0,0 +1,194 @@
+"""Everything the pet says, and the policy differences between kinds of saying.
+
+There used to be four of these in controller.py — a reply, a holding line, a
+streamed sentence, a dialogue scene — each written when its feature was built,
+each repeating the same dance: transition state, show the bubble, maybe record
+history, reset barge-in, call TTS, reset barge-in again, resume state, decide
+whether to keep the mic open. Only the *policy* differed, and the copies had
+already started to drift: one forgot to arm barge-in, another logged a
+different prefix, a third skipped the follow-up rule.
+
+So the dance lives here once, and the differences are data:
+
+    reply        the answer. Transcript, bubble, follow-up rule, ends IDLE.
+    holding      "give me a sec" while a tool runs. No transcript — it is
+                 filler, and the transcript should keep the answer. Resumes
+                 whatever state it interrupted, because the turn isn't over.
+    stream       one sentence of a streamed answer. Transcript and bubble like
+                 a reply, but stays TALKING so the sprite doesn't flicker
+                 between sentences, and the follow-up rule waits for the last.
+    scene        a dialoguectl take. Transcript (the user heard it), resumes
+                 mid-turn like a holding line.
+
+The controller keeps the pipeline; this keeps the rules about talking.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Callable, Optional
+
+from . import config, speech_text
+from .state import PetState
+
+
+@dataclass(frozen=True)
+class Utterance:
+    """One thing to say, and how saying it should behave."""
+
+    text: str
+    record: bool = True         # goes in the transcript, or is it filler?
+    resume: bool = False        # return to the state it interrupted (mid-turn)
+    hold_talking: bool = False  # stay TALKING afterwards (more is coming)
+    follow_up: bool = True      # may leave the mic open if it ends on a question
+    interruptible: bool = True  # arm barge-in for this one
+    log_prefix: str = "Bolt"
+
+    @classmethod
+    def reply(cls, text: str) -> "Utterance":
+        return cls(text)
+
+    @classmethod
+    def holding(cls, text: str) -> "Utterance":
+        # Filler: no transcript, no follow-up, and not interruptible — cutting
+        # off "give me a sec" would strand the tool that is already running.
+        return cls(text, record=False, resume=True, follow_up=False,
+                   interruptible=False, log_prefix="Bolt (holding)")
+
+    @classmethod
+    def stream_chunk(cls, text: str) -> "Utterance":
+        return cls(text, hold_talking=True, follow_up=False)
+
+    @classmethod
+    def scene(cls, text: str) -> "Utterance":
+        return cls(text, resume=True, follow_up=False)
+
+
+class Speaker:
+    """Says things on behalf of the controller.
+
+    Collaborators are passed in rather than reached for, so the whole of
+    speaking is testable without Qt, audio hardware or a state machine: hand it
+    fakes and assert on what came out."""
+
+    def __init__(self, *, state, tts, history=None, on_said=None, on_log=None,
+                 barge_in: Callable[[], object] = lambda: None,
+                 voice_id: Callable[[], str] = lambda: "",
+                 detail_of: Callable[[], str] = lambda: "",
+                 on_level: Optional[Callable[[float], None]] = None):
+        self._state = state
+        self._tts = tts
+        self._history = history
+        self._on_said = on_said or (lambda _text: None)
+        self._on_log = on_log or (lambda _msg: None)
+        # Read through a callable rather than held: the detector is built after
+        # the speaker (it needs the mic stream), replaced when barge-in mode
+        # changes, and swapped by tests. Two copies of it drifting apart is a
+        # bug nobody notices until the wake model starts hearing the pet.
+        self._barge_in_of = barge_in
+        self._voice_id = voice_id
+        # What actually fired, captured BEFORE the post-playback reset. Read it
+        # afterwards and every interruption reports 0.000 at frame 0 — which
+        # looks like hard evidence and is nothing of the sort.
+        self._detail_of = detail_of
+        self.last_detail = ""
+        self._on_level = on_level
+
+    @property
+    def _barge_in(self):
+        try:
+            return self._barge_in_of()
+        except Exception:
+            return None
+
+    def say(self, utterance: Utterance) -> bool:
+        """Speak it. Returns False if it was interrupted.
+
+        The one place that knows the order these steps go in — which is the
+        point, because getting that order wrong is invisible until the wake
+        model starts hearing the pet's own voice."""
+        line = speech_text.for_display(utterance.text)
+        if not line:
+            return True
+
+        resume_state = self._state.state
+        if self._state.state != PetState.TALKING:
+            self._state.transition(PetState.TALKING)
+        self._on_said(line)
+        self._on_log(f"{utterance.log_prefix}: {line}")
+        if utterance.record and self._history is not None:
+            self._history(utterance.text)
+
+        should_stop = None
+        if self._barge_in is not None and utterance.interruptible:
+            self._barge_in.reset()
+            should_stop = self._barge_in.check
+
+        completed = self._tts.speak(
+            utterance.text,
+            on_error=lambda exc: self._on_log(f"TTS failed: {exc}"),
+            should_stop=should_stop,
+            voice_id=self._voice_id() or None,
+            on_level=self._on_level,
+        )
+        self.last_detail = self._detail_of()
+        if self._barge_in is not None:
+            # Playback fed the pet's own voice into the wake model's rolling
+            # window. Clear it before the idle listener scores again, or the
+            # last sentence is still in there being re-heard.
+            self._barge_in.reset()
+        if self._on_level is not None:
+            self._on_level(0.0)  # mouth closed; nothing is playing now
+
+        if utterance.resume and resume_state in (PetState.THINKING, PetState.IDLE):
+            self._state.transition(resume_state)
+        return bool(completed)
+
+
+    def say_pcm(self, utterance: Utterance, *, pcm, sample_rate: int) -> bool:
+        """Speak audio that is already synthesized — a dialoguectl scene.
+
+        Same policy, same barge-in handling, same mouth; only the source of
+        the samples differs. Sharing this is why a scene can be talked over
+        exactly like an ordinary reply."""
+        line = speech_text.for_display(utterance.text)
+        resume_state = self._state.state
+        if self._state.state != PetState.TALKING:
+            self._state.transition(PetState.TALKING)
+        if line:
+            self._on_said(line)
+        self._on_log(f"{utterance.log_prefix}: {line}")
+        if utterance.record and self._history is not None:
+            self._history(utterance.text)
+
+        should_stop = None
+        if self._barge_in is not None and utterance.interruptible:
+            self._barge_in.reset()
+            should_stop = self._barge_in.check
+        completed = self._tts.play_pcm(
+            pcm, sample_rate, should_stop=should_stop, on_level=self._on_level)
+        self.last_detail = self._detail_of()
+        if self._barge_in is not None:
+            self._barge_in.reset()
+        if self._on_level is not None:
+            self._on_level(0.0)
+        if utterance.resume and resume_state in (PetState.THINKING, PetState.IDLE):
+            self._state.transition(resume_state)
+        return bool(completed)
+
+
+def follow_up_decision(text: str, *, completed: bool, follow_ups: int) -> tuple[bool, str]:
+    """Whether to keep listening after speaking, and why.
+
+    Split out as a pure function because it is a *rule* with an off-by-one cap
+    in it, and rules with counters deserve a test that doesn't need audio."""
+    if not completed:
+        return True, "interrupted"
+    if not speech_text.is_question(text):
+        return False, ""
+    cap = config.FOLLOW_UP_MAX_TURNS
+    if not config.FOLLOW_UP_LISTEN:
+        return False, ""
+    if cap > 0 and follow_ups >= cap:
+        return False, f"follow-up cap ({cap}) reached"
+    return True, "question"

bolt_pet/speech_text.py

@@ -97,10 +97,34 @@ def _bullets_to_sentences(text: str) -> str:
     return " ".join(line if line[-1] in ".!?:,;" else line + "." for line in lines)
 
 
+# ElevenLabs v3 delivery tags — "[laughing]", "[whispering]", "[sighs]". They
+# are instructions to the *dialogue* model (see dialogue.py), and only inside a
+# dialoguectl scene. Left in an ordinary reply they reach eleven_flash_v2,
+# which has no idea what they mean and simply reads the word: observed live
+# 2026-07-31, the pet announcing "laughing That one came through clean".
+#
+# Matched narrowly — a bracketed adverb/gerund, or one of the noise words that
+# aren't either — so real bracketed text ("[1]", "[see the docs]") survives.
+_AUDIO_TAG_RE = re.compile(
+    r"\[\s*(?:"
+    r"[a-z]+(?:ly|ing)"
+    r"|laughs?|chuckles?|sighs?|exhales?|inhales?|gulps?|pause|beat"
+    r"|clears throat|shouts?|whispers?|cries|sings?|gasps?|snorts?"
+    r"|sarcastic|excited|curious|nervous|angry|sad|happy|deadpan|flat"
+    r")\s*\]",
+    re.IGNORECASE,
+)
+
+
+def strip_audio_tags(text: str) -> str:
+    """Remove v3 delivery tags from text destined for the ordinary voice."""
+    return _AUDIO_TAG_RE.sub(" ", str(text or ""))
+
+
 def for_speech(text: str) -> str:
     """Plain prose for the TTS engine: no markdown, no emoji, no bare URLs,
     no stray symbols that would be read out character by character."""
-    text = (text or "").strip()
+    text = strip_audio_tags((text or "").strip())
     if not text:
         return ""
     for symbol, spoken in _PRE_SPOKEN_SYMBOLS.items():
@@ -136,8 +160,11 @@ def is_question(text: str) -> bool:
 
 def for_display(text: str) -> str:
     """What the speech bubble shows: markdown syntax removed (the bubble
-    can't render it) but emoji and layout-ish punctuation left alone."""
-    text = (text or "").strip()
+    can't render it) but emoji and layout-ish punctuation left alone.
+
+    Delivery tags go too — the voice no longer says them, so showing them
+    would caption a laugh nobody heard."""
+    text = strip_audio_tags((text or "").strip())
     if not text:
         return ""
     text = _strip_markdown(text, keep_emoji=True)

bolt_pet/state.py

@@ -26,11 +26,16 @@ class PetState(str, Enum):
 # make the pet speak unprompted — a reminder firing, a nudge from the server
 # — without the user having said anything first, so there's no preceding
 # LISTENING/THINKING leg for that turn.
+#
+# TALKING -> THINKING is the mirror case: a `dialoguectl` scene is played
+# *mid-turn*, while the server is still waiting on the tool result, so the pet
+# talks and then goes back to waiting rather than falling to IDLE (which would
+# make it look like the turn had ended).
 _TRANSITIONS: dict[PetState, set[PetState]] = {
     PetState.IDLE: {PetState.LISTENING, PetState.TALKING, PetState.ERROR},
     PetState.LISTENING: {PetState.THINKING, PetState.IDLE, PetState.ERROR},
     PetState.THINKING: {PetState.TALKING, PetState.IDLE, PetState.ERROR},
-    PetState.TALKING: {PetState.IDLE, PetState.ERROR},
+    PetState.TALKING: {PetState.IDLE, PetState.THINKING, PetState.ERROR},
     PetState.ERROR: {PetState.IDLE},
 }
 

bolt_pet/ui/app.py

@@ -41,6 +41,8 @@ def run() -> int:
     thread.started.connect(controller.run)
     controller.state_changed.connect(lambda value: window.set_state(PetState(value)))
     controller.said.connect(window.say)
+    # Lip-sync: the loudness of the audio actually going to the speakers.
+    controller.mouth.connect(window.set_mouth)
     controller.log.connect(_log)
     controller.action.connect(window.apply_action)  # petctl move/emote/say/...
     controller.finished.connect(thread.quit)
@@ -80,6 +82,7 @@ def run() -> int:
         on_set_nap=_set_nap,
         on_show_history=history_window.show_refreshed,
         on_show_wake_tuner=tuner_window.show_refreshed,
+        on_reset_voice=controller.reset_voice,
     )
 
     def _handle_napping(napping: bool) -> None:
@@ -87,6 +90,9 @@ def run() -> int:
         tray.set_napping(napping)
 
     controller.napping.connect(_handle_napping)
+    # The server can hand Bolt a different voice mid-conversation (speak_as);
+    # the tray is where you get his own back.
+    controller.voice_changed.connect(tray.set_voice)
 
     # Push-to-talk: a global hook, because the pet window never has focus.
     # request_talk_now() only sets a threading.Event, so it's safe to call

bolt_pet/ui/pet_window.py

@@ -19,7 +19,7 @@ from PySide6.QtGui import (
 )
 from PySide6.QtWidgets import QApplication, QWidget
 
-from .. import config
+from .. import config, window_state
 from ..monitors import Monitor
 from ..state import PetState
 from .sprite import WALK, SpriteSet
@@ -36,6 +36,11 @@ _NAP_OPACITY = 0.35
 # and the feet skate whenever PET_WANDER_SPEED doesn't happen to match the fps.
 # Eight frames at 13px is a ~104px stride cycle, a bit under the pet's width.
 _WALK_PIXELS_PER_FRAME = 13.0
+# How long a loudness level stays believable. The audio thread sends one per
+# ~30ms while a clip plays; if they stop arriving (offline TTS has no envelope,
+# or playback died) the mouth must not stay frozen mid-syllable, so after this
+# long the ordinary looping animation takes back over.
+_MOUTH_STALE_SECONDS = 0.35
 
 
 def emote_transform(emote: str, progress: float) -> tuple[float, float, float, float]:
@@ -213,6 +218,9 @@ class PetWindow(QWidget):
         self._commanded_move = False  # a petctl move — happens even mid-conversation
         self._next_wander_at = 0.0
         self._bob_offset = 0
+        # Lip-sync: loudness of what is playing right now, and when it arrived.
+        self._mouth_level: Optional[float] = None
+        self._mouth_at = 0.0
         self._bob_phase = 0.0
         self._walking = False
         self._facing = 1  # +1 right, -1 left; the walk art is drawn facing right
@@ -249,6 +257,19 @@ class PetWindow(QWidget):
             y = int(config.PET_START_Y) if config.PET_START_Y else None
         except ValueError:
             x = y = None
+        if x is None and y is None and config.PET_REMEMBER_POSITION:
+            remembered = window_state.load()
+            # Only if it still lands on a screen that exists — the usual reason
+            # a saved position is stale is that the monitor it was on has been
+            # unplugged, and restoring it faithfully would hide the pet.
+            if remembered is not None:
+                rectangles = [
+                    (s.availableGeometry().left(), s.availableGeometry().top(),
+                     s.availableGeometry().right(), s.availableGeometry().bottom())
+                    for s in QApplication.screens()
+                ]
+                if window_state.is_visible_on(*remembered, self.width(), rectangles):
+                    x, y = remembered
         if geo is not None:
             x = geo.right() - self.width() - 40 if x is None else x
             y = geo.bottom() - self.height() - 60 if y is None else y
@@ -688,6 +709,34 @@ class PetWindow(QWidget):
 
     # ── animation ────────────────────────────────────────────────────────
 
+    def set_mouth(self, level: float) -> None:
+        """How loud the pet is *right now* (0..1), straight off the PCM going
+        to the speakers (audio/tts.level_of).
+
+        The talking frames are ordered by mouth openness, so this indexes them
+        directly: the mouth moves with the actual waveform instead of flapping
+        on a timer, which is the difference between a talking sprite and a
+        dubbed one."""
+        self._mouth_level = max(0.0, min(1.0, float(level)))
+        self._mouth_at = time.monotonic()
+        if self._current_state == PetState.TALKING:
+            self.update()
+
+    def _mouth_frame(self, animation) -> Optional[QPixmap]:
+        """The frame matching the current loudness, or None to use the timer.
+
+        Falls back the moment the levels go stale — offline TTS has no
+        envelope, and a mouth frozen mid-syllable is worse than a timed loop."""
+        if self._mouth_level is None or animation is None:
+            return None
+        if time.monotonic() - self._mouth_at > _MOUTH_STALE_SECONDS:
+            return None
+        frames = animation.frames
+        if len(frames) < 2:
+            return None
+        index = int(round(self._mouth_level * (len(frames) - 1)))
+        return frames[max(0, min(len(frames) - 1, index))]
+
     def _advance_frame(self) -> None:
         # While walking the cycle is stepped by _advance_walk from distance
         # travelled; letting this timer also advance it would double-step it
@@ -702,7 +751,12 @@ class PetWindow(QWidget):
         painter.setRenderHint(QPainter.Antialiasing)
         painter.setRenderHint(QPainter.SmoothPixmapTransform)
         key = self._animation_key()
-        pixmap: Optional[QPixmap] = self.sprites.get(key).current()
+        animation = self.sprites.get(key)
+        pixmap: Optional[QPixmap] = None
+        if key == PetState.TALKING:
+            pixmap = self._mouth_frame(animation)
+        if pixmap is None:
+            pixmap = animation.current()
         if key == WALK:
             pixmap = self._oriented(pixmap)
         if pixmap is None:
@@ -759,6 +813,9 @@ class PetWindow(QWidget):
         was_click = not self._dragged
         self._drag_offset = None
         self._press_pos = None
+        if not was_click and config.PET_REMEMBER_POSITION:
+            position = self.geometry().topLeft()
+            window_state.save(position.x(), position.y())
         if was_click:
             self.talk_requested.emit()
         else:

bolt_pet/ui/tray.py

@@ -1,6 +1,7 @@
 """System tray icon — the pet window is frameless with no taskbar entry, so
 this menu is the only always-available way to control or exit it: talk now,
-mute, wander, click-through, nap, history, wake-word tuning, quit.
+mute, wander, click-through, nap, history, wake-word tuning, voice reset,
+quit.
 
 Every entry is a plain callback passed in by ui/app.py; this file knows
 nothing about the controller or the pet window.
@@ -46,6 +47,7 @@ class PetTray(QSystemTrayIcon):
         on_set_nap: Optional[Callable[[bool], None]] = None,
         on_show_history: Optional[Callable[[], None]] = None,
         on_show_wake_tuner: Optional[Callable[[], None]] = None,
+        on_reset_voice: Optional[Callable[[], None]] = None,
         parent=None,
     ):
         super().__init__(_make_icon(muted=False), parent)
@@ -102,6 +104,16 @@ class PetTray(QSystemTrayIcon):
             tuner_action.triggered.connect(on_show_wake_tuner)
             menu.addAction(tuner_action)
 
+        # Only ever enabled while a server-picked voice (speak_as) is in use —
+        # it's the way back from "talk like a pirate", which nothing else
+        # undoes short of a restart.
+        self._voice_action = None
+        if on_reset_voice is not None:
+            self._voice_action = QAction("Use default voice", menu)
+            self._voice_action.setEnabled(False)
+            self._voice_action.triggered.connect(on_reset_voice)
+            menu.addAction(self._voice_action)
+
         menu.addSeparator()
         quit_action = QAction("Quit", menu)
         quit_action.triggered.connect(on_quit)
@@ -115,6 +127,16 @@ class PetTray(QSystemTrayIcon):
         self._mute_action.setChecked(self._muted)
         self._refresh_icon()
 
+    def set_voice(self, voice: str) -> None:
+        """Reflect the voice the controller is speaking in — a name (or id)
+        when the server picked one, "" for Bolt's own."""
+        if self._voice_action is None:
+            return
+        self._voice_action.setEnabled(bool(voice))
+        self._voice_action.setText(
+            f"Use default voice (now: {voice})" if voice else "Use default voice"
+        )
+
     def set_napping(self, napping: bool) -> None:
         """Reflect a nap the *controller* decided on (quiet hours, fullscreen,
         or a petctl command) — not just ones clicked here."""

bolt_pet/window_state.py

@@ -0,0 +1,75 @@
+"""Where the pet was left, so it starts there next time.
+
+Listed in the README as a known limitation: drag it somewhere deliberate, and
+the next launch puts it back in the bottom-right corner. For something that
+lives on your desktop all day that is a small daily annoyance, and it is a
+config write on drag-end.
+
+Lives in the cache dir rather than the repo, next to the restart context: it
+is per-machine state about this install, not something that belongs in a git
+diff. Every function swallows its own errors — a corrupt or unwritable state
+file must never stop the pet from starting, it just means the default corner.
+
+Positions are validated against the *current* screen layout on load, because
+the common case for a stale position is exactly the case where it is
+dangerous: the pet was last on a monitor that is now unplugged, and restoring
+it faithfully would put it somewhere you cannot see or reach.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import tempfile
+from pathlib import Path
+from typing import Optional
+
+logger = logging.getLogger("bolt_pet.window_state")
+
+DEFAULT_PATH = Path.home() / ".cache" / "bolt-pet" / "window.json"
+
+
+def load(path: Optional[Path] = None) -> Optional[tuple[int, int]]:
+    """The saved position, or None if there isn't a usable one."""
+    try:
+        data = json.loads(Path(path or DEFAULT_PATH).read_text(encoding="utf-8"))
+        return int(data["x"]), int(data["y"])
+    except (FileNotFoundError, json.JSONDecodeError, KeyError, TypeError, ValueError, OSError):
+        return None
+
+
+def save(x: int, y: int, path: Optional[Path] = None) -> None:
+    """Remember where it is now. Atomic, so a crash mid-write can't leave a
+    half-file that makes the next start fall back to the corner."""
+    target = Path(path or DEFAULT_PATH)
+    try:
+        target.parent.mkdir(parents=True, exist_ok=True)
+        descriptor, temp_path = tempfile.mkstemp(dir=target.parent, prefix=".window_", suffix=".tmp")
+        try:
+            with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+                json.dump({"x": int(x), "y": int(y)}, handle)
+            os.replace(temp_path, target)
+        except BaseException:
+            try:
+                os.unlink(temp_path)
+            except OSError:
+                pass
+            raise
+    except Exception:
+        logger.debug("Could not save the window position", exc_info=True)
+
+
+def is_visible_on(x: int, y: int, size: int, rectangles) -> bool:
+    """Whether that position still lands on a screen that exists.
+
+    *rectangles* are (left, top, right, bottom) tuples — the caller's job,
+    because this module has no business importing Qt. Requires a real overlap
+    rather than a touching edge, so a pet saved flush against the boundary of a
+    monitor that has since been unplugged is not counted as reachable."""
+    for left, top, right, bottom in rectangles:
+        overlap_x = min(x + size, right) - max(x, left)
+        overlap_y = min(y + size, bottom) - max(y, top)
+        if overlap_x > size * 0.25 and overlap_y > size * 0.25:
+            return True
+    return False

requirements.txt

@@ -8,6 +8,9 @@ numpy>=1.24
 
 # HTTP client to the Bolt desk API
 requests>=2.31
+# Streaming speech-to-text (audio/stt_stream.py). Optional in practice: without
+# it the pet falls back to uploading the finished clip, exactly as before.
+websocket-client>=1.7
 
 # Wake-word detection (local, offline after first run) — runs the
 # custom-trained thunderbolt.onnx model shipped in this repo, same runtime

scripts/generate_bolt_sprites.py

@@ -663,31 +663,43 @@ def render_frame(p) -> Image.Image:
 
 def frames_for(state: str) -> list[dict]:
     if state == "idle":
+        # Eight frames, all distinct. The old version drove breathing on
+        # sin(2*pi*t) and the tail on sin(4*pi*t), which both cross zero at
+        # i=0 and i=4 — so frame 4 was byte-identical to frame 0 and the loop
+        # was really four frames stored twice.
         out = []
         for i in range(8):
             t = i / 8
-            br = math.sin(t * 2 * math.pi)
+            br = math.sin(t * 2 * math.pi + math.pi / 7)
             out.append(
                 default_pose(
                     breathe=br,
                     head_dy=-0.006 * br,
-                    tail=math.sin(t * 4 * math.pi),
+                    # Three-halves harmonic: never in phase with the breath, so
+                    # no two frames of the cycle can coincide.
+                    tail=math.sin(t * 3 * math.pi + 0.6),
+                    ear_twitch=0.30 if i == 3 else 0.0,   # a flick, once a loop
                     blink=1.0 if i == 6 else 0.0,
                 )
             )
         return out
     if state == "listening":
+        # Six frames of *orienting*, not idling: ears up, head turning toward
+        # whoever is talking, then settling. The old four had frames 0 and 2
+        # differing by 0.09 mean pixels — a two-pose animation wearing four.
         out = []
-        for i in range(4):
-            t = i / 4
+        for i in range(6):
+            t = i / 6
+            lean = math.sin(t * 2 * math.pi + math.pi / 5)
             out.append(
                 default_pose(
                     ear=1.0,
-                    ear_twitch=0.35 * math.sin(t * 2 * math.pi),
-                    tilt=-7 + 2.0 * math.sin(t * 2 * math.pi),
+                    ear_twitch=0.45 * math.sin(t * 4 * math.pi),
+                    tilt=-9 + 4.0 * lean,
+                    look=(0.010 * lean, -0.004),
                     brow=1.0,
-                    tail=0.5 * math.sin(t * 2 * math.pi),
-                    head_dy=-0.008,
+                    tail=0.7 * math.sin(t * 2 * math.pi + 1.1),
+                    head_dy=-0.010 - 0.004 * lean,
                     tag_glow=True,
                     extras="listen",
                     phase=i,
@@ -695,35 +707,51 @@ def frames_for(state: str) -> list[dict]:
             )
         return out
     if state == "thinking":
+        # The old six moved by a mean of ~1.3 pixels — effectively a still
+        # image. Thinking should *look* like thinking: the head tilts, the eyes
+        # travel as if following a thought, and one ear rotates independently.
         out = []
         for i in range(6):
             t = i / 6
+            sway = math.sin(t * 2 * math.pi)
             out.append(
                 default_pose(
-                    ear=0.25,
-                    tilt=6.0,
-                    look=(0.022, -0.026),
-                    brow=0.5,
-                    breathe=0.4 * math.sin(t * 2 * math.pi),
-                    tail=0.2 * math.sin(t * 2 * math.pi),
+                    ear=0.25 + 0.35 * abs(sway),
+                    ear_twitch=0.5 * math.cos(t * 2 * math.pi),
+                    tilt=4.0 + 7.0 * sway,
+                    # Eyes wander a small circle: the cheapest possible read of
+                    # "working something out" and the thing most obviously
+                    # missing before.
+                    look=(0.026 * math.cos(t * 2 * math.pi),
+                          -0.020 + 0.014 * math.sin(t * 2 * math.pi)),
+                    brow=0.5 + 0.4 * abs(sway),
+                    breathe=0.5 * math.sin(t * 2 * math.pi + 0.9),
+                    head_dy=-0.008 * sway,
+                    tail=0.35 * math.sin(t * 3 * math.pi),
+                    blink=1.0 if i == 4 else 0.0,
                     extras="think",
                     phase=i // 2,
                 )
             )
         return out
     if state == "talking":
+        # Ordered by mouth openness — closed at frame 0, widest at the last —
+        # because the window indexes these by the loudness of the audio that is
+        # actually playing (see audio/tts.level_of and PetWindow.set_mouth).
+        # A time-ordered loop cannot be indexed that way, and a mouth that
+        # flaps on a timer is what makes a talking sprite look dubbed.
         out = []
-        for i in range(4):
-            t = i / 4
-            open_ = (math.sin(t * 2 * math.pi) + 1) / 2
+        count = 6
+        for i in range(count):
+            open_ = i / (count - 1)
             out.append(
                 default_pose(
-                    mouth=0.25 + 0.75 * open_,
+                    mouth=0.06 + 0.94 * open_,
                     ear=0.6,
                     head_dy=-0.010 * open_,
                     breathe=open_,
-                    tail=math.sin(t * 2 * math.pi + 1.0),
-                    brow=0.35,
+                    tail=0.45 * math.sin(i * 0.9),
+                    brow=0.35 * open_,
                 )
             )
         return out

tests/test_controller.py

@@ -22,6 +22,14 @@ def no_screen_probes(monkeypatch):
     monkeypatch.setattr(controller_mod.screen_context, "is_fullscreen_active", lambda: False)
 
 
+@pytest.fixture(autouse=True)
+def _no_streaming(monkeypatch):
+    """Most tests drive the plain request/response path; leaving streaming on
+    would have them attempt a real HTTP call, fail, and fall back — passing,
+    slowly, for the wrong reason. The streaming path has its own tests."""
+    monkeypatch.setattr(controller_mod.config, "STREAMING_REPLIES", False)
+
+
 @pytest.fixture
 def ctrl():
     return controller_mod.PetController()
@@ -41,10 +49,10 @@ def test_full_turn_happy_path(monkeypatch, ctrl):
 
     monkeypatch.setattr(controller_mod.mic, "record_utterance", lambda *a, **k: np.zeros(10, dtype=np.int16))
     monkeypatch.setattr(controller_mod.stt, "transcribe", lambda pcm: "what's the weather")
-    monkeypatch.setattr(controller_mod.server_client, "converse", lambda text, on_command=None: "sunny and 72")
+    monkeypatch.setattr(controller_mod.server_client, "converse", lambda text, on_command=None, on_say=None: controller_mod.server_client.Reply("sunny and 72"))
     spoken = []
     monkeypatch.setattr(controller_mod.tts, "speak",
-                        lambda text, on_error=None, should_stop=None: (spoken.append(text), True)[1])
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: (spoken.append(text), True)[1])
 
     ctrl._handle_conversation_turn()
 
@@ -59,7 +67,7 @@ def test_turn_with_nothing_heard_returns_to_idle_without_calling_server(monkeypa
     monkeypatch.setattr(controller_mod.mic, "record_utterance", lambda *a, **k: None)
     called = {"n": 0}
     monkeypatch.setattr(controller_mod.server_client, "converse",
-                        lambda text, on_command=None: called.__setitem__("n", called["n"] + 1))
+                        lambda text, on_command=None, on_say=None: called.__setitem__("n", called["n"] + 1))
 
     ctrl._handle_conversation_turn()
 
@@ -97,7 +105,7 @@ def test_turn_with_server_error_flashes_error_then_idle(monkeypatch, ctrl):
     monkeypatch.setattr(controller_mod.mic, "record_utterance", lambda *a, **k: np.zeros(10, dtype=np.int16))
     monkeypatch.setattr(controller_mod.stt, "transcribe", lambda pcm: "hello")
 
-    def boom(text, on_command=None):
+    def boom(text, on_command=None, on_say=None):
         raise controller_mod.server_client.ServerError("server is down")
     monkeypatch.setattr(controller_mod.server_client, "converse", boom)
 
@@ -150,7 +158,7 @@ def test_heartbeat_speaks_a_pending_announcement_when_idle(monkeypatch, ctrl):
     monkeypatch.setattr(controller_mod.server_client, "report_status", lambda: "don't forget your 3pm")
     spoken = []
     monkeypatch.setattr(controller_mod.tts, "speak",
-                        lambda text, on_error=None, should_stop=None: (spoken.append(text), True)[1])
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: (spoken.append(text), True)[1])
     said = _capture(ctrl.said)
 
     ctrl._maybe_heartbeat()

tests/test_controller_features.py

@@ -15,6 +15,7 @@ from PySide6.QtWidgets import QApplication
 
 from bolt_pet import controller as controller_mod
 from bolt_pet.notifications import Notification
+from bolt_pet.server_client import Reply
 from bolt_pet.state import PetState
 
 sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
@@ -28,6 +29,14 @@ def no_screen_probes(monkeypatch):
     monkeypatch.setattr(controller_mod.screen_context, "context_for", lambda text: text)
 
 
+@pytest.fixture(autouse=True)
+def _no_streaming(monkeypatch):
+    """Most tests drive the plain request/response path; leaving streaming on
+    would have them attempt a real HTTP call, fail, and fall back — passing,
+    slowly, for the wrong reason. The streaming path has its own tests."""
+    monkeypatch.setattr(controller_mod.config, "STREAMING_REPLIES", False)
+
+
 @pytest.fixture
 def ctrl():
     return controller_mod.PetController()
@@ -159,7 +168,7 @@ def test_the_interrupt_log_reports_what_fired_not_the_reset_counters(monkeypatch
     ctrl._barge_in = detector
     logs = _capture(ctrl.log)
 
-    def interrupted_playback(text, on_error=None, should_stop=None):
+    def interrupted_playback(text, on_error=None, should_stop=None, voice_id=None, on_level=None):
         # What really happens: frames get scored during playback, then one
         # clears the threshold and playback aborts.
         detector._frames, detector._peak, detector._last = 7, 0.81, 0.81
@@ -179,7 +188,7 @@ def test_the_interrupt_log_reports_what_fired_not_the_reset_counters(monkeypatch
 def test_interrupted_playback_queues_an_immediate_next_turn(monkeypatch, ctrl):
     logs = _capture(ctrl.log)
     monkeypatch.setattr(controller_mod.tts, "speak",
-                        lambda text, on_error=None, should_stop=None: False)  # interrupted
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: False)  # interrupted
 
     ctrl._speak("a very long explanation")
 
@@ -189,7 +198,7 @@ def test_interrupted_playback_queues_an_immediate_next_turn(monkeypatch, ctrl):
 
 def test_uninterrupted_playback_does_not_queue_a_turn(monkeypatch, ctrl):
     monkeypatch.setattr(controller_mod.tts, "speak",
-                        lambda text, on_error=None, should_stop=None: True)
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: True)
     ctrl._speak("short answer")
     assert not ctrl._talk_now.is_set()
 
@@ -201,7 +210,7 @@ def spoke(monkeypatch):
     """Playback that always completes, so only the follow-up rule decides
     whether another turn is queued."""
     monkeypatch.setattr(controller_mod.tts, "speak",
-                        lambda text, on_error=None, should_stop=None: True)
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: True)
 
 
 def test_a_reply_ending_in_a_question_keeps_listening(spoke, ctrl):
@@ -289,7 +298,7 @@ def test_follow_up_can_be_turned_off(spoke, monkeypatch, ctrl):
 
 def test_being_interrupted_restarts_the_chain(monkeypatch, ctrl):
     monkeypatch.setattr(controller_mod.tts, "speak",
-                        lambda text, on_error=None, should_stop=None: False)
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: False)
     ctrl._follow_ups = 3
 
     ctrl._speak("a very long explanation")
@@ -300,7 +309,7 @@ def test_being_interrupted_restarts_the_chain(monkeypatch, ctrl):
 
 def test_speech_is_recorded_in_the_history(monkeypatch, ctrl):
     monkeypatch.setattr(controller_mod.tts, "speak",
-                        lambda text, on_error=None, should_stop=None: True)
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: True)
     ctrl._speak("**bold** reply")
     assert ctrl.history.last().text == "**bold** reply"  # raw, for copy/paste
 
@@ -314,10 +323,10 @@ def test_the_active_window_rides_along_with_the_utterance(monkeypatch, ctrl):
     monkeypatch.setattr(controller_mod.screen_context, "context_for",
                         lambda text: f"{text}\n\n[on screen right now: app.py]")
     monkeypatch.setattr(controller_mod.tts, "speak",
-                        lambda text, on_error=None, should_stop=None: True)
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: True)
     sent = []
     monkeypatch.setattr(controller_mod.server_client, "converse",
-                        lambda text, on_command=None: sent.append(text) or "that's a KeyError")
+                        lambda text, on_command=None, on_say=None: sent.append(text) or Reply("that's a KeyError"))
 
     ctrl._handle_conversation_turn()
 
@@ -370,10 +379,10 @@ def test_napping_still_answers_when_spoken_to(monkeypatch, ctrl):
                         lambda *a, **k: np.zeros(10, dtype=np.int16))
     monkeypatch.setattr(controller_mod.stt, "transcribe", lambda pcm: "you awake?")
     monkeypatch.setattr(controller_mod.server_client, "converse",
-                        lambda text, on_command=None: "always")
+                        lambda text, on_command=None, on_say=None: Reply("always"))
     spoken = []
     monkeypatch.setattr(controller_mod.tts, "speak",
-                        lambda text, on_error=None, should_stop=None: spoken.append(text) or True)
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: spoken.append(text) or True)
     ctrl.set_napping(True)
 
     ctrl._handle_conversation_turn()
@@ -388,9 +397,9 @@ def test_notifications_are_forwarded_and_spoken(monkeypatch, ctrl):
     ctrl._notification_gate = controller_mod.notifications.NotificationGate("", 0)
     sent, spoken = [], []
     monkeypatch.setattr(controller_mod.server_client, "converse",
-                        lambda text, on_command=None: sent.append(text) or "your build is green")
+                        lambda text, on_command=None, on_say=None: sent.append(text) or Reply("your build is green"))
     monkeypatch.setattr(controller_mod.tts, "speak",
-                        lambda text, on_error=None, should_stop=None: spoken.append(text) or True)
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: spoken.append(text) or True)
 
     ctrl._queue_notification(Notification(app="CI", summary="Build finished", body=""))
     ctrl._drain_notifications()
@@ -410,7 +419,7 @@ def test_notifications_are_not_forwarded_while_napping(monkeypatch, ctrl):
     ctrl._notification_gate = controller_mod.notifications.NotificationGate("", 0)
     called = {"n": 0}
     monkeypatch.setattr(controller_mod.server_client, "converse",
-                        lambda text, on_command=None: called.__setitem__("n", called["n"] + 1))
+                        lambda text, on_command=None, on_say=None: called.__setitem__("n", called["n"] + 1))
     ctrl.set_napping(True)
 
     ctrl._queue_notification(Notification(app="CI", summary="Build finished", body=""))
@@ -506,9 +515,9 @@ def test_check_deliveries_runs_after_a_conversation_turn(monkeypatch, ctrl, tmp_
                         lambda *a, **k: np.zeros(10, dtype=np.int16))
     monkeypatch.setattr(controller_mod.stt, "transcribe", lambda pcm: "send me that file")
     monkeypatch.setattr(controller_mod.server_client, "converse",
-                        lambda text, on_command=None: "it's on the way")
+                        lambda text, on_command=None, on_say=None: Reply("it's on the way"))
     monkeypatch.setattr(controller_mod.tts, "speak",
-                        lambda text, on_error=None, should_stop=None: True)
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: True)
     monkeypatch.setattr(controller_mod.config, "DELIVERED_FILES_DIR", tmp_path)
     monkeypatch.setattr(controller_mod.server_client, "list_outbox_files",
                         lambda: [{"id": "abc", "name": "notes.txt", "size": 2}])
@@ -518,3 +527,516 @@ def test_check_deliveries_runs_after_a_conversation_turn(monkeypatch, ctrl, tmp_
     ctrl._handle_conversation_turn()
 
     assert (tmp_path / "notes.txt").read_bytes() == b"hi"
+
+
+# ── server-picked voice (the desk API's speak_as marker) ────────────────────
+
+def _voice_turn(monkeypatch, ctrl, reply, said="talk like a pirate"):
+    """Run one full conversation turn whose reply is *reply*, returning the
+    voice_id each tts.speak() call was given."""
+    voices = []
+    monkeypatch.setattr(controller_mod.mic, "record_utterance",
+                        lambda *a, **k: np.zeros(10, dtype=np.int16))
+    monkeypatch.setattr(controller_mod.stt, "transcribe", lambda pcm: said)
+    monkeypatch.setattr(controller_mod.server_client, "converse",
+                        lambda text, on_command=None, on_say=None: reply)
+    monkeypatch.setattr(
+        controller_mod.tts, "speak",
+        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None:
+            voices.append(voice_id) or True,
+    )
+    ctrl._handle_conversation_turn()
+    return voices
+
+
+def test_a_speak_as_reply_is_spoken_in_that_voice(monkeypatch, ctrl):
+    voices = _voice_turn(monkeypatch, ctrl, Reply("Ahoy.", "VOICE1", "Terence"))
+    assert voices == ["VOICE1"]
+    assert ctrl.current_voice() == "Terence"
+
+
+def test_the_picked_voice_sticks_for_later_replies(monkeypatch, ctrl):
+    """The server tags one reply and doesn't keep the id in its history, so
+    it can't re-request the voice when you say "keep talking like that"."""
+    monkeypatch.setattr(controller_mod.config, "VOICE_STICKY", True)
+    _voice_turn(monkeypatch, ctrl, Reply("Ahoy.", "VOICE1", "Terence"))
+    voices = _voice_turn(monkeypatch, ctrl, Reply("Still me."), said="and now?")
+    assert voices == ["VOICE1"]
+
+
+def test_voice_stickiness_can_be_turned_off(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.config, "VOICE_STICKY", False)
+    _voice_turn(monkeypatch, ctrl, Reply("Ahoy.", "VOICE1", "Terence"))
+    voices = _voice_turn(monkeypatch, ctrl, Reply("Back to normal."), said="and now?")
+    assert voices == [None]
+    assert ctrl.current_voice() == ""
+
+
+def test_a_new_pick_replaces_the_old_one(monkeypatch, ctrl):
+    changes = _capture(ctrl.voice_changed)
+    _voice_turn(monkeypatch, ctrl, Reply("Ahoy.", "VOICE1", "Terence"))
+    voices = _voice_turn(monkeypatch, ctrl, Reply("こんにちは。", "VOICE2", "Asahi"),
+                         said="say that in Japanese")
+    assert voices == ["VOICE2"]
+    assert changes == ["Terence", "Asahi"]
+
+
+def test_resetting_the_voice_goes_back_to_the_default(monkeypatch, ctrl):
+    _voice_turn(monkeypatch, ctrl, Reply("Ahoy.", "VOICE1", "Terence"))
+    changes = _capture(ctrl.voice_changed)
+
+    ctrl.reset_voice()
+
+    assert ctrl.current_voice() == ""
+    assert changes == [""]  # the tray's menu entry follows this signal
+    voices = _voice_turn(monkeypatch, ctrl, Reply("Normal again."), said="hi")
+    assert voices == [None]
+
+
+def test_an_unnamed_voice_still_reports_something_resettable(monkeypatch, ctrl):
+    """voice_name is optional server-side — falling back to the id keeps the
+    tray entry from reading "now: " with nothing after it."""
+    _voice_turn(monkeypatch, ctrl, Reply("Ahoy.", "VOICE1"))
+    assert ctrl.current_voice() == "VOICE1"
+
+
+def test_petctl_voice_reset_returns_bolt_to_his_own_voice(monkeypatch, ctrl):
+    """The server can pick a voice but can't ask for the default back — it
+    was never told what Bolt's own voice id is. This is how it asks."""
+    ran = []
+    monkeypatch.setattr(controller_mod.server_client, "run_local_command", lambda cmd: ran.append(cmd))
+    _voice_turn(monkeypatch, ctrl, Reply("Ahoy.", "VOICE1", "Terence"))
+
+    output = ctrl._handle_command("petctl voice reset")
+
+    assert ran == []  # never reaches a shell, like every other petctl verb
+    assert "Terence" in output  # the server can't see the voice; tell it what changed
+    assert ctrl.current_voice() == ""
+    assert _voice_turn(monkeypatch, ctrl, Reply("Normal again."), said="hi") == [None]
+
+
+def test_petctl_voice_reset_says_so_when_there_was_nothing_to_reset(ctrl):
+    assert "already" in ctrl._handle_command("petctl voice reset")
+
+
+# ── dialoguectl (multi-voice scenes) ────────────────────────────────────────
+
+def _dialogue_command(*lines):
+    import json
+    return "dialoguectl " + json.dumps({"lines": list(lines)})
+
+
+def test_dialoguectl_never_reaches_the_shell(monkeypatch, ctrl):
+    ran = []
+    monkeypatch.setattr(controller_mod.server_client, "run_local_command", lambda cmd: ran.append(cmd))
+    monkeypatch.setattr(controller_mod.config, "ELEVENLABS_VOICE_ID", "aaorr6ZHIL88gEexu7dC")
+    monkeypatch.setattr(controller_mod.tts, "synthesize_dialogue",
+                        lambda inputs, model_id=None, stability=None: (np.zeros(4, dtype=np.int16), 24000))
+    monkeypatch.setattr(controller_mod.tts, "play_pcm",
+                        lambda pcm, rate, should_stop=None, on_level=None: True)
+
+    output = ctrl._handle_command(_dialogue_command({"voice": "self", "text": "[cheerfully] hi"}))
+
+    assert ran == []
+    assert "[dialogue] played 1 line" in output
+
+
+def test_a_scene_shows_in_the_bubble_with_the_delivery_tags_stripped(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.config, "ELEVENLABS_VOICE_ID", "aaorr6ZHIL88gEexu7dC")
+    monkeypatch.setattr(controller_mod.config, "DIALOGUE_VOICES", "narrator:9BWtsMINqrJLrRacOk9x")
+    monkeypatch.setattr(controller_mod.tts, "synthesize_dialogue",
+                        lambda inputs, model_id=None, stability=None: (np.zeros(4, dtype=np.int16), 24000))
+    monkeypatch.setattr(controller_mod.tts, "play_pcm", lambda pcm, rate, should_stop=None, on_level=None: True)
+    said = _capture(ctrl.said)
+
+    ctrl._handle_command(_dialogue_command(
+        {"voice": "self", "text": "[cheerfully] Hello there!"},
+        {"voice": "narrator", "text": "[whispering] He is lying."},
+    ))
+
+    assert said == ["Hello there! He is lying."]
+    assert ctrl.history.last().text == "Hello there! He is lying."
+
+
+def test_a_mid_turn_scene_returns_to_thinking_not_idle(monkeypatch, ctrl):
+    """The server is still waiting on the tool result, so the pet talks and
+    goes back to waiting — dropping to IDLE would look like the turn ended."""
+    monkeypatch.setattr(controller_mod.config, "ELEVENLABS_VOICE_ID", "aaorr6ZHIL88gEexu7dC")
+    monkeypatch.setattr(controller_mod.tts, "synthesize_dialogue",
+                        lambda inputs, model_id=None, stability=None: (np.zeros(4, dtype=np.int16), 24000))
+    monkeypatch.setattr(controller_mod.tts, "play_pcm", lambda pcm, rate, should_stop=None, on_level=None: True)
+    ctrl._state.transition(PetState.LISTENING)
+    ctrl._state.transition(PetState.THINKING)
+    states = _capture(ctrl.state_changed)
+
+    ctrl._handle_command(_dialogue_command({"voice": "self", "text": "hi"}))
+
+    assert states == ["talking", "thinking"]
+    assert ctrl._state.state == PetState.THINKING
+
+
+def test_the_scene_uses_a_voice_the_server_picked_with_speak_as(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.config, "ELEVENLABS_VOICE_ID", "aaorr6ZHIL88gEexu7dC")
+    seen = {}
+
+    def capture(inputs, model_id=None, stability=None):
+        seen["inputs"] = inputs
+        return np.zeros(4, dtype=np.int16), 24000
+
+    monkeypatch.setattr(controller_mod.tts, "synthesize_dialogue", capture)
+    monkeypatch.setattr(controller_mod.tts, "play_pcm", lambda pcm, rate, should_stop=None, on_level=None: True)
+    ctrl._apply_voice(controller_mod.server_client.Reply("ok", "PICKEDvoice123456789", "Terence"))
+
+    ctrl._handle_command(_dialogue_command({"voice": "self", "text": "hi"}))
+
+    assert seen["inputs"][0]["voice_id"] == "PICKEDvoice123456789"
+
+
+def test_a_synthesis_failure_is_reported_back_for_bolt_to_retry(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.config, "ELEVENLABS_VOICE_ID", "aaorr6ZHIL88gEexu7dC")
+
+    def boom(inputs, model_id=None, stability=None):
+        raise controller_mod.tts.TtsError("voice_id not found")
+
+    monkeypatch.setattr(controller_mod.tts, "synthesize_dialogue", boom)
+
+    output = ctrl._handle_command(_dialogue_command({"voice": "self", "text": "hi"}))
+
+    assert "couldn't synthesize" in output and "voice_id not found" in output
+    assert ctrl._state.state == PetState.IDLE  # nothing left half-transitioned
+
+
+def test_a_bad_voice_name_comes_back_as_advice_not_an_exception(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.config, "DIALOGUE_VOICES", "narrator:9BWtsMINqrJLrRacOk9x")
+    output = ctrl._handle_command(_dialogue_command({"voice": "wizard", "text": "hi"}))
+    assert "unknown voice" in output and "narrator" in output
+
+
+def test_dialogue_can_be_switched_off_on_this_device(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.config, "DIALOGUE", False)
+    called = []
+    monkeypatch.setattr(controller_mod.tts, "synthesize_dialogue",
+                        lambda *a, **k: called.append(1))
+    output = ctrl._handle_command(_dialogue_command({"voice": "self", "text": "hi"}))
+    assert "disabled" in output and called == []
+
+
+def test_talking_over_a_scene_is_reported_up_the_relay(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.config, "ELEVENLABS_VOICE_ID", "aaorr6ZHIL88gEexu7dC")
+    monkeypatch.setattr(controller_mod.tts, "synthesize_dialogue",
+                        lambda inputs, model_id=None, stability=None: (np.zeros(4, dtype=np.int16), 24000))
+    monkeypatch.setattr(controller_mod.tts, "play_pcm",
+                        lambda pcm, rate, should_stop=None, on_level=None: False)  # barge-in
+
+    output = ctrl._handle_command(_dialogue_command({"voice": "self", "text": "hi"}))
+
+    assert "interrupted" in output
+
+
+# ── petctl self_restart ─────────────────────────────────────────────────────
+
+def test_self_restart_arms_after_the_turn_rather_than_dying_mid_relay(monkeypatch, ctrl, tmp_path):
+    """Restarting inline would kill the HTTP tool relay before the result was
+    posted, and the server would wait out its timeout on a turn that can never
+    finish. So the command returns, the turn completes, *then* the pet dies."""
+    monkeypatch.setattr(controller_mod.self_restart, "DEFAULT_STATE_PATH", tmp_path / "ctx.json")
+    monkeypatch.setattr(controller_mod.self_restart, "preflight", lambda *a, **k: None)
+    restarts = _capture(ctrl.restart_requested)
+
+    output = ctrl._handle_command("petctl self_restart check the new dialogue code")
+
+    assert "restarting as soon as this turn finishes" in output
+    assert restarts == []  # nothing has happened yet
+
+    assert ctrl._maybe_self_restart() is True
+    assert restarts and "check the new dialogue code" in restarts[0]
+
+
+def test_a_broken_edit_is_reported_instead_of_leaving_nothing_running(monkeypatch, ctrl, tmp_path):
+    monkeypatch.setattr(controller_mod.self_restart, "DEFAULT_STATE_PATH", tmp_path / "ctx.json")
+
+    def boom(*args, **kwargs):
+        raise controller_mod.self_restart.RestartError(
+            "the current code does not import, so restarting would leave you with "
+            "nothing running. Fix this first:\nSyntaxError: invalid syntax"
+        )
+
+    monkeypatch.setattr(controller_mod.self_restart, "preflight", boom)
+    restarts = _capture(ctrl.restart_requested)
+
+    output = ctrl._handle_command("petctl self_restart try the new code")
+
+    assert "SyntaxError" in output and "refused" in output
+    assert ctrl._maybe_self_restart() is False
+    assert restarts == []
+
+
+def test_a_second_restart_request_in_one_turn_is_a_no_op(monkeypatch, ctrl, tmp_path):
+    monkeypatch.setattr(controller_mod.self_restart, "DEFAULT_STATE_PATH", tmp_path / "ctx.json")
+    monkeypatch.setattr(controller_mod.self_restart, "preflight", lambda *a, **k: None)
+    ctrl._handle_command("petctl self_restart first")
+    assert "already armed" in ctrl._handle_command("petctl self_restart second")
+
+
+def test_self_restart_can_be_switched_off_on_this_device(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.config, "SELF_RESTART", False)
+    checked = []
+    monkeypatch.setattr(controller_mod.self_restart, "preflight",
+                        lambda *a, **k: checked.append(1))
+    assert "disabled" in ctrl._handle_command("petctl self_restart go")
+    assert checked == []
+
+
+def test_coming_back_up_reports_to_the_server_and_speaks_the_reply(monkeypatch, ctrl, tmp_path):
+    """The half that makes it a loop: the new process tells Bolt it's back and
+    why, and his answer is spoken like any other turn."""
+    state = tmp_path / "ctx.json"
+    monkeypatch.setattr(controller_mod.self_restart, "DEFAULT_STATE_PATH", state)
+    controller_mod.self_restart.arm("check the walk cycle", version="0.2.3",
+                                    path=state, now=1000.0)
+    sent, spoken = [], []
+    monkeypatch.setattr(controller_mod.server_client, "converse",
+                        lambda text, on_command=None, on_say=None: sent.append(text) or Reply("Good, it's up."))
+    monkeypatch.setattr(controller_mod.tts, "speak",
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None:
+                            spoken.append(text) or True)
+
+    ctrl._report_self_restart()
+
+    assert "[pet self-restart]" in sent[0] and "check the walk cycle" in sent[0]
+    assert spoken == ["Good, it's up."]
+    # Consumed, so the next start doesn't announce the same restart again.
+    assert controller_mod.self_restart.load(state) is None
+
+
+def test_an_ordinary_start_reports_nothing(monkeypatch, ctrl, tmp_path):
+    monkeypatch.setattr(controller_mod.self_restart, "DEFAULT_STATE_PATH", tmp_path / "none.json")
+    called = []
+    monkeypatch.setattr(controller_mod.server_client, "converse",
+                        lambda text, on_command=None, on_say=None: called.append(text))
+
+    ctrl._report_self_restart()
+
+    assert called == []
+
+
+# ── holding line: "give me a sec" while a tool runs ────────────────────────
+# The server used to discard whatever the model wrote alongside a tool call,
+# so the whole round trip was silence — and the model, with no evidence its
+# sentence landed, said it again in the final reply.
+
+def test_a_holding_line_is_spoken_before_the_tool_runs(monkeypatch, ctrl):
+    order = []
+    monkeypatch.setattr(controller_mod.tts, "speak",
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None:
+                            order.append(("spoke", text)) or True)
+    monkeypatch.setattr(controller_mod.server_client, "run_local_command",
+                        lambda cmd: order.append(("ran", cmd)) or "[exit 0]")
+
+    ctrl._speak_holding("Give me a sec.")
+    ctrl._handle_command("df -h /")
+
+    assert order == [("spoke", "Give me a sec."), ("ran", "df -h /")]
+
+
+def test_the_holding_line_shows_in_the_bubble_but_not_the_transcript(monkeypatch, ctrl):
+    """It's filler. The transcript should keep the actual answer."""
+    monkeypatch.setattr(controller_mod.tts, "speak",
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: True)
+    said = _capture(ctrl.said)
+
+    ctrl._speak_holding("I'll check on that — one moment.")
+
+    assert said == ["I'll check on that — one moment."]
+    assert ctrl.history.entries() == []
+
+
+def test_a_holding_line_returns_to_waiting_not_idle(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.tts, "speak",
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: True)
+    ctrl._state.transition(PetState.LISTENING)
+    ctrl._state.transition(PetState.THINKING)
+    states = _capture(ctrl.state_changed)
+
+    ctrl._speak_holding("one sec")
+
+    assert states == ["talking", "thinking"]
+
+
+def test_the_relay_speaks_whatever_the_server_attaches(monkeypatch, ctrl):
+    spoken = []
+    monkeypatch.setattr(controller_mod.tts, "speak",
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None:
+                            spoken.append(text) or True)
+    monkeypatch.setattr(controller_mod.mic, "record_utterance",
+                        lambda *a, **k: np.zeros(10, dtype=np.int16))
+    monkeypatch.setattr(controller_mod.stt, "transcribe", lambda pcm: "what's in that folder?")
+
+    def fake_converse(text, on_command=None, on_say=None):
+        on_say("Let me check that for you.")      # what the server now sends
+        on_command("filectl {\"op\": \"list\", \"path\": \"/tmp\"}")
+        return Reply("It's got three files in it.")
+
+    monkeypatch.setattr(controller_mod.server_client, "converse", fake_converse)
+
+    ctrl._handle_conversation_turn()
+
+    assert spoken == ["Let me check that for you.", "It's got three files in it."]
+
+
+# ── streamed replies ───────────────────────────────────────────────────────
+# Without streaming the pet waits out the entire model call before saying a
+# word. With it, the wait is time-to-first-sentence.
+
+def test_each_sentence_is_spoken_as_it_arrives(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.config, "STREAMING_REPLIES", True)
+    spoken = []
+    monkeypatch.setattr(controller_mod.tts, "speak",
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None:
+                            spoken.append(text) or True)
+
+    def fake_stream(text, on_say, on_command=None, timeout=180.0):
+        on_say("The disk is fine.")
+        on_say("About sixty percent used.")
+        return controller_mod.server_client.Reply(
+            "The disk is fine. About sixty percent used.", spoken=True)
+
+    monkeypatch.setattr(controller_mod.server_client, "converse_stream", fake_stream)
+    monkeypatch.setattr(controller_mod.mic, "record_utterance",
+                        lambda *a, **k: np.zeros(10, dtype=np.int16))
+    monkeypatch.setattr(controller_mod.stt, "transcribe", lambda pcm: "how's the disk?")
+
+    ctrl._handle_conversation_turn()
+
+    assert spoken == ["The disk is fine.", "About sixty percent used."]
+    # ...and the empty final reply is not spoken as an extra blank utterance.
+    assert ctrl.history.entries()[-1].text == "About sixty percent used."
+
+
+def test_a_stream_that_fails_before_speaking_falls_back_silently(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.config, "STREAMING_REPLIES", True)
+    spoken = []
+    monkeypatch.setattr(controller_mod.tts, "speak",
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None:
+                            spoken.append(text) or True)
+
+    def broken_stream(text, on_say, on_command=None, timeout=180.0):
+        raise controller_mod.server_client.ServerError("no streaming endpoint")
+
+    monkeypatch.setattr(controller_mod.server_client, "converse_stream", broken_stream)
+    monkeypatch.setattr(controller_mod.server_client, "converse",
+                        lambda text, on_command=None, on_say=None: Reply("Fell back fine."))
+
+    assert ctrl._ask_server("hello").text == "Fell back fine."
+    assert spoken == []   # nothing was said twice
+
+
+def test_streaming_can_be_switched_off(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.config, "STREAMING_REPLIES", False)
+    called = []
+    monkeypatch.setattr(controller_mod.server_client, "converse_stream",
+                        lambda *a, **k: called.append(1))
+    monkeypatch.setattr(controller_mod.server_client, "converse",
+                        lambda text, on_command=None, on_say=None: Reply("plain path"))
+
+    assert ctrl._ask_server("hi").text == "plain path"
+    assert called == []
+
+
+def test_talking_over_a_streamed_reply_still_interrupts(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.config, "STREAMING_REPLIES", True)
+    monkeypatch.setattr(controller_mod.tts, "speak",
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: False)
+
+    ctrl._speak_stream_chunk("A long explanation you cut short.")
+
+    assert ctrl._talk_now.is_set()
+
+
+# ── notification latency (reported 2026-08-02: 5-10 minutes) ───────────────
+# Draining was wired to the heartbeat's 60s interval, and a heartbeat that
+# landed mid-conversation stamped its clock before noticing — so it burned the
+# slot and waited another full interval. Several of those in a row is minutes.
+
+def test_a_notification_goes_out_on_the_next_tick_not_the_next_heartbeat(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.config, "NOTIFICATION_MIN_INTERVAL_SECONDS", 0)
+    ctrl._notification_gate = controller_mod.notifications.NotificationGate("", 0)
+    sent = []
+    monkeypatch.setattr(controller_mod.server_client, "converse",
+                        lambda text, on_command=None, on_say=None:
+                            sent.append(text) or Reply("noted"))
+    monkeypatch.setattr(controller_mod.tts, "speak",
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: True)
+    monkeypatch.setattr(controller_mod.server_client, "report_status", lambda: None)
+    # A heartbeat has just run, so the next one is a full interval away.
+    ctrl._last_heartbeat = controller_mod.time.monotonic()
+
+    ctrl._queue_notification(Notification(app="Signal", summary="Harry", body="you there?"))
+    ctrl._maybe_heartbeat()
+
+    assert sent and "Harry" in sent[0]
+
+
+def test_a_heartbeat_skipped_mid_conversation_does_not_burn_its_slot(monkeypatch, ctrl):
+    monkeypatch.setattr(controller_mod.server_client, "report_status", lambda: None)
+    ctrl._last_heartbeat = 0.0
+    ctrl._state.transition(PetState.LISTENING)
+    ctrl._state.transition(PetState.THINKING)
+
+    ctrl._maybe_heartbeat()          # due, but the pet is busy
+    assert ctrl._last_heartbeat == 0.0, "the clock must not advance on a skipped tick"
+
+    ctrl._state.transition(PetState.IDLE)
+    ctrl._maybe_heartbeat()          # free now — runs immediately
+    assert ctrl._last_heartbeat > 0.0
+
+
+def test_notifications_wait_while_the_pet_is_mid_turn(monkeypatch, ctrl):
+    """Speaking over the answer they're already getting would be worse than
+    waiting a couple of seconds."""
+    ctrl._notification_gate = controller_mod.notifications.NotificationGate("", 0)
+    sent = []
+    monkeypatch.setattr(controller_mod.server_client, "converse",
+                        lambda text, on_command=None, on_say=None: sent.append(text))
+    ctrl._state.transition(PetState.LISTENING)
+
+    ctrl._queue_notification(Notification(app="CI", summary="Build finished", body=""))
+    ctrl._maybe_heartbeat()
+
+    assert sent == []
+    assert len(ctrl._pending_notifications) == 1   # kept, not dropped
+
+
+def test_a_second_message_inside_the_rate_limit_is_no_longer_lost(monkeypatch, ctrl):
+    """The gate used to drop it. With NOTIFICATION_MIN_INTERVAL_SECONDS=60,
+    two texts a minute apart meant you heard about one of them."""
+    ctrl._notification_gate = controller_mod.notifications.NotificationGate("", 60)
+    sent = []
+    monkeypatch.setattr(controller_mod.server_client, "converse",
+                        lambda text, on_command=None, on_say=None:
+                            sent.append(text) or Reply("ok"))
+    monkeypatch.setattr(controller_mod.tts, "speak",
+                        lambda text, on_error=None, should_stop=None, voice_id=None, on_level=None: True)
+
+    ctrl._queue_notification(Notification(app="Signal", summary="Harry", body="you there?"))
+    ctrl._queue_notification(Notification(app="Signal", summary="Harry", body="it's urgent"))
+    ctrl._drain_notifications()
+
+    assert len(sent) == 1                      # one round trip...
+    assert "you there?" in sent[0] and "it's urgent" in sent[0]   # ...both messages
+    assert "2 desktop notifications" in sent[0]
+
+
+def test_the_filter_still_applies(ctrl):
+    ctrl._notification_gate = controller_mod.notifications.NotificationGate("deploy", 0)
+    ctrl._queue_notification(Notification(app="Chat", summary="lunch?", body=""))
+    assert ctrl._pending_notifications == []
+
+
+def test_a_notification_storm_cannot_become_an_unbounded_backlog(ctrl):
+    ctrl._notification_gate = controller_mod.notifications.NotificationGate("", 0)
+    for index in range(40):
+        ctrl._queue_notification(Notification(app="Spam", summary=f"#{index}", body=""))
+
+    assert len(ctrl._pending_notifications) == controller_mod._MAX_PENDING_NOTIFICATIONS
+    assert "#39" in ctrl._pending_notifications[-1].as_text()   # newest kept

tests/test_dialogue.py

@@ -0,0 +1,236 @@
+"""`dialoguectl` — multi-voice scene parsing, voice resolution, API limits,
+and the request the ElevenLabs Text to Dialogue endpoint actually gets.
+
+Pure logic plus one mocked HTTP call: no audio device, no network, no display.
+"""
+
+import sys
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import numpy as np
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from bolt_pet import dialogue
+from bolt_pet.audio import tts
+
+SELF_ID = "aaorr6ZHIL88gEexu7dC"
+NARRATOR_ID = "9BWtsMINqrJLrRacOk9x"
+VILLAIN_ID = "IKne3meq5aSn9XLyUdCD"
+VOICES = {"narrator": NARRATOR_ID, "villain": VILLAIN_ID}
+
+
+def _scene(*lines):
+    return '{"lines": [' + ", ".join(lines) + "]}"
+
+
+# ── parsing ─────────────────────────────────────────────────────────────────
+
+def test_non_dialogue_commands_are_left_alone():
+    assert dialogue.parse("ls -la") is None
+    assert dialogue.parse('filectl {"op": "list"}') is None
+    assert dialogue.parse("") is None
+    # "dialogues" must not be mistaken for the "dialogue" prefix
+    assert dialogue.parse("dialogues --list") is None
+
+
+def test_a_scene_parses_into_lines():
+    action = dialogue.parse(
+        'dialoguectl ' + _scene(
+            '{"voice": "self", "text": "[cheerfully] Hello, how are you?"}',
+            '{"voice": "villain", "text": "[stuttering] I am... fine."}',
+        )
+    )
+    assert action["action"] == "dialogue"
+    assert [line["voice"] for line in action["lines"]] == ["self", "villain"]
+    assert action["lines"][0]["text"].startswith("[cheerfully]")
+
+
+def test_the_elevenlabs_field_names_are_accepted_too():
+    """The model has read that API; copying its shape is the obvious thing to
+    try, so 'inputs'/'voice_id' work as well as 'lines'/'voice'."""
+    action = dialogue.parse(
+        'dialoguectl {"inputs": [{"voice_id": "%s", "text": "hi"}]}' % NARRATOR_ID
+    )
+    assert action["lines"] == [{"voice": NARRATOR_ID, "text": "hi"}]
+
+
+def test_a_line_with_no_voice_defaults_to_the_pet_itself():
+    action = dialogue.parse('dialoguectl {"lines": [{"text": "just me talking"}]}')
+    assert action["lines"][0]["voice"] == "self"
+
+
+def test_truncated_json_explains_the_one_line_rule():
+    """The real failure mode: the server's command extractor stops at the
+    first newline, so a multi-line payload arrives cut in half. The error has
+    to name the cause, since Bolt is the one who has to fix it."""
+    with pytest.raises(dialogue.DialogueError, match="one line"):
+        dialogue.parse('dialoguectl {"lines": [{"voice": "self", "text": "hi"')
+
+
+def test_an_empty_or_shapeless_payload_is_rejected():
+    with pytest.raises(dialogue.DialogueError, match="needs a JSON argument"):
+        dialogue.parse("dialoguectl")
+    with pytest.raises(dialogue.DialogueError, match="non-empty"):
+        dialogue.parse('dialoguectl {"lines": []}')
+    with pytest.raises(dialogue.DialogueError, match="no text"):
+        dialogue.parse('dialoguectl {"lines": [{"voice": "self", "text": "  "}]}')
+
+
+def test_optional_model_and_stability_ride_along():
+    action = dialogue.parse(
+        'dialoguectl {"model_id": "eleven_v3", "stability": 0.8, '
+        '"lines": [{"text": "hi"}]}'
+    )
+    assert action["model"] == "eleven_v3"
+    assert action["stability"] == 0.8
+
+
+# ── voice resolution ────────────────────────────────────────────────────────
+
+def test_named_voices_resolve_from_the_configured_cast():
+    action = dialogue.parse('dialoguectl ' + _scene(
+        '{"voice": "narrator", "text": "Once upon a time."}',
+        '{"voice": "villain", "text": "Not this again."}',
+    ))
+    inputs = dialogue.resolve(action, voices=VOICES, self_voice=SELF_ID)
+    assert [entry["voice_id"] for entry in inputs] == [NARRATOR_ID, VILLAIN_ID]
+
+
+def test_self_tracks_the_voice_the_pet_is_currently_using():
+    """A scene featuring Bolt should sound like whoever Bolt currently is —
+    including a voice the server picked mid-conversation with speak_as."""
+    action = dialogue.parse('dialoguectl {"lines": [{"voice": "self", "text": "hi"}]}')
+    picked = "VOICEfromSPEAKas1234"
+    assert dialogue.resolve(action, self_voice=picked)[0]["voice_id"] == picked
+
+
+def test_a_raw_voice_id_passes_straight_through():
+    action = dialogue.parse('dialoguectl {"lines": [{"voice": "%s", "text": "hi"}]}' % NARRATOR_ID)
+    assert dialogue.resolve(action, self_voice=SELF_ID)[0]["voice_id"] == NARRATOR_ID
+
+
+def test_an_unknown_name_lists_what_is_available():
+    action = dialogue.parse('dialoguectl {"lines": [{"voice": "wizard", "text": "hi"}]}')
+    with pytest.raises(dialogue.DialogueError) as excinfo:
+        dialogue.resolve(action, voices=VOICES, self_voice=SELF_ID)
+    message = str(excinfo.value)
+    assert "wizard" in message and "narrator" in message and "villain" in message
+
+
+def test_self_without_a_configured_voice_says_so():
+    action = dialogue.parse('dialoguectl {"lines": [{"voice": "self", "text": "hi"}]}')
+    with pytest.raises(dialogue.DialogueError, match="ELEVENLABS_VOICE_ID"):
+        dialogue.resolve(action, self_voice="")
+
+
+def test_the_voice_map_parser_skips_typos_instead_of_dying():
+    voices = dialogue.parse_voice_map(f"narrator:{NARRATOR_ID}, broken-entry, villain:{VILLAIN_ID}")
+    assert voices == {"narrator": NARRATOR_ID, "villain": VILLAIN_ID}
+    assert dialogue.parse_voice_map("") == {}
+
+
+# ── API limits, enforced before the request goes out ────────────────────────
+
+def test_too_many_distinct_voices_is_refused_locally():
+    inputs = [{"text": "hi", "voice_id": f"voice{index:015d}"} for index in range(11)]
+    with pytest.raises(dialogue.DialogueError, match="limit is 10"):
+        dialogue.check_limits(inputs)
+
+
+def test_an_over_long_scene_is_refused_with_advice():
+    inputs = [{"text": "x" * 1100, "voice_id": SELF_ID} for _ in range(2)]
+    with pytest.raises(dialogue.DialogueError) as excinfo:
+        dialogue.check_limits(inputs)
+    assert "Split it" in str(excinfo.value)  # actionable, since Bolt reads this
+
+
+# ── display / reporting ─────────────────────────────────────────────────────
+
+def test_delivery_tags_are_stripped_from_what_the_bubble_shows():
+    action = dialogue.parse('dialoguectl ' + _scene(
+        '{"voice": "self", "text": "[cheerfully] Hello there!"}',
+        '{"voice": "narrator", "text": "[whispering] He is lying."}',
+    ))
+    assert dialogue.spoken_text(action) == "Hello there! He is lying."
+
+
+def test_the_relay_report_names_the_cast():
+    action = dialogue.parse('dialoguectl ' + _scene(
+        '{"voice": "self", "text": "one"}', '{"voice": "narrator", "text": "two"}',
+    ))
+    assert dialogue.describe(action).startswith(
+        "[dialogue] played 2 lines in 2 voices: narrator, self")
+
+
+def test_the_report_says_the_scene_was_already_heard():
+    """Observed 2026-07-31: the scene played, then the final reply summarised
+    it, so the pet said the same thing twice with nothing in between. The
+    model cannot know the audio already happened unless it is told."""
+    action = dialogue.parse('dialoguectl {"lines": [{"text": "hello"}]}')
+    report = dialogue.describe(action)
+    assert "HEARD this already" in report
+    assert "Do not repeat" in report
+
+
+# ── the HTTP request ────────────────────────────────────────────────────────
+
+def _pcm_response(samples=(1, 2, 3, 4)):
+    response = MagicMock()
+    response.content = np.array(samples, dtype=np.int16).tobytes()
+    response.raise_for_status = MagicMock()
+    return response
+
+
+def test_the_request_matches_the_text_to_dialogue_api(monkeypatch):
+    monkeypatch.setattr(tts.config, "ELEVENLABS_API_KEY", "test-key")
+    monkeypatch.setattr(tts.config, "TTS_SAMPLE_RATE", 24000)
+    monkeypatch.setattr(tts.config, "DIALOGUE_MODEL_ID", "eleven_v3")
+    inputs = [
+        {"text": "[cheerfully] Hello", "voice_id": NARRATOR_ID},
+        {"text": "[stuttering] H-hi", "voice_id": VILLAIN_ID},
+    ]
+    with patch.object(tts.requests, "post", return_value=_pcm_response()) as post:
+        pcm, rate = tts.synthesize_dialogue(inputs)
+
+    assert rate == 24000 and pcm.tolist() == [1, 2, 3, 4]
+    args, kwargs = post.call_args
+    assert args[0] == "https://api.elevenlabs.io/v1/text-to-dialogue"
+    assert kwargs["params"] == {"output_format": "pcm_24000"}
+    assert kwargs["headers"] == {"xi-api-key": "test-key"}
+    assert kwargs["json"]["inputs"] == inputs
+    assert kwargs["json"]["model_id"] == "eleven_v3"
+    assert "settings" not in kwargs["json"]  # omitted unless asked for
+
+
+def test_stability_is_only_sent_when_given(monkeypatch):
+    monkeypatch.setattr(tts.config, "ELEVENLABS_API_KEY", "test-key")
+    with patch.object(tts.requests, "post", return_value=_pcm_response()) as post:
+        tts.synthesize_dialogue([{"text": "hi", "voice_id": SELF_ID}], stability=0.3)
+    assert post.call_args.kwargs["json"]["settings"] == {"stability": 0.3}
+
+
+def test_a_rejected_request_surfaces_what_the_api_said(monkeypatch):
+    """The API explains refusals in the body; Bolt reads this through the tool
+    relay, so it has to reach him rather than being flattened to '422'."""
+    monkeypatch.setattr(tts.config, "ELEVENLABS_API_KEY", "test-key")
+    failure = MagicMock()
+    failure.text = '{"detail": "voice_id not found"}'
+    error = Exception("422 Client Error")
+    error.response = failure
+    response = MagicMock()
+    response.raise_for_status = MagicMock(side_effect=error)
+
+    with patch.object(tts.requests, "post", return_value=response):
+        with pytest.raises(tts.TtsError, match="voice_id not found"):
+            tts.synthesize_dialogue([{"text": "hi", "voice_id": "nope"}])
+
+
+def test_no_api_key_fails_before_the_request(monkeypatch):
+    monkeypatch.setattr(tts.config, "ELEVENLABS_API_KEY", "")
+    with patch.object(tts.requests, "post") as post:
+        with pytest.raises(tts.TtsError):
+            tts.synthesize_dialogue([{"text": "hi", "voice_id": SELF_ID}])
+    post.assert_not_called()

tests/test_doctor.py

@@ -0,0 +1,115 @@
+"""The preflight. Its one job is to never be the thing that's broken.
+
+A doctor that raises on a broken install diagnoses the wrong patient, so the
+tests that matter here are the ugly-input ones: no config at all, a check that
+throws, a dependency missing. The individual diagnoses are simple enough to
+read; that they *run* on a machine missing everything is the property worth
+pinning down.
+"""
+
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from bolt_pet import config, doctor
+from bolt_pet.doctor import FAIL, OK, WARN
+
+
+def test_every_check_returns_a_verdict_on_a_bare_machine(monkeypatch):
+    """Nothing configured, nothing installed — still a full report."""
+    for name in ("SERVER_URL", "API_KEY", "DEEPGRAM_API_KEY",
+                 "ELEVENLABS_API_KEY", "ELEVENLABS_VOICE_ID"):
+        monkeypatch.setattr(config, name, "")
+    monkeypatch.setattr(doctor, "_module", lambda _n: False)
+
+    results = doctor.run()
+
+    assert len(results) == len(doctor.CHECKS)
+    assert all(c.status in (OK, WARN, FAIL) for c in results)
+    assert all(c.name and c.detail for c in results)
+
+
+def test_a_check_that_raises_does_not_hide_the_others():
+    """One broken probe must not cost you the other eleven diagnoses."""
+    def explode(*_args):
+        raise RuntimeError("boom")
+
+    original = doctor.CHECKS
+    doctor.CHECKS = (("mic", explode),) + original[:2]
+    try:
+        results = doctor.run()
+    finally:
+        doctor.CHECKS = original
+
+    assert len(results) == 3
+    assert results[0].status == FAIL
+    assert "boom" in results[0].detail
+
+
+def test_missing_server_config_is_a_failure_not_a_warning(monkeypatch):
+    """Without it the controller exits its thread at startup — the pet looks
+    alive and simply never answers. That is the worst failure mode there is."""
+    monkeypatch.setattr(config, "missing_config", lambda: ["BOLT_SERVER_URL", "DESK_API_KEY"])
+    check = doctor.check_config()
+    assert check.status == FAIL
+    assert "BOLT_SERVER_URL" in check.detail
+    assert check.fix
+
+
+def test_a_configured_server_passes_without_being_contacted(monkeypatch):
+    """The shallow run must not need the network — it's the first thing you
+    reach for when the network is what's wrong."""
+    monkeypatch.setattr(config, "missing_config", lambda: [])
+    monkeypatch.setattr(config, "SERVER_URL", "http://bolt.local:8000")
+    assert doctor.check_config().status == OK
+    assert doctor.check_server(deep=False).status == OK
+
+
+def test_every_problem_comes_with_something_to_do_about_it(monkeypatch):
+    """"screen reading: warn" is useless on its own; "apt install tesseract-ocr"
+    is the entire point of the tool."""
+    for name in ("SERVER_URL", "API_KEY", "DEEPGRAM_API_KEY"):
+        monkeypatch.setattr(config, name, "")
+    monkeypatch.setattr(doctor, "_module", lambda _n: False)
+
+    for check in doctor.run():
+        if check.status == FAIL:
+            assert check.fix, f"{check.name} says what's wrong but not what to do"
+
+
+def test_the_exit_code_is_nonzero_only_for_real_failures(monkeypatch, capsys):
+    monkeypatch.setattr(doctor, "run", lambda deep=False: [
+        doctor.Check("a", OK, "fine"), doctor.Check("b", WARN, "degraded")])
+    assert doctor.main([]) == 0
+
+    monkeypatch.setattr(doctor, "run", lambda deep=False: [doctor.Check("a", FAIL, "broken")])
+    assert doctor.main([]) == 1
+    assert "Fix those first" in capsys.readouterr().out
+
+
+def test_deep_is_off_unless_asked(monkeypatch):
+    seen = []
+    monkeypatch.setattr(doctor, "run", lambda deep=False: seen.append(deep) or [])
+    doctor.main([])
+    doctor.main(["--deep"])
+    assert seen == [False, True]
+
+
+def test_a_slow_silence_timeout_is_flagged(monkeypatch):
+    """The setting most likely to make it feel sluggish, and the least obvious
+    — it is pure dead air before anything at all starts happening."""
+    monkeypatch.setattr(config, "SILENCE_END_SEC", 2.0)
+    check = doctor.check_latency()
+    assert check.status == WARN
+    assert "2s" in check.detail or "2 " in check.detail
+
+    monkeypatch.setattr(config, "SILENCE_END_SEC", 0.9)
+    assert doctor.check_latency().status == OK
+
+
+def test_a_check_line_renders_the_fix_only_when_there_is_a_problem():
+    assert "→" not in doctor.Check("x", OK, "all good", fix="unused").line()
+    assert "→ do the thing" in doctor.Check("x", WARN, "hmm", fix="do the thing").line()

tests/test_file_ops.py

@@ -264,3 +264,66 @@ def test_write_creates_parent_directories(tmp_path):
     action = file_ops.parse(_cmd({"op": "write", "path": str(target), "content": "hi"}))
     file_ops.execute(action)
     assert target.read_text() == "hi"
+
+
+# ── lenient JSON (see relay_json) ───────────────────────────────────────────
+# Machine-written JSON fails in a small, repeatable set of ways. Observed live
+# 2026-07-30: a stray quote after `false` cost a whole desk turn — rejected,
+# re-sent identically, rejected again, then abandoned with a promise to the
+# user that nothing fulfilled.
+
+def test_the_stray_quote_that_cost_a_live_turn_now_parses():
+    action = file_ops.parse(
+        'filectl {"op":"list","path":"/home/maji/Documents","pattern":"*","recursive":false"}'
+    )
+    assert action["action"] == "list"
+    assert action["path"] == "/home/maji/Documents"
+    assert action["recursive"] is False
+    assert action["_repairs"] == ["removed a stray quote after a bare value"]
+
+
+@pytest.mark.parametrize("payload,expected", [
+    ('{"op": "read", "path": "/tmp/a.txt",}', "removed a trailing comma"),
+    ("{'op': 'read', 'path': '/tmp/a.txt'}", "converted single-quoted strings to double-quoted"),
+    ('{“op”: “read”, “path”: “/tmp/a.txt”}', "replaced smart quotes with straight ones"),
+    ('```json {"op": "read", "path": "/tmp/a.txt"} ```', "stripped a markdown code fence"),
+])
+def test_common_model_json_mistakes_are_repaired(payload, expected):
+    action = file_ops.parse("filectl " + payload)
+    assert action["action"] == "read"
+    assert action["path"] == "/tmp/a.txt"
+    assert expected in action["_repairs"]
+
+
+def test_python_literals_are_converted():
+    action = file_ops.parse('filectl {"op": "list", "path": "/tmp", "recursive": True}')
+    assert action["recursive"] is True
+
+
+def test_a_repair_is_reported_in_the_output_never_hidden(tmp_path):
+    """Silently fixing it would work today and guarantee the same broken call
+    tomorrow — the model has to be told while it still has the turn."""
+    (tmp_path / "a.txt").write_text("hello", encoding="utf-8")
+    action = file_ops.parse(
+        'filectl {"op":"list","path":"%s","recursive":false"}' % tmp_path
+    )
+    output = file_ops.execute(action)
+    assert "a.txt" in output
+    assert "your JSON was malformed" in output
+    assert "stray quote" in output
+
+
+def test_valid_json_gets_no_repair_note(tmp_path):
+    (tmp_path / "a.txt").write_text("hello", encoding="utf-8")
+    action = file_ops.parse('filectl {"op": "list", "path": "%s"}' % tmp_path)
+    assert "_repairs" not in action
+    assert "malformed" not in file_ops.execute(action)
+
+
+def test_genuinely_unparseable_json_points_at_the_character():
+    """"Expecting ',' delimiter: char 74" is not something a model can act on."""
+    with pytest.raises(file_ops.FileOpError) as excinfo:
+        file_ops.parse('filectl {"op": "read", "path": "/tmp/a.txt" "extra": 1}')
+    message = str(excinfo.value)
+    assert "^" in message           # caret under the offending character
+    assert '"extra"' in message     # ...and the fragment around it

tests/test_lipsync.py

@@ -0,0 +1,135 @@
+"""Amplitude → mouth openness, from PCM samples to the drawn frame.
+
+Two halves, tested separately because only one of them needs a display:
+`tts.level_of`/`envelope` turn samples into a 0..1 loudness, and
+`PetWindow._mouth_frame` turns that loudness into a frame index. They meet at
+the `mouth` signal, which the pipeline smoke test covers end to end.
+"""
+
+import sys
+import time
+from pathlib import Path
+
+import numpy as np
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from bolt_pet.audio import tts
+
+
+def frame(amplitude: int, samples: int = 480) -> np.ndarray:
+    return np.full(samples, amplitude, dtype=np.int16)
+
+
+# ── loudness ────────────────────────────────────────────────────────────────
+
+def test_silence_closes_the_mouth():
+    assert tts.level_of(np.zeros(480, dtype=np.int16)) == 0.0
+
+
+def test_a_loud_frame_opens_it_fully():
+    assert tts.level_of(frame(30000)) == 1.0
+
+
+def test_the_level_never_leaves_zero_to_one():
+    """It indexes a frame list; out of range is an IndexError on the UI thread."""
+    for amplitude in (0, 1, 500, 6000, 20000, 32767):
+        assert 0.0 <= tts.level_of(frame(amplitude)) <= 1.0
+
+
+def test_it_rises_with_amplitude():
+    quiet, middling, loud = (tts.level_of(frame(a)) for a in (800, 4000, 12000))
+    assert quiet < middling < loud
+
+
+def test_quiet_speech_still_moves_the_mouth_visibly():
+    """The sqrt curve is the whole point. Speech spends most of its time well
+    below peak, so a linear map leaves the mouth barely open for normal talking
+    and the pet looks like it's mumbling."""
+    assert tts.level_of(frame(1500)) > 0.15
+
+
+def test_an_empty_frame_is_silence_not_a_crash():
+    assert tts.level_of(np.zeros(0, dtype=np.int16)) == 0.0
+
+
+# ── the envelope of a whole clip ────────────────────────────────────────────
+
+def test_an_envelope_has_one_value_per_frame_at_the_requested_rate():
+    one_second = np.zeros(16000, dtype=np.int16)
+    assert len(tts.envelope(one_second, 16000, fps=30)) == pytest.approx(30, abs=1)
+
+
+def test_an_envelope_tracks_loud_and_quiet_stretches():
+    pcm = np.concatenate([np.zeros(8000, dtype=np.int16), frame(20000, 8000)])
+    levels = tts.envelope(pcm, 16000, fps=10)
+    assert max(levels[:4]) == 0.0      # the silent half
+    assert min(levels[-4:]) > 0.5      # the loud half
+
+
+def test_an_empty_clip_has_an_empty_envelope():
+    assert tts.envelope(np.zeros(0, dtype=np.int16), 16000) == []
+
+
+# ── the drawn frame ─────────────────────────────────────────────────────────
+
+@pytest.fixture
+def window():
+    """Needs a QApplication; run with QT_QPA_PLATFORM=offscreen."""
+    from PySide6.QtWidgets import QApplication
+
+    from bolt_pet.ui.pet_window import PetWindow
+
+    _app = QApplication.instance() or QApplication(["test"])
+    win = PetWindow()
+    yield win
+    win.close()
+
+
+class FakeAnimation:
+    """Stands in for sprite.Animation — _mouth_frame only wants `.frames`."""
+
+    def __init__(self, frames):
+        self.frames = list(frames)
+
+
+def test_the_talking_frame_follows_the_level(window):
+    """The talking frames are an openness ramp — closed first, widest last —
+    specifically so loudness can index them directly."""
+    animation = FakeAnimation(["closed", "a", "b", "c", "d", "open"])
+
+    assert window._mouth_frame(animation) is None      # no level set yet
+
+    window.set_mouth(0.0)
+    assert window._mouth_frame(animation) == "closed"
+
+    window.set_mouth(1.0)
+    assert window._mouth_frame(animation) == "open"
+
+    window.set_mouth(0.5)
+    assert window._mouth_frame(animation) not in ("closed", "open")
+
+
+def test_a_stale_level_gives_the_animation_back(window):
+    """If the audio thread stops sending levels — TTS died, the clip ended
+    without a final zero — the mouth must not freeze half-open forever. After a
+    moment it falls back to the ordinary looping animation."""
+    animation = FakeAnimation(["a", "b", "c"])
+    window.set_mouth(0.9)
+    assert window._mouth_frame(animation) is not None
+
+    window._mouth_at = time.monotonic() - 5.0
+    assert window._mouth_frame(animation) is None
+
+
+def test_a_single_frame_animation_falls_back_instead_of_indexing(window):
+    """Art with one talking frame can't lip-sync; it must not try."""
+    window.set_mouth(1.0)
+    assert window._mouth_frame(FakeAnimation(["only"])) is None
+    assert window._mouth_frame(FakeAnimation([])) is None
+
+
+def test_no_animation_at_all_is_handled(window):
+    window.set_mouth(0.5)
+    assert window._mouth_frame(None) is None

tests/test_pet_actions.py

@@ -69,3 +69,17 @@ def test_describe_is_reported_back_to_the_server():
     assert "top-left" in pet_actions.describe({"action": "move", "anchor": "top-left"})
     assert "wave" in pet_actions.describe({"action": "emote", "emote": "wave"})
     assert pet_actions.describe({"action": "help"}) == pet_actions.HELP
+
+
+def test_voice_reset_parses_with_or_without_the_word_reset():
+    assert pet_actions.parse("petctl voice reset") == {"action": "voice", "voice": "default"}
+    assert pet_actions.parse("petctl voice default") == {"action": "voice", "voice": "default"}
+    assert pet_actions.parse("petctl voice") == {"action": "voice", "voice": "default"}
+
+
+def test_petctl_cannot_be_used_to_pick_a_voice():
+    """Choosing a voice is the server's job (speak_as) — it has the voice
+    library. petctl only ever undoes one, so an attempt to set a voice here
+    is pointed back at the marker that works."""
+    with pytest.raises(pet_actions.ActionError, match="speak_as"):
+        pet_actions.parse("petctl voice Terence")

tests/test_pipeline_smoke.py

@@ -0,0 +1,289 @@
+"""End-to-end: microphone in, speech out, over real HTTP.
+
+Every other test in this suite injects a fake at the seam it cares about, and
+every one of them passed all week while these got through to production:
+
+  - notifications sitting unspoken for minutes (a clock stamped in the wrong
+    order, two correct units)
+  - the pet saying the same thing twice (server discarded prose, model repeated
+    it — both sides behaving as written)
+  - `[laughing]` read out loud (a tag that means something to one model and
+    nothing to the next one down the pipe)
+  - a device command written as prose (extractor fine, prompt fine, no marker)
+
+They were all *interaction* bugs. So this one runs the actual pipeline against
+a real socket: a threaded HTTP server that speaks the desk protocol, the real
+`server_client` doing real requests (including NDJSON streaming), the real
+controller loop and state machine. The only fakes are where the hardware is —
+the mic stream and the speakers — because those are the two things a test
+genuinely cannot have.
+"""
+
+import json
+import sys
+import threading
+from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+
+import numpy as np
+import pytest
+from PySide6.QtWidgets import QApplication
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from bolt_pet import controller as controller_mod
+from bolt_pet.notifications import Notification
+from bolt_pet.state import PetState
+
+_app = QApplication.instance() or QApplication(["test"])
+
+
+# ── a desk server that actually listens on a port ───────────────────────────
+
+class FakeDesk:
+    """Scripted responses, real HTTP. Set `.script` per test."""
+
+    def __init__(self):
+        self.script = {}
+        self.requests = []
+        self._server = ThreadingHTTPServer(("127.0.0.1", 0), self._handler())
+        self._thread = threading.Thread(target=self._server.serve_forever, daemon=True)
+        self._thread.start()
+
+    @property
+    def url(self) -> str:
+        host, port = self._server.server_address[:2]
+        return f"http://{host}:{port}"
+
+    def stop(self) -> None:
+        self._server.shutdown()
+        self._server.server_close()
+
+    def _handler(self):
+        desk = self
+
+        class Handler(BaseHTTPRequestHandler):
+            def log_message(self, *_args):
+                pass  # the test output is not an access log
+
+            def do_GET(self):
+                path = self.path.split("?")[0]
+                desk.requests.append(("GET", path))
+                self._json(desk.script.get(path, {"files": []}))
+
+            def do_POST(self):
+                length = int(self.headers.get("Content-Length") or 0)
+                body = json.loads(self.rfile.read(length) or b"{}")
+                path = self.path.split("?")[0]
+                desk.requests.append(("POST", path, body))
+                response = desk.script.get(path)
+                if callable(response):
+                    response = response(body)
+                if path.endswith("converse_stream"):
+                    self._ndjson(response or [])
+                else:
+                    self._json(response if response is not None else {"type": "reply", "text": "ok"})
+
+            def _json(self, payload):
+                data = json.dumps(payload).encode()
+                self.send_response(200)
+                self.send_header("Content-Type", "application/json")
+                self.send_header("Content-Length", str(len(data)))
+                self.end_headers()
+                self.wfile.write(data)
+
+            def _ndjson(self, events):
+                self.send_response(200)
+                self.send_header("Content-Type", "application/x-ndjson")
+                self.end_headers()
+                for event in events:
+                    self.wfile.write((json.dumps(event) + "\n").encode())
+                    self.wfile.flush()
+
+        return Handler
+
+
+class FakeMic:
+    """Loud frames then quiet ones, so the VAD ends the utterance on its own."""
+
+    def __init__(self, loud=8, quiet=60):
+        self.frames = ([np.full((320, 1), 4000, dtype=np.int16)] * loud
+                       + [np.zeros((320, 1), dtype=np.int16)] * quiet)
+
+    def read(self, _n):
+        return (self.frames.pop(0) if self.frames
+                else np.zeros((320, 1), dtype=np.int16)), None
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *_a):
+        return False
+
+
+@pytest.fixture
+def pipeline(monkeypatch):
+    """A controller wired to a real local server, with fake ears and mouth."""
+    desk = FakeDesk()
+    spoken: list[str] = []
+    levels: list[float] = []
+
+    monkeypatch.setattr(controller_mod.config, "SERVER_URL", desk.url)
+    monkeypatch.setattr(controller_mod.config, "API_KEY", "test-key")
+    monkeypatch.setattr(controller_mod.config, "SESSION_ID", "pet-smoke")
+    monkeypatch.setattr(controller_mod.config, "SILENCE_END_SEC", 0.2)
+    monkeypatch.setattr(controller_mod.config, "MIN_UTTERANCE_S", 0.0)
+    monkeypatch.setattr(controller_mod.config, "RECEIVE_FILES", False)
+    # Off by default so each test picks its own path; the streaming tests opt in.
+    monkeypatch.setattr(controller_mod.config, "STREAMING_REPLIES", False)
+    monkeypatch.setattr(controller_mod.screen_context, "context_for", lambda text: text)
+    monkeypatch.setattr(controller_mod.screen_context, "is_fullscreen_active", lambda: False)
+    # Deepgram and the speakers are the two things a test can't have.
+    monkeypatch.setattr(controller_mod.stt, "transcribe", lambda pcm: "what's on my disk?")
+    monkeypatch.setattr(controller_mod.stt_stream.StreamingTranscriber, "open",
+                        classmethod(lambda cls, **kw: None))
+
+    def fake_speak(text, on_error=None, should_stop=None, voice_id=None, on_level=None):
+        spoken.append(text)
+        if on_level is not None:
+            on_level(0.8)   # the mouth opens while a word plays...
+            levels.append(0.8)
+        return True
+
+    monkeypatch.setattr(controller_mod.tts, "speak", fake_speak)
+
+    ctrl = controller_mod.PetController()
+    ctrl._stream = FakeMic()
+    try:
+        yield ctrl, desk, spoken, levels
+    finally:
+        desk.stop()
+
+
+# ── the whole path ──────────────────────────────────────────────────────────
+
+def test_a_plain_turn_goes_mic_to_speaker(pipeline):
+    ctrl, desk, spoken, _levels = pipeline
+    desk.script["/desk/converse"] = {"type": "reply", "text": "About sixty percent full."}
+
+    ctrl._handle_conversation_turn()
+
+    assert spoken == ["About sixty percent full."]
+    assert ctrl._state.state == PetState.IDLE
+    posted = [r for r in desk.requests if r[0] == "POST"]
+    assert posted[0][1] == "/desk/converse"
+    assert "what's on my disk?" in posted[0][2]["text"]
+    assert ctrl.history.entries()[-1].text == "About sixty percent full."
+
+
+def test_a_streamed_turn_speaks_each_sentence_as_it_lands(pipeline, monkeypatch):
+    """The NDJSON is parsed by the real client over a real socket — the layer
+    that a mocked `converse` can never exercise."""
+    ctrl, desk, spoken, _levels = pipeline
+    monkeypatch.setattr(controller_mod.config, "STREAMING_REPLIES", True)
+    desk.script["/desk/converse_stream"] = [
+        {"type": "say", "text": "The disk is fine."},
+        {"type": "say", "text": "About sixty percent used."},
+        {"type": "reply", "text": "The disk is fine. About sixty percent used.",
+         "already_spoken": True},
+    ]
+
+    ctrl._handle_conversation_turn()
+
+    assert spoken == ["The disk is fine.", "About sixty percent used."]
+    # The final reply must not be spoken a third time.
+    assert len(spoken) == 2
+
+
+def test_a_tool_turn_says_give_me_a_sec_then_the_answer(pipeline, monkeypatch):
+    """Holding line, relayed command, and the real answer — in that order."""
+    ctrl, desk, spoken, _levels = pipeline
+    ran = []
+    monkeypatch.setattr(controller_mod.server_client, "run_local_command",
+                        lambda cmd: ran.append(cmd) or "[exit 0]\n60% used")
+    desk.script["/desk/converse"] = {
+        "type": "command", "command": "df -h /", "token": "tok",
+        "say": "Let me check that for you.",
+    }
+    desk.script["/desk/tool_result"] = {"type": "reply", "text": "Sixty percent used."}
+
+    ctrl._handle_conversation_turn()
+
+    assert spoken == ["Let me check that for you.", "Sixty percent used."]
+    assert ran == ["df -h /"]
+    relayed = next(r for r in desk.requests if r[0] == "POST" and r[1] == "/desk/tool_result")
+    assert relayed[2]["output"].endswith("60% used")
+
+
+def test_a_device_command_never_reaches_the_shell(pipeline, monkeypatch):
+    ctrl, desk, spoken, _levels = pipeline
+    ran = []
+    monkeypatch.setattr(controller_mod.server_client, "run_local_command", lambda cmd: ran.append(cmd))
+    actions = []
+    ctrl.action.connect(actions.append)
+    desk.script["/desk/converse"] = {
+        "type": "command", "command": "petctl emote wave", "token": "tok"}
+    desk.script["/desk/tool_result"] = {"type": "reply", "text": "There you go."}
+
+    ctrl._handle_conversation_turn()
+
+    assert ran == []
+    assert actions == [{"action": "emote", "emote": "wave"}]
+    assert spoken == ["There you go."]
+
+
+def test_the_mouth_moves_with_the_audio(pipeline):
+    """Lip-sync is only real if the level actually reaches the window."""
+    ctrl, desk, _spoken, levels = pipeline
+    mouth = []
+    ctrl.mouth.connect(mouth.append)
+    desk.script["/desk/converse"] = {"type": "reply", "text": "Talking now."}
+
+    ctrl._handle_conversation_turn()
+
+    assert levels, "TTS was never given a level callback"
+    assert 0.8 in mouth              # opened while speaking...
+    assert mouth[-1] == 0.0          # ...and closed at the end
+
+
+def test_a_notification_is_forwarded_and_spoken(pipeline):
+    """The path that was silently sitting for five to ten minutes."""
+    ctrl, desk, spoken, _levels = pipeline
+    ctrl._notification_gate = controller_mod.notifications.NotificationGate("", 0)
+    desk.script["/desk/converse"] = {"type": "reply", "text": "Harry says he's around."}
+
+    ctrl._queue_notification(Notification(app="Signal", summary="Harry", body="you there?"))
+    ctrl._maybe_heartbeat()
+
+    assert spoken == ["Harry says he's around."]
+    forwarded = next(r for r in desk.requests if r[0] == "POST" and r[1] == "/desk/converse")
+    assert "Harry" in forwarded[2]["text"]
+
+
+def test_streaming_falls_back_when_the_server_is_older(pipeline, monkeypatch):
+    """A server without /desk/converse_stream (or one that answers with nothing)
+    must not cost a turn — the client drops to the plain endpoint. This is how
+    the pet keeps working against a container that hasn't been updated yet."""
+    ctrl, desk, spoken, _levels = pipeline
+    monkeypatch.setattr(controller_mod.config, "STREAMING_REPLIES", True)
+    desk.script["/desk/converse_stream"] = []          # nothing streamed back
+    desk.script["/desk/converse"] = {"type": "reply", "text": "Still here."}
+
+    ctrl._handle_conversation_turn()
+
+    assert spoken == ["Still here."]
+    paths = [r[1] for r in desk.requests if r[0] == "POST"]
+    assert paths == ["/desk/converse_stream", "/desk/converse"]
+
+
+def test_a_dead_server_leaves_the_pet_usable(pipeline):
+    """It should flash an error and go back to listening, not wedge."""
+    ctrl, desk, spoken, _levels = pipeline
+    desk.stop()   # the server disappears mid-session
+    states = []
+    ctrl.state_changed.connect(states.append)
+
+    ctrl._handle_conversation_turn()
+
+    assert states[-2:] == ["error", "idle"]
+    assert spoken == []

tests/test_self_restart.py

@@ -0,0 +1,158 @@
+"""`petctl self_restart` — the pet restarting itself and remembering why.
+
+Everything here runs against a temp context file and a fake subprocess runner,
+so the tests exercise the arming/preflight/report logic without any process
+actually dying.
+"""
+
+import subprocess
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from bolt_pet import pet_actions, self_restart
+
+
+@pytest.fixture
+def state(tmp_path):
+    return tmp_path / "restart_context.json"
+
+
+def _ok_run(*args, **kwargs):
+    return SimpleNamespace(returncode=0, stdout="", stderr="")
+
+
+def _broken_run(*args, **kwargs):
+    return SimpleNamespace(
+        returncode=1, stdout="",
+        stderr='  File "bolt_pet/controller.py", line 42\n    def _speak(\nSyntaxError: invalid syntax',
+    )
+
+
+# ── parsing ─────────────────────────────────────────────────────────────────
+
+def test_self_restart_parses_with_a_free_text_reason():
+    action = pet_actions.parse("petctl self_restart check the new walk cycle loads")
+    assert action == {
+        "action": "self_restart", "reason": "check the new walk cycle loads",
+    }
+
+
+def test_self_restart_needs_no_reason_and_accepts_aliases():
+    assert pet_actions.parse("petctl self_restart")["reason"] == ""
+    assert pet_actions.parse("petctl restart")["action"] == "self_restart"
+    assert pet_actions.parse("petctl reboot")["action"] == "self_restart"
+
+
+def test_self_restart_is_listed_in_the_help():
+    assert "self_restart" in pet_actions.HELP
+
+
+# ── preflight ───────────────────────────────────────────────────────────────
+
+def test_preflight_passes_when_the_code_imports():
+    self_restart.preflight(run=_ok_run)  # no exception
+
+
+def test_preflight_hands_back_the_traceback_instead_of_dying(state):
+    """The whole point: a syntax error Bolt just introduced comes back as
+    something he can read and fix, in the same turn, with the pet still up."""
+    with pytest.raises(self_restart.RestartError) as excinfo:
+        self_restart.preflight(run=_broken_run)
+    message = str(excinfo.value)
+    assert "does not import" in message
+    assert "SyntaxError" in message and "controller.py" in message
+
+
+def test_preflight_runs_the_import_in_a_subprocess_not_here():
+    """This process holds the *old* modules, so an in-process import would
+    pass on a file that no longer parses."""
+    seen = {}
+
+    def capture(cmd, **kwargs):
+        seen["cmd"], seen["kwargs"] = cmd, kwargs
+        return SimpleNamespace(returncode=0, stdout="", stderr="")
+
+    self_restart.preflight(run=capture)
+    assert seen["cmd"][0] == sys.executable
+    assert "import bolt_pet" in seen["cmd"][2]
+    assert seen["kwargs"]["env"]["QT_QPA_PLATFORM"] == "offscreen"  # imports need no display
+
+
+def test_a_subprocess_that_cannot_even_run_is_reported(monkeypatch):
+    def explode(*args, **kwargs):
+        raise OSError("no python here")
+
+    with pytest.raises(self_restart.RestartError, match="couldn't run the preflight"):
+        self_restart.preflight(run=explode)
+
+
+# ── context across the restart ──────────────────────────────────────────────
+
+def test_arming_persists_the_reason_for_the_next_process(state):
+    self_restart.arm("check the sprite frames load", version="0.2.3",
+                     session="pet-desktop", recent=["you: reload the sprites"],
+                     path=state, now=1000.0)
+    revived = self_restart.load(state)
+    assert revived.reason == "check the sprite frames load"
+    assert revived.version == "0.2.3"
+    assert revived.recent == ["you: reload the sprites"]
+    assert revived.restarts == [1000.0]
+
+
+def test_no_context_means_a_normal_start(state):
+    assert self_restart.load(state) is None
+
+
+def test_a_corrupt_context_file_is_ignored_not_fatal(state):
+    state.write_text("{not json at all", encoding="utf-8")
+    assert self_restart.load(state) is None
+
+
+def test_clearing_the_context_stops_it_being_re_announced(state):
+    self_restart.arm("once", path=state, now=1000.0)
+    self_restart.clear(state)
+    assert self_restart.load(state) is None
+    self_restart.clear(state)  # clearing twice is not an error
+
+
+def test_the_report_says_what_happened_and_what_to_check(state):
+    context = self_restart.arm(
+        "verify the dialogue command works", verify="verify the dialogue command works",
+        version="0.2.3", recent=["you: try a scene"], path=state, now=1000.0,
+    )
+    text = self_restart.report(context, version="0.2.4", now=1004.5)
+    assert "I restarted myself" in text
+    assert "verify the dialogue command works" in text
+    assert "4.5s" in text
+    assert "0.2.4" in text and "was 0.2.3" in text
+    assert "you: try a scene" in text
+
+
+# ── loop guard ──────────────────────────────────────────────────────────────
+
+def test_restart_history_accumulates_across_restarts(state):
+    self_restart.arm("one", path=state, now=1000.0)
+    self_restart.arm("two", path=state, now=1100.0)
+    assert self_restart.load(state).restarts == [1000.0, 1100.0]
+
+
+def test_too_many_restarts_in_the_window_is_refused(state):
+    now = 1000.0
+    for index in range(self_restart.MAX_RESTARTS):
+        self_restart.arm(f"attempt {index}", path=state, now=now + index)
+    with pytest.raises(self_restart.RestartError, match="looping"):
+        self_restart.check_loop_guard(self_restart.load(state), now=now + 10)
+
+
+def test_old_restarts_fall_out_of_the_window(state):
+    now = 1000.0
+    for index in range(self_restart.MAX_RESTARTS):
+        self_restart.arm(f"attempt {index}", path=state, now=now + index)
+    later = now + self_restart.WINDOW_SECONDS + 60
+    self_restart.check_loop_guard(self_restart.load(state), now=later)  # no exception
+    assert self_restart.recent_restarts(self_restart.load(state), now=later) == []

tests/test_server_client.py

@@ -27,7 +27,8 @@ def test_converse_returns_reply_directly():
     with patch.object(server_client.requests, "post") as post:
         post.return_value = _mock_response({"type": "reply", "text": "hello there"})
         result = server_client.converse("hi")
-    assert result == "hello there"
+    assert result.text == "hello there"
+    assert result.voice_id == ""  # no speak_as on this reply
     post.assert_called_once()
     args, kwargs = post.call_args
     assert args[0] == "http://test-server:5002/desk/converse"
@@ -43,7 +44,7 @@ def test_converse_relays_a_command_then_returns_reply():
     with patch.object(server_client.requests, "post", side_effect=responses) as post:
         on_command = MagicMock(return_value="[exit 0]\nhi")
         result = server_client.converse("run echo hi", on_command=on_command)
-    assert result == "done"
+    assert result.text == "done"
     on_command.assert_called_once_with("echo hi")
     # second call was to /desk/tool_result with the command's output
     second_call = post.call_args_list[1]
@@ -53,6 +54,19 @@ def test_converse_relays_a_command_then_returns_reply():
     }
 
 
+def test_converse_carries_a_speak_as_voice_back_with_the_reply():
+    """The server tags a reply with the voice it picked (speak_as); this
+    client is what actually speaks in it, so the id has to survive the
+    return trip rather than being dropped with the rest of the payload."""
+    with patch.object(server_client.requests, "post") as post:
+        post.return_value = _mock_response({
+            "type": "reply", "text": "Ahoy there.",
+            "voice_id": "hnhGxwvHP8fc469w51rM", "voice_name": "Terence",
+        })
+        result = server_client.converse("talk like a pirate")
+    assert result == server_client.Reply("Ahoy there.", "hnhGxwvHP8fc469w51rM", "Terence")
+
+
 def test_converse_raises_server_error_on_error_payload():
     with patch.object(server_client.requests, "post") as post:
         post.return_value = _mock_response({"type": "error", "error": "unauthorized"})

tests/test_speech.py

@@ -0,0 +1,260 @@
+"""The rules about talking — the four kinds of utterance and the mic policy.
+
+These were four near-copies in the controller before, and the copies had
+drifted: one didn't arm barge-in, one skipped the follow-up rule. The value of
+having one `Speaker` is only real if the differences between the kinds stay
+*visible*, so this asserts on the differences rather than on the machinery.
+"""
+
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from bolt_pet import config, speech
+from bolt_pet.speech import Speaker, Utterance
+from bolt_pet.state import PetState, PetStateMachine
+
+
+class FakeTts:
+    def __init__(self, completed=True):
+        self.completed = completed
+        self.calls = []
+
+    def speak(self, text, on_error=None, should_stop=None, voice_id=None, on_level=None):
+        self.calls.append({"text": text, "voice_id": voice_id,
+                           "interruptible": should_stop is not None})
+        if on_level is not None:
+            on_level(0.7)
+        return self.completed
+
+    def play_pcm(self, pcm, sample_rate, should_stop=None, on_level=None):
+        self.calls.append({"pcm": pcm, "rate": sample_rate,
+                           "interruptible": should_stop is not None})
+        return self.completed
+
+
+class FakeBargeIn:
+    def __init__(self):
+        self.resets = 0
+
+    def reset(self):
+        self.resets += 1
+
+    def check(self, _frame=None):
+        return False
+
+
+def build(**kwargs):
+    """A speaker plus the things worth asserting on."""
+    state = PetStateMachine()
+    tts = kwargs.pop("tts", None) or FakeTts()
+    said, logged, recorded, levels = [], [], [], []
+    speaker = Speaker(
+        state=state, tts=tts,
+        history=recorded.append,
+        on_said=said.append,
+        on_log=logged.append,
+        on_level=levels.append,
+        **kwargs,
+    )
+    return speaker, state, tts, said, logged, recorded, levels
+
+
+# ── what distinguishes the four kinds ───────────────────────────────────────
+
+def test_a_reply_is_recorded_but_a_holding_line_is_not():
+    """Filler must not push the actual answer out of the transcript."""
+    speaker, state, _tts, _said, _logged, recorded, _levels = build()
+    state.transition(PetState.LISTENING)
+    state.transition(PetState.THINKING)
+
+    speaker.say(Utterance.holding("Give me a sec."))
+    speaker.say(Utterance.reply("Sixty percent used."))
+
+    assert recorded == ["Sixty percent used."]
+
+
+def test_a_holding_line_resumes_the_turn_it_interrupted():
+    """The turn isn't over — a tool is still running — so it must go back to
+    THINKING, not drop to IDLE and end the turn."""
+    speaker, state, _tts, *_ = build()
+    state.transition(PetState.LISTENING)
+    state.transition(PetState.THINKING)
+
+    speaker.say(Utterance.holding("Let me check."))
+
+    assert state.state == PetState.THINKING
+
+
+def test_a_holding_line_cannot_be_talked_over():
+    """Cutting off "give me a sec" strands the tool that's already running."""
+    detector = FakeBargeIn()
+    speaker, state, tts, *_ = build(barge_in=lambda: detector)
+    state.transition(PetState.LISTENING)
+    state.transition(PetState.THINKING)
+
+    speaker.say(Utterance.holding("One sec."))
+    assert tts.calls[-1]["interruptible"] is False
+
+    speaker.say(Utterance.reply("Done."))
+    assert tts.calls[-1]["interruptible"] is True
+
+
+def test_a_streamed_sentence_stays_talking_between_sentences():
+    """Otherwise the sprite flickers idle-talking-idle down a long answer."""
+    speaker, state, *_ = build()
+    state.transition(PetState.LISTENING)
+    state.transition(PetState.THINKING)
+
+    speaker.say(Utterance.stream_chunk("The disk is fine."))
+
+    assert state.state == PetState.TALKING
+
+
+def test_a_scene_is_recorded_because_the_user_heard_it():
+    speaker, state, _tts, _said, _logged, recorded, _levels = build()
+    state.transition(PetState.LISTENING)
+    state.transition(PetState.THINKING)
+
+    speaker.say_pcm(Utterance.scene("Once upon a time."), pcm=b"\x00\x00", sample_rate=44100)
+
+    assert recorded == ["Once upon a time."]
+    assert state.state == PetState.THINKING
+
+
+# ── barge-in ordering, which is what the copies got wrong ───────────────────
+
+def test_the_detector_is_reset_after_playback_not_only_before():
+    """Playback fed the pet's own voice into the wake model's window. If it
+    isn't cleared afterwards, the idle listener re-hears the last sentence and
+    the pet answers itself."""
+    detector = FakeBargeIn()
+    speaker, state, *_ = build(barge_in=lambda: detector)
+    state.transition(PetState.LISTENING)
+    state.transition(PetState.THINKING)
+
+    speaker.say(Utterance.reply("Hello there."))
+
+    assert detector.resets == 2  # armed before, cleared after
+
+
+def test_the_barge_in_detail_is_captured_before_the_reset():
+    """Read it after the reset and every interruption reports zeroed counters —
+    which reads like hard evidence and is nothing of the sort."""
+    detector = FakeBargeIn()
+    details = ["score 0.81 at frame 12", "score 0.000 at frame 0"]
+    speaker, state, *_ = build(barge_in=lambda: detector,
+                               detail_of=lambda: details.pop(0))
+    state.transition(PetState.LISTENING)
+    state.transition(PetState.THINKING)
+
+    speaker.say(Utterance.reply("Hello there."))
+
+    assert speaker.last_detail == "score 0.81 at frame 12"
+
+
+def test_a_detector_that_appears_late_is_still_used():
+    """The detector is built after the speaker — it needs the mic stream — so
+    it's read through a callable. Holding a copy is how the two drift apart."""
+    detector = None
+    speaker, state, tts, *_ = build(barge_in=lambda: detector)
+    state.transition(PetState.LISTENING)
+    state.transition(PetState.THINKING)
+
+    speaker.say(Utterance.reply("Before."))
+    assert tts.calls[-1]["interruptible"] is False
+
+    detector = FakeBargeIn()
+    speaker.say(Utterance.reply("After."))
+    assert tts.calls[-1]["interruptible"] is True
+
+
+# ── the mouth ───────────────────────────────────────────────────────────────
+
+def test_the_mouth_is_closed_when_the_line_ends():
+    """A pet left mid-vowel after the audio stops looks broken."""
+    speaker, state, _tts, _said, _logged, _recorded, levels = build()
+    state.transition(PetState.LISTENING)
+    state.transition(PetState.THINKING)
+
+    speaker.say(Utterance.reply("Talking."))
+
+    assert levels[0] > 0
+    assert levels[-1] == 0.0
+
+
+# ── text handling ───────────────────────────────────────────────────────────
+
+def test_an_empty_line_is_not_spoken_at_all():
+    """A reply that is nothing but an audio tag reduces to '' — and a silent
+    bubble with no audio is better than the pet announcing "laughing"."""
+    speaker, state, tts, said, *_ = build()
+
+    assert speaker.say(Utterance.reply("[laughing]")) is True
+    assert tts.calls == []
+    assert said == []
+    assert state.state == PetState.IDLE
+
+
+def test_the_bubble_gets_display_text_and_tts_gets_the_original():
+    """The bubble keeps emoji and drops markdown; TTS does its own stripping
+    (inside speak(), so every path is covered) and needs the real text."""
+    speaker, state, tts, said, *_ = build()
+    state.transition(PetState.LISTENING)
+    state.transition(PetState.THINKING)
+
+    speaker.say(Utterance.reply("**Sixty** percent 🎉"))
+
+    assert said == ["Sixty percent 🎉"]
+    assert tts.calls[-1]["text"] == "**Sixty** percent 🎉"
+
+
+def test_a_voice_override_reaches_tts():
+    speaker, state, tts, *_ = build(voice_id=lambda: "voice-abc")
+    state.transition(PetState.LISTENING)
+    state.transition(PetState.THINKING)
+
+    speaker.say(Utterance.reply("In character."))
+
+    assert tts.calls[-1]["voice_id"] == "voice-abc"
+
+
+# ── the follow-up rule ──────────────────────────────────────────────────────
+
+@pytest.fixture
+def follow_ups_on(monkeypatch):
+    monkeypatch.setattr(config, "FOLLOW_UP_LISTEN", True)
+    monkeypatch.setattr(config, "FOLLOW_UP_MAX_TURNS", 3)
+
+
+def test_an_interruption_always_reopens_the_mic(follow_ups_on):
+    """You talked over it — you are mid-sentence, so it has to listen."""
+    keep, why = speech.follow_up_decision("Anything else?", completed=False, follow_ups=99)
+    assert keep is True
+    assert why == "interrupted"
+
+
+def test_a_question_keeps_the_mic_open_without_the_wake_word(follow_ups_on):
+    keep, why = speech.follow_up_decision("Want me to check?", completed=True, follow_ups=0)
+    assert (keep, why) == (True, "question")
+
+
+def test_a_statement_ends_the_turn(follow_ups_on):
+    keep, _why = speech.follow_up_decision("Sixty percent used.", completed=True, follow_ups=0)
+    assert keep is False
+
+
+def test_the_cap_stops_a_server_that_ends_every_reply_with_a_question(follow_ups_on):
+    """Otherwise mic noise loops it forever."""
+    assert speech.follow_up_decision("Ok?", completed=True, follow_ups=2)[0] is True
+    keep, why = speech.follow_up_decision("Ok?", completed=True, follow_ups=3)
+    assert keep is False
+    assert "cap" in why
+
+
+def test_the_rule_can_be_switched_off(monkeypatch):
+    monkeypatch.setattr(config, "FOLLOW_UP_LISTEN", False)
+    assert speech.follow_up_decision("Ok?", completed=True, follow_ups=0)[0] is False

tests/test_speech_text.py

@@ -4,6 +4,8 @@
 import sys
 from pathlib import Path
 
+import pytest
+
 sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
 
 from bolt_pet.speech_text import for_display, for_speech, is_question
@@ -77,3 +79,33 @@ def test_is_question_ignores_question_marks_that_are_not_spoken():
     assert not is_question("Docs are at https://example.com/x?y=1")
     assert not is_question("")
     assert not is_question(None)
+
+
+# ── ElevenLabs v3 delivery tags (observed live 2026-07-31) ──────────────────
+# "[laughing] That one came through clean" was spoken as "laughing That one
+# came through clean": the tags mean something to the dialogue model inside a
+# dialoguectl scene, and nothing at all to the ordinary reply voice.
+
+def test_delivery_tags_are_never_spoken_aloud():
+    spoken = for_speech("[laughing] That one came through clean.")
+    assert "laughing" not in spoken
+    assert spoken.startswith("That one came through clean")
+
+
+def test_the_bubble_does_not_caption_a_laugh_nobody_heard():
+    assert "[laughing]" not in for_display("[laughing] All good.")
+
+
+@pytest.mark.parametrize("tag", [
+    "[whispering]", "[cheerfully]", "[sighs]", "[laughs]", "[clears throat]",
+    "[nervously]", "[excited]", "[pause]", "[shouting]",
+])
+def test_the_common_tags_are_all_covered(tag):
+    assert "" == for_speech(tag).strip()
+
+
+def test_ordinary_bracketed_text_survives():
+    """The tags are matched narrowly on purpose — real bracketed content is
+    part of what the user asked to hear."""
+    assert "1" in for_speech("See reference [1] for details.")
+    assert "docs" in for_speech("It's in [the docs] somewhere.")

tests/test_stt_stream.py

@@ -0,0 +1,173 @@
+"""Streaming speech-to-text: the protocol, and the fallback that makes it safe
+to switch on at all.
+
+A fake websocket throughout — no network, no Deepgram account, no audio.
+"""
+
+import json
+import sys
+import time
+from pathlib import Path
+
+import numpy as np
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from bolt_pet.audio import mic
+from bolt_pet.audio.stt_stream import StreamingTranscriber
+
+
+class FakeSocket:
+    """Records what was sent; replays scripted Deepgram frames."""
+
+    def __init__(self, messages=(), fail_on_send=False):
+        self.sent = []
+        self.closed = False
+        self.fail_on_send = fail_on_send
+        self._messages = list(messages)
+
+    def send_binary(self, data):
+        if self.fail_on_send:
+            raise ConnectionError("socket died")
+        self.sent.append(data)
+
+    def send(self, text):
+        self.sent.append(text)
+
+    def recv(self):
+        if self._messages:
+            return self._messages.pop(0)
+        time.sleep(0.01)
+        raise ConnectionError("closed")
+
+    def close(self):
+        self.closed = True
+
+
+def _results(transcript, is_final=True):
+    return json.dumps({
+        "type": "Results", "is_final": is_final,
+        "channel": {"alternatives": [{"transcript": transcript}]},
+    })
+
+
+def _frame(value=1000):
+    return np.full(320, value, dtype=np.int16)
+
+
+# ── the protocol ────────────────────────────────────────────────────────────
+
+def test_frames_go_up_as_they_are_captured():
+    socket = FakeSocket([_results("what's the weather")])
+    session = StreamingTranscriber(socket)
+
+    for _ in range(3):
+        session.feed(_frame())
+    text = session.finish()
+
+    assert len(socket.sent) == 4          # three frames plus the close message
+    assert text == "what's the weather"
+    assert socket.closed
+
+
+def test_only_final_results_are_kept():
+    """Interim hypotheses change under you; concatenating them would produce
+    "what what's what's the what's the weather"."""
+    socket = FakeSocket([
+        _results("what's", is_final=False),
+        _results("what's the", is_final=False),
+        _results("what's the weather", is_final=True),
+    ])
+    session = StreamingTranscriber(socket)
+    assert session.finish() == "what's the weather"
+
+
+def test_several_final_segments_are_joined():
+    socket = FakeSocket([_results("turn the lights on"), _results("in the kitchen")])
+    session = StreamingTranscriber(socket)
+    assert session.finish() == "turn the lights on in the kitchen"
+
+
+def test_junk_frames_are_ignored_rather_than_killing_the_reader():
+    """An exception on the reader thread would silently end transcription for
+    the rest of the utterance."""
+    socket = FakeSocket(["not json at all", '{"type":"Metadata"}',
+                         _results("still works")])
+    session = StreamingTranscriber(socket)
+    assert session.finish() == "still works"
+
+
+def test_an_empty_frame_means_the_socket_closed():
+    """websocket-client returns "" from recv() on a closed connection, so it
+    ends the read loop rather than being treated as a blank transcript."""
+    socket = FakeSocket([_results("heard this much"), "", _results("never arrives")])
+    session = StreamingTranscriber(socket)
+    assert session.finish() == "heard this much"
+
+
+def test_a_socket_that_dies_mid_utterance_gives_up_quietly():
+    socket = FakeSocket([], fail_on_send=True)
+    session = StreamingTranscriber(socket)
+
+    session.feed(_frame())      # must not raise — recording carries on
+    assert session.finish() == ""
+
+
+# ── opening: failure is an ordinary outcome ────────────────────────────────
+
+def test_open_returns_none_when_it_cannot_connect():
+    """None means "the one-shot path will do it", not an error."""
+    def refuse():
+        raise OSError("no network")
+
+    assert StreamingTranscriber.open(connect=refuse) is None
+
+
+def test_open_returns_a_session_when_it_can():
+    session = StreamingTranscriber.open(connect=lambda: FakeSocket([_results("hi")]))
+    assert session is not None
+    assert session.finish() == "hi"
+
+
+def test_streaming_is_off_without_the_switch_or_a_key(monkeypatch):
+    from bolt_pet.audio import stt_stream
+
+    monkeypatch.setattr(stt_stream.config, "STT_STREAMING", False)
+    assert stt_stream.available() is False
+    monkeypatch.setattr(stt_stream.config, "STT_STREAMING", True)
+    monkeypatch.setattr(stt_stream.config, "DEEPGRAM_API_KEY", "")
+    assert stt_stream.available() is False
+
+
+# ── the capture hook ────────────────────────────────────────────────────────
+
+class _Stream:
+    """Loud frames, then quiet ones, so the VAD ends the utterance."""
+
+    def __init__(self, loud=6, quiet=40):
+        self.frames = ([np.full((320, 1), 3000, dtype=np.int16)] * loud
+                       + [np.zeros((320, 1), dtype=np.int16)] * quiet)
+
+    def read(self, n):
+        return (self.frames.pop(0) if self.frames
+                else np.zeros((320, 1), dtype=np.int16)), None
+
+
+def test_recording_hands_every_speech_frame_to_the_listener():
+    seen = []
+    pcm = mic.record_utterance(_Stream(), on_frame=seen.append,
+                               silence_end_sec=0.2, min_utterance_s=0.0)
+    assert pcm is not None
+    assert len(seen) >= 6            # every frame of speech was streamed
+
+
+def test_a_listener_that_throws_cannot_break_the_recording():
+    """The fallback is about to need this audio — a dead stream must not cost
+    the recording too."""
+    def explode(frame):
+        raise RuntimeError("stream died")
+
+    pcm = mic.record_utterance(_Stream(), on_frame=explode,
+                               silence_end_sec=0.2, min_utterance_s=0.0)
+    assert pcm is not None and len(pcm) > 0

tests/test_tts_stream.py

@@ -8,7 +8,8 @@ import numpy as np
 
 sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
 
-from bolt_pet.audio.tts import chunks_to_int16
+from bolt_pet import config as tts_config
+from bolt_pet.audio.tts import chunks_to_int16, model_for, voice_for
 from bolt_pet.audio.wake_word import NearMissLog
 
 
@@ -80,3 +81,27 @@ def test_clear_resets_peak_and_entries():
     log.observe(0.45, threshold=0.5, timestamp=1.0)
     log.clear()
     assert log.entries() == [] and log.peak == 0.0
+
+
+# ── voice / model selection (server speak_as) ───────────────────────────────
+
+def test_the_override_voice_wins_over_the_configured_one(monkeypatch):
+    monkeypatch.setattr(tts_config, "ELEVENLABS_VOICE_ID", "DEFAULT")
+    assert voice_for("VOICE1") == "VOICE1"
+    assert voice_for("") == "DEFAULT"
+    assert voice_for(None) == "DEFAULT"
+
+
+def test_english_replies_in_the_default_voice_use_the_default_model(monkeypatch):
+    monkeypatch.setattr(tts_config, "ELEVENLABS_MODEL_ID", "eleven_flash_v2")
+    monkeypatch.setattr(tts_config, "ELEVENLABS_MULTILINGUAL_MODEL_ID", "eleven_flash_v2_5")
+    assert model_for("all good here", None) == "eleven_flash_v2"
+
+
+def test_a_picked_voice_or_non_english_text_uses_the_multilingual_model(monkeypatch):
+    # eleven_flash_v2 is English-only: it would read either of these as
+    # mangled phonetic English rather than failing outright.
+    monkeypatch.setattr(tts_config, "ELEVENLABS_MODEL_ID", "eleven_flash_v2")
+    monkeypatch.setattr(tts_config, "ELEVENLABS_MULTILINGUAL_MODEL_ID", "eleven_flash_v2_5")
+    assert model_for("all good here", "VOICE1") == "eleven_flash_v2_5"
+    assert model_for("こんにちは", None) == "eleven_flash_v2_5"

tests/test_window_state.py

@@ -0,0 +1,84 @@
+"""Remembering where the pet was left — and refusing to when that's a trap."""
+
+import json
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from bolt_pet import window_state
+
+
+def test_a_saved_position_comes_back(tmp_path):
+    path = tmp_path / "window.json"
+    window_state.save(1200, 640, path)
+    assert window_state.load(path) == (1200, 640)
+
+
+def test_no_file_yet_is_not_an_error(tmp_path):
+    assert window_state.load(tmp_path / "nope.json") is None
+
+
+def test_a_corrupt_file_falls_back_to_the_default_corner(tmp_path):
+    """Whatever is in there, the pet still has to start."""
+    path = tmp_path / "window.json"
+    for junk in ("", "{", "null", "[]", '{"x": "left"}', '{"y": 3}'):
+        path.write_text(junk)
+        assert window_state.load(path) is None
+
+
+def test_saving_creates_the_cache_directory(tmp_path):
+    path = tmp_path / "deep" / "nested" / "window.json"
+    window_state.save(10, 20, path)
+    assert window_state.load(path) == (10, 20)
+
+
+def test_an_unwritable_location_is_swallowed(tmp_path):
+    """A read-only cache dir is a reason to forget the position, not to crash
+    on every drag."""
+    window_state.save(1, 2, tmp_path / "no" / "\0bad" / "window.json")
+
+
+def test_the_write_is_atomic_and_leaves_no_litter(tmp_path):
+    path = tmp_path / "window.json"
+    window_state.save(5, 5, path)
+    window_state.save(7, 7, path)
+    assert json.loads(path.read_text()) == {"x": 7, "y": 7}
+    assert [p.name for p in tmp_path.iterdir()] == ["window.json"]
+
+
+# ── validating against the screens that exist *now* ─────────────────────────
+
+LAPTOP = (0, 0, 1920, 1080)
+EXTERNAL = (1920, 0, 4480, 1440)
+
+
+def test_a_position_on_a_connected_screen_is_kept():
+    assert window_state.is_visible_on(1700, 900, 128, [LAPTOP])
+
+
+def test_a_position_on_an_unplugged_monitor_is_refused():
+    """The dangerous case: restoring it faithfully puts the pet somewhere you
+    can't see or reach."""
+    assert not window_state.is_visible_on(3000, 700, 128, [LAPTOP])
+    assert window_state.is_visible_on(3000, 700, 128, [LAPTOP, EXTERNAL])
+
+
+def test_mostly_off_screen_counts_as_gone():
+    """A few pixels of ear poking onto the desktop is not "reachable"."""
+    assert not window_state.is_visible_on(1910, 500, 128, [LAPTOP])
+    assert window_state.is_visible_on(1830, 500, 128, [LAPTOP])
+
+
+def test_touching_an_edge_is_not_overlapping():
+    assert not window_state.is_visible_on(1920, 0, 128, [LAPTOP])
+
+
+def test_negative_coordinates_are_fine_when_a_screen_is_there():
+    """Monitors left of or above the primary have negative origins."""
+    left_of_primary = (-1920, 0, 0, 1080)
+    assert window_state.is_visible_on(-900, 400, 128, [left_of_primary, LAPTOP])
+
+
+def test_no_screens_at_all_is_not_visible():
+    assert not window_state.is_visible_on(100, 100, 128, [])