fix: heid-code-review fixups — donut voiced-interview slices 2+3

Triaged the heid-code-review panel (3 arms; reconciled against 56dce00 — three
findings already closed by the bug-hunt, and the two firewalled lenses converged
independently on the same three defects). Fixed the real one + contract precision.

Code:
- kb_bridge: no-hit sentinel (F7, the sharpest solo). The consult prompt asks Mimir
  to emit NO_CORPUS_MATCH when nothing is relevant; pin_kb_context drops any extract
  containing it -> [], so a non-empty "no results found" answer is never pinned as the
  character's own memory. Live-proven: a grounding query pins (5.6s), a nonsense query
  -> [] (0.7s); the sentinel is artificial so `in` can't false-positive on a passage.

Contract (the CODE is correct; the spec had drifted/undercounted — kept canonical):
- DEC-8: the custom "donut" voice was registered EARLY (verified live), so mapping
  ratatoskr:donut -> "donut" is right; "preset now" was stale. A live gateway read
  INVERTED the 3-arm remedy (reverting to a preset would have been the regression).
- FN tts_synthesize: declared the `url` swap-seam param (F3); voice membership is
  gateway-enforced not client-asserted (F2); the postcondition is a container-level
  RIFF/WAVE check, not a 16-bit-PCM fmt parse.
- FN tts_endpoint: pad is BROWSER-SENT per DEC-7, not a server PAD lookup (F5);
  documented the 413 text cap.
- FN pin_kb_context: documented the sentinel + the session-delete hygiene.

Tests (real coverage gaps):
- the read_note prompt test asserts the distinguishing "do NOT call read_note" phrase,
  not the bare token an inverted prompt would also carry (#8 mutation-blind).
- extract-bound asserts the literal 2000, not the impl constant it slices by (#9).
- route roster asserts /api/tts + /api/sessions/{id}/messages (#10 undercount).
- new server test: a degraded KB consult ([]) still streams the turn to done (F9).

Accepted (not fixed): caller-supplied agent_id (LAN/no-auth debug-tool trust model);
no DEC-5 concurrency test (asyncio.Lock is trivially correct — a test would test
asyncio, not our code). 545 green.

docs/contracts/donut_voiced_interview.contract.md

@@ -76,10 +76,14 @@ each independently shippable. Slice order is chosen for fastest visible result.
   `affect_update` SSE the console already consumes) → Zonos `emotion_valence`
   (pleasure) + `emotion_arousal` (arousal). This reframes the feature as voice
   OBSERVABILITY (hear the affect the persona pane shows), not chat-app TTS.
-- **DEC-8 — voice: preset now, custom later.** Donut starts on a theatrical
-  Zonos preset (of the 8; pick expressive — Miranda/Penny/Emmie). A custom
-  "donut" voice registers server-side via infra-ops later; adoption is a single
-  `voice:` string swap — no code change.
+- **DEC-8 — voice: custom "donut" is REGISTERED (superseded the preset-first plan).**
+  The original plan was a theatrical Zonos preset first (Miranda/Penny/Emmie), custom
+  "donut" later. But infra-ops registered + verified the custom `voice:"donut"` before
+  slice-2 build (GET /v1/voices returns Donut; case-folded), so `_TTS_VOICE_MAP` maps
+  `ratatoskr:donut → "donut"` directly — no interim preset. Non-interview agents still
+  fall to the gateway default (Cora). (Amended 2026-08-02 per heid-code-review: 3 arms
+  flagged the code as DEC-8 drift; a live gateway read INVERTED the remedy — the code is
+  correct, DEC-8's "preset now" was stale.)
 
 ## Invariants
 
@@ -110,11 +114,17 @@ each independently shippable. Slice order is chosen for fastest visible result.
 
 ### FN tts_synthesize
 ```
-tts_synthesize(text: str, *, voice: str, dials: EmotionDials, client: httpx.AsyncClient) -> bytes
+tts_synthesize(text: str, *, voice: str, dials: EmotionDials, client: httpx.AsyncClient, url=ZONOS_TTS_URL) -> bytes
   # POST {input:text, voice, response_format:"wav", **dials} to the Zonos gateway; return wav bytes.
-  precondition: text non-empty; voice in the gateway's /v1/voices set.
-  postcondition: returns 16-bit RIFF/WAVE bytes.
-  error: gateway non-200 / transport failure -> TtsUnavailable (caller degrades per INV-TTS-4).
+  # `url` (added — heid-code-review F3) is the swap seam (DEC-1): the endpoint passes app.state.tts_url;
+  # tests pass a respx-mocked URL. Defaults to ZONOS_TTS_URL so the parameter is inert for the common call.
+  precondition: text non-empty. Voice membership in /v1/voices is GATEWAY-enforced, not client-asserted
+                (an unknown voice surfaces as a gateway non-200 -> TtsUnavailable) — the contract + bundle
+                carry no local voice catalog, so a client-side check would fork a source of truth.
+  postcondition: returns a RIFF/WAVE container (magic 0:4 == "RIFF" AND form 8:12 == "WAVE"). The DEC-3
+                 guard is operational ("is this wav, not HTML / mislabeled-PCM"), NOT a full 16-bit-PCM
+                 fmt-chunk parse (heid-code-review: "16-bit" is aspirational; the guard is container-level).
+  error: gateway non-200 / transport failure / non-WAVE body -> TtsUnavailable (caller degrades per INV-TTS-4).
   invariant: response_format is ALWAYS "wav" (DEC-3); never mp3/opus.
 ```
 
@@ -131,9 +141,13 @@ pad_to_dials(pad: PadState | None) -> EmotionDials
 
 ### FN tts_endpoint  (server.py, /api/tts)
 ```
-POST /api/tts  {text, agent_id?}  -> audio/wav
+POST /api/tts  {text, agent_id?, pad?}  -> audio/wav
   steps:
-    - resolve voice (per-character map -> preset; default Cora) + dials (pad_to_dials of the agent's current PAD if known).
+    - resolve voice (per-character map -> "donut"; default Cora; a non-str agent_id coerces to None).
+    - dials = pad_to_dials(PadState.from_obj(pad)) — the PAD is BROWSER-SENT in the request body (per DEC-7:
+      the console already holds live PAD from the affect_update SSE), NOT a server-side PAD lookup. (Clarified
+      per heid-code-review F5 — the original "the agent's current PAD if known" wording read as a server fetch.)
+    - reject text over the max-char budget with 413 (bug-hunt: bound before the lock); missing/non-str text -> 400.
     - tts_synthesize(...) behind the serialize guard (DEC-5); return wav with Content-Type audio/wav.
     - on TtsUnavailable -> 503 controlled envelope (client skips playback, INV-TTS-4).
 ```
@@ -149,6 +163,12 @@ pin_kb_context(question: str, agent_id: str | None, *, client) -> list[dict]   #
     - return [{"kind":"corpus_reference","text":<extract>}].
   error/empty/timeout: any failure or no hits -> [] (INV-KB-3; never raises to the turn path).
                        CancelledError (browser disconnect) is NOT caught — it propagates.
+  no-hit sentinel (heid-code-review F7): the consult prompt asks Mimir to emit exactly NO_CORPUS_MATCH
+                       when the search finds nothing relevant; pin_kb_context drops any extract containing
+                       it -> [], so a non-empty "no results found" answer is never pinned as the character's
+                       own memory. The token is artificial (no genuine passage contains it).
+  session hygiene (heid-bug-hunt): the throwaway Mimir consult session is deleted (SDK sessions.delete) on
+                       success/error/timeout via a caller-owned holder, so consults don't accumulate upstream.
   CONSULT PROMPT (foot-gun mitigation, tuned live 2026-08-02): force "search_library EXACTLY ONCE,
     no read_note" — converges Mimir in ~3-15s. The softer "do one search" phrasing let Mimir loop
     read_note<->search past a 25s ceiling on conversational (non-keyword) questions (live-observed).