Tonnodoubt
diff --git a/‎config/activity_keywords.py‎
Lines changed: 361 additions & 134 deletions b/‎config/activity_keywords.py‎
Lines changed: 361 additions & 134 deletions
diff --git a/‎config/prompts_activity.py‎
Lines changed: 78 additions & 0 deletions b/‎config/prompts_activity.py‎
Lines changed: 78 additions & 0 deletions
diff --git a/‎docs/design/user-activity-tracker.md‎
Lines changed: 178 additions & 2 deletions b/‎docs/design/user-activity-tracker.md‎
Lines changed: 178 additions & 2 deletions
@@ -274,6 +274,7 @@
         'voice_engaged':   '语音对话中',
         'idle':            '空闲',
         'transitioning':   '切换状态中',
+        'private':         '隐私应用前台',
     },
     'en': {
         'away':            'away',
@@ -285,6 +286,7 @@
         'voice_engaged':   'voice conversation',
         'idle':            'idle',
         'transitioning':   'transitioning',
+        'private':         'private app foreground',
     },
     'ja': {
         'away':            '離席',
@@ -296,6 +298,7 @@
         'voice_engaged':   'ボイス会話中',
         'idle':            'アイドル',
         'transitioning':   '状態切替中',
+        'private':         'プライベートアプリ前面',
     },
     'ko': {
         'away':            '자리 비움',
@@ -307,6 +310,7 @@
         'voice_engaged':   '음성 대화 중',
         'idle':            '유휴',
         'transitioning':   '상태 전환 중',
+        'private':         '비공개 앱 전면',
     },
     'ru': {
         'away':            'отсутствует',
@@ -318,6 +322,70 @@
         'voice_engaged':   'голосовая беседа',
         'idle':            'простой',
         'transitioning':   'смена контекста',
+        'private':         'приватное приложение в фокусе',
+    },
+}
+
+
+# ── Tone hints (single-line style modifier) ─────────────────────────
+#
+# Tone is orthogonal to propensity: propensity decides *what kind of
+# source* the AI may draw from, tone decides *how to deliver it*. The
+# Phase 2 prompt renders tone as one extra line:
+#
+#     口吻：短句优先，不延展话题，避免动作描写
+#
+# Tones and when they fire (see ``derive_tone`` in
+# ``main_logic/activity/snapshot.py`` for the full table):
+#
+#   * ``terse``   — competitive games, rhythm games
+#   * ``hushed``  — immersive horror games
+#   * ``mellow``  — immersive RPG / story-driven games
+#   * ``playful`` — casual gaming, casual_browsing
+#   * ``warm``    — voice / chatting / stale_returning
+#   * ``concise`` — focused_work / idle / default (rendered nothing —
+#                   format_activity_state_section skips when concise to
+#                   save a line in the common case)
+ACTIVITY_TONE_HINTS: dict[str, dict[str, str]] = {
+    'zh': {
+        'terse':   '短句优先，不延展话题，避免动作描写',
+        'hushed':  '轻声细语，配合氛围克制说话',
+        'mellow':  '慢节奏放松陪伴，不丢专业术语进来',
+        'playful': '闲适带点小俏皮，可以开玩笑',
+        'warm':    '自然对话，回应感强',
+        'concise': '不啰嗦，专业克制',
+    },
+    'en': {
+        'terse':   'short sentences first; do not extend topics; avoid action narration',
+        'hushed':  'soft and quiet, restrained to match the atmosphere',
+        'mellow':  'slow-paced, relaxed companionship; no jargon dumps',
+        'playful': 'easygoing with a touch of mischief; jokes welcome',
+        'warm':    'natural conversation, responsive in tone',
+        'concise': 'no fluff, professional and restrained',
+    },
+    'ja': {
+        'terse':   '短文優先・話題を広げない・動作描写を避ける',
+        'hushed':  '小声で控えめに、雰囲気に合わせて',
+        'mellow':  'ゆったりした寄り添い、専門用語は出さない',
+        'playful': 'のんびりしつつ少し茶目っ気、冗談 OK',
+        'warm':    '自然な会話、反応性高め',
+        'concise': '冗長なし、控えめでプロフェッショナル',
+    },
+    'ko': {
+        'terse':   '짧은 문장 우선, 화제 확장 금지, 동작 묘사 자제',
+        'hushed':  '낮은 목소리로, 분위기에 맞게 절제',
+        'mellow':  '느긋한 동행, 전문 용어는 자제',
+        'playful': '편안하게 약간 장난스럽게, 농담도 OK',
+        'warm':    '자연스러운 대화, 반응성 높게',
+        'concise': '군더더기 없이, 절제된 전문성',
+    },
+    'ru': {
+        'terse':   'короткие фразы; не расширять тему; без описаний действий',
+        'hushed':  'тихо и сдержанно, в тон атмосфере',
+        'mellow':  'неспешное сопровождение, без жаргона',
+        'playful': 'непринуждённо и слегка игриво, шутки уместны',
+        'warm':    'естественный разговор, отзывчивая интонация',
+        'concise': 'без воды, сдержанно и профессионально',
     },
 }
 
@@ -395,6 +463,7 @@
         'state_chatting':        '前台聊天：{app}',
         'state_transitioning':   '近期窗口频繁切换',
         'state_idle':            '在电脑前但无明显任务',
+        'state_private':         '前台是隐私应用——不分类、不缓存',
         'high_cpu':              'CPU 30s 均值 {cpu_percent}%',
         'high_gpu':              'GPU 利用率 {gpu_percent}%',
         'gaming_by_gpu':         'GPU 持续高负载（怀疑未识别的游戏）',
@@ -409,6 +478,7 @@
         'state_chatting':        'foreground chat: {app}',
         'state_transitioning':   'rapid window switching recently',
         'state_idle':            'at the computer but no clear task',
+        'state_private':         'private app in foreground — not classifying / caching',
         'high_cpu':              'CPU 30s avg {cpu_percent}%',
         'high_gpu':              'GPU utilization {gpu_percent}%',
         'gaming_by_gpu':         'sustained high GPU (likely unrecognized game)',
@@ -423,6 +493,7 @@
         'state_chatting':        'フォアグラウンドチャット：{app}',
         'state_transitioning':   '最近のウィンドウ切替が頻繁',
         'state_idle':            'PC前にいるが明確な作業なし',
+        'state_private':         'プライベートアプリ前面——分類もキャッシュもしない',
         'high_cpu':              'CPU 30秒平均 {cpu_percent}%',
         'high_gpu':              'GPU 使用率 {gpu_percent}%',
         'gaming_by_gpu':         'GPU 高負荷継続（未識別のゲームの可能性）',
@@ -437,6 +508,7 @@
         'state_chatting':        '전경 채팅: {app}',
         'state_transitioning':   '최근 창 전환 빈번',
         'state_idle':            'PC 앞에 있으나 명확한 작업 없음',
+        'state_private':         '비공개 앱 전면 — 분류/캐시하지 않음',
         'high_cpu':              'CPU 30초 평균 {cpu_percent}%',
         'high_gpu':              'GPU 사용률 {gpu_percent}%',
         'gaming_by_gpu':         'GPU 고부하 지속 (미식별 게임 의심)',
@@ -451,6 +523,7 @@
         'state_chatting':        'переписка на переднем плане: {app}',
         'state_transitioning':   'недавно частая смена окон',
         'state_idle':            'за компьютером без явной задачи',
+        'state_private':         'приватное приложение в фокусе — не классифицируем / не кэшируем',
         'high_cpu':              'CPU средн. 30с {cpu_percent}%',
         'high_gpu':              'загрузка GPU {gpu_percent}%',
         'gaming_by_gpu':         'устойчиво высокая GPU (вероятно нераспознанная игра)',
@@ -497,6 +570,7 @@
         'activity_scores_label': '评估',
         'activity_guess_label': '叙述',
         'open_threads_label': '开放话题',
+        'tone_label': '口吻',
         'time_user_ai_fmt': '{time} | 用户 {user} | AI {ai}',
         'time_user_only_fmt': '{time} | 用户 {user}',
         'time_only_fmt': '{time}',
@@ -517,6 +591,7 @@
         'activity_scores_label': 'scores',
         'activity_guess_label': 'narrative',
         'open_threads_label': 'open threads',
+        'tone_label': 'tone',
         'time_user_ai_fmt': '{time} | user msg {user} ago | AI {ai} ago',
         'time_user_only_fmt': '{time} | user msg {user} ago',
         'time_only_fmt': '{time}',
@@ -537,6 +612,7 @@
         'activity_scores_label': '評価',
         'activity_guess_label': '叙述',
         'open_threads_label': '保留話題',
+        'tone_label': '口調',
         'time_user_ai_fmt': '{time} | ユーザー {user} | AI {ai}',
         'time_user_only_fmt': '{time} | ユーザー {user}',
         'time_only_fmt': '{time}',
@@ -557,6 +633,7 @@
         'activity_scores_label': '평가',
         'activity_guess_label': '서술',
         'open_threads_label': '보류 화제',
+        'tone_label': '말투',
         'time_user_ai_fmt': '{time} | 사용자 {user} | AI {ai}',
         'time_user_only_fmt': '{time} | 사용자 {user}',
         'time_only_fmt': '{time}',
@@ -577,6 +654,7 @@
         'activity_scores_label': 'оценки',
         'activity_guess_label': 'описание',
         'open_threads_label': 'открытые нити',
+        'tone_label': 'тон',
         'time_user_ai_fmt': '{time} | польз. {user} назад | AI {ai} назад',
         'time_user_only_fmt': '{time} | польз. {user} назад',
         'time_only_fmt': '{time}',
 
@@ -71,7 +71,8 @@ for all fields.
 |---|---|---|---|
 | `away` | System idle ≥ 15 min | `open` | Normal proactive — frontend backoff handles frequency |
 | `stale_returning` | Just back from `away` (≤ 60s window) | `greeting_window` | Encourage greeting, allow 1d+ reminiscence |
-| `gaming` | Game window in foreground (subcategory='game') | `restricted_screen_only` | Only screen-derived chatter; no externals, no reminisce |
+| `private` | Sensitive app (password mgr / banking / wallet) foreground | `closed` | Hard skip — no LLM, no enrichment, no buffer caching |
+| `gaming` | Game window in foreground (subcategory='game') | `restricted_screen_only` *or* `open` (casual intensity) | Intensity / genre refines further (see "Game intensity & genre" below) |
 | `focused_work` | Work window + ≥ 90s dwell + recent input | `restricted_screen_only` | Same as gaming |
 | `casual_browsing` | Entertainment window + ≥ 30s dwell | `open` | Encourage external material |
 | `chatting` | Communication app in foreground | `open` | Allow externals, careful with screen comments |
@@ -85,18 +86,193 @@ the existing frontend backoff curve in `static/app-proactive.js`),
 not "don't speak". The greeting machinery in `core.py:trigger_greeting`
 uses a separate path on first reconnect.
 
+The `own_app` keyword category (catgirl app foreground) is handled at
+the observation layer — see "Own-app exclusion" below. It never
+produces a state, just a no-op tick.
+
 ## Propensity directives (what Phase 2 sees)
 
 | Propensity | Allowed channels | Recommended emphasis |
 |---|---|---|
-| `closed` | (reserved; no longer emitted) | — |
+| `closed` | None — hard skip | Used only by `private` state; proactive Phase 1 short-circuits before any LLM call |
 | `restricted_screen_only` | Screen only | Avoid duplication with last 1h; no externals; no reminiscence |
 | `open` | All channels | Reminiscence and externals both available |
 | `greeting_window` | All channels | Encourage gentle greeting + 1d+ reminiscence |
 
 Phase 2 prompt rewrites map these directives into language directives
 (see `config/prompts_proactive.py` for the post-revision prompt).
 
+## Skip probability (probabilistic gate, distinct from propensity)
+
+`ActivitySnapshot.skip_probability` is rolled at proactive Phase 1 entry
+*before any other gating* — if `random() < skip_probability` and there's
+no unfinished thread to follow up on, the round is skipped entirely
+(no LLM, no source fetch, no prompt assembly). Default 0 means "always
+proceed".
+
+Defaults are derived from `(state, intensity, genre)` in
+`derive_skip_probability()`:
+
+| Combo | Default skip |
+|---|---|
+| `gaming + competitive` (any genre) | 0.3 |
+| `gaming + immersive + horror` | 0.3 |
+| `gaming + immersive` (other genre) | 0.0 |
+| `gaming + casual` | 0.0 |
+| `gaming + varied` / untagged | 0.0 |
+| Non-gaming states | 0.0 |
+
+User overrides via `user_preferences.json`'s
+`__global_conversation__::activity::skip_probability_overrides` take
+precedence — set `1.0` for "fully silent during this combo" or `0.0`
+to disable. Keys are intensity-only (`competitive`) or intensity_genre
+joined with underscore (`immersive_horror`).
+
+The `unfinished_thread` guard means an open AI question still gets its
+follow-up window even at `skip_probability=1.0`. Promise-keeping trumps
+silence; the existing 2-followup hard cap prevents harassment.
+
+## Tone modifier (style hint, orthogonal to propensity)
+
+`ActivitySnapshot.tone` is a single-axis style hint that controls *how*
+the AI delivers its message. Six tones, derived in `derive_tone()`:
+
+| Tone | When | Prompt hint (zh) |
+|---|---|---|
+| `terse` | competitive games / rhythm | "短句优先，不延展话题，避免动作描写" |
+| `hushed` | immersive horror | "轻声细语，配合氛围克制说话" |
+| `mellow` | immersive RPG / story | "慢节奏放松陪伴，不丢专业术语进来" |
+| `playful` | casual gaming / casual_browsing | "闲适带点小俏皮，可以开玩笑" |
+| `warm` | voice / chatting / stale_returning | "自然对话，回应感强" |
+| `concise` | focused_work / idle / default | "不啰嗦，专业克制" |
+
+Rendered by `format_activity_state_section` as one extra line:
+
+```
+口吻：短句优先，不延展话题，避免动作描写
+```
+
+`concise` (the safe fallback) and any tone under `propensity=closed`
+are NOT rendered — saves a token line in the common case.
+
+`silent` is intentionally not a tone. Silencing the AI is the
+`skip_probability` mechanism's job; conflating "voice" with "presence"
+muddies both axes.
+
+## Game intensity & genre
+
+Game-keyword rows in `config/activity_keywords.py::GAME_TITLE_KEYWORDS`
+support two shapes:
+
+```python
+# Legacy 2-tuple (untagged — falls through to varied/None)
+('Some Indie Game', ['Some Indie Game', 'SIG'])
+
+# New 4-tuple (tagged)
+('League of Legends', ['LoL', '英雄联盟'], 'competitive', 'moba')
+```
+
+`intensity` (`competitive` / `casual` / `immersive` / `varied`) drives
+propensity + skip_probability. `genre` (`fps` / `moba` / `rpg` / `sim` /
+`horror` / `racing` / `rhythm` / `strategy` / `sports` / `party` /
+`action` / `misc`) refines tone — the only genre-specific branch is
+`horror` triggering the `hushed` tone.
+
+User overrides (`user_game_overrides` in preferences) patch
+intensity/genre on top of static-DB classification by canonical name —
+useful for "I'm playing Elden Ring chill, not sweaty" style flips.
+
+The retag is incremental: top ~70 well-known games are tagged at the
+moment this doc was written; long-tail entries stay 2-tuple and behave
+identically to PR #1015's single `gaming → restricted_screen_only`
+bucket.
+
+## Privacy blacklist
+
+`PRIVATE_TITLE_KEYWORDS` and `PRIVATE_PROCESS_NAMES` in
+`config/activity_keywords.py` list password managers (KeePass /
+1Password / Bitwarden / etc), authenticator apps, and crypto wallets.
+A match emits `state='private', propensity='closed'`. The state
+machine sanitizes the observation (clears title + process_name from the
+snapshot's `active_window`) and the tracker bypasses LLM enrichment +
+suppresses background `activity_guess` ticks while in this state. Net
+effect: sensitive context never reaches the prompt or any model API.
+
+User app/title overrides cannot demote a static-DB privacy hit.
+Game intensity/genre overrides still apply (no privacy implication).
+
+## Own-app exclusion
+
+`OWN_APP_TITLE_KEYWORDS` and `OWN_APP_PROCESS_NAMES` cover the catgirl
+app's own windows (`projectneko_server.exe`, `Xiao8.exe`,
+`lanlan_frd.exe`, plus titles `N.E.K.O` / `Xiao8` / `小八` / `Project
+N.E.K.O`). When the catgirl app is foreground, the tracker treats the
+tick as "no fresh window data" — observation is dropped, dwell timer
+freezes, GPU fallback gaming doesn't trip on the catgirl's own
+Live2D / VRM rendering. Avoids the recursive feedback where "user is
+looking at the catgirl" itself becomes an input the catgirl reasons
+over.
+
+## User overrides & externalized config
+
+`utils/activity_config.py` reads the `activity` sub-dict from
+`user_preferences.json::__global_conversation__`:
+
+```json
+{
+  "model_path": "__global_conversation__",
+  "activity": {
+    "thresholds": {
+      "away_idle_seconds": 600,
+      "focused_work_min_dwell_seconds": 60
+    },
+    "user_app_overrides": {
+      "MyCorpApp.exe": {"category": "work", "subcategory": "office", "canonical": "MyCorpApp"}
+    },
+    "user_title_overrides": {
+      "MyCustomDashboard": {"category": "work", "subcategory": "office"}
+    },
+    "user_game_overrides": {
+      "Elden Ring": {"intensity": "casual"}
+    },
+    "skip_probability_overrides": {
+      "competitive":      0.5,
+      "immersive_horror": 1.0
+    }
+  }
+}
+```
+
+* **thresholds** — every state-machine constant (away_idle_seconds,
+  focused_work_min_dwell_seconds, etc.) can be tuned. Code defaults
+  remain hardcoded in `state_machine.py` as the fallback when an entry
+  is missing or invalid (positive numbers only; bad values silently
+  dropped).
+* **user_app_overrides** — process-name keyed, lowercased. **Additive
+  only**: fires only when the static DB returned `unknown`. Cannot
+  rewrite stable static classifications (e.g. `Code.exe → work/ide`
+  cannot be flipped to `entertainment` via override). Cannot demote
+  `private` or `own_app` static-DB hits (privacy / catgirl-app
+  guarantee).
+* **user_title_overrides** — title-substring keyed, lowercased. Same
+  additive rule as app overrides — fires only when the static DB
+  returned `unknown`.
+* **user_game_overrides** — canonical-name keyed (case-sensitive). The
+  one exception to the additive rule: it patches `(intensity, genre)`
+  on top of an existing gaming classification (doesn't change
+  category/subcategory/canonical, only refines intensity / genre tags
+  within gaming).
+* **skip_probability_overrides** — float in [0, 1] per intensity[_genre]
+  combo. Beats default lookups; out-of-range values are clamped.
+
+Cache: file is read at most once per 30s with mtime-based
+invalidation. Edits to the JSON take effect on the next reload tick.
+`invalidate_activity_preferences_cache()` is exposed for tests + for
+explicit reload after a settings UI write.
+
+There's no save path for the activity sub-dict yet — users hand-edit
+the JSON. Add a settings-UI write path when a UI lands.
+
 ## Architecture
 
 ```text