Fix NSFW reply refusals and media offers

docs/data-flow.md

@@ -98,6 +98,8 @@ flowchart TD
 
 The inbound event key, intended reply, claim status, and conversation state make retries idempotent. Immediately after any limiter wait, automation refreshes Matrix and revalidates the latest inbound event, boundaries, images, seller evidence, policy status, and the one-media-request limit. Newer state makes the old claim terminally `superseded`; it is never sent. If the process dies after Matrix accepted a reply, reconciliation finds the outbound event and marks the old claim sent instead of sending it again.
 
+General R4R generation explicitly permits consensual adult NSFW conversation. A model response that softly refuses, moralizes, or diverts solely because the topic is sexual is rejected before send and falls through to the next configured chat model. General replies may offer a generic approved saved picture without that offer being miscounted as a request for recipient media.
+
 Legacy conversations may make at most one optional autonomous media request, including a request already present in the opener. The hybrid policy retains its single rapport-gated media ask. Deterministic, sequence-aware refusal checks run before generation and again at send time; generated media asks must pass the same non-explicit, non-coercive validator.
 
 ## Chat and media synchronization
@@ -116,7 +118,7 @@ The media listing reads persisted indexes for every stored account, including ac
 
 The process-global exchange library is separate. Dashboard uploads are decoded and re-encoded with `sharp`, which validates the actual JPEG/PNG/WebP contents, applies orientation, and removes EXIF/location/camera metadata. OpenRouter then assigns overlapping anatomy tags plus SFW/NSFW classification. Failed or low-confidence classifications remain disabled until the operator corrects them.
 
-For each latest inbound text event, `MediaLibraryExchangeService` detects direct or indirect image requests before normal reply generation. Exact requests require the matching tag. Generic requests use the conversation's completed library-send count to broaden the eligible safety tier and randomly choose an unused asset. A unique durable reservation on account + conversation + asset prevents reuse, while account + conversation + inbound event makes restart handling idempotent.
+For each latest inbound text event, `MediaLibraryExchangeService` detects direct or indirect image requests before normal reply generation. A clear affirmative response to the immediately preceding generic bot media offer is also a generic request; unrelated agreement is not. Exact requests require the matching tag. Generic requests use the conversation's completed library-send count to broaden the eligible safety tier and randomly choose an unused asset. A unique durable reservation on account + conversation + asset prevents reuse, while account + conversation + inbound event makes restart handling idempotent.
 
 After the normal reply limiter waits, automation refreshes Matrix and rechecks that the same inbound request is still latest and that no image, boundary, seller signal, or other terminal state has appeared. It then uploads the private file to Matrix, sends an `m.image` event with a stable transaction ID, and only after confirmation sends the optional reciprocal text. If the image is confirmed but the text is not, the asset remains consumed and the conversation is handed to the operator rather than risking a duplicate.
 

docs/product-and-safety.md

@@ -51,6 +51,8 @@ Each subreddit snapshots a policy into a conversation when automation first hand
 
 The snapshot matters: changing configuration later must not silently rewrite the rules for an active conversation. Automation stops for seller/upsell evidence, an image received, a detected boundary, unsafe content, an exhausted turn budget, a repeated media request, or a manual policy.
 
+Within those boundaries, R4R replies are expected to participate naturally in consensual adult NSFW conversation instead of moralizing, declining the topic, or diverting ordinary flirting into generic small talk. In-character soft refusals are treated like provider refusals and fall through to the next configured chat model. This does not weaken recipient boundaries, the under-18 handoff, seller/off-platform controls, location and meeting prohibitions, or the separate media-request rules.
+
 Two of those stops are terminal rather than handoffs. A reply that pushes the conversation onto another messaging app, asks for contact details, solicits payment, points at a paid-content funnel, or runs the age/bot "verification" scam sets the automation status to `killed`, marks the durable seller flag, and resolves the operator's triage state, so the conversation leaves every actionable queue instead of collecting in the manual one. Detection normalizes the text first — unicode folding, zero-width stripping, leet mapping, separator removal — because these words are routinely obfuscated (`0nlyfans`, `t3l3gram`, `t e l e g r a m`). Ambiguous terms need context: `snap` on its own is a photo request in this product and never a kill on its own. Off-platform kills are a safety control and stay on independently of `reddit.filterSellers`; a configured seller keyword or domain also kills unless `conversations.killOnSellerKeyword` is disabled. Under-18 disclosures and in-person/contact-detail asks remain human handoffs, and now apply to every policy mode rather than the R4R ones only.
 
 Optional second-stage AI screening (`conversations.aiReplyScreening`) runs only when the deterministic rules come up clean, classifies the inbound side of the conversation as genuine, seller, off-platform, scam, bot, or unclear, and kills at or above `killConfidence` while handing off at or above `flagConfidence`. It fails open: a classifier error or outage never blocks a reply, and each inbound event is screened at most once per process. Short refusals are interpreted in sequence: phrases such as “I’m good” become media boundaries only when they answer a media request.
@@ -78,7 +80,7 @@ Browsing sessions are a separate, disabled-by-default account-growth experiment.
 
 The exchange library contains only operator-uploaded images. Upload requires confirmation that every depicted adult consented to storage and bot delivery. Received conversation media is account-owned evidence and can never be promoted into this shared library.
 
-The bot may continue to ask another person for an optional photo under the configured conversation policy, but it must never mention, advertise, or offer an exchange-library image proactively. A library send requires a direct or indirect inbound image request. Exact anatomy requests match the operator-reviewed tags `penis`, `chest`, `selfie`, `topless`, or `feet`; the bot does not substitute a different anatomy when a match is unavailable.
+The bot may continue to ask another person for an optional photo under the configured conversation policy. During ordinary adult conversation it may also make a low-pressure generic offer to share one of its own approved saved pictures, but it must not promise a particular image or anatomy. A clear acceptance of that immediately preceding offer counts as a generic inbound request; otherwise a library send still requires a direct or indirect inbound image request. Every automated send remains subject to the existing inventory, safety-tier, deduplication, boundary, seller, and send-time checks. Exact anatomy requests match the operator-reviewed tags `penis`, `chest`, `selfie`, `topless`, or `feet`; the bot does not substitute a different anatomy when a match is unavailable.
 
 Nonspecific requests broaden progressively within one conversation. The first selects a random unused SFW asset, a later request may include topless/NSFW assets, and further requests may select from the full library. An asset is never selected twice in the same conversation, including after an uncertain send. After Matrix confirms the image event, the bot asks the other person to reciprocate without pressure. Missing inventory, failed delivery, changed conversation state, or an unconfirmed reciprocal message becomes an operator handoff.