# TODO

This file tracks larger Lumi work that cannot safely be completed in one pass. Keep pending work under the relevant category and move completed items to the Done section with a short note.

## Lumi Companion transcription — experimental-companion (2026-07-22)

Foundation implemented locally: independent `lumi_transcription` plugin; generic
core WebSocket-upgrade capability; single-use pairing and revocable devices;
HTTPS/WSS device transport with exact localhost-origin HTTP allowed only for
locally generated pairing packages; bounded PCM/session queues; revision-safe settings;
provider/delivery interfaces; worker supervision; caption stabilization; pinned
whisper.cpp/model manifests; short-lived JSONL diagnostics; protocol schemas;
and .NET/native companion boundaries with focused verification. The companion now
has a Lumi-styled Avalonia 12 single-instance tray shell, guided real-boundary
test states, DPAPI pairing, local preferences/autostart, and bounded diagnostics.
A pinned native whisper.cpp worker builds on the CPU verification target and the
server offers consent-gated model download/load controls. The Transcription
settings now render inside the shared Lumi shell, and Admin shows a compact
Companion health/download section beneath its shortcut cards. A checksum-pinned
self-contained Windows bundle includes a one-time pairing file and pairs after
extraction without a separate import workflow. The pinned CPU whisper worker now
has a reproducible Windows build/install script and is discovered automatically;
the production CUDA build and target benchmark remain pending below. Companion
experimental.3 adds user-approved, checksum-verified, stream-safe in-place updates;
a reproducible native OBS 31+ bridge build; one-click UAC install/repair/removal;
selected-source PCM capture; nested Program-scene evaluation; bounded same-user
IPC; bridge health; and native caption submission. Experimental.2 must be replaced
manually once to bootstrap the updater.

Experimental.4 contains Windows speech-path reliability fixes: native PCM stdin
is explicitly binary-safe, broken worker pipes no longer terminate Lumi, the
worker restarts and reloads the selected model automatically, and the Companion
test reports the server failure at Speech recognition instead of hanging.

Experimental.5 retries and acknowledges the saved OBS source attachment after
reconnects, waits for finalized path-test captions, and adds a separate
user-controlled accuracy/latency test with a ten-second silence cutoff. The host
retains per-word latency/confidence inspection data for one hour, while paired
device management now defaults to active credentials and purges revoked history
after 30 days.

Experimental.6 makes the full-path readiness check voice-free, preserves a valid
pass across restarts until a relevant source/model/bridge configuration changes,
adds a live dBFS meter to the dedicated speech test, and fixes reusable benchmark
sessions so failed starts cannot leave worker activity behind. Companion now also
reports verified OBS integration and path readiness to the WebUI setup progress.

Experimental.7 replaces the portable paired app download with a durable per-user
Windows installer while preserving the verified in-place updater and DPAPI data.
It also makes OBS bridge repair recoverable with fresh validation and actionable
elevated-process errors, and adds timed permanent device revocation in the WebUI.

Experimental.8 makes the installed single-file build discover and verify its OBS
payload deterministically, adds an executable-level package diagnostic, and shows
OBS maintenance failures directly instead of leaving them only in diagnostics.

Experimental.9 coalesces OBS callbacks into fixed 20 ms network frames and gives
audio and initial OBS source inventory their own soft gateway budgets, so normal
or pathological capture cadence cannot rate-limit and disconnect the Companion
control connection.

Experimental.10 deduplicates OBS source inventories and unchanged source-state
notifications at both ends, removing the high-volume source-update feedback seen
with large scene collections while retaining the non-disconnecting safety budget.

Experimental.11 removes server-side inference backlog, filters whisper.cpp
control tokens, preserves first-visible word latency while retaining finalized
confidence, and makes manual test completion wait for the final worker result.
The portable CUDA 12.4 worker targets RTX 3060 and newer NVIDIA GPUs, activates
from the Lumi WebUI without a host SDK dependency, and retains a CPU
compatibility package. On the RTX 3080 Ti acceptance phrase, `small.en` returned
the exact 19-word transcript at 300 ms average, 106 ms median, and 1,007 ms maximum
first-visible latency.

Release-blocking work remains:

- Repeat the `small.en` latency gate and benchmark quantized `small.en` and
  `base.en` on the production RTX 3060.
- Sign the companion installer and add a rollback policy after the experimental
  updater has target-machine acceptance evidence.
- Complete target-machine bridge acceptance and source rename/missing recovery.
- Run the OBS 31+/Twitch compatibility spike and prove toggleable closed captions;
  tune replacement/display duration from player behavior without open-caption fallback.
- Complete the remaining live source/setup steps, conflict-resolution UI, and
  live settings synchronization, then run the target-topology failure and
  performance matrix.

## Remaining DesignMotionHQ UX work — experimental-ux checkpoint (2026-07-22)

The shared UX foundation and representative settings, navigation, theme, command,
updates, resources, and overlay workflows are implemented. Continue applying the
same hierarchy, progressive disclosure, motion, state feedback, accessibility,
and context-preservation principles globally in this order:

- Migrate and browser-accept the remaining core route groups: Feedback;
  Logs/Diagnostics; Users/Privileges/Pages/Plugins; and their empty, loading,
  partial, error, offline, permission-limited, disabled, and read-only states.
- Migrate remaining plugin-owned routes to the shared request, lifecycle, dialog,
  field-state, responsive-list, and no-forced-reload contracts.
- Add a plugin-enabled authenticated browser fixture so Lumi AI polling,
  Improvement Center live updates, and plugin settings are exercised in the
  Playwright viewport matrix rather than only source/focused verification.
- Browser-test the complete built-in/custom-theme contrast matrix, including
  default badges, disabled controls, preview surfaces, alerts, and plugin pages.
- Complete manual keyboard and screen-reader acceptance for every destructive
  and entity-edit dialog, including focus restoration and timed confirmation.
- Continue replacing broad legacy selectors and route-specific controls with
  explicit shared components; finish wording, density, helper-text, and advanced
  disclosure cleanup on lower-priority plugin and diagnostics surfaces.
- Finish homepage hero/embed usability: non-technical configuration copy,
  unavailable/fallback explanations, Twitch parent-domain guidance, YouTube live
  failure states, and external iframe refusal handling.
- Re-run the checkpoint review after each route group and remove completed items
  from `docs/lumi-ux-checkpoint-review.md` and the route manifest P1 list.

## Command policy and stream controls

Implemented on 2026-07-19: centralized command groups and per-command overrides
for every routed custom/core/plugin command, with global/per-user time windows,
persistent crash-tolerant per-stream limits, platform role requirements,
subscriber tiers, and Economy Framework costs/refunds in normal banking history.
Added conditional keyword custom replies with conservative fuzzy matching, plus
core `!clip` platform/OBS replay orchestration and Twitch `!raid`/`!raid cancel`.
OBS replay saving works through local WebSocket and the credential-free Browser
Bridge BASIC permission. Admin UI and focused verification cover the shared
storage and enforcement path.

Follow-up completed on 2026-07-19: added a protected, implicitly inherited
default group; accurate read-only inherited-value summaries; conditional child
fields; clearer nested visual hierarchy; friendly command-source labels; fuzzy
search suggestions with positive-only live setting/source filters; and atomic
page-wide saving for every command so collapsed or filtered drafts survive the
save.

Patch completed on 2026-07-19: conditional reply rules now accept
comma-separated keyword aliases that share one response.

Overlay chat follow-up completed on 2026-07-19: Twitch messages resolve cached
global, channel, and shared BetterTTV emotes without affecting chat delivery
when BetterTTV is unavailable.

Remaining work:

- Add platform action providers when YouTube or future chat integrations expose
  supported clip/raid APIs.
- Replace heuristic Discord subscriber/VIP role-name matching with explicit
  per-server role mapping if communities need stricter Discord entitlements.

## Event automation and audience tracking

Overlay event-alert baseline completed on 2026-07-19: a shared, extensible event
registry now drives saved per-overlay actions through the existing scoped live
event stream. Admins can play queued audio/video once or show text/images for a
chosen duration, test alerts against connected Browser Sources, and receive
Twitch follows, incoming raids, subscriptions, gifted subscriptions, and Discord
member joins. Twitch uses a revocable server-side EventSub authorization with
automatic reconnect/token refresh; plugins can register and emit additional
event types through the shared event API.

Remaining work:

- Add centralized named counters with atomic modification actions, persistent or
  per-stream reset modes, admin controls, and placeholders such as
  `{{counter.twitch.followers}}`.
- Add watchtime, followage, subscription age, and equivalent provider-backed
  audience tracking, then expose suitable totals and durations in leaderboards.
- Add more trigger adapters as integrations expose reliable events, including
  chat-presence joins where the platform can distinguish a real join from an
  ordinary message or reconnect.

## Content delivery library

Implemented on 2026-07-20: administrators can upload and manage verified
streaming resources through a shared core library with previews, filters,
storage quotas, physical free-space reserves, configurable upload limits, and
progress feedback. Locked resources remain available only to admins and trusted
Lumi code; exposed resources receive revocable encrypted bearer URLs. Delivery
supports safe MIME handling, CORS, ETags, and byte ranges for OBS and browser
media seeking. Plugins use the shared `global.lumiFrameworks.resources` API.
OKF's generated core reference now discovers shared route modules so the AI can
also find and explain the Resources and overlay endpoints.

Follow-up completed on 2026-07-20: repaired shared timed confirmation for lock
and delete actions, added reliable attachment downloads and network-drive-safe
deletion, redesigned cards for responsive filenames/actions and embedded media
controls, corrected empty/filter messages, and made storage/upload limit changes
take effect and update the open page immediately.

## Current Local State / Source of Truth

### P0 OBS Overlay System

Implemented locally on 2026-07-17: admin-only overlay management, separate public
Browser Source rendering, encrypted and revocable overlay/scene tokens, live
scoped event updates with reconnect recovery, scene and module-instance CRUD and
ordering, optional OBS WebSocket control/synchronization, connector provider
interfaces, focused verification, and operator documentation.

The editor now also includes an OBS-style live canvas with source selection,
eight resize handles, drag/nudge positioning, edge/center/source snapping,
anchors, contextual source fields, text layout/overflow controls, and external
website-overlay health checks plus manual and automatic refresh. Video and audio
sources now include playback controls and OBS-routable sound; web sources include
isolated custom frame CSS, cropping, and zoom. An optional OBS Browser Bridge now
syncs supported OBS scene, transition, canvas, output, permission, and source
state without WebSocket credentials, with a one-action setup importer. The clean
render page and editor now share a fixed full-resolution canvas, transparent OBS
defaults, and explicit Browser Source dimensions so responsive third-party alerts
render consistently in the preview and OBS. Website CSS is injected into the
third-party document itself through scoped revocable render tickets, matching OBS
Custom CSS behavior while keeping the page isolated from Lumi sessions and local
network targets. A native multi-platform Lumi chat source now combines connected
Twitch, YouTube, and Discord chats with channel filters, full visual controls,
animations, timeout removal, short reconnect replay, Twitch emotes, and isolated
custom CSS. The editor now previews server-normalized unsaved changes (including
temporary website CSS), marks/reverts drafts, provides contrast and grid views,
and keeps save actions reachable. Alert documents also retain transparent page
and app-root backgrounds after late DOM/style changes. Chat includes Lumi's own
platform messages, image-based platform/badge marks, and server-enforced platform
or linked-Lumi-account user blocking. Live draft rerenders preserve form focus;
chat messages now use content-sized cards and whole-message alignment, cached
Twitch avatars, Discord emoji/GIF/sticker media, four-direction entry/exit
animations, and a continuously animated multi-message editor simulation.
Each saved native chat source also has a signed standalone OBS Custom Browser
Dock URL. The dock reuses its filters and visual settings without overlay canvas
coordinates, fixed source dimensions, or message animations, and its private URL
is revoked through the existing overlay/scene token lifecycle.

Remaining work:

- Build and authenticate the future trusted Lumi streaming-computer client.
- Add moderator-to-overlay assignment UI and persistence when the assignment
  model is defined; centralized overlay capability hooks are ready and continue
  to deny moderators and all secret access by default.

### OKF Knowledge System

Current state on `experimental-okf` as of 2026-06-21: standalone OKF plugin work is implemented locally and not pushed. The plugin provides SQLite-backed entries, sanitized Markdown, logged-in browsing, role-gated details, admin/editor management, per-user OKF permission grants through the shared core user lookup, workflow actions, version history, version restore, role-preview tooling, role-aware Lumi AI context integration through the generic AI context provider hook, a file-backed Markdown knowledge retrieval layer, generated core/plugin OKF baseline files, admin-editable community OKF files, and admin-created correction OKF files from reviewed core feedback.

#### Implemented Locally

- Added standalone `plugins/okf` plugin with WebUI route mounting and navigation registration.
- Added plugin-owned SQLite tables for OKF entries, versions, and per-user OKF permission grants.
- Added sanitized Markdown rendering for OKF answers/details without unsafe raw HTML.
- Added logged-in OKF/Q&A index, search, category/tag filtering, and entry detail pages.
- Enforced server-side visibility:
  - anonymous users blocked
  - normal users see published user-visible entries
  - moderators see published user/mod entries and support details
  - admins see all OKF fields and workflow state
- Added admin/editor management UI for create/edit, workflow actions, and version history.
- Added OKF-specific permission grants independent of normal roles:
  - `edit`
  - `edit_review`
  - `edit_review_implement`
- Added workflow actions for review, publish, archive, restore-as-draft, and soft delete.
- Added version snapshots for create/update/workflow changes.
- Added restore-from-version service/action/UI with a new audit version recorded for restores.
- Added admin role preview cards for user, moderator, and admin/editor visibility.
- Added shared core user lookup support through `/api/users/search` and `[data-user-lookup]`.
- Migrated OKF permission grants, Lumi AI access grants, moderation target fields, Economy banking transfers, and Economy balance adjustment fields to the shared user lookup.
- Fixed the moderation target internal username search by removing its page-local picker and using the shared live lookup.
- Added a local `global.lumiFrameworks.okf.search(...)` integration point for later AI context provider wiring.
- Wired OKF into Lumi AI prompt context through the existing generic `registerContext` hook.
- Made Lumi AI context providers receive user/message/scope/origin context so per-user OKF permissions can be enforced.
- Ensured OKF AI context includes only published and approved entries and only fields visible to the requesting user.
- Changed OKF aliases/related questions to newline-only input so commas remain valid inside questions.
- Added `knowledge/core`, `knowledge/plugins`, `knowledge/community`, and `knowledge/corrections` with ownership documentation and keep-files.
- Added dependency-free OKF Markdown/frontmatter parsing for stable IDs, scopes, status, priority, tags, generated/editable flags, and timestamps.
- Added file-backed OKF chunking by Markdown heading with source metadata: path, id, heading, score, and excerpt.
- Wired file-backed OKF retrieval into Lumi AI context alongside existing SQLite entries.
- Enforced file retrieval priority: corrections, community, plugins, then core.
- Enforced file-backed visibility for user/mod/admin knowledge.
- Added access-aware OKF placeholder resolution for visible frontmatter values, with generic missing-reference markers for hidden or unavailable references.
- Added an mtime/size-based file knowledge cache so unchanged files are reused and changed/deleted files are reflected on later searches.
- Added generated core/plugin OKF baseline generation from package metadata, README, detected core routes, plugin manifests, plugin routes, and static command trigger hints.
- Added generated baseline files under `knowledge/core` and `knowledge/plugins`.
- Generated OKF files are marked `generated: true` and `editable: false`; files marked `generated: false` or `editable: true` are not overwritten.
- Added an OKF admin community file editor for `knowledge/community` Markdown with frontmatter fields, Markdown body editing, preview, filename rename support, and generated/non-editable save protection.
- Added admin feedback-to-correction OKF creation that writes searchable Markdown files under `knowledge/corrections` and links the generated path back to the reviewed feedback item.
- Changed selected OKF entry editing into a full-screen admin modal with session-backed draft preservation.
- Added global opt-in placeholder auto-suggest for fields that declare scoped placeholder sources, with OKF Markdown fields as the first consumer.
- Added system-generated Throne Wishlist destination template placeholders to the global placeholder auto-suggest, using double-brace syntax while preserving legacy single-brace rendering.
- Added a server-side placeholder registry, trusted field policy registry, catalog/preview APIs, and save/render validation for first user-visible fields.
- Split `/plugins/okf/admin` into tabbed General OKF, Community OKF, and System-generated OKF sections.
- Added a read-only System-generated OKF admin tab that lists generated core/plugin knowledge files and previews selected Markdown while preserving role-scoped retrieval semantics.
- Replaced Community and System-generated OKF pill rows with responsive searchable/filterable tables while preserving edit and preview actions.
- Expanded generated core/plugin OKF route documentation with static route reference details for purpose, inputs, response format, access signals, side effects, and limitations.
- Capped OKF AI context output from generated route docs so route help queries do not overfill the local model context, and prefer specific route chunks over generic route-list chunks.
- Replaced literal full-question matching for SQLite-backed OKF entries with role-safe natural-language token, alias, title, and visible-body scoring.
- Ranked file-backed and SQLite-backed OKF candidates together, retained source metadata, and limited repeated chunks from one entry so one broad file cannot crowd out a better source.
- Added an explicit AI evidence order for corrections, repository facts, community OKF, generated OKF, and external web results; retrieved content is reference data and cannot supply model instructions.
- Added OKF-first Lumi AI routing: nearly all safe requests receive a cheap role-filtered OKF pass before model routing, exact OKF links are grounded deterministically, the fast gate model answers sufficient factual matches, early results are reused by the main model, and Web Search is withheld when OKF already contains enough evidence.
- Hardened read-only web-tool finalization against prompt injection and invented citations, including deterministic removal of URLs absent from the tool result and automatic attribution to returned sources when links are allowed.
- Added `plugins/okf/tests/verify.js`.

### Core Feedback System

Current state on `experimental-okf` as of 2026-06-21: the core feedback system is implemented locally and not yet pushed after the latest context-menu, review action, screenshot attachment, Codex export, semantic target, draft-retention, and similar-feedback confirmation refinements. The detailed checklist below is retained for hardening, but this current-state block is the source of truth.

#### Implemented Locally

- Core-level feedback storage in SQLite:
  - `feedback_entries`
  - `feedback_comments`
  - `feedback_status_history`
  - `feedback_view_state`
- Logged-in feedback submission through:
  - persistent floating feedback button
  - site-wide custom context menu
  - `/api/feedback`
- `/feedback` under Community navigation for logged-in users.
- `/admin/feedback` under Admin navigation for admin review.
- Generic issue categories, severity values, scope types, and status labels.
- Feedback modal fields for summary, category, severity, scope, description, steps, expected behavior, actual behavior, page URL, page title, clicked-element metadata, and optional browser/viewport diagnostics.
- Element-targeted feedback from right-click context menu with safe metadata:
  - selector/path
  - tag
  - visible text snippet
  - aria label/title/role
  - nearest label/heading
  - page URL/title
  - viewport size
- Sensitive form field values are not captured by the element metadata collector.
- Selected feedback target is highlighted while the modal is open and cleared when closed.
- User feedback center:
  - public non-identifying feedback summary list
  - “My feedback” section
  - own-feedback detail view
  - submitter comments/follow-up
  - admin replies visible to submitter
- Per-user notification counters for solved, needs-context, and not-worked/not-planned outcomes.
- Notification counters reset/update when the user opens `/feedback`.
- Admin review page:
  - full feedback details
  - submitter identity
  - target metadata
  - optional diagnostics
  - status history
  - comments/replies
  - private work notes
  - filters for status, category, severity, scope, submitter, and needs-action
  - filters for plugin/area text and submitted date range
  - sorting by newest, oldest, severity, status, and last activity
  - status/category/severity updates
  - admin reply to submitter
  - private admin work note
  - request-more-context support through `needs_more_context`
  - duplicate/rejected/not-planned/won't-fix/archive/delete statuses
  - manual links to issue/correction references
- Admin review actions:
  - `Finalize & Close`
  - reopen closed feedback
  - hard-delete feedback, comments, private notes, status history, and screenshots
  - sensitive-data cleanup for screenshots, diagnostics, target metadata, and public admin replies
  - feedback rows are collapsed by default
- Moderate submission rate limit.
- Similar-feedback warnings show matching reports and require an explicit confirmation that the new report is distinct or adds useful context; confirmed reports retain this decision in sanitized diagnostics for admin review.
- Validation against empty/too-short feedback.
- Server-side permission checks for submission, own-feedback details, submitter comments, and admin review.
- EJS escaping and sanitized server-side JSON/text handling for submitted feedback.
- AI Improvement Center remains separate; `wrong_tool_usage` classification already exists there.
- Custom context menu:
  - Back
  - Forward
  - Copy
  - Cut
  - Paste
  - Link to here
  - Hard reload
  - Feedback
- Context menu availability behavior:
  - all actions remain visible
  - unavailable actions are greyed out and non-interactive
  - Back/Forward availability is history-aware where browser APIs allow
  - Copy is available only for selected text or right-clicked images
  - Cut is available only for selected text inside editable fields
  - Paste is available only when an editable field is active and readable clipboard text exists
  - Link to here, Hard reload, and Feedback remain available
- Context menu tooltips:
  - show after one second of hover
  - explain each action
  - use fixed positioning
  - clamp to the viewport so they do not overflow or expand the page
- Context menu keyboard behavior:
  - arrow-key navigation
  - Home/End navigation
  - Enter/Space activation
  - Tab focus wrapping while open
- Scope label/target field:
  - displayed as a generated read-only “Detected target” field
  - updates when “Feedback is about” changes
  - is regenerated server-side and does not trust submitted free text
- Optional screenshot support:
  - explicit opt-in only
  - supports image upload
  - supports pasted screenshots from the clipboard where browsers allow
  - avoids browser tab/window picker capture so the browser prompt is not submitted
  - shows an attached screenshot preview
  - lets users remove the screenshot before submitting
  - stores screenshots under `data/feedback/screenshots`
  - exposes screenshots only to the submitter or admins through authenticated routes
- General protected attachments:
  - supports up to three optional PNG/JPEG/WebP/PDF/text files per feedback item
  - stores attachments under `data/feedback/attachments`
  - exposes attachments only to the submitter or admins through authenticated routes
  - supports admin cleanup/removal
- Public discussion on existing feedback:
  - logged-in users can open public feedback detail without private diagnostics or attachments
  - logged-in users can mark existing feedback as affecting them too
  - logged-in users can add public context comments to existing feedback
- Feedback form draft retention:
  - backdrop clicks and Escape no longer close the feedback modal
  - explicit close controls preserve the latest non-submitted report in session storage
  - reopening feedback from the floating button or context menu restores the draft
  - attached screenshot blobs are retained across modal close/reopen for the current page session
  - Reset clears the form, stored draft, screenshot, and detected target from the right side of the modal action row

#### Partially Implemented

- Optional diagnostics exist for browser/user-agent, viewport, language, current URL, page title, selected scope, target metadata, screenshot attachment source, and opt-in sanitized page structure snapshots.
- Admin filters cover status/category/severity/scope/plugin-area/submitter/date/needs-action. Richer custom-scope filters are not implemented.
- Admin-created OKF correction files are available from feedback review, but broader task tracking remains manual and outside the feedback feature.
- Duplicate handling includes lightweight similar-feedback suggestions from summary, description, scope, category, and page path; an explicit confirmation path for distinct/additional reports; “also affected” counts; and public context comments, but not full duplicate merging.
- Feedback data is in SQLite under `data/app.db`, which is preserved by the update system through the existing protected `data/` path. Screenshot files are stored under `data/feedback/screenshots`, also covered by the protected `data/` path.

## Active Work

Audited on 2026-07-17 after completing the exported P0-P3 queue. Only the items
in this section remain active; the detailed planning checklists below are kept
as historical design context and are no longer an open-work list.

- Build and authenticate the future trusted Lumi streaming-computer client.
- Add moderator-to-overlay assignments after the ownership model is defined;
  the centralized overlay capability hooks already fail closed.
- Add Twitch live state, follower/subscriber statistics, and scheduled stream
  placeholders only after a background provider cache exists. Rendering must
  never make provider API calls.
- Revisit a persistent OKF index when there are at least 2,000 active files and
  generated-fixture or production warm-search p95 exceeds 100 ms. The
  2026-07-17 benchmark measured about 45 ms p95 at 1,000 files and 87 ms at
  2,000 files, so the current mtime/size parse cache remains appropriate.
- Continue live Lumi AI controller tuning only when real usage provides evidence
  that the current heuristics need adjustment.
- Consider Discord.js 14 as a separately planned compatibility upgrade; the
  current v13 integration is verified and a major upgrade should not be mixed
  into unrelated security fixes.
- Broaden browser-matrix checks for clipboard image copy/read behavior. Upload,
  paste, native-menu, URL-copy, and file-picker fallbacks are implemented.
- Add deeper provider-specific homepage failure detection only where a safe
  cached API or browser signal exists. Cross-origin iframe CSP/X-Frame-Options
  failures cannot be reliably preflighted without creating an SSRF path.

## Historical Planning Checklists (Implemented or Superseded)

### OKF Knowledge System: File-Backed Knowledge Storage

- Add richer category/tag management and Markdown preview/editor polish.
- Continue enriching the non-editable system-generated OKF files so they act as scoped user manuals and developer support context. Route-level details are now generated; remaining work is broader content quality, role-specific depth, and retrieval tuning so casual admin questions do not receive unnecessary technical detail.

### OKF Retrieval and Indexing

- Add a more advanced persistent OKF index if file count or search volume requires it later.

### Global Placeholder System

- Continue migrating remaining placeholder-compatible fields away from inline JSON/static sources to trusted server-side `field_id` policies.
- Consider an admin-managed `/admin/settings -> Placeholders` registry later for custom placeholders under the `{{custom.*}}` namespace.
- Expand additional plugin-owned destination template fields to register generated placeholder sources, following the Throne Wishlist pattern.
- Add API-backed platform statistic placeholders after reliable fetch/cache layers exist, especially Twitch follower/subscriber counts and scheduled stream start times.
- Add async OKF AI context placeholder rendering if Lumi AI context providers are updated to support async providers.

### Lumi AI Controller Routing

- Consider a separate controller enablement/advanced-tuning switch only if live testing shows admins need to disable or override the heuristic controller. Internal mode budgets, source profile final-output limits, and controller diagnostics are exposed locally.
- Expand controller tests with simulated controller timeout cases if the gate model is later changed to emit full controller schema directly. Invalid controller normalization is covered locally.
- Tune controller heuristics after live use, especially unlimited-mode eligibility and OKF deep-vs-light retrieval thresholds.

### AI Reply Feedback and OKF Correction Pipeline

This section is for Lumi chat answer feedback and AI Improvement Center work, not the separate core feedback system.

#### Feedback Loop

- Add thumbs up/down controls to Lumi chat answers.
- Store feedback payloads with rating, prompt, response, retrieved context, optional comment, model/provider, timestamp, and review status.
- Show an optional comment field for thumbs down and keep thumbs up lightweight.
- Ensure feedback never directly modifies OKF.

#### Admin Feedback Review

- Add an admin feedback review page or section.
- Show prompt, response, rating, comment, retrieved OKF sources, model/provider, and timestamp for each feedback item.
- Add review actions: reviewed/no action, good, bad retrieval, bad response, missing knowledge, archive/delete.
- Add correction creation UI with title, tags, affected topic/file, and Markdown body.
- Save approved corrections as OKF files and re-index after save.
- Add links from feedback rows to generated correction files.

#### Storage and Preservation

- Store feedback queue, review status, source context snapshots, and correction links in SQLite or existing app storage.
- Keep community OKF, corrections OKF, feedback/review data, and source metadata preserved across updates.
- Ensure generated OKF is reproducible and not accidentally overwritten by admin edits.

### Core Feedback System: Remaining Hardening

- Full scroll-page or automatic current-tab screenshot capture is not implemented. Current browser APIs require prompts for page capture, so the implemented path is explicit upload/paste.
- Full duplicate merge workflow and richer duplicate detection beyond lightweight summary/description/scope/category/page matching.
- Richer custom scope targeting filters.
- Broader OKF correction workflow polish for documentation/terminology/knowledge feedback, including review guidance and discoverability.
- Broader browser testing for image clipboard copy and clipboard-read availability because browser support and permissions vary.

#### Foundation

- Implement a general core feedback system available to logged-in users only.
- Add a persistent feedback entry point somewhere logical in the UI.
- Add `/feedback` under the Community navbar section for logged-in users.
- Add `/admin/feedback` as the admin review entry point.
- Ensure the feedback system is core-level functionality and can cover any area, scope, feature, page, plugin, or UI element.
- Keep the AI Improvement Center separate from this system; it should continue handling AI reply quality feedback.
- Add a `wrong tool` classification to the AI Improvement Center for cases where the AI used the wrong tool, action, integration, or capability.

#### Feedback Categories and Scope

- Use generic feedback categories based on issue type rather than feature-specific categories.
- Suggested categories:
  - bug
  - confusing wording
  - broken interaction
  - visual/layout issue
  - accessibility issue
  - missing feature
  - improvement suggestion
  - performance issue
  - permission/access issue
  - unexpected behavior
  - other
- Allow feedback to target:
  - the whole page
  - a specific clicked UI element
  - the current feature/page
  - a plugin
  - a broad system area
  - other/custom scope
- Encourage users to submit one feedback item per issue.
- Add helper text explaining that small, specific feedback reports are preferred over broad combined reports.

#### Feedback Submission UI

- Add a feedback modal for creating feedback.
- The modal should be accessible from the persistent feedback button and from the custom context menu.
- Require logged-in user identity for all feedback submissions.
- Allow the user to enter:
  - short summary/title
  - category
  - severity/priority
  - scope/target
  - detailed description
  - optional steps to reproduce
  - optional expected behavior
  - optional actual behavior
- Support severity/priority values such as:
  - minor
  - confusing
  - broken
  - urgent
  - security/sensitive
  - suggestion
- Pre-fill feedback scope based on the current page or clicked element when available.
- Allow users to change the auto-detected scope before submitting.
- Show clear confirmation after feedback is submitted.

#### Site-Wide Custom Context Menu

- Replace the standard browser right-click context menu across Lumi with a custom site-wide context menu.
- Include the following actions:
  - Back
  - Forward
  - Copy
  - Cut
  - Paste
  - Link to here
  - Hard reload
  - Feedback
- Ensure context menu actions respect browser permissions and limitations.
- Ensure copy, cut, and paste only appear or work where appropriate.
- Implement “Link to here” by creating a URL to the current page and, when possible, the clicked element or section.
- Implement “Hard reload” as a cache-bypassing reload comparable to a developer hard refresh where possible.
- Add the Feedback action to open the feedback modal with the clicked element as the target.
- Preserve keyboard accessibility and provide fallback behavior if custom context menu features are unavailable in a browser.

#### Element-Targeted Feedback

- When feedback is opened from the context menu, capture the clicked element as the feedback target.
- Store safe metadata about the clicked element, such as:
  - selector or generated stable path
  - element tag
  - visible text snippet
  - aria-label/title/role when available
  - nearest form label or heading
  - page URL
  - page title
  - viewport size
- Do not store sensitive field values from passwords, tokens, secrets, or private inputs.
- Allow users to choose whether feedback is about the clicked element, the whole page, the current feature, a plugin, or another scope.
- Highlight the selected target while the feedback modal is open when practical.
- Remove the highlight when the modal closes.

#### Optional Screenshot Support

- Add optional screenshot attachment support without browser tab/window picker prompts.
- Screenshots must be opt-in by the submitting user.
- Do not require screenshots for feedback submission.
- Support uploaded screenshot image files.
- Support pasted screenshots from the clipboard where browsers allow it.
- Consider full-page screenshots only if a safe DOM-rendering implementation or browser extension path is added later.
- Store screenshots only when explicitly attached by the user.
- Clearly warn users not to include sensitive information in screenshots.
- Allow users to remove an attached screenshot before submitting.

#### Optional Diagnostic Data

- Automatically attach basic non-sensitive context:
  - user ID
  - current URL
  - page title
  - timestamp
  - selected scope
  - target metadata if element-targeted
- Make browser/user agent and screenshot/DOM snapshot optional opt-in fields.
- If DOM snapshot support is added, sanitize it before storage.
- Do not capture sensitive form values, passwords, tokens, secrets, private messages, or hidden data.
- Clearly label optional diagnostic data so users understand what they are submitting.

#### Feedback Visibility for Users

- On `/feedback`, show logged-in users a general list of current and past feedback that has not been deleted.
- Public/general feedback list should only show basic non-identifying information:
  - summary
  - category
  - general scope
  - status
  - created date
  - last updated date
- Do not expose submitter identity in the general feedback list.
- Allow users to see their own feedback in detail.
- Make it easy to distinguish the current user’s own feedback from general feedback.
- Consider a separate “My feedback” section or a clear badge/label in the shared list.
- Allow users to add comments to their own feedback when follow-up is needed.
- Allow users to see admin replies that are visible to the submitter.

#### User Feedback Notifications

- Add per-user feedback notification badges.
- Show a green badge/sphere with the number of the user’s feedback items solved since they last opened the feedback center.
- Show a red badge/sphere with the number of the user’s feedback items marked as needing more context.
- Show a grey badge/sphere with the number of the user’s feedback items marked as declined, rejected, duplicate, won’t fix, not planned, or otherwise not being worked on.
- Reset or update badge counts when the user opens the feedback center and views the relevant items.
- Ensure notification badges only reflect the logged-in user’s own feedback.

#### Feedback Statuses

- Support feedback statuses such as:
  - new
  - reviewed
  - accepted
  - planned
  - in progress
  - fixed
  - solved
  - needs more context
  - duplicate
  - rejected
  - not planned
  - won’t fix
  - archived
  - deleted
- Allow admins to change status from the admin review UI.
- Store status history with timestamps and actor information.
- Show user-friendly status names and explanations on `/feedback`.

#### Replies, Comments, and Work Notes

- Allow admins to reply to feedback.
- Allow submitters to comment on their own feedback.
- Allow admins to add private internal work notes that are not visible to normal users.
- Allow admins to mark feedback as “needs more context”.
- When feedback is marked “needs more context”, notify the submitter through the red feedback badge.
- Allow the submitter to add additional context/comments after the request.
- Distinguish clearly between public/admin replies, submitter comments, and private admin work notes.

#### Admin Feedback Review

- Add `/admin/feedback` for admin feedback review.
- Admins should be able to view full feedback details, including:
  - submitter
  - summary
  - description
  - category
  - severity
  - scope
  - target metadata
  - current URL
  - browser/user agent if submitted
  - screenshot if submitted
  - DOM snapshot if submitted
  - comments/replies
  - work notes
  - status history
- Add filters for:
  - status
  - category
  - severity
  - scope
  - plugin/area
  - submitter
  - date
  - needs admin action
- Add sorting by newest, oldest, severity, status, and last activity.
- Add admin actions:
  - change status
  - assign category
  - change severity
  - reply to submitter
  - add internal work note
  - request more context
  - mark duplicate
  - archive
  - delete
  - convert to OKF correction where relevant
  - link to existing issue/correction

#### OKF and AI Improvement Integration

- Keep this feedback system separate from AI reply feedback.
- Do not use this feedback system to rate individual AI replies.
- Use the AI Improvement Center for AI answer quality, wrong answers, bad context, and correction review.
- Add `wrong tool` as a classification in the AI Improvement Center.
- Allow core feedback to cover AI features, AI UI, AI configuration, and AI workflow problems.
- Allow admins to convert relevant core feedback into OKF corrections only when the feedback concerns documentation, feature behavior, terminology, or community/system knowledge.
- Do not automatically modify OKF based on general feedback.

#### Rate Limits and Abuse Prevention

- Add moderate rate limits for feedback submissions.
- Rate limits should prevent spam without blocking normal use.
- Encourage one feedback item per issue.
- Add validation to prevent empty or extremely vague feedback.
- Add optional duplicate detection based on similar title, scope, and page.
- If similar existing feedback exists, suggest adding a public comment or marking that it affects the user too instead of creating a duplicate.
- Allow admins to delete or archive abusive/spam feedback.

#### Data Storage and Preservation

- Store feedback data in SQLite or the existing app storage system.
- Store screenshots and optional attachments in a protected feedback uploads/storage directory.
- Preserve feedback data across repo updates, ZIP updates, migrations, and recovery operations.
- Include feedback data in the protected user-data list for backups and update preservation.
- Never overwrite feedback data during core/plugin updates.
- Include feedback data in backup/restore planning.
- Store enough metadata for auditability:
  - created_at
  - updated_at
  - submitter_id
  - assigned_admin_id if used
  - status history
  - comments/replies
  - linked issues/corrections

#### Privacy and Safety

- Do not expose submitter identity in the general feedback list.
- Only admins should see submitter identity and full diagnostic details.
- Users should only see full detail for their own feedback.
- Sanitize all submitted HTML/text before rendering.
- Avoid capturing sensitive form values.
- Make optional diagnostic capture transparent to users.
- Add admin controls for deleting sensitive feedback, screenshots, or diagnostic data.
- Ensure permissions are enforced server-side, not only in the UI.

#### Acceptance Criteria

- Logged-in users can submit general feedback from a persistent UI entry point.
- Logged-in users can submit targeted feedback from the custom right-click context menu.
- Right-click context menu includes Back, Forward, Copy, Cut, Paste, Link to here, Hard reload, and Feedback.
- Feedback modal can target the whole page, clicked element, current feature/page, plugin, broad system area, or custom scope.
- Users can optionally attach screenshots by upload or clipboard paste.
- `/feedback` appears under the Community navbar section for logged-in users.
- `/feedback` shows general non-identifying feedback summaries and detailed feedback for the current user’s own submissions.
- Users see per-user notification badges for solved, needs-context, and not-worked-on feedback.
- Admins can review and manage feedback at `/admin/feedback`.
- Admins can reply, add work notes, request more context, change statuses, finalize and close, reopen closed feedback, and permanently delete feedback.
- Feedback data is preserved across updates and included in protected user data.
- AI reply feedback remains handled by the AI Improvement Center, with an added `wrong tool` classification.

### Homepage Hero System and Embeds

#### General Hero Embed Requirements

- Continue improving service-specific "why unavailable" messages where external providers expose enough signal.
- Improve handling of live-only Twitch heroes and live-state detection.
- Add explicit Discord invite-to-widget guidance or lookup support if Discord server IDs are not known.

#### Discord Server Widget Hero

- Add optional Discord invite-to-server-ID lookup support if Discord server IDs are not known.

#### Twitch Stream Hero

- Support additional configured parent domains for alternate hostnames.
- Support stream-only and stream-with-chat layouts.
- Respect Twitch minimum player size requirements.
- If live-only mode is enabled, check live status or gracefully hide/fallback when offline.
- Show a clear admin warning when the Twitch embed fails due to missing or incorrect parent domain.
- Add admin helper text explaining that Twitch embeds require the site domain to be allowed as a parent domain.

#### YouTube Live Hero

- Support YouTube live video URLs, raw video IDs, and optional channel-based live lookup.
- For static live heroes, extract and use the provided live video ID.
- For automatic channel live detection, require YouTube API configuration.
- Cache live lookup results to avoid excessive API calls.
- Support optional live-only mode.
- Support optional YouTube live chat only when a valid live video ID exists.
- Support autoplay and muted settings.
- If live-only mode is enabled and no active stream is found, skip the hero or show fallback content.
- Show fallback/error states for private, removed, age-restricted, embedding-disabled, unavailable, or not-yet-live videos.
- Add admin helper text explaining that YouTube Live requires either a live video link or API-based channel lookup.

#### YouTube Video Hero

- Show fallback/error states for private, removed, age-restricted, unavailable, or embedding-disabled videos.
- Detect embedding-disabled videos before save when a YouTube API key or another reliable server-side signal is available.

#### External Embedded Content Hero

- Support generic external iframe embeds only for sites that explicitly allow embedding.
- Detect or gracefully handle sites that block embedding through `X-Frame-Options` or CSP `frame-ancestors`.
- Show an admin warning when an external site refuses to be embedded.

#### Hero Embed Admin UX

- Show “why unavailable” information in the admin UI when a hero cannot render.

#### Homepage Hero UX Improvements

- Review all homepage builder forms for non-technical usability.
- Add tooltips and inline explanations where appropriate.

### Update Page UX Improvements

- Add async in-place checks for the older `/admin` and `/admin/settings` update buttons, matching `/admin/updates`.
- Continue simplifying advanced update terminology without hiding recovery-critical detail.

### UI Text and Button Language

- Review all button labels, field labels, headings, helper text, warnings, empty states, and confirmation dialogs across Lumi.
- Replace technical/internal wording with clearer user-facing wording where possible.
- Keep AI-related wording precise enough for admins to understand model, provider, context, retrieval, embeddings, feedback, corrections, and OKF behavior.
- Review the update pages and simplify labels such as `Check plugin`, `Apply safe target`, and `Disable for recovery`.
- Prefer clear action labels such as `Check for updates`, `Update plugin`, `Use recommended version`, `Disable temporarily`, and `Start recovery mode`.
- Add short helper text below advanced or risky update actions explaining what will happen.
- Replace implementation-focused wording with task-focused wording wherever practical.
- Avoid exposing Git, branch, commit, target, repository, cache, migration, or rollback terms unless the user needs them.
- When technical terms are unavoidable, add short tooltips or inline explanations.
- Standardize common action wording across all pages: save, update, check, review, restore, disable, enable, archive, delete, retry, import, export, cancel, and confirm.
- Ensure destructive or system-changing actions have clear confirmation text.
- Ensure error messages explain both what went wrong and what the admin can try next.
- Review plugin management, core settings, update pages, homepage management, OKF management, feedback review, and AI configuration for inconsistent wording.
- Split highly technical pages into simple and advanced sections where practical.
- Hide rarely needed expert controls behind expandable advanced sections.
- Add examples for fields that expect URLs, model names, provider names, paths, selectors, or structured values.
- Ensure labels and helper text are suitable for non-technical admins without removing important admin-level specificity.
- Review localization/translation keys if present so simplified wording remains consistent across languages.

### Custom Commands
- Wrap `function run(ctx){ ... }` around each custom command, preventing the requirement of it being defined, but leaving support for it being defined if it is.
- Incorporate more custom command modes:
  - Random Reply
    - Has an optional RNG number that can be enabled and refernced from within the messages, and can also be used to define message selection criteria (eg. rng must = <20|>10)
    - Has an optional weight system that returns a message randomly based on a weight as an int 1-999

## Done

- 2026-07-19: Fixed native chat overlays to include Lumi's own platform messages; added `platform:username|id` and linked `lumi:username|id` blocking before scoped delivery; replaced text platform/badge labels with images and official Twitch badge catalog artwork; added normalized unsaved source previews, secured website-CSS drafts, visible dirty/revert state, sticky save controls, contrast backgrounds, and a placement grid; and hardened transparency against late-loading alert-app DOM/style changes.

- 2026-07-19: Added the native Lumi chat overlay source with combined Twitch, YouTube, and Discord messages; optional platform/channel filters; avatars, badges, Twitch emotes, timestamps, typography, transparent colors, alignment and spacing; entry/exit animations; bounded timeout/capacity removal; isolated CSS; representative editor previews; and short-lived reconnect replay through the existing scoped overlay event stream.

- 2026-07-18: Replaced frame-only website styling with OBS-style document CSS injection. External alert pages now receive OBS's transparent body CSS by default plus administrator selectors inside the website document; scoped revocable source tickets, opaque sandboxing, no-referrer handling, bounded public fetching, and private-network blocking protect Lumi and its overlay secrets.
- 2026-07-18: Fixed OBS overlay transparency and preview fidelity by applying OBS's exact default Browser Source CSS, rendering the editor and clean output from the same full-resolution canvas coordinate system, keeping iframe surfaces transparent, and showing the required OBS width/height plus copyable CSS in setup.

- 2026-07-18: Reworked shared logging repo-wide with structured component/category/event/request metadata, recursive secret redaction, bounded details, automatic retention, scoped plugin loggers, platform/command/webhook/lifecycle/admin HTTP auditing, live `/admin/logs` updates, complete server-side filters and summaries, and text/JSONL exports.
- 2026-07-18: Fixed core 0.2.10 local Windows startup under Node.js 24 by resolving npm's JavaScript CLI through the active Node installation, retaining a command-shell fallback, and verifying automatic dependency repair through the real launcher on port 3000.
- 2026-07-18: Fixed core 0.2.9 and Lumi AI 0.8.5 forms whose `action` or `method` fields could shadow the form endpoint, added a shared clobber-safe resolver, and migrated the affected feedback/settings requests to it.
- 2026-07-18: Fixed Lumi AI 0.8.4 Improvement Center state changes for no-change, dismiss, edit, and restore actions with an explicit authenticated JSON contract, actionable errors, safe diagnostics, and focused regression coverage.
- 2026-07-18: Fixed private reverse-proxy HTTPS recognition for production diagnostics in core 0.2.5 without globally trusting client forwarding headers, and taught the local client to consume the repository's env-style `.secrets` file and short diagnostic variable names directly.
- 2026-07-18: Fixed Windows/network-share plugin updates in core 0.2.6 by leaving live preserved plugin data in place and transactionally replacing only code, including automatic code rollback coverage.
- 2026-07-18: Retired the one-off core repair ZIP build scripts after repository updates proved reliable; core 0.2.6 is distributed through the normal immutable Git release flow.
- 2026-07-18: Reworked Lumi AI 0.8.3's Improvement Center into a live, non-technical review queue with one-step activation, direct final outcomes, automatic queue cleanup, and searchable/restorable/editable finalized-feedback history.
- 2026-07-18: Updated production diagnostics examples in core 0.2.4 to derive the full endpoint and client base URL from the administrator's current Lumi request instead of showing a placeholder hostname.
- 2026-07-18: Fixed the shared submit-action resolver in core 0.2.3: ordinary buttons now inherit their parent form endpoint unless they explicitly declare `formaction`, restoring timed diagnostics-key creation and preventing async update actions from posting back to the Updates page.
- 2026-07-18: Added production-stage plugin update diagnostics in core 0.2.2: selected plugin source is verified before snapshotting, failures record their exact stage and target in update state, and the affected plugin row displays the server error directly.
- 2026-07-18: Added opt-in production diagnostics in core 0.2.2: administrators can issue or revoke a one-time access key for an HTTPS-only, rate-limited endpoint with five fixed read-only checks, recursive secret/path redaction, and audited access; no arbitrary command, SQL, file, URL, or write capability is exposed.
- 2026-07-18: Released the follow-up core 0.2.1 update-page fix: update checks now have one client-side handler, successful results use clear module-specific wording, and exact core/plugin version controls are collapsed and list only the selected module’s versions.
- 2026-07-18: Audited the 0.1.9-to-0.2.0 update boundary, removed core's direct dependency on OKF plugin files, made OBS WebSocket optional, added locked runtime dependency repair, corrected 1.2.0 to 0.2.0, added immutable release metadata and exact-version core/plugin installs, and produced a checksummed data-preserving core repair patch.

### 2026-07-18

- 2026-07-18: Prepared Lumi Core 0.2.0 release metadata with a safe path from 0.1.9 and a version-correction path from the mistakenly published 1.2.0, patch-bumped all changed plugin/tool packages, added core and package-specific changelogs, synchronized generated OKF version references, and added release-metadata verification.
- 2026-07-18: Fixed community OKF discovery end-to-end: Community Knowledge now lists and opens visible file-backed community entries alongside general entries, keeps admin-only files role-filtered, tolerates a single-character name typo such as `jejee`/`Jejeee`, and carries the earlier user subject into explicit OKF follow-ups without treating previous assistant text as evidence.
- 2026-07-18: Made Lumi AI OKF-first: role-filtered OKF retrieval now precedes normal gate routing, the fast model can answer sufficient local facts, verified link questions return exact OKF URLs, early context is reused instead of searched twice, and Web Search is unavailable whenever the fast gate confirms OKF is sufficient.
- 2026-07-18: Improved fast OKF reply quality: compact evidence now preserves useful roles, relationships, aliases, activities, and channel names; one-word or incomplete identity replies are rejected; grounded terse drafts receive one bounded fast-model rewrite; and relationship follow-ups must explicitly answer the requested relationship before bypassing the main model.
- 2026-07-18: Hardened Lumi AI use of OKF and read-only tools: natural-language SQLite OKF scoring, relevance-ranked file/database merging, explicit evidence precedence, untrusted retrieval boundaries, and deterministic Web Search source URL grounding with focused privacy/reliability coverage.
- 2026-07-18: Reworked update snapshots to exclude preserved/reconstructable data such as LLM models and runtimes, compress core/plugin/database rollback payloads, compact legacy raw snapshots, delete consumed payloads after rollback, and enforce admin-configurable 30-day/per-target retention automatically at startup and update boundaries.
- 2026-07-18: Extended custom-command discovery: optional descriptions now persist through create/edit, `/commands` reuses the safe stored output preview without public refresh controls, users can switch custom rows between preview and description, saved per-command platform assignments are visible, and grouped-command expansion remains reliable after list filtering.
- 2026-07-18: Completed a repository-wide WebUI visual cleanup through the shared Lumi design system: clearer card/section rhythm, accessible fieldset legends, compact aligned action rows, non-stretching form controls, responsive filter panels, and improved mobile behavior. Reworked the densest Settings, Custom Commands, Feedback, OKF, Lumi AI, and OBS overlay screens while preserving the active theme; the OBS editor keeps a sticky preview and independently scrollable settings column with reachable bottom spacing.

### 2026-07-17

- 2026-07-17: Completed exported P0 preflight/security work: deterministic preflight/all verifiers, shared atomic retrying file writes with diagnostics, shared WebUI authentication guards, OKF privilege/field filtering, direct dependency audit remediation, and signature-validated bounded uploads with cleanup and protected downloads.
- 2026-07-17: Completed exported P1 update/recovery work: protected-data preservation tests, rollback-safe repository/tool updates, shared async update actions, clearer update language, and activation validation inside tool-install transactions.
- 2026-07-17: Completed Lumi AI feedback and work-history tasks: answer ratings/comments/context snapshots, admin review/corrections, correction links/inventory, sanitized grouped Codex exports including legacy rows, and controller/retrieval diagnostics coverage.
- 2026-07-17: Completed OKF usability and retrieval work: live Markdown previews, role-safe contributor navigation, category/tag filtering, deterministic generated files, improved specific-query ranking, generic-help suppression, and correction discovery.
- 2026-07-17: Completed core feedback hardening: merge/unmerge with canonical support aggregation, richer route/plugin/target filters, stronger duplicate similarity, attachment lifecycle/security, clipboard fallbacks, and expanded correction redaction.
- 2026-07-17: Completed the trusted placeholder migration audit, fixed deterministic async replacement, added resolver timeouts/fallbacks, documented cache-only platform data status, and added the admin-managed permission-aware `{{custom.*}}` registry.
- 2026-07-17: Completed homepage embed reliability: Twitch multi-parent player/chat layouts and minimum sizing, YouTube cached connected-channel live lookup and valid-video live chat, live-only fall-through, responsive dual-frame rendering, and clearer setup warnings.
- 2026-07-17: Completed the major UI wording/action audit: task-focused labels, contextual helper text, consistent destructive styling/confirmations, and removal of generic Save/Update button labels from primary forms.
- 2026-07-17: Completed custom-command expansion: automatically wrapped JavaScript/Python snippets, preserved explicit/module handlers, Random Reply mode, optional RNG conditions, integer weights, the `{{core.command.rng}}` value, migration-safe storage, validation, and previews.
- 2026-07-17: Hardened Dynamic command previews after release audit: safe built-ins remain available, harmless blocked-word text no longer causes false failures, host-constructor escapes remain disabled, external preview network requests are blocked, and long previews now expand inline without altering punctuation or whitespace.
- 2026-07-17: Benchmarked file-backed OKF search with generated 1,000- and 2,000-file fixtures, including visibility and changed/deleted-file assertions. Persistent indexing is deferred until the documented 2,000-file/100-ms-p95 threshold is crossed.
- 2026-07-17: Added the optional OBS Browser Bridge provider using OBS-injected page bindings: scoped heartbeat/state reporting, active-instance election, page-permission diagnostics, scene synchronization and commands, transitions/output/canvas/source status, profile/scene-collection capability reporting, and a non-destructive OBS setup importer. No repo push yet.
- 2026-07-17: Connected destructive controls across core and plugins to the shared timed-confirmation contract, moved generic Lumi AI and Auto VC deletes onto explicit protected routes, added timed update-restore requests, and added a repository-wide destructive-action verifier. No repo push yet.
- 2026-07-17: Extended OBS overlays with video/media and audio sources, play-once/loop/manual behavior, volume/start/speed/video-fit controls, live playback restart, website-alert autoplay audio, and isolated web-frame CSS plus crop/zoom controls. No repo push yet.
- 2026-07-17: Added the visual overlay editor follow-up locally: simplified user-facing language, contextual help, a responsive sticky preview canvas, drag/resize/nudge transforms, Ctrl/Cmd-toggle snapping to canvas and source lines, nine anchors, conditional source controls, horizontal/vertical text alignment and overflow modes, and sandboxed third-party website sources with live manual refresh plus bounded automatic health recovery. No repo push yet.
- 2026-07-17: Implemented the P0 OBS overlay system locally: multi-overlay and scene management, fixed and active-scene Browser Sources, encrypted revocable tokens, live scoped updates with reconnect recovery, reusable overlay module instances, optional OBS WebSocket testing/control/mapping/sync with loop prevention, future trusted-client provider interfaces, focused tests, and documentation. No repo push yet.

### 2026-06-25

- 2026-06-25: Continued Lumi AI runtime CUDA-preference work locally: Windows NVIDIA-compatible installs now prefer the managed CUDA llama.cpp runtime over Vulkan, the runtime manifest supports CUDA dependency archives, runtime downloads validate/reuse complete partial archives, install metadata records the backend variant/dependencies, and `/plugins/lumi_ai` shows the total runtime download size. No repo push yet.
- 2026-06-25: Fixed Lumi AI runtime reinstall lock handling locally: redownloading/reinstalling the managed runtime now stops main and gate runtimes just before file replacement, pauses gate auto-recovery during install, replaces runtime files through a retryable backup/restore path, reports locked runtime files clearly, and shows install-stage download status. No repo push yet.
- 2026-06-25: Fixed Lumi AI simple OKF lookup routing locally: short factual identity-style prompts now deterministically route to main LLM with light OKF retrieval instead of failing through the gate runtime, OKF file search ignores common lookup stopwords and handles compact/camel-case names, no-context prompts use a smaller compact scaffold, OKF retrieval diagnostics record query/candidate/fallback details, and a community people OKF seed file plus verifier coverage were added. No repo push yet.
- 2026-06-25: Fixed broken timed-confirmation buttons locally: added core `LumiConfirm.destructiveToken/destructiveFetch` helpers for JSON/fetch actions that need backend confirmation tokens, moved the Lumi AI tool settings reset button onto that flow, and changed the Lumi AI eval-case delete button to the shared timed confirmation modal instead of the older custom confirm prompt. No repo push yet.

### 2026-06-21

- 2026-06-21: Fixed Lumi AI WebUI final delivery locally: WebUI no longer inherits a fixed platform character cap, constrained sources compact at safe text boundaries instead of raw tail truncation, and delivery diagnostics record whether compaction occurred. No repo push yet.
- 2026-06-21: Tightened feedback-to-Codex default exports locally: output is now task-centric strict JSON with short source references, route-only internal locations, deduplicated task sections, and full raw metadata retained only in the separate debug export. No repo push yet.
- 2026-06-21: Reworked Community and System-generated OKF file listings locally into responsive searchable/filterable tables using existing Lumi UI patterns while preserving file actions and permission behavior. No repo push yet.
- 2026-06-21: Added confirmed similar-feedback submission locally: matching reports are shown before submission, users can explicitly confirm that a report is distinct or adds context, and the server validates and records that confirmation before creating the report. No repo push yet.

### 2026-06-20

- 2026-06-20: Split OKF Management locally into General OKF, Community OKF, and System-generated OKF tabs; kept community files editable, kept generated core/plugin OKF read-only, and added generated file preview links backed by the existing file knowledge loader. No repo push yet.
- 2026-06-20: Expanded generated system OKF route documentation locally: generated core/plugin files now include route purpose, detected request inputs, response format, access signals, side effects, and static-analysis limitations; plugin routes now use mounted full paths. No repo push yet.
- 2026-06-20: Fixed generated OKF route docs overloading Lumi AI prompts locally: OKF context now keeps only the top high-signal chunks, drops generic route-list chunks when specific route chunks match, and enforces a hard context character budget before inference. No repo push yet.
- 2026-06-20: Added a first Lumi AI controller-routing pass locally: introduced a validated controller decision schema, internal modes `fast|normal|expanded|unlimited`, OKF retrieval depths, source profile metadata, controller metrics/diagnostics, controller-aware output budgets, and safe fallback so low-confidence/failed gate decisions escalate to at least normal processing instead of tiny simple-answer budgets. No repo push yet.
- 2026-06-20: Continued Lumi AI controller-routing locally: exposed source-profile final-output limits in Lumi AI admin settings, kept internal processing budgets code-owned/dynamically selected, added a compact controller stage event for assistant jobs, and surfaced controller mode/reason in recent job diagnostics without showing token-budget columns. No repo push yet.
- 2026-06-20: Hardened Lumi AI controller diagnostics locally: controller normalization now clamps invalid source profiles and bad enum values, delivery metrics include controller details plus truncation/final-delivered lengths, and settings metrics visibly mark truncated replies. No repo push yet.
- 2026-06-20: Corrected Lumi AI controller budget UX locally: removed user-facing token budget controls, raised code-owned dynamic controller mode budgets so OKF route explanations are not starved, removed token-budget columns from diagnostics, and lifted the global Feedback button above the assistant chat panel when visible. No repo push yet.
- 2026-06-20: Added grouped Lumi AI work history locally as an enhancement to the existing Metrics table: request-scoped prompt/controller/gate/OKF/prompt-build/model/delivery/error/fallback events are grouped by work item inside `#metrics > div.table-wrap > table`, with full-row expandable summaries and nested lifecycle sub-tables, processed/final/delivered token estimates, filters, count/age retention, safer route-like prompt classification, and fallback recording for empty model responses. No repo push yet.

### 2026-06-19

- 2026-06-19: Added admin feedback-to-Codex export locally on `experimental-okf`: per-feedback Export to job, selected/all eligible global export, sanitized JSON taskfile modal with copy/download, optional Lumi AI compression using a configurable token/context limit, and the `internal-feedback-to-codex-taskfile` trigger phrase. No repo push yet.
- 2026-06-19: Fixed feedback-to-Codex export UX locally: export clicks now open a modal reliably, the result surface is copy-focused, AI compression controls render only when Lumi AI is actually available, and token/context limit appears only when AI compression is enabled. No repo push yet.
- 2026-06-19: Refined feedback-to-Codex export locally: default output is now a compact strict-JSON Codex taskfile with normalized severity/priority, actionable areas to inspect, concrete requirements/criteria/validation, privacy redaction, and closed/duplicate/rejected feedback kept debug-only; full verbose export remains selectable as debug mode. No repo push yet.
- 2026-06-19: Fixed feedback submission without screenshots by making the screenshot normalizer accept null/no-file submissions and store empty screenshot columns instead of throwing. No repo push yet.
- 2026-06-19: Applied exported feedback task `51386173-03bc-4674-82ca-e5cdcb6088ed` locally: OKF entry creation moved into a modal opened by a top-right OKF admin header button, while editing remains inline and server-side permissions/routes are unchanged. No repo push yet.
- 2026-06-19: Improved feedback target capture locally: detected target now stores a semicolon-separated semantic UI path such as `/admin/feedback;Feedback queue;Feedback entry metadata` instead of raw clicked-container text, and exports prefer that path. No repo push yet.
- 2026-06-19: Updated feedback-to-Codex export context locally: compact taskfiles and AI compression now include sanitized submitter comments, admin replies, and private admin work-note context without actor identity or raw private data. No repo push yet.
- 2026-06-19: Applied exported feedback task locally: `taskfile-export.json` is ignored/local-only, feedback modal backdrop clicks and Escape no longer close the form, non-submitted feedback drafts persist in session storage and restore from the floating button or context menu, current-session screenshot attachments survive close/reopen, and Reset clears the draft from the right side of the modal action row. No repo push yet.
- 2026-06-19: Added conservative feedback-to-Codex grouping locally: default compact exports now merge likely related actionable feedback by shared root-cause signals, route/target similarity, and error patterns, with grouped source references, affected targets, support counts, privacy-safe distinct reporter counts, and debug export left unchanged. No repo push yet.
- 2026-06-19: Added first file-backed OKF retrieval locally: documented `knowledge/core`, `knowledge/plugins`, `knowledge/community`, and `knowledge/corrections`; added Markdown/frontmatter parsing, heading chunks, source metadata, user/mod/admin visibility checks, corrections/community/plugins/core priority, Lumi AI context integration, and verifier coverage. No repo push yet.
- 2026-06-19: Hardened file-backed OKF retrieval locally: added access-aware placeholder resolution for visible frontmatter values, generic missing-reference markers for hidden/unavailable references, mtime/size-based changed-file reuse, deleted-file cache cleanup, and verifier coverage for placeholder privacy plus update/delete reindexing. No repo push yet.
- 2026-06-19: Added generated core/plugin OKF locally: generator creates reproducible `knowledge/core/lumi-core.md` and per-plugin `knowledge/plugins/*.md` files from package metadata, README, core routes, plugin manifests, plugin routes, and static command trigger hints; generated files are skipped when marked editable or non-generated. No repo push yet.
- 2026-06-19: Added admin-editable community OKF files locally: `/plugins/okf/admin` now lists, creates, edits, previews, and renames `knowledge/community` Markdown files with frontmatter fields and refuses saves to generated or non-editable files. No repo push yet.
- 2026-06-19: Added admin feedback-to-correction OKF creation locally: `/admin/feedback` can create sanitized, searchable correction Markdown files under `knowledge/corrections`, records source feedback metadata, links the generated path back to the feedback item, and verifier coverage confirms correction file search priority. No repo push yet.
- 2026-06-19: Added OKF admin category/tag suggestions locally: create/edit entry forms and community file forms now use existing category/tag datalist suggestions from all manageable OKF entries plus community files to reduce duplicated taxonomy wording. No repo push yet.
- 2026-06-19: Refined OKF admin editing locally: selected entries now open in a full-screen modal with session-backed draft preservation and explicit close/reset controls, and the Community OKF category suggestion input no longer shows a misleading dropdown arrow. No repo push yet.
- 2026-06-19: Added OKF update preservation notes/tests locally: `knowledge/README.md` documents preserved local OKF paths, and the OKF verifier asserts repo-based updates preserve `knowledge/community` and `knowledge/corrections`. No repo push yet.
- 2026-06-19: Added global placeholder auto-suggest locally: placeholder-compatible fields opt into scoped JSON placeholder sources, suggestions trigger from `{{` through the first whitespace-delimited token, current-level suggestions can be inserted by keyboard or click, invalid completed placeholders get a faint red backlight when the cursor leaves them, and OKF admin Markdown fields now use OKF placeholder suggestions. No repo push yet.
- 2026-06-19: Refined global placeholder auto-suggest locally: inline suggestions now show up to 9 current-level options plus a distinct Expand action that opens a searchable placeholder tree; live search greys out non-matching tree entries and collapses branches with no matches; selecting a tree leaf inserts the full placeholder and closes the modal. No repo push yet.
- 2026-06-19: Refined placeholder tree display locally: the Expand modal now renders recursive collapsible placeholder levels instead of repeating full placeholder strings, with structural `{{`, `.`, and `}}` tokens muted so branch/field names are easier to scan. No repo push yet.
- 2026-06-19: Fixed placeholder suggestion source locally: auto-suggest now exposes only authored/custom frontmatter keys, not generic metadata like `scope`, `status`, `editable`, or `generated` on every OKF entry; manual placeholder resolution remains permissive for explicit metadata references. No repo push yet.
- 2026-06-19: Improved placeholder level selection locally: choosing an inline branch suggestion ending in `.` keeps the suggestion menu open and refreshes to the next level, so admins can click through levels smoothly without deleting/retyping punctuation. No repo push yet.
- 2026-06-19: Corrected placeholder direction locally: removed the Community OKF per-file custom placeholder editor, kept OKF placeholder suggestions system-generated from visible file metadata, and added Throne Wishlist destination message placeholders as a generated double-brace source with legacy single-brace rendering preserved. No repo push yet.
- 2026-06-19: Added secure placeholder registry locally: `src/services/placeholders.js` now owns server-side placeholder definitions, trusted field policies, shared access checks, catalog/preview APIs, save-time validation, and runtime rendering; custom command static responses and Throne Wishlist message templates use field policies, Throne registers namespaced `{{plugin.throne_wishlist.*}}` placeholders with legacy aliases, raw `payload_json` is withheld from user-visible output, the frontend catalog fetches by `data-placeholder-field`, and `docs/placeholder-system.md` documents the architecture/security rules. No repo push yet.
- 2026-06-20: Extended placeholders locally for OKF and platform integrations: OKF Markdown fields now use the global server catalog with output-audience-specific policies, SQLite-backed OKF entries validate placeholders on save and resolve them on display, file-backed OKF frontmatter values register as `{{okf.file.*}}` placeholders with legacy aliases, and safe platform placeholders were added for Discord guild stats plus locally available Twitch/YouTube channel/runtime values. No repo push yet.
- 2026-06-19: Added OKF placeholder migration locally: OKF startup runs a one-time conversion for single-brace dotted OKF placeholders in `knowledge/*.md`, changing examples like `{community.currency.primary_name}` into `{{community.currency.primary_name}}` without touching already-double placeholders or unrelated plugin token systems. No repo push yet.

### 2026-06-18

- 2026-06-18: Fixed urgent UI tail items locally on `experimental-okf`: mobile sidebar now fits the viewport and scrolls internally, moderation notes can be permanently deleted by admins, both theme preview pop-out buttons open the preview, unauthenticated pages use the Lumi context menu with Feedback disabled, and the global savebar now submits URL-encoded settings data so normal settings routes actually save. No repo push yet.
- 2026-06-18: Updated OKF aliases/related questions to newline-only parsing and display so commas remain valid inside questions. No repo push yet.
- 2026-06-18: Continued `experimental-okf` locally: wired OKF into Lumi AI through the generic context provider hook, made AI context providers user/message-aware, and verified OKF AI context only includes published/approved entries and fields visible to the requester. No repo push yet.
- 2026-06-18: Continued `experimental-okf` locally: added shared core live user lookup, migrated OKF/Lumi AI/Moderation/Economy user-selection fields to it, fixed the moderation target search field, added OKF restore-from-version, and added OKF role-preview cards. No repo push yet.
- 2026-06-18: Started `experimental-okf` with a standalone OKF plugin: role-gated SQLite entries, sanitized Markdown browsing, admin/editor management, per-user OKF grants, workflow actions, version snapshots, and first verification coverage. No repo push yet.
- 2026-06-18: Emergency patched `/admin/navigation` so the Unassigned items pool stays sticky while editing sections on desktop, and aligned Save navigation / Reset to default actions in a shared horizontal Lumi button group.
- 2026-06-18: Removed feedback conversion actions from the experimental feedback system, added Finalize & Close/Reopen/Delete admin actions, made delete hard-remove feedback records/comments/notes/history/screenshots, kept admin feedback rows collapsed by default, and replaced browser tab capture screenshots with upload/clipboard-paste attachments.
- 2026-06-18: Fixed experimental feedback review buttons to use the stable save endpoint for Finalize & Close/Reopen and added a reusable Lumi `button-group` utility, including the `.field.button-group` specificity case, so review buttons align horizontally.
- 2026-06-18: Moved feedback screenshot guidance above Description, centered feedback screenshot/form action rows, and moved feedback modal sizing overrides into the later-loaded Lumi component layer so generic `.modal` styles no longer win.
- 2026-06-18: Added feedback “also affects me” records, user-facing similar-feedback suggestions before submit, admin plugin/area/date filters, sensitive-data cleanup controls, and keyboard navigation for the custom context menu; dropped external issue creation from the feedback roadmap and left OKF conversion deferred.
- 2026-06-18: Added protected general feedback attachments, protected attachment downloads, admin attachment cleanup/removal, viewer-safe public feedback details, and public context comments on existing feedback.
- 2026-06-18: Added opt-in sanitized page structure diagnostics for feedback, excluding sensitive form values and capping stored snapshot text server-side.
- 2026-06-18: Updated the experimental feedback context menu locally so all actions remain visible with disabled unavailable states, Back/Forward/Copy/Cut/Paste availability is context-aware, image/text copy and input-only cut/paste rules are enforced where browsers allow, and one-second viewport-clamped tooltips explain each action.
- 2026-06-18: Added a core feedback system first pass on `experimental-feedback-system`: SQLite feedback entries/comments/status history/view state, logged-in `/feedback`, admin `/admin/feedback`, persistent feedback modal, site-wide custom context menu with element-targeted feedback, per-user notification badges, admin replies/work notes/status changes, and AI Improvement Center `wrong_tool_usage` confirmed present.

### 2026-06-17

- 2026-06-17: Added Economy cleanup for fallback-name artifact users such as `SammyCat-2`, merging them into matching real platform users and making Economy stats tolerate missing/mid-migration tables; bumped Economy Framework to v0.2.9.
- 2026-06-17: Fixed update metadata for renamed Economy plugins so legacy installed rows are folded into canonical `economy-*` plugin update rows instead of appearing as separate installs; bumped core to v0.1.8.
- 2026-06-17: Renamed all remaining Economy internals from the old misspelled IDs/paths/tables to `economy-*`, added startup migration for legacy plugin rows, settings, command usage IDs, tables, uploads, asset paths, old URLs, and bumped core/plugin patch versions.
- 2026-06-17: Fixed user-facing Economy spelling, restored `/stats/{username}` Compare toggling, linked Top commands run leaderboard entries to `/commands`, and bumped core/plugin patch versions.
- 2026-06-17: Fixed custom command Edit buttons and `/commands` Copy Link / expand buttons with delegated handlers, clipboard fallback, and v0.1.5 patch bump.
- 2026-06-17: Fixed repo-based core updates deleting `data/update-cache/repo` during apply, added a verification guard, and bumped core package version to v0.1.4.
- 2026-06-17: Bumped core package version to v0.1.3.
- 2026-06-17: Completed homepage hero embed pass for Discord widgets, YouTube video playback options, external embed fallback/sandbox controls, admin validation, platform-specific fields, and Test preview behavior.
- 2026-06-17: Fixed core update snapshots for large ZIP-origin installs by replacing the full-install ZIP backup with a filesystem snapshot directory, avoiding the 2 GiB ZIP limit for large preserved files such as local AI models.
- 2026-06-17: Completed `/admin/updates` UX pass: viewport-fixed dismissible notifications, auto-dismiss for non-critical results, async core/plugin check actions without page refresh or scroll jumps, in-place update-card data refresh, loading states, and collapsed advanced Manual ZIP fallback below repo update containers.
- 2026-06-17: Completed homepage hero reliability pass: server-side hero validation before save, admin-visible validation errors, home-page fallback message for broken legacy heroes, automatic YouTube/Twitch/Discord embed derivation, correct Twitch parent host at render time, and image/embed conflict handling.
- 2026-06-17: Completed homepage hero builder UX pass: friendlier labels, contextual help text, normal URL paste support, automatic embed filling, per-row readiness messages, and test preview support.
- 2026-06-17: Fixed homepage links to support local Lumi paths such as `/commands`, and made unavailable live-only heroes fall through to lower-priority heroes instead of blocking the homepage.
- 2026-06-17: Completed update-page wording cleanup for common actions such as check, update, restore previous version, disable temporarily, and ZIP rollback wording.
- 2026-06-17: Added permanent repo-update architecture for ZIP-origin installs using `data/update-cache/repo`, non-live-git metadata checks, snapshot-copy apply, update-state recording, and preservation of user-owned paths.
- 2026-06-17: Separated Lumi AI `tool_info.json` tools from normal plugin update rows and rendered tools under the `lumi_ai` plugin row.
