# ReWrite — Roadmap Single tracker for the lifecycle of every feature and bug fix. Each item moves through three states: - **Planned** — agreed/backlogged, not yet built. Not committed to a release. - **Unreleased** — implemented and merged to `master`, but not yet shipped under a version tag. This is the staging area that becomes the next release's notes. - **Released** — shipped under a tagged version (see the per-version headings). This file replaces the old `FEATURES.md` (which only had "Open" and "Done"). The extra **Unreleased** state is the point: it makes "done in code" vs "available to users" an explicit, visible distinction, and it doubles as the draft changelog for the next release. ## How this drives the release process The release mechanics live in [RELEASING.md](RELEASING.md); this file is the content side. The two interlock: 1. **While building:** when you finish a feature or fix, add an entry under **Unreleased** (newest first). Keep the same engineering-detail style as the Released archive below, so the entry is still useful long after it ships. 2. **When cutting a release** (the version-bump step in [RELEASING.md](RELEASING.md)): rename the `## Unreleased` heading's items into a new `### — ` block at the top of **Released**, then re-add an empty `## Unreleased` for the next cycle. The version + date must match the tag you push (bare version, no leading `v`). 3. **Bug fixes count too:** a fix that ships in a patch release gets its own Unreleased entry and rides into the next version heading, so the archive doubles as a changelog reviewers and users can read. Keep an item in exactly one state. Moving an Unreleased item into a version heading is the release; do not leave a duplicate behind under Unreleased. ## Planned ### Plugin-managed local whisper.cpp server (desktop) — Phase B remainder (supervision hardening) The auto-start and idle-stop lifecycle toggles shipped (see Unreleased). The remaining Phase B work is deferred pending real-world reports: - Process supervision hardening based on real-world usage (zombies, orphans, signal-handling differences across platforms) beyond what the probe/adopt + PID-sidecar model already covers. --- ## Unreleased Merged to `master`, not yet tagged. These become the next version's release notes. --- ## Released > Per-version attribution starts with the first release cut after this roadmap was adopted. The archive below collects work that shipped across **1.0.0 through 1.1.0** before per-version tracking began; it is grouped as one historical block rather than retro-fitted to individual tags. New releases get their own `### — ` heading above this archive. ### 1.2.0 — 2026-07-08 ### Real-time transcription mode (live dictation at the cursor), configured independently of batch Opt-in live STT, command-only (`rewrite-voice-notes:realtime-transcribe`, "Real-time transcription (start/stop)"), no template / no LLM cleanup / no saved audio: it streams the mic to the provider over a WebSocket and types finalized segments at the editor cursor as they arrive, like dictation. Provider support is gated by `transcriptionProviderSupportsRealtime(id)` in [src/realtime/index.ts](../src/realtime/index.ts): only `deepgram` and `assemblyai` expose a browser-reachable streaming endpoint; the rest accept whole-file uploads only and the command errors with a steer to those two. New `src/realtime/` module: `pcm.ts` (`PcmCapture`, a `ScriptProcessorNode` mic tap, since `AudioWorklet` needs a separate module file a single-bundle plugin can't ship under the app CSP, plus the pure, unit-tested `downsampleBuffer` / `floatTo16BitPcm` to 16 kHz signed-16 PCM), `index.ts` (`RealtimeProvider` / `RealtimeSession` interfaces + `waitForOpen`/`waitForClose`), `deepgram.ts` (auth via the `['token', key]` WebSocket subprotocol so the key stays off the URL; `is_final` marks a final), and `assemblyai.ts` (Universal-Streaming v3; because a browser WS can't send an Authorization header, the real key mints a short-lived single-use 60 s token that alone rides the WS query, the one sanctioned exception to the "auth never in the query" rule; `format_turns` de-duplicates each turn). **Realtime is configured entirely independently of batch transcription**: its own `EnvironmentProfile.realtimeProvider` + `realtimeConfig` (key + model), persisted under secret id `profile-{kind}-realtime`, so a profile can run e.g. Voxtral for batch, AssemblyAI for realtime, and Anthropic for cleanup. The settings tab renders a self-contained "Real-time transcription" section (provider dropdown limited to None + realtime-capable, key, and the same adaptive model control as the batch fields via `populateModelField(..., 'realtime')`: dropdown + Refresh for Deepgram, text field for AssemblyAI). [src/ui/realtime.ts](../src/ui/realtime.ts) `RealtimeController` owns capture + session + a floating status bar (reuses `.rewrite-quick-floater`), inserts via `editor.replaceSelection`, and is a single plugin-owned session (`activeRealtime` + `realtimeStarting`, cancelled in `onunload`). Honest scope note preserved from the plan: lower-value than the cleanup pipeline (a raw transcript is what other voice plugins already do), shipped because the primitives were cheap once the streaming adapters existed. **Voxtral realtime was reverse-engineered and built but pulled**: Mistral's realtime endpoint rejects the only auth a browser WebSocket can send, so the adapter ([src/realtime/voxtral.ts](../src/realtime/voxtral.ts)) is kept on disk, unwired (not in the gate or factory, so not bundled or selectable), documented in `wiki/Voxtral-Realtime.md` for a contributor who finds a browser-auth path. Docs: CLAUDE.md (Real-time transcription section + gotchas), `wiki/Providers.md`, `wiki/Settings-Reference.md`, `wiki/Voxtral-Realtime.md`, `wiki/Commands-and-Menus.md`, README. ### Diarization moved from a settings toggle to per-invocation (template flag + per-run checkbox) Speaker diarization is no longer a persisted per-profile setting (which wrongly diarized e.g. daily notes, producing stray `Speaker A` labels). It is now chosen per recording: the per-template `NoteTemplate.diarize` frontmatter flag (Meeting transcript ships it on) sets the default, and the main modal shows an **Identify speakers** checkbox (`renderDiarizeToggle` in [src/ui/modal.ts](../src/ui/modal.ts)) only on a capable provider (assemblyai/deepgram/revai), defaulting to the active template's flag and reset on template change. [src/pipeline.ts](../src/pipeline.ts) computes `effectiveDiarize = (template.diarize || params.diarize) && transcriptionProviderSupportsDiarization(id)` and always sets `transcriptionConfig.diarize` explicitly. `PipelineParams.diarize` is threaded through the Record tab, `startRecordingPipeline`, and the Record-in-background handoff. The settings-tab "Identify speakers" toggle is gone; `TranscriptionConfig.diarize` is now purely the internal pipeline->adapter transport. Docs: CLAUDE.md (Speaker diarization), docs/DIARIZATION.md, `wiki/Providers.md`, `wiki/Settings-Reference.md`. ### Mobile foreground caution while recording Both recording UIs now show a mobile-only yellow caution (`MOBILE_RECORD_WARNING_TEXT`, "Keep Obsidian in the foreground...") for the duration of capture, because an app switch suspends the Capacitor WebView and kills `MediaRecorder` mid-recording (the screen wake lock only prevents screen-sleep, not backgrounding). Shown on record-start, hidden on stop/when busy: `.rewrite-mobile-record-warning` in the modal's Record tab and `.rewrite-quick-mobile-warning` in the Quick Record floater, both gated on `Platform.isMobile`. Styled yellow (`--text-warning`), distinct from the red silence warning, so it reads as an alert not an error. Docs: CLAUDE.md (Recording and capture gotcha), `wiki/Mobile.md`. ### Settings profile section: per-subsection headings + standardized field order The profile section is now split into three headed subsections (**Transcription**, **Real-time transcription**, **Post-processing (LLM)**) that share one field order: provider, base URL (where applicable), API key, then model. Previously only the real-time block had a heading and the batch/LLM blocks put the model before the API key. Purely a settings-tab layout change ([src/settings/tab.ts](../src/settings/tab.ts) `renderProfile`). Docs: `wiki/Settings-Reference.md`. ### Record in background, plus non-blocking capture always Two coupled changes to the main modal's Record tab. (1) **Processing already ran detached on Stop** (the 1.1.1 fix); this cycle confirms and preserves that: regardless of the new checkbox, pressing Stop closes the modal and runs the transcribe/cleanup/insert pipeline in the background so the vault is usable during processing. (2) **New "Record in background" checkbox** (desktop only, hidden on mobile where the WebView suspends backgrounded `MediaRecorder`), backed by the remembered `GlobalSettings.recordInBackground` flag (default off). When ticked, pressing Record does not capture in the modal at all: `startBackgroundHandoff` ([src/ui/modal.ts](../src/ui/modal.ts)) captures the modal's template + destination override + context hint into locals, closes the modal, and calls `plugin.startBackgroundRecording(opts)` ([src/main.ts](../src/main.ts)), which routes into the SAME `activeQuickRecord` slot + `quickRecordStarting` guard as the Quick Record commands (preserving the one-recording-at-a-time guarantee and the single `onunload` cleanup path). `QuickRecordController` / `startQuickRecord` gained optional `destinationOverride` + `contextHint` params, carried into `runPipeline`; switching templates via the floater popover clears them (they belonged to the original template). Docs: CLAUDE.md (Pipeline + Quick Record gotcha), `wiki/Commands-and-Menus.md`, `wiki/Settings-Reference.md`, README. ### Manage individual default templates: enable/disable + track/untrack via a `managed` flag Replaced the all-or-nothing default set with two per-default controls, surfaced as a "Manage built-in templates" checklist in the Templates settings section (`renderManageDefaults` in [src/settings/tab.ts](../src/settings/tab.ts), driven off `freshDefaultTemplates()`). **Enable/disable** governs existence: disabling deletes the on-disk file (matched by frontmatter `id`, via `app.fileManager.trashFile` behind a `ConfirmModal`) and records the id in `GlobalSettings.disabledDefaultTemplateIds`, which both `populateDefaultTemplates` and `updateDefaultTemplates` now receive as a `disabledIds` set and never (re)create — including a future re-ship. Decision: the ignore list is keyed by `id` only, not also by name (the `managed` flag already protects a name-colliding user template). **Track/untrack** governs updates via the new tri-state `NoteTemplate.managed` field: `true` (Populate/Update stamp it on files they create/reconcile — Update may reconcile), `false` (untracked; Update skips it, counted in `UpdateResult.untracked`), `undefined` (absent/empty — treated as tracked when the id matches a built-in, preserving pre-flag behavior). `parseTriStateFlag` + `renderTemplateFile` handle all three states; the untrack toggle edits just the frontmatter key via `processFrontMatter`. Update's file-matching became "id matches a built-in AND not `managed: false`", and `mergeTemplate` stamps `managed: true` on its result, so a user's own hand-authored template that shares a name (or id) with a built-in is never clobbered. `ConfirmModal` gained an `onCancel` hook so backing out re-renders/reset the optimistically-flipped toggle. Docs: `wiki/Creating-Templates.md` (frontmatter table row + dedicated `managed` section), `wiki/Settings-Reference.md`, CLAUDE.md (Managing individual defaults + Updating defaults). ### Auto-ingest folders: batch-process dropped audio with a preassigned template New `rewrite-voice-notes:process-ingest-folders` command ("Process auto-ingest folders", all platforms including mobile) plus a settings "Auto-ingest folders" section. Each rule (`GlobalSettings.ingestRules: { folderPath; templateId; enabled }[]`) pairs a vault folder with a newFile-mode template, edited in a popup ([src/ui/ingest-rule-modal.ts](../src/ui/ingest-rule-modal.ts), dropdown filtered to newFile templates). [src/ingest.ts](../src/ingest.ts) `runIngestBatch` scans each enabled rule's direct audio children (`collectIngestFiles`, exported/tested; no recursion), gates like manual reprocess (unlocked secrets + `isProfileConfigured`), and runs each file through the pipeline serialized behind a sticky Notice + Cancel. Each run reuses the reprocess path (`sourcePath` skips persist, keeps the `![[embed]]`); **move-on-success is the dedupe** — a fully-processed recording is moved to the attachments location via `app.fileManager.renameFile` (which fixes the note's embed link), so a re-run never reprocesses it and there is no processed-path bookkeeping in `data.json`; a failed file stays put and is retried next run. `isIngestTemplate` enforces newFile-only in both the rule editor and the runner (unattended runs have no active editor, so cursor/append would cascade to newFile anyway; requiring it makes the destination explicit). Same-folder guard, two layers: `collectWork` (now async) skips a rule UP FRONT (before creating any note) when its folder is also where recordings would be stored, resolved via the side-effect-free `resolveAttachmentFolder`; `moveIngestedFile` keeps the per-file `ingestTargetIsSameFolder` backstop for the case only knowable at move time. Failure reasons surface in a second sticky Notice (`• : `, first 5). `resolveAttachmentPath` extracted from `persistAudio` so the mover resolves the same destination a live recording would. Docs: `wiki/Settings-Reference.md` (Auto-ingest section), `wiki/Commands-and-Menus.md`, CLAUDE.md (Auto-ingest folders + gotchas), README. ### Local whisper.cpp server — Phase B: auto-start and idle stop Two opt-in lifecycle toggles for the desktop whisper.cpp host (both default off), completing the auto-start-lifecycle portion of the former Planned item #1. **Start automatically** (`localWhisper.autoStart`): after `onload`'s probe settles, [src/main.ts](../src/main.ts) starts the server when the active profile uses `whisper-local` and nothing was found to adopt (`shouldAutoStartWhisper`). **Stop when idle** (`localWhisper.idleStopMinutes`, 0 disables): a 60 s `registerInterval` calls `whisperHost.stopIfIdle()`, whose decision is the pure, unit-tested `shouldStopWhenIdle(...)` in [src/whisper-host.ts](../src/whisper-host.ts) — it only stops a ReWrite-owned (spawned/adopted, never external) server, never while a transcription is in flight, and only past the threshold. The `whisper-local` adapter brackets each transcription with `beginUse()`/`endUse()` (including the transcode) so a long job on a big model is never killed under the user and the idle clock restarts on completion; `start()` and `probe()`-adopt set the activity timestamp. Settings gained the two fields; the remaining Phase B supervision-hardening work stays in Planned. Docs: [docs/WHISPER_HOST.md](WHISPER_HOST.md) (Phase B section + config shape), `wiki/Settings-Reference.md`, `wiki/Self-Hosting-Whisper.md`, CLAUDE.md. ### Dev tooling: local-LLM build review + release-verification skill Added two `.mjs`-at-root scripts and the repo's first project-level Claude Code skill to close the gap that Obsidian plugins have no headless UI test harness (a self-inflicted `isLocked()` self-lockout regression shipped past build/lint/test and was only caught by hand in Obsidian). [local-review.mjs](../local-review.mjs) (`npm run review`): advisory, always-exits-0 code-review pass over the current diff, run against a locally-hosted llama.cpp model (Ornith 1.0), spawning/adopting the server (loopback-enforced, duplicating `whisper-host`'s `getHostArgs`/`isLoopbackHost`/`splitArgs` since that file can't load in plain Node), POSTing to `/v1/chat/completions`, printing findings + writing `docs/claude-scratch/local-review-report.md`. [prepare-release-vault.mjs](../prepare-release-vault.mjs) (`npm run release:prep`): fails-loudly build + copy of the three release artifacts into a scratch vault's plugin folder. [.claude/skills/release-checklist/](../.claude/skills/release-checklist/) (`SKILL.md` + `CHECKLIST.md`): the live feature-by-feature manual pass that replaced the stale `obsidian-voice-notes-spec.md` "Testing Checklist" (5-vs-10 templates, removed `webspeech`, flat 60 s poll, removed clipboard fallback). Both scripts share one gitignored `dev-tools.config.json` (no baked defaults, mirroring `LocalWhisperSettings`); pure logic is unit-tested in [test/local-review.test.ts](../test/local-review.test.ts) / [test/prepare-release-vault.test.ts](../test/prepare-release-vault.test.ts). New deep-dive [docs/DEV_TOOLING.md](DEV_TOOLING.md); CLAUDE.md and RELEASING.md updated. ### 1.1.1 — 2026-06-19 ### Fix: recording the modal now closes on Stop and reports via notices, instead of holding the modal open The main modal's **Record** tab used to keep the popup open after Stop, showing an inline "Working... / Transcribing..." line (and an inline **Retry** button on error) while the transcribe → cleanup → insert pipeline ran. It now closes the modal the moment recording stops and runs the pipeline detached, reporting progress through a sticky `Notice` (`setMessage` per stage: "ReWrite: Saving audio... / Transcribing... / Cleaning up... / Inserting...") and surfacing errors as a `Notice` — the same UX as reprocessing a saved file ([src/ui/audio-source.ts](../src/ui/audio-source.ts) `runAudioFilePipeline`). New private method `startRecordingPipeline(source)` in [src/ui/modal.ts](../src/ui/modal.ts) captures `profile` / `destinationOverride` / `contextHint` into locals, calls `this.close()`, then runs `runPipeline` inside a detached async IIFE. Safe because the `persist-audio` stage writes the recording to the vault before transcription, so the saved file is the recovery path on error (no inline Retry needed). **Paste** and **From note** keep the prior in-modal `execute` flow (inline progress + Retry), since their input is not persisted and closing would lose it. Docs updated in [CLAUDE.md](../CLAUDE.md) (Pipeline section) and [wiki/Commands-and-Menus.md](../wiki/Commands-and-Menus.md) (The main modal). ### Fix: secret storage now actually defaults on first run; passphrase creation no longer silently no-ops Two coupled bugs in the secrets bootstrap, both surfacing as "I can't create a passphrase without first switching to Obsidian secret storage, and the secrets file never gets written." **Probe ordering ([src/main.ts](../src/main.ts)).** `loadSettings()` runs `hydrateSecrets → loadAllKeys → ensureEnvelope`, which reads and caches the secrets envelope for the session. That ran *before* `warmSecretStorage()`, so on a fresh install the availability probe was still cold and `defaultEnvelope()` fell back to `'passphrase'` instead of `'secretStorage'`. Reordered `onload` so `warmSecretStorage(this)` runs before `loadSettings(this)`; a fresh install now correctly defaults to Obsidian secret storage when the OS store is available, not just labels it "recommended." **`setEncryptionMode` early-return ([src/secrets.ts](../src/secrets.ts)).** Because the envelope had cached as unconfigured `passphrase` mode, the create-passphrase flow called `setEncryptionMode(plugin, 'passphrase', pass)`, hit the blanket `if (envelope.mode === newMode) return;`, and silently did nothing — no kdf/verifier built, no `secrets.json.nosync` written. The modal reported success (onSubmit never threw) while status stayed unconfigured/locked, hence "set a passphrase first." Replaced the blanket guard with per-branch logic: secretStorage no-ops only if already active; configured passphrase flips mode only if not already active; an unconfigured passphrase store (no kdf/verifier) always builds a fresh envelope, *even when `mode` is already `passphrase`*. This also fixes a latent bug where a genuine Linux-without-keyring user (correctly defaulting to passphrase) could never create one through that path. Docs updated in [docs/SECRETS.md](SECRETS.md) (the `setEncryptionMode` model, the `warmSecretStorage` ordering note, and the probe gotcha). ### 1.1.0 and earlier (historical archive, not tracked per-version) ### Template maintenance: Update, default history, and Load prior versions Populate only ever adds missing files, so a changed built-in template (new field, new `noteProperty`, reworded prompt) can never reach a copy the user already has. Added three buttons sharing the Populate `Setting` row (Populate stays `.setCta()` primary; Update and Load prior versions secondary), in [src/templates-folder.ts](../src/templates-folder.ts). **Default history** ([src/settings/template-history.ts](../src/settings/template-history.ts)): `TEMPLATE_HISTORY: Record` is the plugin's in-code memory of past default versions, the base for the merge and the source for Load prior versions. Starts empty; maintenance rule (documented in CLAUDE.md): when you change a default in `default-templates.ts`, append the outgoing template under the manifest version it shipped in. **Update** (`updateDefaultTemplates`): per-field 3-way merge via `mergeTemplate(onDisk, def, priors)` (pure). A field is *pristine* (brought forward to the new default) when its on-disk value equals the current default or any prior shipped default; a genuine edit is kept. The prompt body is the only field whose kept edit becomes a report `body` conflict — an unedited old body is silently upgraded. Scalars/flags adopt-or-keep silently; `noteProperties` union by name (missing appended, pristine instruction upgraded, edited instruction kept + flagged, dropped property kept + flagged with `wasShippedDefault` so the report can say it is safe to delete). Matches files by `id` (new `readTemplateId` helper, also now backing `collectExistingIds`), `vault.modify`s only when the render differs (CRLF-normalized; never renames), then recreates any default deleted entirely (superset top-up; does NOT seed SharedCore.md / the guide). Non-auto-mergeable items go to **`Template update report.md`** via `writeTemplateUpdateReport` ([src/template-guide.ts](../src/template-guide.ts)), next to the guide (outside the templates folder), overwritten each run, `~~~text`-fenced "your file / default now" blocks. Types (`UpdateResult` / `TemplateUpdateEntry` / `TemplateUpdateConflict`) live in `templates-folder.ts`; `template-guide.ts` imports them type-only (the one new runtime edge, acyclic). **Load prior versions** (`loadPriorTemplateVersions`): writes each `allPriorVersions()` snapshot as a standalone selectable template with a distinct id (`@`) and versioned name (` `) for comparison; non-destructive, left untouched by Update/Populate; reports `available` so the button can say "none yet" while the registry is empty. Decisions (confirmed with user): per-field 3-way (not whole-template) auto-update; prior versions land in the templates folder as selectable templates; never delete user data (dropped properties kept + flagged). Caveat: a `vault.modify` re-serializes frontmatter via `stringifyYaml` and drops YAML comments; the body is untouched (unless it was an unedited old version) and a current file is never rewritten. The template guide gained "Keeping templates up to date" + "Comparing prompt versions" sections; CLAUDE.md updated. ### Live "no audio detected" warning during recording Warns the user about a muted or dead mic *while* recording instead of only surfacing an empty result afterward. [src/recorder.ts](../src/recorder.ts) taps the mic `MediaStream` with a Web Audio `AnalyserNode` in `start()` (not connected to `destination`, so no monitoring feedback) and samples peak amplitude every 100 ms via a `window.setInterval`. New methods `getInputLevel()` (0..1 peak), `hasDetectedSound()`, and `getSilentMs()` (continuous-silence ms; returns 0 while paused / stopped or when the analyser could not be built, so the UI never warns when there is nothing to listen to). `resume()` resets the silence baseline so the paused gap is not counted, and `releaseStream()` tears the monitor down on `stop()`/`cancel()`. Threshold `SILENCE_LEVEL_THRESHOLD = 0.015` clears even quiet speech but flags silence. Both recording UIs poll `getSilentMs()` in their existing 250 ms timer loop and show a "No audio detected" banner past `SILENCE_WARNING_MS` (3 s): the main modal's Record tab (`.rewrite-silence-warning`, [src/ui/modal.ts](../src/ui/modal.ts)) and the Quick Record floater, which gained a `.rewrite-quick-row` wrapper so the warning (`.rewrite-quick-silence-warning`) can sit below the controls (`setSilenceWarning`, hidden while busy, [src/ui/quick-record.ts](../src/ui/quick-record.ts)). Any Web Audio setup failure degrades to "monitoring unavailable" and the recording proceeds normally. CSS added in [styles.css](../styles.css). ### Per-template diarization override + Meeting transcript default Added `NoteTemplate.diarize?: boolean` (frontmatter `diarize: true`), a positive opt-in that forces speaker diarization on for a template's transcription regardless of the per-profile "Identify speakers" toggle. [src/pipeline.ts](../src/pipeline.ts) `collectTranscript` merges `{ ...profile.transcriptionConfig, diarize: true }` for the transcribe call only when the template flag is set AND `transcriptionProviderSupportsDiarization` is true for the active provider (assemblyai/deepgram/revai); a documented no-op on the rest. The profile config is never mutated, and a template can only raise the effective setting, never turn diarization off. Parse/render in [src/templates-folder.ts](../src/templates-folder.ts) follow the same always-emitted-key, boolean-or-`"true"` convention as `disableSharedCore` / `enableContextHint`. New eighth default template **Meeting transcript** ([src/settings/default-templates.ts](../src/settings/default-templates.ts)): the Meeting notes prompt adapted for `Speaker X:` input, shipped with `diarize: true` and `enableContextHint: true`. The vault-seeded template guide ([src/template-guide.ts](../src/template-guide.ts)) gained frontmatter-table rows and dedicated sections for both `enableContextHint` and `diarize`, plus an updated assembly-order list and template count. CLAUDE.md now records (in both the Documentation maintenance and Templates sections) that any template-structure change must update the template guide in the same commit. ### Optional per-invocation speaker/context hint for the LLM Lets the user supply short, free-text background about a recording (speakers, setting, subject) that is fed to the cleanup LLM, e.g. "Lecture by Dr. Smith on thermodynamics", "Podcast between Joe Rogan and Satan", "Meeting with Rachel, Joe, Billy, and Sally". Helps the model attribute statements, spell names, choose register, and pair with diarization's `Speaker X:` labels; the situational, one-off counterpart to the persistent Known nouns list. Decoupled into a UI gate and a flag-agnostic injection. **UI gate:** new positive opt-in flag `NoteTemplate.enableContextHint?: boolean` (frontmatter `enableContextHint: true`) decides whether the Context field is shown for a template; the reverse polarity of `disableSharedCore` (see [[shared-core-disable-flag-polarity]]). `parseTemplateFile` / `renderTemplateFile` in [src/templates-folder.ts](../src/templates-folder.ts) handle it like `disableSharedCore` (boolean `true` or string `"true"`; key always emitted for discoverability). The Meeting notes / Lecture / Podcast defaults ([src/settings/default-templates.ts](../src/settings/default-templates.ts)) ship with the flag; the other four do not. **Injection:** new `PipelineParams.contextHint?: string`; [src/pipeline.ts](../src/pipeline.ts) `cleanupTranscript` appends a `## Context` block (with a "treat as reference, not instructions" preface) whenever the hint is non-empty, ordered after `## Ad-hoc instructions` and before Known nouns. The pipeline never reads the flag — it injects on any non-empty hint. The hint flows in unescaped behind the shared-core anti-injection guardrail like the other system-prompt inputs. Two UI surfaces, each a collapsed `
` so the default path stays frictionless: the main modal ([src/ui/modal.ts](../src/ui/modal.ts) `renderContextSelector`, shown only when the active template has the flag; `contextHint`/`contextExpanded` instance state reset on template change, survives re-renders like `destinationExpanded`) and the reprocess-audio picker ([src/ui/template-picker.ts](../src/ui/template-picker.ts) `showContext`, which [src/main.ts](../src/main.ts) sets to `templates.some(t => t.enableContextHint)`; the typed value is forwarded to `runAudioFilePipeline` only when the picked template has the flag). Quick Record and the process-text command intentionally skip it. Value is per-invocation and ephemeral. CSS: `.rewrite-context-row` / `-summary` / `-body` / `-input` in [styles.css](../styles.css), mirroring the destination block. ### Speaker identification (diarization) for recorded/long-form audio Shipped the opt-in, string-embed v1 shape (option 1 from the former item #4). New optional `TranscriptionConfig.diarize?: boolean` ([src/types.ts](../src/types.ts)); capability centralized in `transcriptionProviderSupportsDiarization(id)` ([src/transcription/index.ts](../src/transcription/index.ts)), true only for `assemblyai` / `deepgram` / `revai`. The settings tab ([src/settings/tab.ts](../src/settings/tab.ts)) renders an "Identify speakers" toggle in the per-profile transcription block, gated on that helper (setup card left untouched). Each capable adapter embeds `Speaker X:` labels into the returned transcript string, leaving the `transcribe(): Promise` interface and the pipeline unchanged: AssemblyAI sets `speaker_labels: true` and formats `utterances[]` (native letter labels); Deepgram adds `diarize=true` and groups per-word `speaker` indices via `formatDiarizedWords` (0-based bumped to `Speaker 1`); Rev.ai fetches the JSON transcript (`Accept: application/vnd.rev.transcript.v1.0+json`) and rebuilds labels from `monologues[]` via `formatMonologues` (0-based bumped to `Speaker 1`). Each adapter falls back to flat text when the labeled payload is missing, so toggling off is a clean no-op. Label survival is handled by a clause added to `DEFAULT_SHARED_CORE` ([src/shared-core.ts](../src/shared-core.ts)); the Podcast default template already tolerated both cases. Decision: keep provider-native labels (letters for AssemblyAI, 1-based integers for Deepgram/Rev.ai) rather than normalizing. Structured `{ speaker, text }[]` segments deferred until a consumer needs them. ### Long-form audio workflow: lectures and podcasts (docs guide) Pure documentation; all primitives already shipped (reprocess-audio command + file/editor menu entries, Lecture/Podcast templates). Added an inline `## Long-form audio (lectures, podcasts)` section to [README.md](../README.md) walking through: getting an audio file (mic, meeting-tool export, ripped CD, or `yt-dlp` for YouTube with the ToS/copyright caveat that the user must confirm they have the right to the audio); dropping it in the vault; reprocessing via the file-explorer menu / command / `![[audio]]` embed; picking Lecture or Podcast; per-provider duration caps (recommend AssemblyAI/Rev.ai for multi-hour); and the new speaker-identification toggle (AssemblyAI / Deepgram / Rev.ai only). Added matching Features bullets. The hosted `yt-dlp` shell-out adapter remains deferred until demanded. ### Secrets encryption: dropped plaintext, hardened passphrase mode (verified keychain + entropy gate + Argon2id) Reduced the three secrets modes to two trustworthy ones (no unencrypted at-rest option). Implemented the [docs/REMOVE_PLAINTEXT_SECRETS_MODE.md](REMOVE_PLAINTEXT_SECRETS_MODE.md) plan plus the keychain-verification and passphrase-hardening work. **Dropped plaintext.** `EncryptionMode` is `'safeStorage' | 'passphrase'`. `defaultEnvelope()` falls back to an *unconfigured* passphrase envelope (no `kdf`/`verifier`) when no verified keychain exists; nothing is written in that state (`saveManyKeys` is a no-op while locked). `EncryptionStatus` gained `configured` (passphrase has a kdf+verifier) and `safeStorageInsecure`. `promptUnlock` ([src/main.ts](../src/main.ts)) branches on `configured`: unconfigured opens a create-passphrase modal, configured-but-locked opens the unlock modal. The four entry points were unchanged (unconfigured reports `locked === true`). Stored `plaintext` envelopes parse as invalid and reset to a fresh start (pre-release no-migration rule). Deferred to GA: Obsidian's `app.secretStorage` as the future zero-config cross-platform mode. **Verified OS keychain.** Split `getRawSafeStorage()` (present + `isEncryptionAvailable()`) from `getSafeStorage()`, which session-caches a gate that rejects Chromium's unencrypted `basic_text` backend and runs an encrypt/decrypt round-trip self-test. Only the verified accessor is used for encrypt/decrypt and availability; the settings tab shows the backend and an "OS keychain unavailable" warning (steering to passphrase) when `safeStorageInsecure`. **Hardened passphrase.** Entropy gate via new [src/passphrase-strength.ts](../src/passphrase-strength.ts) (zxcvbn-ts wrapper, `MIN_PASSPHRASE_SCORE = 3`), enforced hard in `changeEncryptionMode`/`changePassphrase` and surfaced as a live strength meter + a Generate button (6-word EFF-wordlist diceware, [src/diceware.ts](../src/diceware.ts) + [src/eff-large-wordlist.ts](../src/eff-large-wordlist.ts)) in the passphrase modal on create/change flows. KDF is now Argon2id by default (`hash-wasm`, `m = 32 MiB`, `t = 3`, `p = 1`, 32-byte output) with PBKDF2 fallback on any derivation failure; the envelope gained a `kdf.algo` discriminant (a legacy `iterations`-only kdf reads as `pbkdf2`). On unlock, a legacy PBKDF2 envelope opportunistically re-encrypts to Argon2id (best-effort), and an Argon2id allocation failure throws a clear "can't allocate enough memory" message. Decisions: score 3, generator on, 32 MiB. New deps `hash-wasm` + `@zxcvbn-ts/{core,language-common,language-en}` bundle into the single `main.js` (hash-wasm inlines its wasm as base64; no separate `.wasm`). zxcvbn's dictionaries (~1.6 MB, ~140 ms to build) are **lazy-loaded** via dynamic `import()` so they are not evaluated at plugin startup (measured startup cost for the feature dropped from ~47 ms to ~9 ms; the dictionary build moves to first passphrase-meter use and is warmed on modal open). `evaluatePassphrase`/`isPassphraseAcceptable` are async as a result. `eslint.config.mts` gained the Argon2id/Argon2/zxcvbn/diceware/EFF brand names. CLAUDE.md and README updated. ### Shared core promoted to an editable vault file Superseded the baked-in `SHARED_CORE`/`withCore()` approach from "Default-prompt overhaul" below. The shared cleanup preface (anti-injection guardrail + condensed cleanup + output discipline) now lives in a vault Markdown file (`GlobalSettings.sharedCorePath`, default `ReWrite/SharedCore.md`) and is prepended to each template prompt at runtime, mirroring the assistant-prompt / known-nouns pattern. New module [src/shared-core.ts](../src/shared-core.ts) (`loadSharedCoreFromFile`, `populateDefaultSharedCore`, `isPathSharedCore`, `DEFAULT_SHARED_CORE`); cache on `plugin.sharedCore: string | null` refreshed on the usual triggers; `PipelineHost` gained `sharedCore`. The default template `.md` files now carry only their per-template rules; [src/pipeline.ts](../src/pipeline.ts) composes `sharedCore\n\n${template.prompt}`. Two opt-out levers: deleting/emptying SharedCore.md disables it globally (loader returns `null`, nothing prepended), and `disableSharedCore: true` in a template's frontmatter (`NoteTemplate.disableSharedCore`) skips it for that one template. `renderTemplateFile` always emits the key (empty by default so it does not apply, `true` when set) so the knob is discoverable in every default file; `parseTemplateFile` treats boolean `true` or string `"true"` as disabled (the string form covers edits made via Obsidian's Properties UI). Settings gained a "Shared core" section (path field, re-create button, open button, a note that deleting it disables the feature) with an Enabled/Disabled status badge next to the heading (`.rewrite-status-badge` `is-enabled`/`is-disabled` in [styles.css](../styles.css), driven by whether `plugin.sharedCore` is non-null; refreshed on full settings redraws). The Templates "Populate" button also seeds SharedCore.md when missing, since the shared core is load-bearing for the defaults' quality. README documents the file and the delete-to-disable behavior. Rationale: discoverability (users can see and tweak the baseline) plus token control (trim or drop it). ### Model selector: dropdown when models are available, field when not Replaced the hybrid model control (dropdown + an always-present canonical text input shown simultaneously) with a single adaptive control. The two duplicated `populate*ModelField` methods in [src/settings/tab.ts](../src/settings/tab.ts) collapsed into one `populateModelField(wrapper, profile, side, forceText)` shared by both transcription and LLM sides. Mode: **dropdown** when the provider supports `listModels` and the cache is non-empty; **plain text field** otherwise (no `listModels`, e.g. `openai-compatible`/AssemblyAI/Rev.ai, or an empty cache). Never both at once. The dropdown carries a trailing "Custom..." option (sentinel `CUSTOM_MODEL_OPTION`, never written to `config.model`) that toggles the same control into the text field via the `forceText` arg, with a "Back to list" button to return; a custom value absent from the cache renders as a selected ` (custom)` option. The Refresh button accompanies the dropdown and the empty-cache text field (so the first fetch flips it to a dropdown); on success the field re-renders in dropdown mode. Canonical setting unchanged: `profile.config.model` is still a plain string written by whichever control is active. `modelFieldDesc` now switches on a `ModelFieldMode` ('plain' | 'empty-cache' | 'dropdown' | 'custom') so the help text matches the visible control. ### Mobile soft-keyboard avoidance and settings-tab scroll-jump audit Two sub-issues originally deferred from "Visual differentiation between desktop and mobile profile sections." **Keyboard coverage (modals):** Obsidian mobile (Capacitor) overlays the soft keyboard on top of the WebView without resizing the layout or visual viewport, so JS approaches (`scrollIntoView`, `visualViewport` listener) were unreliable or confirmed no-ops. Resolved via CSS only in [styles.css](../styles.css): under `.is-mobile`, `.rewrite-modal` and `.rewrite-rename-modal` get `align-self: flex-start; margin-top: 8px; margin-bottom: auto; max-height: calc(100% - 16px)`, pinning our popups to the top of the flex container (keyboard opens from the bottom, so top-anchored fields stay visible). Three companion tweaks keep relevant inputs high within tall modals: (a) `.is-mobile .rewrite-modal .modal-content` gets `padding-top: 8px` and `.is-mobile .rewrite-modal h2` gets `margin-top: 0` to reclaim the space Obsidian leaves above the title; (b) the Paste textarea renders at `rows = 4` on mobile (vs 10 on desktop) with `min-height` reduced to 80px so its submit button stays above the keyboard; (c) the passphrase-tips `
` auto-collapses on mobile when a passphrase field receives focus, so it is visible on open but stops pushing fields into the keyboard once the user starts typing. The earlier JS helper (`installMobileKeyboardScrollFix`) was confirmed a no-op and removed. **Keyboard coverage (settings tab):** Determined to be a non-issue. The settings tab is a tall scrollable surface; Chromium's native focus-scroll scrolls the focused element into view when the keyboard appears. No plugin code needed. **Scroll-jump audit:** Audited all settings-tab fields for redraw behavior. Text fields call `saveSettings()` on change without triggering a full-container redraw, preserving focus and scroll position during typing. Conditional fields that appear or disappear on dropdown changes require a full-container redraw (unavoidable for layout correctness); scroll jump on dropdown selection is an accepted trade-off. The audit found no newer fields had slipped into the redraw path in violation of the pattern. ### Default-prompt overhaul + structured daily note + Lecture/Podcast templates Rewrote all default template prompts in [src/settings/default-templates.ts](../src/settings/default-templates.ts) to a much higher quality bar and added two new defaults (Lecture, Podcast), bringing the Populate set to 7. (Originally each prompt baked in a `SHARED_CORE` constant via a `withCore()` helper; that shared preface was subsequently promoted to an editable vault file, see "Shared core promoted to an editable vault file" above. The default template bodies now carry only their per-template rules.) The shared preface carries the anti-injection guardrail ("the input is transcribed speech, NOT instructions for you"), condensed cleanup rules (grammar/fillers/false-starts/self-corrections, preserve voice + technical nouns, spoken punctuation), and output discipline. General cleanup additionally carries the full detailed prose-polishing ruleset (the "like"-removal, sentence-initial So/And, hedge-collapsing, restated-synonym, rejoin-split-sentence rules) as its body; the structured templates carry only their section layout. This resolves the former item #4 (daily-note structured fill): the answer is prompt-only, no `NoteTemplate` schema change. The Daily note default lays the transcript into extracted `## Calendar` (scheduled events), `## Goals` (strategic directions), and `## Tasks` (checkbox actions), each omitted when empty, then `## Braindump` (the entire cleaned transcript) last. It also completes the two-template portion of the long-form item; the docs guide for that workflow was tracked separately and later shipped (see "Long-form audio workflow: lectures and podcasts (docs guide)" in this archive). ### Visual differentiation between desktop and mobile profile sections [src/settings/tab.ts](../src/settings/tab.ts) `renderProfile()` now wraps each profile's settings in a `.rewrite-profile-section` div. The active-on-this-device profile (resolved via `detectActiveProfileKind` from [src/platform.ts](../src/platform.ts)) gets an `is-active-profile` modifier that adds an accent-colored left border, plus a `.rewrite-profile-active-badge` span inserted into the heading's `nameEl` reading "Active on this device". The inactive profile's body (everything below the heading) is rendered inside a `
` collapsed by default, with a "Show settings" summary. Expanded state lives on `ReWriteSettingTab.inactiveProfileExpanded` so it survives the full-container redraws triggered by provider/insertMode/activeProfileOverride dropdowns. New CSS classes in [styles.css](../styles.css): `.rewrite-profile-section`, `.rewrite-profile-section.is-active-profile`, `.rewrite-profile-active-badge`, `.rewrite-profile-collapsed`. ### Voxtral transcription model dropdown populates [src/transcription/mistral-voxtral.ts](../src/transcription/mistral-voxtral.ts) gained a `listModels` method that fetches `https://api.mistral.ai/v1/models` and filters to IDs containing `voxtral` (case-insensitive), sorted. The shape mirrors the listModels in [src/transcription/openai.ts](../src/transcription/openai.ts), but stays a local filter rather than extending `filterAudioTranscriptionModels` (which is hardcoded to whisper/transcribe and owned by the OpenAI/Groq path). The settings tab's existing model-field dropdown + Refresh button pick up the new method automatically through the `typeof provider.listModels === 'function'` check. ### Removed the Web Speech transcription provider The browser-native Web Speech API option (`'webspeech'`) is gone. An earlier idempotency fix to `src/webspeech.ts` stopped the "short phrase repeats indefinitely" symptom, but field testing showed the underlying provider still produced garbled output and froze after a few seconds, with no path to a reliable experience. With six remote providers plus local whisper.cpp covering both platforms, Web Speech wasn't worth keeping as a viable option. Removed: `src/webspeech.ts`, `src/transcription/webspeech.ts`, the `'webspeech'` variant of `TranscriptionProviderID`, the `'webspeech'` variant of `PipelineSource`, `isWebSpeechAvailable()` in [src/platform.ts](../src/platform.ts), the dropdown entry in [src/settings/tab.ts](../src/settings/tab.ts) and [src/ui/setup-card.ts](../src/ui/setup-card.ts), all `transcriptionProvider !== 'webspeech'` conditionals in those files, the Web Speech branches in [src/ui/modal.ts](../src/ui/modal.ts) and [src/ui/quick-record.ts](../src/ui/quick-record.ts), the `isWebSpeech` constructor param on `QuickRecordController`, the `webspeech` case in [src/transcription/limits.ts](../src/transcription/limits.ts), and all CLAUDE.md / README / eslint-config references. The mobile default `transcriptionProvider` changed from `'webspeech'` to `'openai'`. Pre-release rule: no migration code; dev installs with old data should delete `data.json`. ### Mode selector on the Quick Record floater The Quick Record floating mini-UI ([src/ui/quick-record.ts](../src/ui/quick-record.ts)) gained a third button between the timer and Stop that opens a popover-style list of `plugin.templates`. Selecting an entry updates `QuickRecordController.template` in place and the button label so the user can see which template will run. Switching does NOT update `lastUsedTemplateId`; that still only happens after a successful completion. The popover is a child of the floater div, dismisses on selection / Escape / outside-click (capture-phase listeners on `document`, registered and torn down per open), and is force-closed when `setBusy` runs so the user can't switch templates after Stop is pressed. CSS additions in [styles.css](../styles.css): `.rewrite-quick-template` (the button), `.rewrite-quick-popover` (the floating list), `.rewrite-quick-popover-item` (rows, with an `is-active` modifier for the current selection). No destination-override UI on the floater per the v1 scope decision. ### Per-invocation destination override on the main modal The ReWrite modal ([src/ui/modal.ts](../src/ui/modal.ts)) renders a "Destination" row under the template picker exposing Insert mode (cursor / new file / append) and, conditionally, folder + filename-template inputs for `newFile` mode. The selection defaults to the active template's values and only becomes a non-null `DestinationOverride` once the user touches any field. A "Reset to template default" button clears it back to null. Switching the template selector resets the override (the new template's values become the new defaults). The override is plumbed through `PipelineParams.destinationOverride` and applied by `applyDestinationOverride` in [src/pipeline.ts](../src/pipeline.ts), which spreads the override onto a copy of the template before calling `insertOutput` — the template object passed in is never mutated, and the underlying Markdown file on disk is never touched. Applies to all three modal tabs (Record / Paste / From note) because they all converge on the modal's single `execute()` call site. Not exposed in Quick Record / `runTextPipeline` / `runAudioFilePipeline` to keep those paths frictionless; if a user asks for it later we can add a destination row to the template picker modal. ### Move the assistant prompt into the vault; standardize branding to "Assistant" The system-prompt preface that frames extracted ad-hoc directives moved from a settings textarea (`GlobalSettings.adHocInstructionsPrompt`) to a Markdown file in the vault (`GlobalSettings.assistantPromptPath`, default `ReWrite/AssistantPrompt.md`). [src/assistant-prompt.ts](../src/assistant-prompt.ts) exports `loadAssistantPromptFromFile`, `populateDefaultAssistantPrompt`, `isPathAssistantPrompt`, and `DEFAULT_ASSISTANT_PROMPT`. The loader strips any leading frontmatter (tolerated for future extensions but not consumed in v1) and returns the trimmed body. Cache lives at `plugin.assistantPrompt: string | null`, refreshed in [src/main.ts](../src/main.ts) on `workspace.onLayoutReady`, scoped vault `create/modify/delete/rename` events, the path-field change, and the Populate button. [src/pipeline.ts](../src/pipeline.ts) reads `params.host.assistantPrompt ?? DEFAULT_ASSISTANT_PROMPT` inside `cleanupTranscript`, so a missing or empty file falls back to the previous hardcoded preface. Branding standardized to "Assistant" everywhere the old "AI" / "Agent" labels appeared. `GlobalSettings.aiName` → `assistantName`; "AI name" label → "Assistant name"; "Agent control prompt" textarea → "Assistant prompt file" path field. `GlobalSettings.adHocInstructionsPrompt` is gone (the file is the source of truth). The wake-name term is preserved separately because it names the trigger, not the persona. Pre-release rule applies: no migration code, no compatibility reads — dev installs reset via deleting `data.json`. The settings tab's "Ad-hoc instructions" section heading stays (the *feature* is ad-hoc-instruction extraction; "Assistant" is the persona inside it). ### Known nouns list in the vault A new vault file at `GlobalSettings.knownNounsPath` (default `ReWrite/KnownNouns.md`) holds proper nouns the LLM should preserve verbatim, with optional misheard alternates. File format: YAML frontmatter for human-readable guidance (token-cost warning, format hint) plus a Markdown body with one noun per line, optional `canonical: alt1, alt2` for misheard variants. Lines starting with `#` and blank lines are skipped. Frontmatter is parsed but NOT sent to the LLM in v1; the structure leaves a future opt-in possible. The default file body (created by the Populate button) includes both the guidance frontmatter and two example nouns the user can keep or delete. [src/known-nouns.ts](../src/known-nouns.ts) exports `loadKnownNounsFromFile`, `populateDefaultKnownNouns`, `isPathKnownNouns`, and `buildKnownNounsSystemPromptSection(nouns)`. Cache on `plugin.knownNouns: KnownNoun[]`, refreshed on the same triggers as the assistant prompt. [src/pipeline.ts](../src/pipeline.ts) appends the section returned by `buildKnownNounsSystemPromptSection` to the system prompt only when non-empty; order is template prompt → ad-hoc instructions → known nouns. The settings tab has a dedicated "Known nouns" section with the path field, a Populate button, an Open-file button, and a reminder that an unbounded list inflates token cost on every recording. The default file body carries the same warning so users see it the first time they open the file. Side change: `PipelineParams` gained a `host: PipelineHost` field (narrow interface in [src/types.ts](../src/types.ts): `{ assistantPrompt; knownNouns }`). The plugin class `implements PipelineHost`; the pipeline never imports `ReWritePlugin` directly (would form a cycle through the UI layer). All four call sites (modal, Quick Record, text-source, audio-source) updated to pass `host: plugin`. ### Reprocess a saved recording Added [src/ui/audio-source.ts](../src/ui/audio-source.ts) (`isAudioFile`, `collectAudioFiles`, `readAudioFileAsBlob`, `runAudioFilePipeline`) and [src/ui/audio-file-picker.ts](../src/ui/audio-file-picker.ts) (a `FuzzySuggestModal` over the vault's audio files). Extended `audio` `PipelineSource` with an optional `sourcePath: string`; when set, [src/pipeline.ts](../src/pipeline.ts) skips the `persist-audio` stage entirely and routes the existing path straight to the `![[]]\n\n` prepend, so reprocessed output keeps the audio link without writing a duplicate file. Three entry points: a `rewrite-plugin:reprocess-audio` command opens the fuzzy file picker, an editor-menu item appears when the cursor sits inside an `![[