wiseguru_ReWrite-Voice-Notes/docs/ROADMAP.md

# ReWrite — Roadmap

Single tracker for the lifecycle of every feature and bug fix. Each item moves through three states:

- **Planned** — agreed/backlogged, not yet built. Not committed to a release.
- **Unreleased** — implemented and merged to `master`, but not yet shipped under a version tag. This is the staging area that becomes the next release's notes.
- **Released** — shipped under a tagged version (see the per-version headings).

This file replaces the old `FEATURES.md` (which only had "Open" and "Done"). The extra **Unreleased** state is the point: it makes "done in code" vs "available to users" an explicit, visible distinction, and it doubles as the draft changelog for the next release.

## How this drives the release process

The release mechanics live in [RELEASING.md](RELEASING.md); this file is the content side. The two interlock:

1. **While building:** when you finish a feature or fix, add an entry under **Unreleased** (newest first). Keep the same engineering-detail style as the Released archive below, so the entry is still useful long after it ships.
2. **When cutting a release** (the version-bump step in [RELEASING.md](RELEASING.md)): rename the `## Unreleased` heading's items into a new `### <version> — <YYYY-MM-DD>` block at the top of **Released**, then re-add an empty `## Unreleased` for the next cycle. The version + date must match the tag you push (bare version, no leading `v`).
3. **Bug fixes count too:** a fix that ships in a patch release gets its own Unreleased entry and rides into the next version heading, so the archive doubles as a changelog reviewers and users can read.

Keep an item in exactly one state. Moving an Unreleased item into a version heading is the release; do not leave a duplicate behind under Unreleased.

## Planned

### Plugin-managed local whisper.cpp server (desktop) — Phase B remainder (supervision hardening)

The auto-start and idle-stop lifecycle toggles shipped (see Unreleased). The remaining Phase B work is deferred pending real-world reports:

- Process supervision hardening based on real-world usage (zombies, orphans, signal-handling differences across platforms) beyond what the probe/adopt + PID-sidecar model already covers.

---

## Unreleased

Merged to `master`, not yet tagged. These become the next version's release notes.

### Fix: resolve the 1.2.1 automated-review `no-unsafe-*` warnings at the root (type-environment parity)

All ~30 warnings the Obsidian review bot raised on 1.2.1 traced to its lint environment resolving types differently from local, not to genuinely unsafe code (full analysis: [DEVCONFLICTS.md](DEVCONFLICTS.md) finding 10). Fixed at the root so the class cannot recur: `tsconfig.json` now declares `lib: ["DOM", "ES2019"]` (matching the ES2017–ES2019 APIs the code actually uses) with `types: []` so the test suite's `@types/node` can no longer mask a lib/API mismatch locally; all `moment` calls go through the new `formatMoment` structural wrapper in `src/time.ts` (moment's typings don't resolve in the bot's environment); `src/secrets.ts` was restructured to need no `as BufferSource` assertions under any TypeScript version; and two `as Record<string, unknown>` narrows became an `isRecord` type predicate. Runtime behavior is unchanged. Guardrails documented in CLAUDE.md's "Review-bot type environment" gotcha and RELEASING.md's parity section.

---

## Released

> Per-version attribution starts with the first release cut after this roadmap was adopted. The archive below collects work that shipped across **1.0.0 through 1.1.0** before per-version tracking began; it is grouped as one historical block rather than retro-fitted to individual tags. New releases get their own `### <version> — <date>` heading above this archive.

### 1.2.1 — 2026-07-08

Community-review remediation for the 1.2.0 submission (no user-facing behavior change). Two blocking review-bot errors resolved:

- **Removed the `eslint-disable` directives in [src/realtime/pcm.ts](../src/realtime/pcm.ts).** The review bot forbids disabling its rules, and the file disabled `@typescript-eslint/no-deprecated` five times for the intentional `ScriptProcessorNode` usage (AudioWorklet can't ship in a single-file CSP-constrained plugin). The deprecated members (`createScriptProcessor`, `onaudioprocess`, `AudioProcessingEvent`, the node type) are now reached through local structural type-aliases (`ScriptProcessorNodeLike` / `AudioProcessingEventLike` / `ScriptProcessorFactory`) that carry no `@deprecated` marker, so the rule never fires and no directive is needed. Same pattern as `WakeLockLike` / `hotkeyManager`.
- **Raised `minAppVersion` from 1.4.4 to 1.6.6.** `FileManager.trashFile` (used to delete a disabled built-in template, respecting the user's deletion preference) is `@since 1.6.6`, which tripped `obsidianmd/no-unsupported-api`. 1.6.6 is a negligible floor bump; `versions.json` gained the `1.2.1 -> 1.6.6` entry.

Also enabled the reviewer's type-checked lint rules locally (`@typescript-eslint/no-deprecated` + the `no-unsafe-*` / `no-unnecessary-type-assertion` family) in [eslint.config.mts](../eslint.config.mts) for `src/`, so this class of finding surfaces in `npm run lint` instead of only at submission. The bot's remaining `no-unsafe-*` warnings are false-positives from its weaker type resolution (it types Obsidian's `moment` re-export and `parseYaml` result as `any` where our installed `obsidian` types resolve them); our code already guards those boundaries with `: unknown` annotations + explicit casts, and satisfying the "unnecessary assertion" warnings would break the correctly-typed `tsc` build.

### 1.2.0 — 2026-07-08

### Real-time transcription mode (live dictation at the cursor), configured independently of batch

Opt-in live STT, command-only (`rewrite-voice-notes:realtime-transcribe`, "Real-time transcription (start/stop)"), no template / no LLM cleanup / no saved audio: it streams the mic to the provider over a WebSocket and types finalized segments at the editor cursor as they arrive, like dictation. Provider support is gated by `transcriptionProviderSupportsRealtime(id)` in [src/realtime/index.ts](../src/realtime/index.ts): only `deepgram` and `assemblyai` expose a browser-reachable streaming endpoint; the rest accept whole-file uploads only and the command errors with a steer to those two. New `src/realtime/` module: `pcm.ts` (`PcmCapture`, a `ScriptProcessorNode` mic tap, since `AudioWorklet` needs a separate module file a single-bundle plugin can't ship under the app CSP, plus the pure, unit-tested `downsampleBuffer` / `floatTo16BitPcm` to 16 kHz signed-16 PCM), `index.ts` (`RealtimeProvider` / `RealtimeSession` interfaces + `waitForOpen`/`waitForClose`), `deepgram.ts` (auth via the `['token', key]` WebSocket subprotocol so the key stays off the URL; `is_final` marks a final), and `assemblyai.ts` (Universal-Streaming v3; because a browser WS can't send an Authorization header, the real key mints a short-lived single-use 60 s token that alone rides the WS query, the one sanctioned exception to the "auth never in the query" rule; `format_turns` de-duplicates each turn). **Realtime is configured entirely independently of batch transcription**: its own `EnvironmentProfile.realtimeProvider` + `realtimeConfig` (key + model), persisted under secret id `profile-{kind}-realtime`, so a profile can run e.g. Voxtral for batch, AssemblyAI for realtime, and Anthropic for cleanup. The settings tab renders a self-contained "Real-time transcription" section (provider dropdown limited to None + realtime-capable, key, and the same adaptive model control as the batch fields via `populateModelField(..., 'realtime')`: dropdown + Refresh for Deepgram, text field for AssemblyAI). [src/ui/realtime.ts](../src/ui/realtime.ts) `RealtimeController` owns capture + session + a floating status bar (reuses `.rewrite-quick-floater`), inserts via `editor.replaceSelection`, and is a single plugin-owned session (`activeRealtime` + `realtimeStarting`, cancelled in `onunload`). Honest scope note preserved from the plan: lower-value than the cleanup pipeline (a raw transcript is what other voice plugins already do), shipped because the primitives were cheap once the streaming adapters existed. **Voxtral realtime was reverse-engineered and built but pulled**: Mistral's realtime endpoint rejects the only auth a browser WebSocket can send, so the adapter ([src/realtime/voxtral.ts](../src/realtime/voxtral.ts)) is kept on disk, unwired (not in the gate or factory, so not bundled or selectable), documented in `wiki/Voxtral-Realtime.md` for a contributor who finds a browser-auth path. Docs: CLAUDE.md (Real-time transcription section + gotchas), `wiki/Providers.md`, `wiki/Settings-Reference.md`, `wiki/Voxtral-Realtime.md`, `wiki/Commands-and-Menus.md`, README.

### Diarization moved from a settings toggle to per-invocation (template flag + per-run checkbox)

Speaker diarization is no longer a persisted per-profile setting (which wrongly diarized e.g. daily notes, producing stray `Speaker A` labels). It is now chosen per recording: the per-template `NoteTemplate.diarize` frontmatter flag (Meeting transcript ships it on) sets the default, and the main modal shows an **Identify speakers** checkbox (`renderDiarizeToggle` in [src/ui/modal.ts](../src/ui/modal.ts)) only on a capable provider (assemblyai/deepgram/revai), defaulting to the active template's flag and reset on template change. [src/pipeline.ts](../src/pipeline.ts) computes `effectiveDiarize = (template.diarize || params.diarize) && transcriptionProviderSupportsDiarization(id)` and always sets `transcriptionConfig.diarize` explicitly. `PipelineParams.diarize` is threaded through the Record tab, `startRecordingPipeline`, and the Record-in-background handoff. The settings-tab "Identify speakers" toggle is gone; `TranscriptionConfig.diarize` is now purely the internal pipeline->adapter transport. Docs: CLAUDE.md (Speaker diarization), docs/DIARIZATION.md, `wiki/Providers.md`, `wiki/Settings-Reference.md`.

### Mobile foreground caution while recording

Both recording UIs now show a mobile-only yellow caution (`MOBILE_RECORD_WARNING_TEXT`, "Keep Obsidian in the foreground...") for the duration of capture, because an app switch suspends the Capacitor WebView and kills `MediaRecorder` mid-recording (the screen wake lock only prevents screen-sleep, not backgrounding). Shown on record-start, hidden on stop/when busy: `.rewrite-mobile-record-warning` in the modal's Record tab and `.rewrite-quick-mobile-warning` in the Quick Record floater, both gated on `Platform.isMobile`. Styled yellow (`--text-warning`), distinct from the red silence warning, so it reads as an alert not an error. Docs: CLAUDE.md (Recording and capture gotcha), `wiki/Mobile.md`.

### Settings profile section: per-subsection headings + standardized field order

The profile section is now split into three headed subsections (**Transcription**, **Real-time transcription**, **Post-processing (LLM)**) that share one field order: provider, base URL (where applicable), API key, then model. Previously only the real-time block had a heading and the batch/LLM blocks put the model before the API key. Purely a settings-tab layout change ([src/settings/tab.ts](../src/settings/tab.ts) `renderProfile`). Docs: `wiki/Settings-Reference.md`.

### Record in background, plus non-blocking capture always

Two coupled changes to the main modal's Record tab. (1) **Processing already ran detached on Stop** (the 1.1.1 fix); this cycle confirms and preserves that: regardless of the new checkbox, pressing Stop closes the modal and runs the transcribe/cleanup/insert pipeline in the background so the vault is usable during processing. (2) **New "Record in background" checkbox** (desktop only, hidden on mobile where the WebView suspends backgrounded `MediaRecorder`), backed by the remembered `GlobalSettings.recordInBackground` flag (default off). When ticked, pressing Record does not capture in the modal at all: `startBackgroundHandoff` ([src/ui/modal.ts](../src/ui/modal.ts)) captures the modal's template + destination override + context hint into locals, closes the modal, and calls `plugin.startBackgroundRecording(opts)` ([src/main.ts](../src/main.ts)), which routes into the SAME `activeQuickRecord` slot + `quickRecordStarting` guard as the Quick Record commands (preserving the one-recording-at-a-time guarantee and the single `onunload` cleanup path). `QuickRecordController` / `startQuickRecord` gained optional `destinationOverride` + `contextHint` params, carried into `runPipeline`; switching templates via the floater popover clears them (they belonged to the original template). Docs: CLAUDE.md (Pipeline + Quick Record gotcha), `wiki/Commands-and-Menus.md`, `wiki/Settings-Reference.md`, README.

### Manage individual default templates: enable/disable + track/untrack via a `managed` flag

Replaced the all-or-nothing default set with two per-default controls, surfaced as a "Manage built-in templates" checklist in the Templates settings section (`renderManageDefaults` in [src/settings/tab.ts](../src/settings/tab.ts), driven off `freshDefaultTemplates()`). **Enable/disable** governs existence: disabling deletes the on-disk file (matched by frontmatter `id`, via `app.fileManager.trashFile` behind a `ConfirmModal`) and records the id in `GlobalSettings.disabledDefaultTemplateIds`, which both `populateDefaultTemplates` and `updateDefaultTemplates` now receive as a `disabledIds` set and never (re)create — including a future re-ship. Decision: the ignore list is keyed by `id` only, not also by name (the `managed` flag already protects a name-colliding user template). **Track/untrack** governs updates via the new tri-state `NoteTemplate.managed` field: `true` (Populate/Update stamp it on files they create/reconcile — Update may reconcile), `false` (untracked; Update skips it, counted in `UpdateResult.untracked`), `undefined` (absent/empty — treated as tracked when the id matches a built-in, preserving pre-flag behavior). `parseTriStateFlag` + `renderTemplateFile` handle all three states; the untrack toggle edits just the frontmatter key via `processFrontMatter`. Update's file-matching became "id matches a built-in AND not `managed: false`", and `mergeTemplate` stamps `managed: true` on its result, so a user's own hand-authored template that shares a name (or id) with a built-in is never clobbered. `ConfirmModal` gained an `onCancel` hook so backing out re-renders/reset the optimistically-flipped toggle. Docs: `wiki/Creating-Templates.md` (frontmatter table row + dedicated `managed` section), `wiki/Settings-Reference.md`, CLAUDE.md (Managing individual defaults + Updating defaults).

### Auto-ingest folders: batch-process dropped audio with a preassigned template

New `rewrite-voice-notes:process-ingest-folders` command ("Process auto-ingest folders", all platforms including mobile) plus a settings "Auto-ingest folders" section. Each rule (`GlobalSettings.ingestRules: { folderPath; templateId; enabled }[]`) pairs a vault folder with a newFile-mode template, edited in a popup ([src/ui/ingest-rule-modal.ts](../src/ui/ingest-rule-modal.ts), dropdown filtered to newFile templates). [src/ingest.ts](../src/ingest.ts) `runIngestBatch` scans each enabled rule's direct audio children (`collectIngestFiles`, exported/tested; no recursion), gates like manual reprocess (unlocked secrets + `isProfileConfigured`), and runs each file through the pipeline serialized behind a sticky Notice + Cancel. Each run reuses the reprocess path (`sourcePath` skips persist, keeps the `![[embed]]`); **move-on-success is the dedupe** — a fully-processed recording is moved to the attachments location via `app.fileManager.renameFile` (which fixes the note's embed link), so a re-run never reprocesses it and there is no processed-path bookkeeping in `data.json`; a failed file stays put and is retried next run. `isIngestTemplate` enforces newFile-only in both the rule editor and the runner (unattended runs have no active editor, so cursor/append would cascade to newFile anyway; requiring it makes the destination explicit). Same-folder guard, two layers: `collectWork` (now async) skips a rule UP FRONT (before creating any note) when its folder is also where recordings would be stored, resolved via the side-effect-free `resolveAttachmentFolder`; `moveIngestedFile` keeps the per-file `ingestTargetIsSameFolder` backstop for the case only knowable at move time. Failure reasons surface in a second sticky Notice (`• <file>: <reason>`, first 5). `resolveAttachmentPath` extracted from `persistAudio` so the mover resolves the same destination a live recording would. Docs: `wiki/Settings-Reference.md` (Auto-ingest section), `wiki/Commands-and-Menus.md`, CLAUDE.md (Auto-ingest folders + gotchas), README.

### Local whisper.cpp server — Phase B: auto-start and idle stop

Two opt-in lifecycle toggles for the desktop whisper.cpp host (both default off), completing the auto-start-lifecycle portion of the former Planned item #1. **Start automatically** (`localWhisper.autoStart`): after `onload`'s probe settles, [src/main.ts](../src/main.ts) starts the server when the active profile uses `whisper-local` and nothing was found to adopt (`shouldAutoStartWhisper`). **Stop when idle** (`localWhisper.idleStopMinutes`, 0 disables): a 60 s `registerInterval` calls `whisperHost.stopIfIdle()`, whose decision is the pure, unit-tested `shouldStopWhenIdle(...)` in [src/whisper-host.ts](../src/whisper-host.ts) — it only stops a ReWrite-owned (spawned/adopted, never external) server, never while a transcription is in flight, and only past the threshold. The `whisper-local` adapter brackets each transcription with `beginUse()`/`endUse()` (including the transcode) so a long job on a big model is never killed under the user and the idle clock restarts on completion; `start()` and `probe()`-adopt set the activity timestamp. Settings gained the two fields; the remaining Phase B supervision-hardening work stays in Planned. Docs: [docs/WHISPER_HOST.md](WHISPER_HOST.md) (Phase B section + config shape), `wiki/Settings-Reference.md`, `wiki/Self-Hosting-Whisper.md`, CLAUDE.md.

### Dev tooling: local-LLM build review + release-verification skill

Added two `.mjs`-at-root scripts and the repo's first project-level Claude Code skill to close the gap that Obsidian plugins have no headless UI test harness (a self-inflicted `isLocked()` self-lockout regression shipped past build/lint/test and was only caught by hand in Obsidian). [local-review.mjs](../local-review.mjs) (`npm run review`): advisory, always-exits-0 code-review pass over the current diff, run against a locally-hosted llama.cpp model (Ornith 1.0), spawning/adopting the server (loopback-enforced, duplicating `whisper-host`'s `getHostArgs`/`isLoopbackHost`/`splitArgs` since that file can't load in plain Node), POSTing to `/v1/chat/completions`, printing findings + writing `docs/claude-scratch/local-review-report.md`. [prepare-release-vault.mjs](../prepare-release-vault.mjs) (`npm run release:prep`): fails-loudly build + copy of the three release artifacts into a scratch vault's plugin folder. [.claude/skills/release-checklist/](../.claude/skills/release-checklist/) (`SKILL.md` + `CHECKLIST.md`): the live feature-by-feature manual pass that replaced the stale `obsidian-voice-notes-spec.md` "Testing Checklist" (5-vs-10 templates, removed `webspeech`, flat 60 s poll, removed clipboard fallback). Both scripts share one gitignored `dev-tools.config.json` (no baked defaults, mirroring `LocalWhisperSettings`); pure logic is unit-tested in [test/local-review.test.ts](../test/local-review.test.ts) / [test/prepare-release-vault.test.ts](../test/prepare-release-vault.test.ts). New deep-dive [docs/DEV_TOOLING.md](DEV_TOOLING.md); CLAUDE.md and RELEASING.md updated.

### 1.1.1 — 2026-06-19

### Fix: recording the modal now closes on Stop and reports via notices, instead of holding the modal open

The main modal's **Record** tab used to keep the popup open after Stop, showing an inline "Working... / Transcribing..." line (and an inline **Retry** button on error) while the transcribe → cleanup → insert pipeline ran. It now closes the modal the moment recording stops and runs the pipeline detached, reporting progress through a sticky `Notice` (`setMessage` per stage: "ReWrite: Saving audio... / Transcribing... / Cleaning up... / Inserting...") and surfacing errors as a `Notice` — the same UX as reprocessing a saved file ([src/ui/audio-source.ts](../src/ui/audio-source.ts) `runAudioFilePipeline`). New private method `startRecordingPipeline(source)` in [src/ui/modal.ts](../src/ui/modal.ts) captures `profile` / `destinationOverride` / `contextHint` into locals, calls `this.close()`, then runs `runPipeline` inside a detached async IIFE. Safe because the `persist-audio` stage writes the recording to the vault before transcription, so the saved file is the recovery path on error (no inline Retry needed). **Paste** and **From note** keep the prior in-modal `execute` flow (inline progress + Retry), since their input is not persisted and closing would lose it. Docs updated in [CLAUDE.md](../CLAUDE.md) (Pipeline section) and [wiki/Commands-and-Menus.md](../wiki/Commands-and-Menus.md) (The main modal).

### Fix: secret storage now actually defaults on first run; passphrase creation no longer silently no-ops

Two coupled bugs in the secrets bootstrap, both surfacing as "I can't create a passphrase without first switching to Obsidian secret storage, and the secrets file never gets written."

**Probe ordering ([src/main.ts](../src/main.ts)).** `loadSettings()` runs `hydrateSecrets → loadAllKeys → ensureEnvelope`, which reads and caches the secrets envelope for the session. That ran *before* `warmSecretStorage()`, so on a fresh install the availability probe was still cold and `defaultEnvelope()` fell back to `'passphrase'` instead of `'secretStorage'`. Reordered `onload` so `warmSecretStorage(this)` runs before `loadSettings(this)`; a fresh install now correctly defaults to Obsidian secret storage when the OS store is available, not just labels it "recommended."

**`setEncryptionMode` early-return ([src/secrets.ts](../src/secrets.ts)).** Because the envelope had cached as unconfigured `passphrase` mode, the create-passphrase flow called `setEncryptionMode(plugin, 'passphrase', pass)`, hit the blanket `if (envelope.mode === newMode) return;`, and silently did nothing — no kdf/verifier built, no `secrets.json.nosync` written. The modal reported success (onSubmit never threw) while status stayed unconfigured/locked, hence "set a passphrase first." Replaced the blanket guard with per-branch logic: secretStorage no-ops only if already active; configured passphrase flips mode only if not already active; an unconfigured passphrase store (no kdf/verifier) always builds a fresh envelope, *even when `mode` is already `passphrase`*. This also fixes a latent bug where a genuine Linux-without-keyring user (correctly defaulting to passphrase) could never create one through that path. Docs updated in [docs/SECRETS.md](SECRETS.md) (the `setEncryptionMode` model, the `warmSecretStorage` ordering note, and the probe gotcha).

### 1.1.0 and earlier (historical archive, not tracked per-version)

### Template maintenance: Update, default history, and Load prior versions

Populate only ever adds missing files, so a changed built-in template (new field, new `noteProperty`, reworded prompt) can never reach a copy the user already has. Added three buttons sharing the Populate `Setting` row (Populate stays `.setCta()` primary; Update and Load prior versions secondary), in [src/templates-folder.ts](../src/templates-folder.ts).

**Default history** ([src/settings/template-history.ts](../src/settings/template-history.ts)): `TEMPLATE_HISTORY: Record<id, { version, template }[]>` is the plugin's in-code memory of past default versions, the base for the merge and the source for Load prior versions. Starts empty; maintenance rule (documented in CLAUDE.md): when you change a default in `default-templates.ts`, append the outgoing template under the manifest version it shipped in.

**Update** (`updateDefaultTemplates`): per-field 3-way merge via `mergeTemplate(onDisk, def, priors)` (pure). A field is *pristine* (brought forward to the new default) when its on-disk value equals the current default or any prior shipped default; a genuine edit is kept. The prompt body is the only field whose kept edit becomes a report `body` conflict — an unedited old body is silently upgraded. Scalars/flags adopt-or-keep silently; `noteProperties` union by name (missing appended, pristine instruction upgraded, edited instruction kept + flagged, dropped property kept + flagged with `wasShippedDefault` so the report can say it is safe to delete). Matches files by `id` (new `readTemplateId` helper, also now backing `collectExistingIds`), `vault.modify`s only when the render differs (CRLF-normalized; never renames), then recreates any default deleted entirely (superset top-up; does NOT seed SharedCore.md / the guide). Non-auto-mergeable items go to **`Template update report.md`** via `writeTemplateUpdateReport` ([src/template-guide.ts](../src/template-guide.ts)), next to the guide (outside the templates folder), overwritten each run, `~~~text`-fenced "your file / default now" blocks. Types (`UpdateResult` / `TemplateUpdateEntry` / `TemplateUpdateConflict`) live in `templates-folder.ts`; `template-guide.ts` imports them type-only (the one new runtime edge, acyclic).

**Load prior versions** (`loadPriorTemplateVersions`): writes each `allPriorVersions()` snapshot as a standalone selectable template with a distinct id (`<id>@<version>`) and versioned name (`<name> <version>`) for comparison; non-destructive, left untouched by Update/Populate; reports `available` so the button can say "none yet" while the registry is empty.

Decisions (confirmed with user): per-field 3-way (not whole-template) auto-update; prior versions land in the templates folder as selectable templates; never delete user data (dropped properties kept + flagged). Caveat: a `vault.modify` re-serializes frontmatter via `stringifyYaml` and drops YAML comments; the body is untouched (unless it was an unedited old version) and a current file is never rewritten. The template guide gained "Keeping templates up to date" + "Comparing prompt versions" sections; CLAUDE.md updated.

### Live "no audio detected" warning during recording

Warns the user about a muted or dead mic *while* recording instead of only surfacing an empty result afterward. [src/recorder.ts](../src/recorder.ts) taps the mic `MediaStream` with a Web Audio `AnalyserNode` in `start()` (not connected to `destination`, so no monitoring feedback) and samples peak amplitude every 100 ms via a `window.setInterval`. New methods `getInputLevel()` (0..1 peak), `hasDetectedSound()`, and `getSilentMs()` (continuous-silence ms; returns 0 while paused / stopped or when the analyser could not be built, so the UI never warns when there is nothing to listen to). `resume()` resets the silence baseline so the paused gap is not counted, and `releaseStream()` tears the monitor down on `stop()`/`cancel()`. Threshold `SILENCE_LEVEL_THRESHOLD = 0.015` clears even quiet speech but flags silence. Both recording UIs poll `getSilentMs()` in their existing 250 ms timer loop and show a "No audio detected" banner past `SILENCE_WARNING_MS` (3 s): the main modal's Record tab (`.rewrite-silence-warning`, [src/ui/modal.ts](../src/ui/modal.ts)) and the Quick Record floater, which gained a `.rewrite-quick-row` wrapper so the warning (`.rewrite-quick-silence-warning`) can sit below the controls (`setSilenceWarning`, hidden while busy, [src/ui/quick-record.ts](../src/ui/quick-record.ts)). Any Web Audio setup failure degrades to "monitoring unavailable" and the recording proceeds normally. CSS added in [styles.css](../styles.css).

### Per-template diarization override + Meeting transcript default

Added `NoteTemplate.diarize?: boolean` (frontmatter `diarize: true`), a positive opt-in that forces speaker diarization on for a template's transcription regardless of the per-profile "Identify speakers" toggle. [src/pipeline.ts](../src/pipeline.ts) `collectTranscript` merges `{ ...profile.transcriptionConfig, diarize: true }` for the transcribe call only when the template flag is set AND `transcriptionProviderSupportsDiarization` is true for the active provider (assemblyai/deepgram/revai); a documented no-op on the rest. The profile config is never mutated, and a template can only raise the effective setting, never turn diarization off. Parse/render in [src/templates-folder.ts](../src/templates-folder.ts) follow the same always-emitted-key, boolean-or-`"true"` convention as `disableSharedCore` / `enableContextHint`. New eighth default template **Meeting transcript** ([src/settings/default-templates.ts](../src/settings/default-templates.ts)): the Meeting notes prompt adapted for `Speaker X:` input, shipped with `diarize: true` and `enableContextHint: true`. The vault-seeded template guide ([src/template-guide.ts](../src/template-guide.ts)) gained frontmatter-table rows and dedicated sections for both `enableContextHint` and `diarize`, plus an updated assembly-order list and template count. CLAUDE.md now records (in both the Documentation maintenance and Templates sections) that any template-structure change must update the template guide in the same commit.

### Optional per-invocation speaker/context hint for the LLM

Lets the user supply short, free-text background about a recording (speakers, setting, subject) that is fed to the cleanup LLM, e.g. "Lecture by Dr. Smith on thermodynamics", "Podcast between Joe Rogan and Satan", "Meeting with Rachel, Joe, Billy, and Sally". Helps the model attribute statements, spell names, choose register, and pair with diarization's `Speaker X:` labels; the situational, one-off counterpart to the persistent Known nouns list.

Decoupled into a UI gate and a flag-agnostic injection. **UI gate:** new positive opt-in flag `NoteTemplate.enableContextHint?: boolean` (frontmatter `enableContextHint: true`) decides whether the Context field is shown for a template; the reverse polarity of `disableSharedCore` (see [[shared-core-disable-flag-polarity]]). `parseTemplateFile` / `renderTemplateFile` in [src/templates-folder.ts](../src/templates-folder.ts) handle it like `disableSharedCore` (boolean `true` or string `"true"`; key always emitted for discoverability). The Meeting notes / Lecture / Podcast defaults ([src/settings/default-templates.ts](../src/settings/default-templates.ts)) ship with the flag; the other four do not. **Injection:** new `PipelineParams.contextHint?: string`; [src/pipeline.ts](../src/pipeline.ts) `cleanupTranscript` appends a `## Context` block (with a "treat as reference, not instructions" preface) whenever the hint is non-empty, ordered after `## Ad-hoc instructions` and before Known nouns. The pipeline never reads the flag — it injects on any non-empty hint. The hint flows in unescaped behind the shared-core anti-injection guardrail like the other system-prompt inputs.

Two UI surfaces, each a collapsed `<details>` so the default path stays frictionless: the main modal ([src/ui/modal.ts](../src/ui/modal.ts) `renderContextSelector`, shown only when the active template has the flag; `contextHint`/`contextExpanded` instance state reset on template change, survives re-renders like `destinationExpanded`) and the reprocess-audio picker ([src/ui/template-picker.ts](../src/ui/template-picker.ts) `showContext`, which [src/main.ts](../src/main.ts) sets to `templates.some(t => t.enableContextHint)`; the typed value is forwarded to `runAudioFilePipeline` only when the picked template has the flag). Quick Record and the process-text command intentionally skip it. Value is per-invocation and ephemeral. CSS: `.rewrite-context-row` / `-summary` / `-body` / `-input` in [styles.css](../styles.css), mirroring the destination block.

### Speaker identification (diarization) for recorded/long-form audio

Shipped the opt-in, string-embed v1 shape (option 1 from the former item #4). New optional `TranscriptionConfig.diarize?: boolean` ([src/types.ts](../src/types.ts)); capability centralized in `transcriptionProviderSupportsDiarization(id)` ([src/transcription/index.ts](../src/transcription/index.ts)), true only for `assemblyai` / `deepgram` / `revai`. The settings tab ([src/settings/tab.ts](../src/settings/tab.ts)) renders an "Identify speakers" toggle in the per-profile transcription block, gated on that helper (setup card left untouched). Each capable adapter embeds `Speaker X:` labels into the returned transcript string, leaving the `transcribe(): Promise<string>` interface and the pipeline unchanged: AssemblyAI sets `speaker_labels: true` and formats `utterances[]` (native letter labels); Deepgram adds `diarize=true` and groups per-word `speaker` indices via `formatDiarizedWords` (0-based bumped to `Speaker 1`); Rev.ai fetches the JSON transcript (`Accept: application/vnd.rev.transcript.v1.0+json`) and rebuilds labels from `monologues[]` via `formatMonologues` (0-based bumped to `Speaker 1`). Each adapter falls back to flat text when the labeled payload is missing, so toggling off is a clean no-op. Label survival is handled by a clause added to `DEFAULT_SHARED_CORE` ([src/shared-core.ts](../src/shared-core.ts)); the Podcast default template already tolerated both cases. Decision: keep provider-native labels (letters for AssemblyAI, 1-based integers for Deepgram/Rev.ai) rather than normalizing. Structured `{ speaker, text }[]` segments deferred until a consumer needs them.

### Long-form audio workflow: lectures and podcasts (docs guide)

Pure documentation; all primitives already shipped (reprocess-audio command + file/editor menu entries, Lecture/Podcast templates). Added an inline `## Long-form audio (lectures, podcasts)` section to [README.md](../README.md) walking through: getting an audio file (mic, meeting-tool export, ripped CD, or `yt-dlp` for YouTube with the ToS/copyright caveat that the user must confirm they have the right to the audio); dropping it in the vault; reprocessing via the file-explorer menu / command / `![[audio]]` embed; picking Lecture or Podcast; per-provider duration caps (recommend AssemblyAI/Rev.ai for multi-hour); and the new speaker-identification toggle (AssemblyAI / Deepgram / Rev.ai only). Added matching Features bullets. The hosted `yt-dlp` shell-out adapter remains deferred until demanded.

### Secrets encryption: dropped plaintext, hardened passphrase mode (verified keychain + entropy gate + Argon2id)

Reduced the three secrets modes to two trustworthy ones (no unencrypted at-rest option). Implemented the [docs/REMOVE_PLAINTEXT_SECRETS_MODE.md](REMOVE_PLAINTEXT_SECRETS_MODE.md) plan plus the keychain-verification and passphrase-hardening work.

**Dropped plaintext.** `EncryptionMode` is `'safeStorage' | 'passphrase'`. `defaultEnvelope()` falls back to an *unconfigured* passphrase envelope (no `kdf`/`verifier`) when no verified keychain exists; nothing is written in that state (`saveManyKeys` is a no-op while locked). `EncryptionStatus` gained `configured` (passphrase has a kdf+verifier) and `safeStorageInsecure`. `promptUnlock` ([src/main.ts](../src/main.ts)) branches on `configured`: unconfigured opens a create-passphrase modal, configured-but-locked opens the unlock modal. The four entry points were unchanged (unconfigured reports `locked === true`). Stored `plaintext` envelopes parse as invalid and reset to a fresh start (pre-release no-migration rule). Deferred to GA: Obsidian's `app.secretStorage` as the future zero-config cross-platform mode.

**Verified OS keychain.** Split `getRawSafeStorage()` (present + `isEncryptionAvailable()`) from `getSafeStorage()`, which session-caches a gate that rejects Chromium's unencrypted `basic_text` backend and runs an encrypt/decrypt round-trip self-test. Only the verified accessor is used for encrypt/decrypt and availability; the settings tab shows the backend and an "OS keychain unavailable" warning (steering to passphrase) when `safeStorageInsecure`.

**Hardened passphrase.** Entropy gate via new [src/passphrase-strength.ts](../src/passphrase-strength.ts) (zxcvbn-ts wrapper, `MIN_PASSPHRASE_SCORE = 3`), enforced hard in `changeEncryptionMode`/`changePassphrase` and surfaced as a live strength meter + a Generate button (6-word EFF-wordlist diceware, [src/diceware.ts](../src/diceware.ts) + [src/eff-large-wordlist.ts](../src/eff-large-wordlist.ts)) in the passphrase modal on create/change flows. KDF is now Argon2id by default (`hash-wasm`, `m = 32 MiB`, `t = 3`, `p = 1`, 32-byte output) with PBKDF2 fallback on any derivation failure; the envelope gained a `kdf.algo` discriminant (a legacy `iterations`-only kdf reads as `pbkdf2`). On unlock, a legacy PBKDF2 envelope opportunistically re-encrypts to Argon2id (best-effort), and an Argon2id allocation failure throws a clear "can't allocate enough memory" message. Decisions: score 3, generator on, 32 MiB. New deps `hash-wasm` + `@zxcvbn-ts/{core,language-common,language-en}` bundle into the single `main.js` (hash-wasm inlines its wasm as base64; no separate `.wasm`). zxcvbn's dictionaries (~1.6 MB, ~140 ms to build) are **lazy-loaded** via dynamic `import()` so they are not evaluated at plugin startup (measured startup cost for the feature dropped from ~47 ms to ~9 ms; the dictionary build moves to first passphrase-meter use and is warmed on modal open). `evaluatePassphrase`/`isPassphraseAcceptable` are async as a result. `eslint.config.mts` gained the Argon2id/Argon2/zxcvbn/diceware/EFF brand names. CLAUDE.md and README updated.

### Shared core promoted to an editable vault file

Superseded the baked-in `SHARED_CORE`/`withCore()` approach from "Default-prompt overhaul" below. The shared cleanup preface (anti-injection guardrail + condensed cleanup + output discipline) now lives in a vault Markdown file (`GlobalSettings.sharedCorePath`, default `ReWrite/SharedCore.md`) and is prepended to each template prompt at runtime, mirroring the assistant-prompt / known-nouns pattern. New module [src/shared-core.ts](../src/shared-core.ts) (`loadSharedCoreFromFile`, `populateDefaultSharedCore`, `isPathSharedCore`, `DEFAULT_SHARED_CORE`); cache on `plugin.sharedCore: string | null` refreshed on the usual triggers; `PipelineHost` gained `sharedCore`. The default template `.md` files now carry only their per-template rules; [src/pipeline.ts](../src/pipeline.ts) composes `sharedCore\n\n${template.prompt}`.

Two opt-out levers: deleting/emptying SharedCore.md disables it globally (loader returns `null`, nothing prepended), and `disableSharedCore: true` in a template's frontmatter (`NoteTemplate.disableSharedCore`) skips it for that one template. `renderTemplateFile` always emits the key (empty by default so it does not apply, `true` when set) so the knob is discoverable in every default file; `parseTemplateFile` treats boolean `true` or string `"true"` as disabled (the string form covers edits made via Obsidian's Properties UI). Settings gained a "Shared core" section (path field, re-create button, open button, a note that deleting it disables the feature) with an Enabled/Disabled status badge next to the heading (`.rewrite-status-badge` `is-enabled`/`is-disabled` in [styles.css](../styles.css), driven by whether `plugin.sharedCore` is non-null; refreshed on full settings redraws). The Templates "Populate" button also seeds SharedCore.md when missing, since the shared core is load-bearing for the defaults' quality. README documents the file and the delete-to-disable behavior. Rationale: discoverability (users can see and tweak the baseline) plus token control (trim or drop it).

### Model selector: dropdown when models are available, field when not

Replaced the hybrid model control (dropdown + an always-present canonical text input shown
simultaneously) with a single adaptive control. The two duplicated `populate*ModelField`
methods in [src/settings/tab.ts](../src/settings/tab.ts) collapsed into one
`populateModelField(wrapper, profile, side, forceText)` shared by both transcription and LLM
sides. Mode: **dropdown** when the provider supports `listModels` and the cache is non-empty;
**plain text field** otherwise (no `listModels`, e.g. `openai-compatible`/AssemblyAI/Rev.ai,
or an empty cache). Never both at once. The dropdown carries a trailing "Custom..." option
(sentinel `CUSTOM_MODEL_OPTION`, never written to `config.model`) that toggles the same
control into the text field via the `forceText` arg, with a "Back to list" button to return;
a custom value absent from the cache renders as a selected `<id> (custom)` option. The Refresh
button accompanies the dropdown and the empty-cache text field (so the first fetch flips it to
a dropdown); on success the field re-renders in dropdown mode. Canonical setting unchanged:
`profile.config.model` is still a plain string written by whichever control is active.
`modelFieldDesc` now switches on a `ModelFieldMode` ('plain' | 'empty-cache' | 'dropdown' |
'custom') so the help text matches the visible control.

### Mobile soft-keyboard avoidance and settings-tab scroll-jump audit

Two sub-issues originally deferred from "Visual differentiation between desktop and mobile profile sections."

**Keyboard coverage (modals):** Obsidian mobile (Capacitor) overlays the soft keyboard on top of the WebView without resizing the layout or visual viewport, so JS approaches (`scrollIntoView`, `visualViewport` listener) were unreliable or confirmed no-ops. Resolved via CSS only in [styles.css](../styles.css): under `.is-mobile`, `.rewrite-modal` and `.rewrite-rename-modal` get `align-self: flex-start; margin-top: 8px; margin-bottom: auto; max-height: calc(100% - 16px)`, pinning our popups to the top of the flex container (keyboard opens from the bottom, so top-anchored fields stay visible). Three companion tweaks keep relevant inputs high within tall modals: (a) `.is-mobile .rewrite-modal .modal-content` gets `padding-top: 8px` and `.is-mobile .rewrite-modal h2` gets `margin-top: 0` to reclaim the space Obsidian leaves above the title; (b) the Paste textarea renders at `rows = 4` on mobile (vs 10 on desktop) with `min-height` reduced to 80px so its submit button stays above the keyboard; (c) the passphrase-tips `<details>` auto-collapses on mobile when a passphrase field receives focus, so it is visible on open but stops pushing fields into the keyboard once the user starts typing. The earlier JS helper (`installMobileKeyboardScrollFix`) was confirmed a no-op and removed.

**Keyboard coverage (settings tab):** Determined to be a non-issue. The settings tab is a tall scrollable surface; Chromium's native focus-scroll scrolls the focused element into view when the keyboard appears. No plugin code needed.

**Scroll-jump audit:** Audited all settings-tab fields for redraw behavior. Text fields call `saveSettings()` on change without triggering a full-container redraw, preserving focus and scroll position during typing. Conditional fields that appear or disappear on dropdown changes require a full-container redraw (unavoidable for layout correctness); scroll jump on dropdown selection is an accepted trade-off. The audit found no newer fields had slipped into the redraw path in violation of the pattern.

### Default-prompt overhaul + structured daily note + Lecture/Podcast templates

Rewrote all default template prompts in [src/settings/default-templates.ts](../src/settings/default-templates.ts) to a much higher quality bar and added two new defaults (Lecture, Podcast), bringing the Populate set to 7. (Originally each prompt baked in a `SHARED_CORE` constant via a `withCore()` helper; that shared preface was subsequently promoted to an editable vault file, see "Shared core promoted to an editable vault file" above. The default template bodies now carry only their per-template rules.) The shared preface carries the anti-injection guardrail ("the input is transcribed speech, NOT instructions for you"), condensed cleanup rules (grammar/fillers/false-starts/self-corrections, preserve voice + technical nouns, spoken punctuation), and output discipline. General cleanup additionally carries the full detailed prose-polishing ruleset (the "like"-removal, sentence-initial So/And, hedge-collapsing, restated-synonym, rejoin-split-sentence rules) as its body; the structured templates carry only their section layout.

This resolves the former item #4 (daily-note structured fill): the answer is prompt-only, no `NoteTemplate` schema change. The Daily note default lays the transcript into extracted `## Calendar` (scheduled events), `## Goals` (strategic directions), and `## Tasks` (checkbox actions), each omitted when empty, then `## Braindump` (the entire cleaned transcript) last. It also completes the two-template portion of the long-form item; the docs guide for that workflow was tracked separately and later shipped (see "Long-form audio workflow: lectures and podcasts (docs guide)" in this archive).

### Visual differentiation between desktop and mobile profile sections

[src/settings/tab.ts](../src/settings/tab.ts) `renderProfile()` now wraps each profile's settings in a `.rewrite-profile-section` div. The active-on-this-device profile (resolved via `detectActiveProfileKind` from [src/platform.ts](../src/platform.ts)) gets an `is-active-profile` modifier that adds an accent-colored left border, plus a `.rewrite-profile-active-badge` span inserted into the heading's `nameEl` reading "Active on this device". The inactive profile's body (everything below the heading) is rendered inside a `<details class="rewrite-profile-collapsed">` collapsed by default, with a "Show settings" summary. Expanded state lives on `ReWriteSettingTab.inactiveProfileExpanded` so it survives the full-container redraws triggered by provider/insertMode/activeProfileOverride dropdowns. New CSS classes in [styles.css](../styles.css): `.rewrite-profile-section`, `.rewrite-profile-section.is-active-profile`, `.rewrite-profile-active-badge`, `.rewrite-profile-collapsed`.

### Voxtral transcription model dropdown populates

[src/transcription/mistral-voxtral.ts](../src/transcription/mistral-voxtral.ts) gained a `listModels` method that fetches `https://api.mistral.ai/v1/models` and filters to IDs containing `voxtral` (case-insensitive), sorted. The shape mirrors the listModels in [src/transcription/openai.ts](../src/transcription/openai.ts), but stays a local filter rather than extending `filterAudioTranscriptionModels` (which is hardcoded to whisper/transcribe and owned by the OpenAI/Groq path). The settings tab's existing model-field dropdown + Refresh button pick up the new method automatically through the `typeof provider.listModels === 'function'` check.

### Removed the Web Speech transcription provider

The browser-native Web Speech API option (`'webspeech'`) is gone. An earlier idempotency fix to `src/webspeech.ts` stopped the "short phrase repeats indefinitely" symptom, but field testing showed the underlying provider still produced garbled output and froze after a few seconds, with no path to a reliable experience. With six remote providers plus local whisper.cpp covering both platforms, Web Speech wasn't worth keeping as a viable option. Removed: `src/webspeech.ts`, `src/transcription/webspeech.ts`, the `'webspeech'` variant of `TranscriptionProviderID`, the `'webspeech'` variant of `PipelineSource`, `isWebSpeechAvailable()` in [src/platform.ts](../src/platform.ts), the dropdown entry in [src/settings/tab.ts](../src/settings/tab.ts) and [src/ui/setup-card.ts](../src/ui/setup-card.ts), all `transcriptionProvider !== 'webspeech'` conditionals in those files, the Web Speech branches in [src/ui/modal.ts](../src/ui/modal.ts) and [src/ui/quick-record.ts](../src/ui/quick-record.ts), the `isWebSpeech` constructor param on `QuickRecordController`, the `webspeech` case in [src/transcription/limits.ts](../src/transcription/limits.ts), and all CLAUDE.md / README / eslint-config references. The mobile default `transcriptionProvider` changed from `'webspeech'` to `'openai'`. Pre-release rule: no migration code; dev installs with old data should delete `data.json`.

### Mode selector on the Quick Record floater

The Quick Record floating mini-UI ([src/ui/quick-record.ts](../src/ui/quick-record.ts)) gained a third button between the timer and Stop that opens a popover-style list of `plugin.templates`. Selecting an entry updates `QuickRecordController.template` in place and the button label so the user can see which template will run. Switching does NOT update `lastUsedTemplateId`; that still only happens after a successful completion. The popover is a child of the floater div, dismisses on selection / Escape / outside-click (capture-phase listeners on `document`, registered and torn down per open), and is force-closed when `setBusy` runs so the user can't switch templates after Stop is pressed. CSS additions in [styles.css](../styles.css): `.rewrite-quick-template` (the button), `.rewrite-quick-popover` (the floating list), `.rewrite-quick-popover-item` (rows, with an `is-active` modifier for the current selection). No destination-override UI on the floater per the v1 scope decision.

### Per-invocation destination override on the main modal

The ReWrite modal ([src/ui/modal.ts](../src/ui/modal.ts)) renders a "Destination" row under the template picker exposing Insert mode (cursor / new file / append) and, conditionally, folder + filename-template inputs for `newFile` mode. The selection defaults to the active template's values and only becomes a non-null `DestinationOverride` once the user touches any field. A "Reset to template default" button clears it back to null. Switching the template selector resets the override (the new template's values become the new defaults). The override is plumbed through `PipelineParams.destinationOverride` and applied by `applyDestinationOverride` in [src/pipeline.ts](../src/pipeline.ts), which spreads the override onto a copy of the template before calling `insertOutput` — the template object passed in is never mutated, and the underlying Markdown file on disk is never touched. Applies to all three modal tabs (Record / Paste / From note) because they all converge on the modal's single `execute()` call site. Not exposed in Quick Record / `runTextPipeline` / `runAudioFilePipeline` to keep those paths frictionless; if a user asks for it later we can add a destination row to the template picker modal.

### Move the assistant prompt into the vault; standardize branding to "Assistant"

The system-prompt preface that frames extracted ad-hoc directives moved from a settings textarea (`GlobalSettings.adHocInstructionsPrompt`) to a Markdown file in the vault (`GlobalSettings.assistantPromptPath`, default `ReWrite/AssistantPrompt.md`). [src/assistant-prompt.ts](../src/assistant-prompt.ts) exports `loadAssistantPromptFromFile`, `populateDefaultAssistantPrompt`, `isPathAssistantPrompt`, and `DEFAULT_ASSISTANT_PROMPT`. The loader strips any leading frontmatter (tolerated for future extensions but not consumed in v1) and returns the trimmed body. Cache lives at `plugin.assistantPrompt: string | null`, refreshed in [src/main.ts](../src/main.ts) on `workspace.onLayoutReady`, scoped vault `create/modify/delete/rename` events, the path-field change, and the Populate button. [src/pipeline.ts](../src/pipeline.ts) reads `params.host.assistantPrompt ?? DEFAULT_ASSISTANT_PROMPT` inside `cleanupTranscript`, so a missing or empty file falls back to the previous hardcoded preface.

Branding standardized to "Assistant" everywhere the old "AI" / "Agent" labels appeared. `GlobalSettings.aiName` → `assistantName`; "AI name" label → "Assistant name"; "Agent control prompt" textarea → "Assistant prompt file" path field. `GlobalSettings.adHocInstructionsPrompt` is gone (the file is the source of truth). The wake-name term is preserved separately because it names the trigger, not the persona. Pre-release rule applies: no migration code, no compatibility reads — dev installs reset via deleting `data.json`. The settings tab's "Ad-hoc instructions" section heading stays (the *feature* is ad-hoc-instruction extraction; "Assistant" is the persona inside it).

### Known nouns list in the vault

A new vault file at `GlobalSettings.knownNounsPath` (default `ReWrite/KnownNouns.md`) holds proper nouns the LLM should preserve verbatim, with optional misheard alternates. File format: YAML frontmatter for human-readable guidance (token-cost warning, format hint) plus a Markdown body with one noun per line, optional `canonical: alt1, alt2` for misheard variants. Lines starting with `#` and blank lines are skipped. Frontmatter is parsed but NOT sent to the LLM in v1; the structure leaves a future opt-in possible. The default file body (created by the Populate button) includes both the guidance frontmatter and two example nouns the user can keep or delete.

[src/known-nouns.ts](../src/known-nouns.ts) exports `loadKnownNounsFromFile`, `populateDefaultKnownNouns`, `isPathKnownNouns`, and `buildKnownNounsSystemPromptSection(nouns)`. Cache on `plugin.knownNouns: KnownNoun[]`, refreshed on the same triggers as the assistant prompt. [src/pipeline.ts](../src/pipeline.ts) appends the section returned by `buildKnownNounsSystemPromptSection` to the system prompt only when non-empty; order is template prompt → ad-hoc instructions → known nouns. The settings tab has a dedicated "Known nouns" section with the path field, a Populate button, an Open-file button, and a reminder that an unbounded list inflates token cost on every recording. The default file body carries the same warning so users see it the first time they open the file.

Side change: `PipelineParams` gained a `host: PipelineHost` field (narrow interface in [src/types.ts](../src/types.ts): `{ assistantPrompt; knownNouns }`). The plugin class `implements PipelineHost`; the pipeline never imports `ReWritePlugin` directly (would form a cycle through the UI layer). All four call sites (modal, Quick Record, text-source, audio-source) updated to pass `host: plugin`.

### Reprocess a saved recording

Added [src/ui/audio-source.ts](../src/ui/audio-source.ts) (`isAudioFile`, `collectAudioFiles`, `readAudioFileAsBlob`, `runAudioFilePipeline`) and [src/ui/audio-file-picker.ts](../src/ui/audio-file-picker.ts) (a `FuzzySuggestModal<TFile>` over the vault's audio files). Extended `audio` `PipelineSource` with an optional `sourcePath: string`; when set, [src/pipeline.ts](../src/pipeline.ts) skips the `persist-audio` stage entirely and routes the existing path straight to the `![[<path>]]\n\n` prepend, so reprocessed output keeps the audio link without writing a duplicate file. Three entry points: a `rewrite-plugin:reprocess-audio` command opens the fuzzy file picker, an editor-menu item appears when the cursor sits inside an `![[<audio>]]` embed (resolved via `app.metadataCache.getFirstLinkpathDest`), and a file-menu item appears for audio files in the file explorer. All three open the existing `TemplatePickerModal` and call `runAudioFilePipeline`, which gates on the full voice profile (`isProfileConfigured` from [src/ui/setup-card.ts](../src/ui/setup-card.ts)) and falls back to opening the main modal if either side is unconfigured. Mime type for the reread blob is derived from the file extension via the new `extensionToMime` helper in [src/audio-persist.ts](../src/audio-persist.ts) (reverse of `mimeToExtension`; also exports an `AUDIO_EXTENSIONS` constant the picker and file-menu both filter against).

### Custom prompt for ad-hoc instruction handling

Replaced the hardcoded preface line in the `## Ad-hoc instructions` block at [src/pipeline.ts](../src/pipeline.ts) with a user-editable string. Originally landed as a settings textarea (`GlobalSettings.adHocInstructionsPrompt`); later moved into a vault Markdown file (`GlobalSettings.assistantPromptPath`) and rebranded under "Assistant" — see "Move the assistant prompt into the vault" above. Both LLM adapters route `systemPrompt` into the API system slot, so neither change required provider edits.

### Adopt orphaned whisper-server processes; surface external ones

Closing Obsidian doesn't reliably kill spawned `whisper-server` children on any platform (Linux reparents to init, Windows orphans, macOS SIGTERM may not land before exit). Previously the new plugin instance had no PID handle, so `start()` would hit "port in use", `stop()` was a no-op, and transcription would fail because [src/transcription/whisper-local.ts](../src/transcription/whisper-local.ts) artificially required `host.status() === 'running'` even though the HTTP API doesn't care who owns the process.

Reworked into a three-state model: `'spawned'` (live child handle this session, log capture works), `'adopted'` (port bound, PID sidecar matches a live PID — we started it last session, no log capture), `'external'` (port bound but no sidecar match — someone else started it). Status enum gains `'external'`. `WhisperHost.start()` writes a sidecar at `<plugin folder>/whisper-host.pid.json` once the server is ready; `stop()` and the child `exit` handler clear it. `WhisperHost.probe(config)` (called from `onload` and at the top of `start()`) does the discovery dance; never disturbs state when we already hold a live spawned child.

Transcription drops the `status()` check entirely and just asks `host.baseUrl()`, which returns the URL for both `'running'` and `'external'` so transcription Just Works regardless of ownership. Stop semantics: spawned uses the ChildProcess handle, adopted uses `process.kill(pid, signal)`, external throws "not started by ReWrite — stop it via OS tools." (settings tab button is disabled with a tooltip, status-bar click shows a Notice, `stop-whisper-host` command is hidden). Status bar/settings labels read "Running on http://... (adopted from previous session, pid N).", "External whisper-server on http://... (not started by ReWrite).", etc. New `is-external` dot color (orange) in [styles.css](../styles.css). On `onload`, a Notice fires when we adopt ("Adopted whisper-server from previous session (pid N)") or detect external ("Detected external whisper-server on URL. Transcription will use it; ReWrite won't stop it."). Preserves the "never kill a process we didn't start" invariant — the sidecar is proof we started it.

### Start/stop local whisper.cpp server from outside settings

Surfaced a status-bar item ([src/ui/whisper-status-bar.ts](../src/ui/whisper-status-bar.ts)) showing a colored dot plus "Whisper: <status>" label. Click toggles start/stop, hover tooltip matches the settings-tab status string (extracted to `formatWhisperStatus` in [src/whisper-host.ts](../src/whisper-host.ts) so both surfaces share one implementation). The item polls `whisperHost.status()` every 1 s via `registerInterval` and hides via the `rewrite-hidden` CSS class when on mobile or when the active profile's transcription provider is not `whisper-local`. Added two command-palette entries (`start-whisper-host` / `stop-whisper-host`) using `checkCallback` so they only appear when actionable on the current platform and host state. Same error-surfacing pattern as the settings tab (`Notice` with the error message). Did not add a ribbon variant or modal-header indicator, per the FEATURES.md "pick one" guidance.

### Persist recorded audio to an attachments folder

Added [src/audio-persist.ts](../src/audio-persist.ts) with `mimeToExtension`, `buildAudioFilename`, and `persistAudio`. The pipeline ([src/pipeline.ts](../src/pipeline.ts)) gained a new `'persist-audio'` stage that runs BEFORE transcription on `audio` sources, so the user keeps the recording even if transcription fails. Filename is `ReWrite-YYYY-MM-DD-HHmmss.<ext>` with the extension derived from the blob's mime type (`webm` / `m4a` / `ogg` / `wav` / `mp3`, default `webm`). Path resolution: when the new `GlobalSettings.attachmentsFolderPath` setting is non-empty, the file lands under that folder with manual de-collision (`-1`, `-2`, ...); when empty, the path comes from `app.fileManager.getAvailablePathForAttachment(filename)`, honoring Obsidian's own attachments setting. An `![[<path>]]\n\n` embed is unconditionally prepended to the cleaned output when audio was persisted, regardless of insert mode. Persistence failure is non-fatal: a Notice fires and transcription proceeds. Cancel paths (modal, Quick Record) call `recorder.cancel()` before `runPipeline()`, so no orphan files are written on cancel. UI stage label "Saving audio..." added to both modal and Quick Record floater. Setting field lives under "Recording" in the settings tab.

### Address the assistant directly mid-recording with a wake name (default "Scrivener")

Added [src/wake-name.ts](../src/wake-name.ts) exposing `extractAdHocInstructions(transcript, name)`. Regex pattern requires the vocative comma form (`<name>,`), captures up to a sentence terminator or the next name occurrence, drops filler tokens ("never mind", "scratch that", under 2 chars), and post-processes whitespace. Wired into `cleanupTranscript` in [src/pipeline.ts](../src/pipeline.ts): when `GlobalSettings.adHocInstructionsEnabled` is on and `GlobalSettings.assistantName` is non-empty, the transcript is scanned BEFORE the LLM call. Extracted instructions are stripped from the transcript and appended to the template prompt as a numbered `## Ad-hoc instructions` block; both OpenAI and Anthropic adapters route this into the API system slot. A `Notice` ("Heard N ad-hoc instruction(s).") confirms detection to the user. Applies to all four `PipelineSource` variants (audio / paste / webspeech / text) since the scan runs after `collectTranscript()`. Off by default. Global setting (not per-template). v1 is exact-match regex; fuzzy/Levenshtein matching for whisper homophones deferred. Settings UI is a heading + Enabled toggle + (conditional) Assistant name field, re-rendered on toggle change. Originally landed under the label "AI name"; rebranded to "Assistant name" alongside the assistant-prompt-file change.

### Templates as Markdown files in a vault folder

Removed the in-settings template editor (drag-to-reorder list, per-template editor, Add/Delete buttons, `ConfirmModal` for deletion). `GlobalSettings.templates` is gone; in its place is a `templatesFolderPath` string (default `ReWrite/Templates`). Each `.md` file in that folder is one template: YAML frontmatter holds `id` / `name` / `insertMode` / `newFileFolder` / `newFileNameTemplate`, the body is the LLM prompt. [src/templates-folder.ts](../src/templates-folder.ts) handles loading (sorted by basename so users can prefix `01-`, `02-` to order), and `populateDefaultTemplates(app, folderPath)` writes the five built-in defaults into the folder, skipping any whose `id` already exists on disk so the button is safe to re-run. `plugin.templates` is the cache, refreshed in [src/main.ts](../src/main.ts) on `workspace.onLayoutReady` and via vault `create` / `modify` / `delete` / `rename` events scoped to the templates folder. `defaultTemplateId` stayed as a settings field (now a dropdown of loaded templates) and references the frontmatter `id`, so renames don't break it. Used `parseYaml` / `stringifyYaml` from Obsidian rather than the metadata cache (which is async and doesn't populate immediately after `app.vault.create`).

### Remove the "Advanced" disclosure around whisper-host extra args

Unwrapped the `<details>` that hid the `extraArgs` field in [src/settings/tab.ts](../src/settings/tab.ts)' `renderLocalWhisperServer`. The field now renders inline next to Binary path / Model path / Port. No setting-shape change, just one click less to reach a useful knob.

### Plugin-managed local whisper.cpp server (Phase A: on-demand, button-driven)

Added [src/whisper-host.ts](../src/whisper-host.ts) `WhisperHost` class with `start` / `stop` / `status` / `baseUrl` / `getLog`. Lazy-requires `child_process`, `net`, `fs` inside a `Platform.isDesktop` guard (mirrors the [src/secrets.ts](../src/secrets.ts) `safeStorage` pattern). `start()` validates binary and model paths via `fs.existsSync`, probes the port via `net.createServer().listen(port)` to detect conflicts (does NOT kill unknown bound processes), spawns whisper-server, captures stdout/stderr to a 1 MB ring buffer, polls `net.createConnection` every 250ms for up to 5s before declaring `'running'`. `stop()` sends SIGTERM with a 3s SIGKILL fallback. New settings section "Local whisper.cpp server (desktop)" with binary/model/port fields, an Advanced disclosure for extra args, status indicator with Start/Stop button, and a View log disclosure (last ~50k chars of the ring buffer). New transcription provider option `'whisper-local'` filtered out of dropdowns on mobile; thin shim in [src/transcription/whisper-local.ts](../src/transcription/whisper-local.ts) POSTs to `http://127.0.0.1:<port>/v1/audio/transcriptions` (OpenAI-shaped). No API key field for this provider. [src/main.ts](../src/main.ts) instantiates the host in onload and fire-and-forget stops it in onunload. README has setup walkthrough + transparency disclosure. Phase B (auto-start lifecycle + idle timeout) deferred.

### Model field as a dropdown of available models

Added an optional `listModels(config, signal)` method to both `TranscriptionProvider` and `LLMProvider` interfaces. Implementations: OpenAI / Groq / Mistral (shared via the OpenAI-shaped adapter), Anthropic, Gemini, Deepgram. Skipped (text-only fallback): `openai-compatible` (URL-specific, list-shape varies), AssemblyAI, Rev.ai, Web Speech. Settings tab renders a hybrid Setting per model: dropdown of cached models + Refresh button (when the provider supports listing) plus an always-canonical text input that wins for "Custom" model names not yet in the dropdown. Cache lives at `GlobalSettings.modelCache.{transcription,llm}[providerId] = { ids, fetchedAt }`. No auto-fetch on settings open; the user clicks Refresh once their key is set. Errors surface via Notice with the provider-attributed `ProviderError` message.

### Act on existing text in a note

Added a `{ kind: 'text'; text: string }` source variant to the pipeline (skips transcription, same path as `paste`). Three entry points: `rewrite-plugin:process-text` command, an editor-menu item "ReWrite with template...", and a new "From note" tab in the main modal. All three resolve text from the active editor (selection if non-empty, otherwise whole note body) and open a lightweight template quick-picker before running. Setup-card gating split into voice (full check) vs text (LLM-only check) via `isProfileConfiguredForText` and a `purpose` param on `renderSetupCard`; the modal's per-tab rendering picks the right gate. Helpers live in [src/ui/text-source.ts](../src/ui/text-source.ts) (resolution + `runTextPipeline`) and [src/ui/template-picker.ts](../src/ui/template-picker.ts) (the quick-picker modal). Shipped without the per-invocation "Replace source" checkbox; can revisit if users ask.

### Collapse API key settings: per-profile only, hide rarely-changed fields under "Advanced"

Removed the "Global API keys" section and the by-family `apiKeys` map. Each profile now owns its own transcription and LLM keys directly on `transcriptionConfig.apiKey` / `llmConfig.apiKey`. The per-profile fields are no longer framed as "overrides"; they're the only slot. "Transcription language" and "LLM max tokens" moved into a per-profile `<details>` "Advanced" disclosure. The resolver functions (`resolveTranscriptionApiKey`, `resolveLLMApiKey`) and family helpers (`transcriptionProviderFamily`, `llmProviderFamily`) are gone, along with the `ProviderFamily` type. `secrets.json.nosync` now only contains `profile:{kind}:{side}` IDs.