Update docs for the debug web UI, voice plan, and current status

AGENTS.md

@@ -14,6 +14,8 @@ before you stop.
 - [architecture.md](docs/architecture.md) — system parts and boundaries
 - [core-bridge.md](docs/core-bridge.md) — the Vesktop-side capability layer
 - [daemon.md](docs/daemon.md) — the external MCP daemon
+- [webui.md](docs/webui.md) — the web control UI and its JSON API
+- [voice.md](docs/voice.md) — voice state reads, planned actions, and lifecycle
 - [communication.md](docs/communication.md) — trust model, commands, trigger log
 - [auth.md](docs/auth.md) — QR login and token persistence
 - [testing.md](docs/testing.md) — tests and live test setup
@@ -29,8 +31,9 @@ before you stop.
   `src/main/puppetBridge.ts`. Do not spread logic through upstream files.
 - The daemon holds the logic: triggers, trust list, command parsing, trigger log, and pacing.
 - The daemon binds to localhost. Remote access goes over LAN or Tailscale only.
-- Pacing: the daemon delays every command by 500 to 2800 ms. The core adds a hard limit of 500 ms
-  between sends and 30 sends per minute.
+- Pacing: the daemon sends the first action of a burst in 30-200 ms, then spaces sends 500-2800 ms.
+  A burst resets after a random 5-20 s of quiet. The core adds a hard limit of 500 ms between sends
+  and 30 sends per minute.
 
 ## Guardrails
 
@@ -50,13 +53,18 @@ before you stop.
 | Main bridge, event push, hooks | Implemented |
 | Daemon on the core-bridge transport | Implemented and verified live |
 | QR login, pacing, trigger log | Implemented |
+| Human pacing (fast first send, burst, variable reset) | Implemented |
 | Trusted-only triggers, trust tiers | Implemented |
 | Context cache, fetch cooldown, continuation | Implemented |
 | Response policy (channel or DM) | Implemented |
-| Chat commands (`poll`) | Implemented |
+| Chat commands (`whitelist`) | Implemented. `poll` is paused. |
 | Persistent action log | Implemented |
-| Voice state read | Implemented |
-| Voice actions, notification parsing | Not started |
+| Web UI and JSON API | Nocturne 7a debug shell + roadmap placeholders. No auth; LAN or Tailscale only. |
+| Core process control and web QR login | Implemented. Core start/stop verified live. |
+| User search (cache and guild members) | Implemented |
+| Voice state read and `VOICE_STATE_UPDATE` events | Implemented |
+| Voice actions, audio, video | Not started. Plan in [docs/voice.md](docs/voice.md). |
+| Notification parsing | Not started |
 | Auth persistence in the core | Implemented and verified live |
 | CDP transport | Kept as a development fallback |
 
@@ -64,15 +72,15 @@ before you stop.
 
 See [CURRENT.md](CURRENT.md) and [TODO.md](TODO.md) for the live list. The main items are:
 
-1. Notification parsing: edits, deletes, reactions, and replies.
-2. Reply-to-puppet as a trigger.
-3. Per-user rate limit and command cooldowns.
-4. Setup command with reaction-based multiple choice.
-5. MCP event delivery decision.
+1. Voice backend behind the Web UI Join/Leave buttons.
+2. Voice: `voice.join`, `voice.leave`, `voice.move`, auto-leave, and the `stay @user` command.
+3. Notification parsing: edits, deletes, reactions, and replies.
+4. Reply-to-puppet as a trigger.
+5. Per-user rate limit and command cooldowns.
 6. Collector account with read-only voice membership.
 
-Open decisions wait in [CURRENT.md](CURRENT.md) → Open discussions: MCP event delivery, untrusted
-logging, the privacy pass, the setup command flow, and the first live reaction check.
+Paused: the `poll` command and the setup command flow. Parked: MCP event delivery and the LLM
+attachment. Open decisions wait in [CURRENT.md](CURRENT.md) → Open discussions.
 
 ## Resume checklist