Update docs for the debug web UI, voice plan, and current status

README.md

@@ -49,7 +49,7 @@ Think of it as:
 - 📹 **A streaming endpoint (planned).** Push files, cameras, generative visuals, or pure slop into a voice channel.
 - 🧪 **A science experiment that will absolutely not get your account banned** *(allegedly)*.
 
-> **Status: text layer works.** The real Vesktop client runs headless and is driven through a validated capability layer. Triggers, trust tiers, conversation context, response policy, polls, persistent logging, and MCP tools are live. Voice actions, audio, and video are still the vision. The design docs live in [docs/INDEX.md](docs/INDEX.md).
+> **Status: text layer works.** The real Vesktop client runs headless and is driven through a validated capability layer. Triggers, trust tiers, conversation context, response policy, persistent logging, MCP tools, user search, voice state reads, and the Nocturne-style debug web UI are live. Reaction polls are paused. Voice actions, audio, and video are still the vision. The design docs live in [docs/INDEX.md](docs/INDEX.md).
 
 ## 🗿 Why though
 
@@ -73,7 +73,9 @@ Veskslop ships an **MCP server** so any MCP-capable agent (Claude, GPT-based age
 | --- | --- |
 | `get_state` | User, guilds, and channels. Cache-only, zero queries. |
 | `get_voice_state` | Which voice channel a user is in and who else is suffering there. |
-| `send_message` | Send a message as the account. Query-paced. |
+| `get_voice_overview` | Occupied voice channels in a guild and their members. |
+| `search_users` | Find a user ID from a username, nickname, or cached profile. |
+| `send_message` | Send a message as the account. Send-paced. |
 | `read_messages` | Read the client's message cache. |
 | `send_dm` | Slide into someone's DMs. |
 | `get_context` | Recent conversation context for a channel. Fetches new messages only. |
@@ -83,6 +85,9 @@ Veskslop ships an **MCP server** so any MCP-capable agent (Claude, GPT-based age
 | `whitelist_list` / `whitelist_add` / `whitelist_remove` | Trust tiers: user, trusted, admin. |
 | `run_commands` | Run several read-only tools in one call. |
 
+There is also a small web control UI on `http://<host>:8789/` with a JSON API and an SSE event
+stream. See [docs/webui.md](docs/webui.md).
+
 **Planned**: voice join/leave, audio play/capture, video streams, message edit/delete/upload, presence and voice state control.
 
 Every action is **safe by default**: strict input validation in the client, structured errors, a hard outbound rate limit, and paced sends. A buggy agent cannot crash the client or spam Discord.
@@ -204,14 +209,16 @@ The full setup, including the headless client and the mock core, is in
 - [x] Trigger log, trust tiers, conversation context, continuation window
 - [x] Response policy, hard rate limits, persistent action log
 - [x] MCP server with the live text tool surface
-- [x] Reaction polls and chat command help
+- [x] User search and voice overview
+- [x] Nocturne debug web UI (7a shell, Takeover read-only gate, Settings)
+- [~] Reaction polls and chat command help (paused)
 - [ ] Notification parsing: edits, deletes, replies, references
 - [ ] Reply-to-puppet as a trigger
 - [ ] Per-user rate limits and command cooldowns
-- [ ] Setup command with reaction-based multiple choice
-- [ ] MCP event delivery (poll, stateful session, or local event stream)
-- [ ] Collector account for voice membership fallback
 - [ ] Voice join/leave and invite-link joins
+- [ ] Voice auto-leave and the `stay @user` command
+- [ ] Collector account for voice membership fallback
+- [~] MCP event delivery (parked)
 - [ ] Outbound audio pipeline
 - [ ] Inbound audio capture pipeline
 - [ ] Video stream pipeline