Update docs for the debug web UI, voice plan, and current status

docs/decisions.md

@@ -45,8 +45,8 @@ already does this work.
 
 ## ADR-5: Two pacing layers
 
-**Decision.** The daemon paces all commands with a random delay of 500 to 2800 ms. The core adds a
-hard limit of 500 ms between sends and 30 sends per minute.
+**Decision.** The daemon paces all outbound sends with a human-emulation policy (ADR-12). The core
+adds a hard limit of 500 ms between sends and 30 sends per minute.
 
 **Reason.** The daemon policy looks human. The core limit is a safety net. A daemon bug cannot cause
 a send flood.
@@ -97,3 +97,50 @@ Redact token-shaped strings before the write.
 
 **Reason.** The in-memory trigger log resets at restart. The action log gives a durable audit trail
 without storing raw credentials.
+
+## ADR-12: Human send pacing
+
+**Decision.** The first outbound send of a burst waits 30 to 200 ms. Later sends wait 500 to
+2800 ms. A burst ends after a random 5 to 20 seconds of quiet. Reads take a small 100 to 300 ms gap
+and do not reset the burst.
+
+**Reason.** A real client sends the first message quickly and then slows down. Reads are not
+visible in the same way and must not consume the send budget. The core hard limit stays as the
+safety net. See [daemon.md](daemon.md).
+
+## ADR-13: Web UI on a separate listener
+
+**Decision.** The daemon serves the web UI on its own listener (`0.0.0.0:8789`) with no
+authentication. The MCP server stays on localhost. The page is plain HTML, CSS, and JS behind a
+JSON API.
+
+**Reason.** Remote control over LAN or Tailscale needs a reachable port. A separate listener keeps
+the MCP surface local. The JSON API is the stable boundary, so a future frontend replaces the page
+without a backend change. No auth fits a private network, but the port must never be exposed to the
+public internet.
+
+## ADR-14: Voice joins muted, presence first
+
+**Decision.** `voice.join` joins muted. Audio playback is a later feature and unmutes only while
+playing. The bot leaves on its own after the owner or the stay target leaves, plus a delay.
+
+**Reason.** A muted bot captures no audio and does not disturb the call. The lifecycle keeps the
+bot from lingering in empty calls. See [voice.md](voice.md).
+
+## ADR-15: Nocturne design and the debug shell
+
+**Decision.** The web UI follows the Nocturne design system and the 7a debug shell from the design
+handoff (`poc/WebUIMockup.zip`). `poc/public/nocturne.css` carries the token set. The page stays
+plain HTML, CSS, and JavaScript with no build step. The JSON API stays the migration boundary.
+
+**Reason.** The owner chose the design direction. Vanilla keeps the no-build constraint. Roadmap
+gaps (TTS, transcript, tool-call tracing, favourites, voice actions) show as marked placeholders so
+the shape of the finished UI is visible while the backend catches up.
+
+## ADR-16: Takeover is a read-only gate
+
+**Decision.** The Takeover switch is client-side. Off, the composer is locked and the page cannot
+send. On, manual sends are allowed and each one is written to the action log as a `manual` entry.
+
+**Reason.** The switch exists to stop accidental use of the bot account, not to model agent
+ownership. The API does not enforce it, so other clients can still send. See [webui.md](webui.md).