docs: update .ai.md files for Sprint V-5 changes

- notes/.ai.md: audio attachments (model, routes, backend, journal UI, @mentions)
- media/.ai.md: audio MIME types, magic bytes, image-only re-encoding guard
- sessions/.ai.md: edit modal documentation
- phases.md: mark Sprint V-5 complete with deliverables

https://claude.ai/code/session_01JmHn8AGZVkKPAvHDgR67Hu

Author: claude

.ai/phases.md

@@ -103,6 +103,28 @@ and LegendKeeper's page headers.
 
 **Key files:** `relation_graph.js`, layout block types, entity templates
 
+#### Sprint V-5: Session Journal Audio Attachments & Bug Fixes ✅
+
+Audio file attachments for journal notes. Foundation for future AI transcription.
+Also fixed journal save bug, added @mentions to journal, and session edit UI.
+
+- **Journal save fix**: `journal.js` referenced nonexistent `window.Chronicle._tiptapBundle`
+  instead of `window.TipTap`. Fixed so TipTap editor loads and notes save correctly.
+- **Session edit UI**: Edit button + `editSessionModal` on session detail page.
+  Pre-populates all fields, JSON PUT to existing `UpdateSessionAPI`.
+- **Journal @mentions**: `MentionLink` mark + `MentionExtension` lifecycle wired
+  into journal's TipTap editor for entity search and tooltip cards.
+- **Audio attachments**: `note_attachments` table (migration 000005).
+  `AttachmentRepository` + `AttachmentService` + REST handlers (list/upload/delete/transcript).
+  Media service extended with audio MIME types + magic bytes validation.
+  Journal UI: microphone upload button, inline `<audio>` players, collapsible
+  transcript textarea, delete support.
+
+**Key files:** `static/js/widgets/journal.js`, `internal/widgets/notes/journal.templ`,
+`internal/widgets/notes/handler.go`, `internal/widgets/notes/repository.go`,
+`internal/widgets/notes/service.go`, `internal/plugins/media/service.go`,
+`internal/plugins/sessions/sessions.templ`, `db/migrations/000005_note_attachments.up.sql`
+
 ---
 
 ### Phase W: Polish, Ecosystem & Delight

internal/plugins/media/.ai.md

@@ -137,22 +137,23 @@ Served via `syncapi/media_api_handler.go`, authenticated with API keys.
 
 1. Client sends multipart form with `file` and `usage_type` fields
 2. Handler extracts file, CSRF token validation via middleware
-3. Service validates: MIME type allowlist (JPEG, PNG, WebP, GIF)
-4. Service validates: magic bytes match claimed MIME type
+3. Service validates: MIME type allowlist (JPEG, PNG, WebP, GIF, audio/mpeg, audio/ogg, audio/wav, audio/webm)
+4. Service validates: magic bytes match claimed MIME type (includes audio: ID3/frame sync for MP3, OggS header, RIFF+WAVE, EBML for WebM)
 5. Service checks: static file size limit + dynamic quotas via `StorageLimiter`
-6. **Image re-encoding (CDR)**: decode + re-encode strips ALL metadata (EXIF, IPTC, XMP)
-   and destroys polyglot payloads. WebP is re-encoded as JPEG (no Go WebP encoder).
+6. **Image re-encoding (CDR)**: For image MIME types only — decode + re-encode strips ALL metadata
+   (EXIF, IPTC, XMP) and destroys polyglot payloads. WebP is re-encoded as JPEG (no Go WebP encoder).
+   Audio files skip re-encoding (guarded by `strings.HasPrefix(mimeType, "image/")`).
 7. Service generates UUID filename in date-based directory: `{mediaPath}/2006/01/{uuid}.ext`
 8. Service writes sanitized file to disk (0640 permissions, directory 0750)
-9. Service generates thumbnails (300px, 800px) using Catmull-Rom interpolation
+9. Service generates thumbnails for images only (300px, 800px) using Catmull-Rom interpolation. Audio files skip thumbnail generation.
 10. Service inserts DB record with thumbnail paths as JSON
 11. Handler returns 201 with signed `{id, url, thumbnail_url, mime_type, file_size}`
 
 ## Security
 
 ### Upload Security
-- **MIME validation**: Allowlist only (JPEG, PNG, WebP, GIF)
-- **Magic byte validation**: Prevents Content-Type spoofing
+- **MIME validation**: Allowlist only (JPEG, PNG, WebP, GIF, audio/mpeg, audio/ogg, audio/wav, audio/webm)
+- **Magic byte validation**: Prevents Content-Type spoofing (images + audio formats)
 - **Image re-encoding / CDR**: Strips EXIF/metadata, destroys polyglot payloads
 - **Decompression bomb protection**: Max 10,000x10,000px images
 - **Rate limiting**: 30 uploads/min per IP
@@ -198,7 +199,7 @@ The campaign media browser (`media_browser.templ`) provides:
 - **Per-file progress bars**: XHR-based upload with real-time progress percentage
 - **Upload queue**: Alpine.js `mediaUploader` component with status tracking per file
   (pending → uploading → done/error), auto-refresh on completion
-- Client-side MIME/size validation (JPEG, PNG, WebP, GIF; 10 MB max)
+- Client-side MIME/size validation (JPEG, PNG, WebP, GIF; 10 MB max). Audio uploads go through journal widget, not media browser.
 - Pagination (24 files per page)
 - Storage stats header (file count, total bytes)
 - Sidebar link in "Manage" section (Owner-only)

internal/plugins/sessions/.ai.md

@@ -19,7 +19,8 @@ real-world play sessions (game nights) with attendee management and entity linki
   dependency (auto-invite campaign members). HTMX-aware responses.
 - **routes.go**: Route registration with role middleware.
 - **sessions.templ**: List page with status grouping (Upcoming/Completed/Cancelled),
-  detail page with attendee list and RSVP buttons, create modal.
+  detail page with attendee list and RSVP buttons, create modal, edit modal
+  (`editSessionModal` — pre-populated fields, JSON PUT to `UpdateSessionAPI`).
 
 ## Data Model
 
@@ -58,6 +59,19 @@ real-world play sessions (game nights) with attendee management and entity linki
 3. RSVP updates via HTMX POST, returns refreshed attendee list fragment
 4. Session detail shows attendee count summary (e.g., "3/5 going")
 
+## Session Edit UI
+
+- **Edit button**: Pencil icon in session detail header, visible to Scribe+ users.
+  Opens `#edit-session-modal` dialog.
+- **Edit modal** (`editSessionModal` templ component): Pre-populated with current
+  session values (name, scheduled_date, summary, status, recurrence settings).
+  Uses `<dialog>` element matching `createSessionModal` pattern.
+- **Status select**: Dropdown with planned/completed/cancelled. Uses `data-initial`
+  attribute + JS initialization (templ doesn't support `selected?=` syntax).
+- **Submit**: JS serializes form to JSON, sends `PUT` to existing `UpdateSessionAPI`
+  endpoint via `Chronicle.apiFetch()`, reloads page on success.
+- **Recurrence**: AlpineJS `x-data` toggle for recurring settings (same as create modal).
+
 ## Key Design Decisions
 
 - **Separate from calendar events**: Sessions are their own entity, not calendar

internal/widgets/notes/.ai.md

@@ -26,6 +26,14 @@ be shared with all campaign members via the `is_shared` flag.
 - FK cascade delete from `notes.id`
 - Max 50 versions per note, oldest auto-pruned
 
+### note_attachments table (migration 000005)
+- Per-note audio file attachments (voice memos, session recordings)
+- `id` (CHAR(26) ULID), `note_id` (FK CASCADE), `campaign_id`
+- `file_path`, `original_name`, `mime_type`, `file_size`
+- `duration_secs` (INT nullable — for future metadata extraction)
+- `transcript` (LONGTEXT nullable — manual or AI-generated transcript text)
+- `created_at`, `updated_at`
+
 ## Key Features
 
 ### Core
@@ -87,6 +95,10 @@ All under `/campaigns/:id/notes`:
 | GET | `/:noteId/versions` | ListVersions | Version history |
 | GET | `/:noteId/versions/:vid` | GetVersion | Get specific version |
 | POST | `/:noteId/versions/:vid/restore` | RestoreVersion | Restore to version |
+| GET | `/:nid/attachments` | ListAttachments | List audio attachments for note |
+| POST | `/:nid/attachments` | UploadAttachment | Upload audio file (multipart) |
+| DELETE | `/:nid/attachments/:aid` | DeleteAttachment | Remove attachment |
+| PUT | `/:nid/attachments/:aid/transcript` | UpdateTranscript | Save transcript text |
 
 ## Frontend Widget
 Registered as `Chronicle.register('notes', ...)`. Mounted via
@@ -106,19 +118,53 @@ app layout. The widget renders a fixed-position panel in the bottom-right.
 - `.note-entry-html` — rich text display container
 - `.notes-versions-*` — version history sub-panel
 
+## Audio Attachments (Sprint V-5)
+
+Audio file attachments for journal notes. Foundation for future AI transcription.
+
+### Backend
+- **`MediaUploader` interface** in `handler.go` — adapter wrapping media plugin's `UploadRaw` method
+  for multipart file uploads. Wired in `app/routes.go` via `mediaUploadAdapter`.
+- **`AttachmentRepository`** interface in `repository.go` — CRUD for `note_attachments` table.
+  Methods: `CreateAttachment`, `ListByNote`, `FindAttachmentByID`, `DeleteAttachment`, `UpdateTranscript`.
+- **`AttachmentService`** interface in `service.go` — business logic layer.
+  Methods: `ListAttachments`, `GetAttachment`, `CreateAttachment`, `DeleteAttachment`, `UpdateTranscript`.
+- Upload handler reads multipart file, pipes through `MediaUploader` (inherits media plugin's
+  MIME validation, magic bytes check, quota enforcement), then creates `NoteAttachment` record.
+- Allowed audio MIME types: `audio/mpeg`, `audio/ogg`, `audio/wav`, `audio/webm`.
+
+### Journal UI (`journal.js`)
+- **Upload button**: Microphone icon (`<label>` wrapping hidden file input) in note toolbar.
+  Accepts audio MIME types only.
+- **Attachments area**: `#journal-attachments` div between editor and status bar in `journal.templ`.
+  Hidden when no attachments.
+- **Audio player**: Inline `<audio>` element with native controls per attachment.
+- **Transcript**: Collapsible section per attachment with editable textarea and "Save transcript" button.
+  Submits via `PUT /:nid/attachments/:aid/transcript`.
+- **Delete**: Trash icon per attachment with confirmation dialog.
+- Attachments auto-load when a note is selected (`loadAttachments` in `selectNote`).
+
+### Journal @Mentions
+The journal's TipTap editor now includes `MentionLink` mark (preserves `data-mention-id`
+and `data-entity-preview` attributes) and `MentionExtension` lifecycle hooks (onCreate,
+onUpdate, onKeyDown, onDestroy). Users can type `@` to search entities and insert mention
+links with tooltip cards, matching the main entity editor's behavior.
+
 ## Dependencies
 - **Uses:** `internal/apperror`, `internal/plugins/auth` (GetUserID, RequireAuth),
-  `internal/plugins/campaigns` (RequireCampaignAccess, RequireRole, GetCampaignContext)
-- **Used by:** App layout (`NotesWidget()` templ component)
+  `internal/plugins/campaigns` (RequireCampaignAccess, RequireRole, GetCampaignContext),
+  `internal/plugins/media` (via `MediaUploader` adapter for audio uploads)
+- **Used by:** App layout (`NotesWidget()` templ component), journal page
 
 ## File Map
 | File | Purpose |
 |------|---------|
-| model.go | Note, NoteVersion, Block, ChecklistItem structs; request DTOs; IsLocked()/IsLockedByUser() methods |
-| repository.go | NoteRepository interface + MariaDB impl (CRUD, list queries, lock ops, version ops) |
-| service.go | NoteService interface + impl (business logic, version snapshots, lock management) |
-| handler.go | HTTP handlers (thin: bind, call service, render); canAccessNote helper |
-| routes.go | Route registration on Echo campaign group |
+| model.go | Note, NoteVersion, NoteAttachment, Block, ChecklistItem structs; request DTOs; IsLocked()/IsLockedByUser() methods |
+| repository.go | NoteRepository + AttachmentRepository interfaces + MariaDB impl |
+| service.go | NoteService + AttachmentService interfaces + impl (business logic, version snapshots, lock management, attachment CRUD) |
+| handler.go | HTTP handlers (thin: bind, call service, render); canAccessNote helper; MediaUploader interface; attachment handlers |
+| routes.go | Route registration on Echo campaign group (notes + attachments) |
+| journal.templ | Full-page journal template with audio upload button and attachments area |
 | service_test.go | 28 unit tests with mock repository |
 | .ai.md | This file |