Made of little things.

# Body Journal — implementation roadmap

Updated 26 October 2026. This records the requested next work and the completed
foundation below. The current intake remains for adults describing their own symptoms.
See [product plan](product-plan.md) for the original clinical and data-model brief,
and [anatomy layers](anatomy-layers.md) for the active implementation slice.

## Completed foundation: anatomy layers and focused inspection

Named, paintable muscles, bones and selected organs now follow the pose,
observation, save/reload and screenshot workflows. Sex-dependent reproductive
structures include original female schematics. Body shape and deformation remain
illustrative, and coverage is incomplete.

[Focused inspection](focused-inspection.md) adds region/structure pivots,
independent saved observation views and labeled AI captures.
[Hierarchical visibility](anatomy-visibility.md) now replaces full/fade/isolate modes:
select a body part and press Focus to move the camera; separate checkboxes control
limbs, hands, fingers and their descendants with mixed states. Whole body resets
the camera only, and Show all restores visibility. Skin regions include individual fingers; internal
layers expose available named structures. [Individual finger controls](finger-posing.md) now preserve bends per observation
and in image evidence. [Mouth inspection](oral-inspection.md) now adds 28 permanent
teeth with explicit FDI labels, a tongue surface, jaw references and saved opening
controls. Gums, palate, wisdom teeth, nasal cavities and ear detail remain future
work. The detail-asset inventory is in the linked brief.

[Combined anatomy controls](anatomy-controls-slice.md) now put focus and visibility
in one default-open side panel. Wrist/ankle balls and bounded fingertip IK support
direct dragging and keyboard movement; sliders remain available. Working limb
poses and panel openness persist. Mouth depth is fitted to the skin's lip/ear
landmarks across body shapes. These are illustration controls, not measured motion.

[Observation groups](observation-groups.md) now link body observations and general symptoms
with patient-written names and explanations. Many-to-many membership, independent
disclosures, reload persistence and patient-suspected relationship summaries are included.

[Photos and reports](photos-and-reports.md) now include up to four resized, saved
photos with captions/dates/observation links and explicit AI inclusion. The bridge
labels patient photos separately from illustrations. Report schema v2 adds history,
evidence and unknowns, per-concern assessment, differential evidence, evaluation
rationales, safety-net advice and a simple-language section. The header holds the
former footer controls. Three previewable fictional intake templates include
multiple observations, poses, groups and detailed free-text/chronic timing.

## Next: documents, richer examples and detailed anatomy

| Work | Acceptance and dependencies |
| --- | --- |
| Expand example-case library | Build on the three implemented text/location templates with painted anatomy and additional layers. Clearly marked synthetic, fully captured cases with multiple observations, layers, poses, symptom histories and general symptoms. Preview before replacing the current draft; offer a separate case. No real medical records or provider calls bundled. Include examples of uncertainty and unrelated observations, rather than teaching users to assume diagnoses. |
| Document import | Host-picked reports/PDFs with user-reviewed text extraction, date, provenance and page references. Originals and large private attachments need a storage design beyond the current bounded browser copies. |
| Pose library and categories | Sport, work, everyday activity, rest and examination positions; searchable presets with previews, reset and independent per-observation snapshots. Include kneeling, squatting, prone, side-lying, lifting, desk work, reaching and common sport positions. A template describes the illustration; activity and pain provocation still require patient confirmation. |
| Further IK gizmos | Build on the implemented wrist/ankle and fingertip balls: axis-constrained translation/rotation, elbow/knee pole controls, reset/undo and numeric alternatives. Preserve anchors and camera state throughout edits. |
| Detailed inspection | Build on the implemented adult teeth/tongue layer and FDI labels. Add ear and detailed cavity surfaces, gums/palate and clinically reviewed regional labels; distinguish surface marks from perceived depth. |

Focused inspection must support the intended descriptions: right hand with a bent
index finger; the inner wall of the left nostril; jaw below a specified tooth; and
pain perceived behind the left eye. The location contract needs patient-relative
left/right, subregion, surface versus perceived depth, a free-text override and
confidence/unknown states. Resolve ambiguous wording such as “right interior wall
of the left nostril” with a confirmation view. Tooth numbers must name their
numbering system and dentition, with explicit mappings; never silently reinterpret
a number. A point behind an eye is not automatically an eye disease. New cavity,
dental and joint meshes require provenance, anatomical review and anchor versions.

## Foundation: languages, case history and reports

| Work | Acceptance and dependencies |
| --- | --- |
| Broad internationalization | Externalize UI strings, questions, help, validation, anatomy labels, report sections and prompt templates. Use stable language-independent IDs for answers, structures and groups. Locale-aware dates, numbers and units; pluralization, long labels and RTL layout. Preserve original patient wording and unit values alongside normalized data. Store preferred UI/report language and explicitly request it from AI; validate headings/language without treating machine translation as clinical review. Test a long-text language, RTL and non-Latin scripts. Localize the complete intake and review flow, not only navigation. |
| Follow-up questions before a final report | Let the model choose between a bounded set of focused questions and a final assessment. Explain why each question matters, link it to observations, accept free text / not sure / skip, persist answers, and offer review before each further model call. Limit rounds and costs, keep each input/report revision, and never delay emergency advice for follow-up. Clearly distinguish an unfinished intake from a final report. |
| Report provenance and evaluation | Build on implemented v2 detailed/simple-language reports. Add document source references and clinician-reviewed evaluation. Preserve input revision, provider/model, prompt version and report language. Editing a case visibly marks an older report outdated. Avoid invented examination findings or numerical diagnostic confidence. |
| PDF export | Readable patient summary plus detailed clinician appendix, selected annotated views, dates, units, source/provenance and limitations. Pagination, selectable text, Unicode/font embedding, accessible headings and print layout. Preview and choose contents before export. Verify a supported host-mediated file export path; do not assume browser downloads or filesystem access inside the sandbox. Translation and report schema should land first. |

## Identity and encrypted continuity

1. **Onboarding with a disposable Nostr identity and backup.** Identity creation,
   signing and key backup/recovery belong to the host/signer. The napplet explains
   the difference between a temporary local session, a recoverable identity and
   an existing identity; provides a host-supported handoff; and verifies return
   state. Never expose a private key to app code. Before implementation, verify
   that creation/backup/recovery is actually supported by installed host APIs.
2. **Encrypted persistence on Nostr.** Define a versioned private case envelope,
   host-owned encryption/decryption and OUTBOX publication/read flow. Verify the
   available encryption surface before selecting a protocol. Test recovery on a
   second device, locked/lost keys, failed writes, quotas, concurrent edits and
   migration. Keep health details out of public tags, event summaries and filenames.
   Relays can retain ciphertext and metadata; deletion is not guaranteed erasure.
   Separately design encrypted attachment storage and consented sharing. API keys
   are a separate secret class and must not be included in case backups by default.

These are planned host integrations, not permission to bypass sandbox boundaries
or implement signing, relay connections or crypto key storage inside this napplet.
Existing SDK storage remains the local-session path while these are designed.

## Additional populations and camera-assisted posing

- **Child proportions:** dedicated age-appropriate reference meshes and morphs,
  validated landmarks and stable anchors, rather than scaling an adult uniformly.
  Treat visual age support separately from pediatric intake, guardian/caregiver
  flows, age-dependent questions and evaluated AI behavior. Do not enable pediatric
  assessments solely because a smaller model is available. Include dental
  dentition in the later detailed-anatomy work.
- **Camera pose detection:** verify a host-mediated camera capability, then use
  on-device inference where feasible. Explicit start/stop and visible camera state;
  no automatic capture upload. Show uncertain/occluded joints, allow correction,
  and require acceptance before applying a pose. Camera estimates are not measured
  clinical range of motion. Test orientation, mirroring, seated/lying views,
  mobility aids and failure cases; retain presets and manual controls.

## Suggested order

Report/PDF import and expanded examples → additional detail assets → pose library and IK →
internationalization and report provenance → PDF export → host-supported
identity/recovery and encrypted sync → child-specific and camera-assisted flows.
Host capability investigation can happen alongside local UI work. Each slice
needs saved-data compatibility, the supported narrow/touch layouts, and meaningful
tests of its actual user flow before being called complete.