diff --git a/plans/to-do.md b/plans/to-do.md
index 42c7543e..2767547b 100644
--- a/plans/to-do.md
+++ b/plans/to-do.md
@@ -5,7 +5,7 @@
 5. allow admins to click on locked rovers from the roster [x]
 6. add faster way for admins to login
 7. custom webhook profile pictures for chat bridge in discord
-8. home assistant switch that tells the server to force the lights on
+8. home assistant switch that tells the server to force the lights on [x]
 9. color coding with colored names and tape [x]
 10. audio forwarding [x]
    - streaming from server to rovers [x]
@@ -13,7 +13,11 @@
    - then voice chat [x]
 10. mobile controls column swapping (optional joystick on left) [x]
 11. fix fullscreen on mobile so that you can re-enter it [x]
-12. home assistant rover mute switch
+12. fix scroll bars on mobile
+13. add tool call embeds or something for the llm bot in discord, probably not in web ui
+14. add discord bot typing thing for when someone requests a replay
+15. change replay title for ones requested from discord, something other than "requester driving rover"
+
 
 # relative pipe dreams:
 1. VPS video forwarding
diff --git a/rulesdocs/lockdown_audit_rules.md b/rulesdocs/lockdown_audit_rules.md
index 0e57c4fa..6de43d69 100644
--- a/rulesdocs/lockdown_audit_rules.md
+++ b/rulesdocs/lockdown_audit_rules.md
@@ -1 +1,26 @@
 # RULES FOR LOCKDOWN AUDIT
+## what should not work at all during lockdown?:
+- spectator pages should be disabled
+- llm services should be paused
+- 
+
+## what should be disabled server-side for users during lockdown (to prevent people manually sending socket commands and stuff)?:
+- sending commands to rovers
+- requesting replays (both from socket and discord)
+- audio forwarding
+- using room controls
+- using the lift
+- using the neato
+- cant view video
+- cant stream audio
+- cant view room cameras
+- cant request and drive a rover
+
+## lockdown admin rule:
+- lockdown admins should be able to log in and use ALL features, even during lockdown
+- non-lockdown admins are not able to log in at all during lockdown.
+
+## web ui lockdown rules:
+- show admin login overlay on driver page, already correct i think
+- show disabled overlay on spectator pages, also already good i think
+- dont worry about disabling buttons and stuff. anything unallowed will be blocked server-side, and there will be the overlay in UI.
\ No newline at end of file