Add an incident journal the troubleshooter reads back, and thinking for diagnosis

Plugin/unraid/api/ai.php

@@ -187,6 +187,17 @@ if ($action === 'clear') {
     exit;
 }
 
+// ── incident_add ──────────────────────────────────────────────────────────────
+// Appends one operator-written "this was the fix" note against a scope. POST only, and the
+// scope is whitelisted the same way ask's is — it is written to a file that later rides in a
+// prompt, so it gets the same treatment as anything else that reaches the model.
+if ($action === 'incident_add') {
+    if (!$isPost) { http_response_code(405); echo json_encode(['ok' => false, 'error' => 'POST only']); exit; }
+    echo json_encode(vv_ai_incident_add(
+        trim($_POST['scope'] ?? ''), trim($_POST['symptom'] ?? ''), trim($_POST['fix'] ?? '')));
+    exit;
+}
+
 // ── ask ───────────────────────────────────────────────────────────────────────
 if ($action === 'ask') {
     if (!$isPost) { http_response_code(405); echo json_encode(['ok' => false, 'error' => 'POST only']); exit; }
@@ -220,7 +231,7 @@ if ($action === 'ask') {
     // richer than a file name is an instruction-injection surface for no benefit — a scope is
     // only ever a name from this page's own view state.
     $scope = trim($_POST['scope'] ?? '');
-    if ($scope !== '' && !preg_match('#^[A-Za-z0-9 ._/-]{1,80}$#', $scope)) $scope = '';
+    if ($scope !== '' && !vv_ai_scope_ok($scope)) $scope = '';
 
     // The retrieval filter only means anything to the profile that retrieves.
     $kind = $profile === 'varaverk' ? trim($_POST['kind'] ?? '') : '';