fix(recording): save valid manual capture prefixes on interruption

[zortos293]

Related to #1091. Implements only saving the valid manual-recording prefix and stopping. It does not add clean screenshots, microphone recording/tracks, new containers or automatic recording restart, and does not close the wider feature request.

Preserve valid output without blocking playback

Manual recording now distinguishes normal completion from an early save after stream discontinuity, recorder overflow or transport interruption. It excludes the first invalid frame and stops admitting queued media after a cut. A file is saved only after a configuration-bearing video picture was written, the real Matroska trailer succeeded, the file closed and publication succeeded. Missing/empty prefixes and codec, storage, trailer or publication failures remain errors.

Keep the existing source-media tap and recorder worker. A bounded one-slot notification wakes the worker even when publisher-lock contention occurs without another media frame. Receive/decode/render publication stays nonblocking; source payloads and clocks remain unchanged. Replay export and discontinuity policy are unchanged.

Publish manual recordings through same-directory atomic no-replace rename on Linux, macOS and Windows. This avoids overwriting a concurrent destination without adding replay's hard-link requirement to manual recording. Windows paths retain extended-length/UNC representation. Cleanup does not remove an unrelated preexisting partial.

Report early completion once

Add typed completion metadata and recording-start identity to existing saved events and stop responses under native JSON protocol 7. The C ABI is unchanged. Qt reduces each correlated result once, shows an early-save notice, handles terminal events before acknowledgements, and ignores stale/duplicate replies. An authoritative completion releases retry gates even if a command acknowledgement was lost. Update the retained core command bridge and protocol documentation consistently.

The existing notice component, rendered with a synthetic completion fixture rather than live gameplay:

Verification

Exact reviewed head: 327b77ddcb8af91b6f022c398d057a678cce6a76. The final follow-up changes only test-directory allocation; production and consumer code are unchanged from the fully tested 023efd66 candidate.

• Regression tests failed before implementation on strict prefix deletion, failed completion reporting and preexisting-partial deletion. The dropped-acknowledgement retry regression also failed before its reducer correction.
• Full native streamer workspace: 1,077 passed, 9 existing ignores. Application core: 760 passed, 4 existing ignores. Strict workspace/core Clippy, formatting, localization and whitespace checks passed.
• Full Qt Debug application build with bundled FFmpeg/VAAPI and 413/413 CTest checks passed. The first run exposed a missing local Vulkan ICD; installing the documented software Mesa test dependency resolved all five failures before the final full rerun.
• 100 repetitions of all 18 deterministic recording-tap tests passed with eight threads and fixed wall-clock time, including pre-wait/after-rendezvous signaling, lock contention with no later traffic, graceful re-wait, generation/lifetime isolation and real mux-committed prefix cuts.
• Real CPU-generated H.264/HEVC/AV1 plus stereo Opus fixtures passed normal, discontinuity and RTP-wrap scenarios. FFprobe verified both tracks and packet timing; FFmpeg decoded video and non-silent audio. All nine scenarios also passed on a private exFAT volume that rejects hard links. Baseline rename and no-replace success/collision behavior were probed there; the mount was released afterwards.
• Real muxer write/trailer/publication fault injection, no-picture cases, publication races, restart/repeated stop, JSON FFI forwarding and Qt stale/reordered/drop handling are covered. Independent exact-head native and consumer reviews have zero open findings after correcting retry gating and Windows long-path handling.

No physical microphone, authenticated GFN disconnection, hardware decoder, HDR/10-bit/4:4:4, long-duration A/V sync or OBS performance claim is made. The Windows long-path regression passed in the first Windows CI run on identical production code. The first macOS run exposed shared timestamp-based test directories; the test-only follow-up allocates directories exclusively with a 128-attempt collision bound and adds an ownership regression. Forced collision injection confirms explicit failure after exactly 128 attempts. All 180 affected platform tests passed locally, with 3 existing ignores. Fresh required CodeQL/Windows/Linux/macOS gates passed on exact 327b77dd; actual platform logs confirm Rust 1.99 strict core/streamer Clippy and tests, all repaired prefix/publication fixtures, the Windows long-path regression, and selected Qt checks (Windows 30, Linux/macOS 32 each). A filesystem that cannot perform atomic no-replace publication reports a real save failure. Existing callback loss/runtime destruction and stalled storage do not gain crash-durability or guaranteed-notification semantics.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3082d21d-135e-492a-abfe-ff9a1c3e9025

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}