refactor(recording): use session-bound control commands

[vriesd]

Why

A recording toggle did not identify which session or operation a caller intended. Capture-stop and transcription cancellation shared one file, and the UI reconstructed stop progress from later polls.

Scope

• Replace the GUI toggle IPC with session-bound start, capture-stop, and transcription-cancel commands.
• Wait for the recording owner to publish initial status before acknowledging a start. Bind all control acknowledgements to the requested session; reject stale requests.
• Publish session identity and revision with owner status, and reject stale frontend observations.
• Keep capture-stop and cancellation in separate session-scoped signals. A delayed old request cannot overwrite a replacement session's signal.
• Preserve CLI, tray, and shortcut toggle affordances and legacy lock/control handling.
• Render accepted stop intent from backend snapshots. Retain only normal request-pending UI state.
• Clarify offline research ownership and correct the IPC generator description.

Tradeoffs

The explicit protocol adds backend types and regression coverage. It removes ambiguous stop/cancel behavior and frontend reconstruction of whether a stop was accepted. No daemon, additional speech engine, or new runtime dependency is introduced.

Blast Radius

This changes recording control and status across Rust, Tauri, and React. The existing kernel-backed recording lease, private file handling, injection, and history persistence remain in use. This PR is stacked on #134.

Verification

• The Rust workspace suite passes under Rust 1.89 and Xvfb. Review follow-ups add legacy flat-stop cleanup and immutable control-receipt coverage.
• 266 frontend tests and all 6 browser tests pass.
• Four new UI observation regressions fail against the initial draft and pass with the final ordering rules.
• Real child-process API tests use a blocked speech runtime: duplicate capture-stop preserves the transcript and History; explicit cancellation terminates transcription without a History row.
• Clippy, formatting, frontend lint/typecheck/build, generated IPC verification, and documentation link checks pass.
• Independent reviews passed. Automated review findings were fixed with immutable acknowledgements and exact-token legacy stop handling, including dictionary-training cleanup.

The final combined suite is also checked with the settings child PR. Local full Rust tests use two test threads; hosted CI runs independently.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T09:46:44.676458Z	08e853e	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6bc114f4a1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[vriesd]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 24b2667b02

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[vriesd]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 08e853e930

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[vriesd]

PASS. Independent shipping verification of PR #135.

Verified head 08e853e930098f97ab54867230d5ce8744cb82ec against base 617b92f87bd918efe5a87ab132d7c9016784a2de. Stable patch ID of the base-to-head diff is e2f6c496bda3e32a86d1b4e24e2014f161dc0302.

I did not implement this patch. I compared the previous toggle command and frontend stop coordination with the explicit controls, then traced the recording owner handshake, immutable start/stop/cancel receipts, token-scoped signal writes, exact-token legacy reads, atomic status identity, and frontend observation ordering. No blocking finding.

Fresh verification at this head:

• cargo +1.89.0 test -p echo --test recording_commands passed all three parent tests. The two ignored helper tests execute as separate owner/requester child processes. Duplicate stop preserved transcription and History, explicit cancel terminated transcription without saving History, and the legacy flat stop preserved transcription. Wrong-session controls were rejected and the owner retained status ownership.
• npm test -- src/App.test.tsx src/api/tauriDesktopApi.test.ts src/tauri.test.ts passed all 41 tests, including stale-observation handling and adapter contracts.

The process check uses fixture audio and a controlled speech executable. It verifies real process coordination and persistence, not microphone hardware or transcription accuracy. Prove It Works shaped this check by exercising owner/requester processes rather than relying on CI status alone.