Fix toggle cancellation decision before capture stop

[vriesd]

A CLI, tray, or native-shortcut toggle could stop capture and then mistake the resulting transcription phase for a request to cancel. That could discard the transcript from the same gesture that stopped recording.

Capture the phase and session identity before signaling stop. Only a session already observed transcribing can receive a cancellation intent. Both toggle entry points use this ordering.

PRs #134, #135, and #136 have merged. This follow-up targets main and fixes recording code introduced in #135. It must land before the v0.14.17 release tag. An order-sensitive regression forces the capture-to-transcription transition during the stop callback and covers matching and replaced sessions.

The recording unit suite passes. Reversing the observation and stop callbacks in an isolated checkout makes the new regression fail with status must be observed before stop writes its signal. The fixed ordering passes.

Independent verification passed the real CLI stop/save and separate transcription-toggle/cancel sequences, plus the causal regression. The rebase onto main preserves patch-id fe7c83f2961b02afce81b1a208525272a265cf21.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T11:57:09.003595Z	acb816f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[vriesd]

PASS. Independent shipping verification of PR #137.

Verified head acb816f68d7c9f92d85440df6a4d089af3457324 against base 7582fb6ab33049647171d61153dd7c7adfe99b89. Stable base-to-head patch ID is fe7c83f2961b02afce81b1a208525272a265cf21.

I did not implement this patch. The previous implementation read phase after writing capture-stop. The new shared decision reads phase and session identity before that write. Both CLI and managed tray/shortcut toggle paths use that decision, and a different session token cannot authorize cancellation.

Fresh actual CLI verification used the rebuilt echo-desktop rec --toggle executable with fixture audio and a blocked speech executable:

• First toggle started recording. Second toggle stopped capture. Transcription remained active without a cancel signal, then completed and saved the expected transcript to History. Owner exit was 0.
• In a separate session, a third toggle issued while transcription was already active cancelled transcription. Owner exit was 1, status was Failed, and no History row was saved.

The causal capture_toggle_observed_before_transition_never_becomes_cancel regression also passed on freshly compiled final source. I inspected the separate mutation result showing that reversing observation and signal callbacks fails its ordering assertion.

Commands used Rust 1.89 and held the shared Cargo lock throughout compilation and CLI execution. The desktop binary used --no-default-features because this worktree has no bundled frontend assets. This preserves the CLI recording path. This check covers process behavior and persistence, not microphone hardware, speech accuracy, or a tray click.