refactor(recording): centralize phase publication and verify recovery

[vriesd]

Why

Recording phase changes and their status writes were separate decisions. In particular, the worker entered Injecting without publishing that phase before insertion. A failed recording worker could also leave active status behind while the desktop PID stayed alive.

Scope

• Make PublishedSession own the existing state machine, lease, and phase publication. Publish Injecting before the effect and expose History IDs only after successful append.
• Validate scoped active status against the matching live lease. Keep failed terminal states and legacy recovery behavior.
• Consolidate explicit control/token/revision policy and frontend recording-observation acceptance without removing existing ordering guards.
• Maintain actual CLI stop/save/cancel/restart/owner-death and History-failure tests. Add training identity/resource-release coverage.
• Add an isolated real Tauri/WebKit probe to CI, with source/binary identity, strict evidence validation, and a dedicated build target. Run isolated X11 registration and private-bus portal routing checks in CI.
• Record the implementation, baseline, transport decision, and remaining product acceptance in Plan 21.

Tradeoffs

The implementation retains scoped file intents, polling, and the existing runtime. The measurements do not justify a new transport or daemon. This concentrates production policy and adds maintained verification; it does not claim a reduction in total lines.

Physical-desktop and one-to-two-week routine-use sign-off remain open. Synthetic audio, a fake engine, Xvfb, and a test portal do not establish real microphone, compositor, or insertion behavior across supported desktops.

Verification

• Full Rust workspace: 525 passed, 16 ignored environment/helper cases.
• Frontend: 275 tests, build/typecheck/lint passed. All six browser tests passed on the final run.
• Clippy, formatting, generated IPC, workflow pins, and document links passed.
• Real native probe: ten contracts passed. Five evidence-gate tests reject missing, stale, or failed proof.
• Isolated X11 grab and private-bus portal lifecycle checks passed.
• Independent code review passed the owner/publication, lease recovery, control receipts, and frontend ordering changes.

One browser run timed out during concurrent compilation; the unchanged focused rerun and final full browser run passed. The portal fixture initially consulted host config/models; isolating those paths fixed its timeout.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-05T15:45:27.332760Z	321f7bd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[vriesd]

PASS - independent shipping verdict for PR 138.

Reviewed current PR head 321f7bdab62624e81aefdfc05eaea1cc85574783 against base 55843805aa71a64910daf0730c7921de2fa8afb3.

Evidence checked:

• Stable patch-id: 83067b940039ab19bf9a2bc82ff6724803ae7cba.
• GitHub PR metadata reports base 55843805aa71a64910daf0730c7921de2fa8afb3, head 321f7bdab62624e81aefdfc05eaea1cc85574783, merge state CLEAN.
• Hosted checks are green for the required PR check jobs.
• Hosted native recording artifact /tmp/echo-coordination-impl/ci-final/recording-native.json is valid: exit code 0, source did not change during run, 10/10 native contract checks passed, settings revisions advanced [2, 3, 4, 5], and stop/start/stale-stop/terminal-history checks all passed.
• Prior focused local review/test evidence covered the production coordination paths, including PublishedSession, scoped lease status reads, stop/cancel acks, React recording observation ordering, and the process-level recording command tests.

Notes / known limit:

• This is a shipping PASS for the PR as tested by CI and the native Xvfb/fake-engine lane.
• Physical desktop dictation and elapsed soak were not performed for this PR. The user has explicitly authorized merge with that known limit.