Harden dictation cancellation and streamline audio-to-text processing

[r3dbars]

Why

Canceling dictation could leave queued transcription waiting, allow old save/conversion work to mutate a newer session, or let pasteback continue after cancellation. Model readiness deadlines also did not bound every suspended wait. This change makes those operations respect session ownership and cancellation while preserving durable saves and serialized native inference.

Product Impact

• Affects: dictation; shared microphone downmix also serves meetings.
• Lane: dictation reliability.
• Preserves final-only dictation, per-app Auto Enter, clipboard restoration, recovery audio, and daily Markdown storage.

What changed

• Fence save publication, recovery cleanup, conversion completion, and paste attempts against cancellation or a successor session. Move session-cap saves off the main actor.
• Observe model readiness with caller cancellation and the existing deadline without canceling shared model loading. Remove canceled ASR waiters promptly; active native inference retains ownership until it returns. Suppress canceled results and false failure/no-speech reports.
• Share dominant-channel microphone downmix and add antialiased segmented resampling. Retain native samples on conversion failure.
• Collapse duplicate-word runs in one pass and cache parsed dictionary preferences.
• Measure actual writer time separately from Auto Enter/publication, ASR queue time separately from inference, and AX lookup separately from clipboard snapshot work. Preserve Auto Enter/restoration delays.
• Add concurrency, clipboard, signal-conversion, and output-parity regression coverage. Correct an existing worker-cap test to distinguish legitimate pre-entry queue expiry from an admitted blocked worker; the two-worker cap remains strictly asserted.

How I checked it

• Agent preflight, source-list validation, and diff checks.
• Forced dependency rebuild.
• App compilation, signing, and launch/UI smoke.
• Final complete fast suite: 12,716 passed, zero failures.
• Integration, deterministic artifact E2E, and synthetic slow pasteback checks.
• Core package: 1,084 executed, 13 skipped, zero failures.
• QA CLI: 65 passed; round trip, stress, imported artifacts, synthetic audio, and release-health/PostHog fixtures passed.
• Independent agent reviews against the real base, including adversarial review of conversion ownership and cancellation handoff. Identified ownership gaps were fixed and re-reviewed; no outstanding correctness blockers were reported.
• Owner tested local build dc79a16aa4a7, explicitly confirming Bluetooth dictation and Auto Enter, then reporting ordinary copy/paste and overall behavior working well and feeling faster/more reliable. This is positive local testing, not an exhaustive Bluetooth/Zoom/device matrix.
• Consistently green cold-launch performance budget: see remaining caveat below.

The final verification commit e7b86768 differs from the tested app revision only by the worker test scheduling correction; production app sources are identical.

Synthetic production-path benchmark: five fixtures, three iterations each, with no real microphone or target-app paste. The candidate's stop-to-text medians were 64/99/160/344 ms for 3.9/10.9/36.5/111.8-second clips. All 12 spoken cases saved and all three silence cases stayed empty. Normalized spoken words matched the released build in all 12 runs; the long fixture differed only in punctuation/case normalization. Loaded-host measurements do not establish a guaranteed speedup or general recognition accuracy.

Risk Review

• Privacy/local-first behavior reviewed: new diagnostics contain aggregate timings, not transcript/audio content.
• Storage paths and Markdown format unchanged; recovery cleanup remains tied to ownership and successful persistence or explicit discard.
• Product capabilities and public copy preserved. No visual layout change requiring screenshot evidence.
• No version, appcast, download, or release publication changes.
• No private transcripts, audio, tokens, personal paths, or customer data included.

Remaining caveats

Cold startup is variable. The final build's startup budget stage measured 3,486 ms against the unchanged 3,000 ms limit, although compilation, signing, and UI smoke passed. Isolated candidate repeats measured 4,291/2,679/2,682 ms; the existing budget checker passed against the final repeat. The packaged release measured 911/770/713 ms. Packaging/signing/symbol differences mean this does not isolate a source-code regression, and passing repeats do not erase the slower observations. Cold-launch consistency remains open; this PR is not a release-readiness declaration.

Antialiasing intentionally adds a small conversion cost (about 1.81 ms for 10 seconds and 73.88 ms at the five-minute cap in an isolated optimized benchmark). It is a signal-quality safeguard. Actual Zoom coexistence, Bluetooth route changes, and diverse target-app behavior still benefit from broader hardware trials.

Workpad: dictation hardening scope and trial contract.

Agent handoff

COORD_DONE: BRIEF | this PR | dictation ownership, cancellation, conversion, cleanup, and timing hardening | no cleanup | review cold-launch caveat before release | functional suites passed; owner trial positive | lanes used: Codex=implementation and independent review; Claude/Local/Windows=skipped, no distinct proof added | review the diff and hosted checks