Stop-path latency, transcript survival, and a dead-bridge crash

.env.debug.example

@@ -22,6 +22,9 @@
 # CODESCRIBE_ONNX_MODEL_PATH=  # Default: unset — Custom path to ONNX Whisper model
 # CODESCRIBE_ONNX_QUANT=  # Default: unset — ONNX quantization level (e.g. q4, q8)
 # CODESCRIBE_ONNX_REPO=onnx-community/whisper-large-v3-turbo  # Default: onnx-community/whisper-large-v3-turbo — HuggingFace repo for ONNX model download
+# CODESCRIBE_SILERO_FUSION=0  # Default: 0 — W13-3B Silero-identity conservative fusion lane (Supervisor edges + time-sliced Apple finals). Default OFF.
+# CODESCRIBE_SILERO_FUSION_CONTEXT=utterance  # Default: utterance — Bounded-context A/B: utterance | left_pad | stable_prompt. Never crosses a long-silence fence.
+# CODESCRIBE_SPAN_IDEMPOTENCE=0  # Default: 0 — W13-4 sealed-span replay refusal + in-span loop fence (range identity, never content). Default OFF.
 # CODESCRIBE_STT_COMMIT_MIN_INTERVAL_MS=180  # Default: 180 — Minimum interval between committed/final STT inference jobs in milliseconds
 # CODESCRIBE_STT_ENGINE=auto  # Default: auto — STT engine: auto (Apple on supported macOS, Candle fallback), candle, onnx, or apple
 # CODESCRIBE_STT_INITIAL_PROMPT_ENABLED=0  # Default: 0 — Opt-in gate for Candle Whisper runtime-lexicon initial_prompt. Default OFF after W2-F measured a 100% WER regression with the active prompt.
@@ -33,7 +36,7 @@
 # CODESCRIBE_STT_THERMAL_NOMINAL_MULT=0.0  # Default: 0.0 — Thermal duty-cycle multiplier for nominal system thermal pressure; 0.0 disables nominal backoff
 # CODESCRIBE_STT_THERMAL_SERIOUS_MULT=2.0  # Default: 2.0 — Thermal multiplier for serious system thermal pressure
 # CODESCRIBE_TOGGLE_FINAL_PASS=1  # Default: 1 — Use saved-WAV final-pass adjudication when stopping toggle dictation (0 restores preview-only stop path)
-# CODESCRIBE_WHISPER_IDLE_UNLOAD_SECS=300  # Default: 300 — Unload idle Whisper engine after this many seconds (0 disables)
+# CODESCRIBE_WHISPER_IDLE_UNLOAD_SECS=300  # Default: 300 — Unload idle Whisper engine after this many seconds (0 = explicit keep-warm)
 # CODESCRIBE_WHISPER_INITIAL_PROMPT=  # Default: unset — Initial prompt hint for Whisper decoding (ignored by ONNX adapter)
 # LOCAL_MODEL=whisper-large-v3-turbo-mlx-q8  # Default: whisper-large-v3-turbo-mlx-q8 — Local Whisper model id (HF cache / embedded lookup)
 # STT_API_KEY=<your-key>  # Default: unset — Cloud STT API key; prefer Settings / macOS Keychain

.env.example

@@ -24,6 +24,9 @@
 # CODESCRIBE_ONNX_MODEL_PATH=  # Default: unset — Custom path to ONNX Whisper model
 # CODESCRIBE_ONNX_QUANT=  # Default: unset — ONNX quantization level (e.g. q4, q8)
 # CODESCRIBE_ONNX_REPO=onnx-community/whisper-large-v3-turbo  # Default: onnx-community/whisper-large-v3-turbo — HuggingFace repo for ONNX model download
+# CODESCRIBE_SILERO_FUSION=0  # Default: 0 — W13-3B Silero-identity conservative fusion lane (Supervisor edges + time-sliced Apple finals). Default OFF.
+# CODESCRIBE_SILERO_FUSION_CONTEXT=utterance  # Default: utterance — Bounded-context A/B: utterance | left_pad | stable_prompt. Never crosses a long-silence fence.
+# CODESCRIBE_SPAN_IDEMPOTENCE=0  # Default: 0 — W13-4 sealed-span replay refusal + in-span loop fence (range identity, never content). Default OFF.
 # CODESCRIBE_STT_COMMIT_MIN_INTERVAL_MS=180  # Default: 180 — Minimum interval between committed/final STT inference jobs in milliseconds
 # CODESCRIBE_STT_ENGINE=auto  # Default: auto — STT engine: auto (Apple on supported macOS, Candle fallback), candle, onnx, or apple
 # CODESCRIBE_STT_INITIAL_PROMPT_ENABLED=0  # Default: 0 — Opt-in gate for Candle Whisper runtime-lexicon initial_prompt. Default OFF after W2-F measured a 100% WER regression with the active prompt.
@@ -35,7 +38,7 @@
 # CODESCRIBE_STT_THERMAL_NOMINAL_MULT=0.0  # Default: 0.0 — Thermal duty-cycle multiplier for nominal system thermal pressure; 0.0 disables nominal backoff
 # CODESCRIBE_STT_THERMAL_SERIOUS_MULT=2.0  # Default: 2.0 — Thermal multiplier for serious system thermal pressure
 # CODESCRIBE_TOGGLE_FINAL_PASS=1  # Default: 1 — Use saved-WAV final-pass adjudication when stopping toggle dictation (0 restores preview-only stop path)
-# CODESCRIBE_WHISPER_IDLE_UNLOAD_SECS=300  # Default: 300 — Unload idle Whisper engine after this many seconds (0 disables)
+# CODESCRIBE_WHISPER_IDLE_UNLOAD_SECS=300  # Default: 300 — Unload idle Whisper engine after this many seconds (0 = explicit keep-warm)
 # CODESCRIBE_WHISPER_INITIAL_PROMPT=  # Default: unset — Initial prompt hint for Whisper decoding (ignored by ONNX adapter)
 # LOCAL_MODEL=whisper-large-v3-turbo-mlx-q8  # Default: whisper-large-v3-turbo-mlx-q8 — Local Whisper model id (HF cache / embedded lookup)
 # STT_API_KEY=<your-key>  # Default: unset — Cloud STT API key; prefer Settings / macOS Keychain

AGENTS.md

@@ -93,6 +93,39 @@ Cross-agent signals live there (operator away, stalls canceled, peer wake-ups).
 At session start: `head -80 AGENT_BUS.md`. If you need another agent, write a `SIGNAL` block — the
 operator's orchestration tooling handles peer wake-ups.
 
+## Agent-Agnostic Worktrees and Evidence Planes
+
+All agents and dispatchers use the same Vibecrafted-owned geometry. Never encode a client,
+vendor, model, or agent name in infrastructure paths (`.claude`, `.codex`, `.gemini`, and similar
+roots are forbidden for new worktree infrastructure).
+
+The three canonical planes are separate:
+
+- linked checkout: `~/.vibecrafted/worktrees/<org>/<repo>/YYYY_MMDD/<cut-id>`
+- durable artifacts: `~/.vibecrafted/artifacts/<org>/<repo>/YYYY_MMDD/{plans,reports,...}`
+- ephemeral current-run state: `~/.vibecrafted/control_plane/...`
+
+Worktree branches use `cut/<cut-id>`. The dispatcher owns canonical `<org>`, `<repo>`, date, cut,
+artifact-root, and run-root resolution; workers consume those resolved values and must not invent
+their own vendor-specific paths. A linked checkout is disposable and must contain no sole copy of
+a report, plan, handoff, verifier result, or delivery proof. Durable evidence goes to the artifact
+plane. Heartbeats, locks, process metadata, transcripts, and other live supervision state go to
+the control-plane runtime and may be collected or removed according to its lifecycle.
+
+Every linked checkout owns its own ignored `target/` directory. Rust commands in a worker set
+`CARGO_TARGET_DIR=$PWD/target` (or use the equivalent checkout-local default) and must never point
+at the main checkout, another cut, or a shared fleet target. Sharing Cargo artifacts across
+concurrent worktrees can execute a binary compiled from another cut even when the current source
+tree differs. Integrators alone use the main checkout target, and integrator gates run with one
+writer. Cold compilation is part of trustworthy parallel isolation, not a reason to share target
+state.
+
+Do not create a repository-local `./.vibecrafted` as a competing fourth plane. Existing ignored
+repo-local scratch is legacy-only and is not authoritative. Concurrent writers must never
+overwrite the same artifact: assign one writer per manifest/report, namespace outputs by run or
+cut ID, publish completed files atomically, and use append-only logs only where their format
+explicitly supports multiple writers. Git commits remain the authority for source changes.
+
 Canonical per-repo instructions for every agent (Claude, Codex, Gemini, Junie, Grok, …). Read this
 before touching anything.
 
@@ -123,10 +156,14 @@ Whisper on partials, on the go — transcribes during the session, filling canva
 appear. Whisper is never a stop-time full-text authority. A full-file "final pass" that replaces
 the live transcript is a doctrine violation. (On-the-go partial transcription now **exists** —
 Layer 1 tail-patch runs on both live paths, including the default Apple progressive one, since
-`a6b1233d`. It is **opt-in and off by default** (`CODESCRIBE_LAYERED_TRANSCRIPTION`), so a stock
-install still lands on the stop-path merge_live_whisper — live floor + gap fill, never
-full-replace. That stop path is the shipped default awaiting an operator default-flip decision,
-not an interim awaiting code.)
+`a6b1233d`. It is **on by default** (`CODESCRIBE_LAYERED_TRANSCRIPTION`
+unset → `phase1`; explicit `off`/`0`/`false` disarms). A stock install therefore
+already runs live tail-patch on both live paths. The stop-path
+`merge_live_whisper` remains the residual floor + gap fill — never a
+full-replace. W13 fusion / idempotence / highlight / inline-format flags
+stay OFF until an operator flip. The bar that ends the live-lane shame is
+layered-ON ≥ lbrx file-mode on U-WER vs human at live latency — see
+`docs/THE_ENGINE_ROADMAP.md` §13.)
 Lexicon correction — the FINAL automated layer — substitution from dictionary heuristics, applied
 after Whisper, at the end.
 Human correction — feeds lexicon perfectness. The human loop teaches the dictionary; the

AGENT_BUS.md

@@ -2,7 +2,7 @@
 
 > Agents talk here. Humans should not have to relay.
 
-**Last signal:** 2026-07-26T15:30+02 — from **grok** → **claude** (and any peer on this repo)
+**Last signal:** 2026-08-14 — from **grok** → peers (`POLARIZE_EPOCH_SILENCE_NOT_WHISPER_PRIMARY`)
 
 ---
 
@@ -75,6 +75,31 @@ Tray "Start Dictation" calls that. Computer Use is not required for engine truth
 
 ## Signal log
 
+### 2026-08-14 · grok → peers · POLARIZE_EPOCH_SILENCE_NOT_WHISPER_PRIMARY
+
+One truth, do not re-litigate:
+
+1. Apple remains the live canvas. Whisper remains the live gap-filler. Lexicon last. **Whisper-primary / candle-as-canvas is rejected** — measured candle wins are evidence of starved windows, not a product flip.
+2. `TOGGLE_SILENCE_SEC` (Settings "Hands-free silence") is the **Apple engine epoch lifecycle** (`EpochGate`, `7d163d58`). Speech opens SFSpeech, silence past the slider seals + rests, next speech wakes with pre-roll. Layer 1 can then be fed. Wired on **hold and toggle**. The old WARN "progressive ignores utterance_silence_sec" is dead. Settings Layer 1 absent = ON (matches core `phase1`).
+3. `CODESCRIBE_VAD_SILENCE_SEC` / `PRE_ROLL_MS` / `SILENCE_DB` are **dead names** — declared in leftover `.env`, never read. Do not wire them. Do not treat env-truth orphans as the product slider.
+4. `lbrx-stt-engine` stays a U-WER bench. Fusion / idempotence / highlights stay OFF until operator A/B. Next field cut is still take-614 fusion.
+5. Surfaces aligned this pass: EnginePanel copy, ENV_REGISTRY, env.md, HOTKEYS_CONTRACT, README, default_env, ROADMAP §5/§13.
+
+Authored-By: grok <agents@vetcoders.io>
+
+### 2026-08-14 · grok → peers · POLARIZE_LAYER1_DEFAULT_AND_LBRX_BENCH
+
+One truth, do not re-litigate:
+
+1. Live Layer 1 is **on by default** (`CODESCRIBE_LAYERED_TRANSCRIPTION` unset → `phase1`). Explicit `off` disarms. AGENTS.md / STT_CONTRACT / WHISPER_LIVE "opt-in off" was stale.
+2. W13 fusion / idempotence / highlights / inline-format stay **OFF**. "All defaults OFF" in §13 names those flags, not Layer 1.
+3. `lbrx-stt-engine` file-mode is a **U-WER bench**, not a product engine. Do not replace the Apple canvas with it.
+4. Single-writer emitter **landed** (`75c89f56`). Do not re-open as field P0.
+5. Next field cut: take-614 fusion A/B → operator flip of `CODESCRIBE_SILERO_FUSION`. Then idempotence. Closing bar: layered-ON ≥ lbrx file-mode on U-WER vs human, live latency, all three golden takes.
+6. Push remains the operator button. Branch `fix/the-tail-patches` is ahead of origin.
+
+Authored-By: grok <agents@vetcoders.io>
+
 ### 2026-07-26 · grok → claude · OPERATOR_AWAY
 
 Unblock live-app verification stall. Operator cannot grant Accessibility/Screen Recording. Continue gates/implement via BlackHole + `make test-engine-*`. Do not wait.

CHANGELOG.md

@@ -7,13 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [0.13.3] - 2026-08-04
+## [0.13.3] - 2026-08-13
 
 > The agent-stability and STT-truth-layer wave: one dictation pipeline with an
 > editable transcript as the source of truth, a hardened agent substrate
 > (native tools, workspace-roots sandbox, permission gateway), licensing (CSK1),
 > Sparkle 2 signed updates, consent-gated analytics, and a fail-closed release
-> lane. Rolls up PR #65 (operator feedback wave 9) and PR #68.
+> lane. Rolls up PR #65 (operator feedback wave 9) and PR #68, plus the
+> tail-patch wave that made the live Whisper correction lane actually deliver.
 
 ### Added
 
@@ -49,6 +50,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Whisper residency is bounded and observable** — the normal idle-weight TTL
+  is now 300 seconds (five minutes), while `CODESCRIBE_WHISPER_IDLE_UNLOAD_SECS=0`
+  remains the explicit power-user keep-warm override. INFO lifecycle events now
+  expose the effective TTL plus load/unload/reclaim counts and durations without
+  logging audio or transcript content. Host `vmmap` reclaim remains a release
+  acceptance measurement, not a unit-test claim.
+- **Engine warnings are classed** — only `transcription_failed` reaches the UI
+  as a user-terminal error; routine quality receipts (overlap normalization,
+  under-commit, VAD degradation, backpressure) are log-only. Guarded by
+  `warning_is_user_terminal` in the pipeline contracts and a bridge-side test.
 - **Assistive capture ownership** — assistive capture and agent-window controls
   unified under one owner; the capture contract is documented in `AGENTS.md`.
 - **Hold dictation is always raw** (#65) — the detector-level force-AI chord on
@@ -64,6 +75,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **Live Whisper tail patches finally land** — the correction lane compared
+  tokens character-for-character, so the Apple+lexicon canvas (casing,
+  punctuation) never matched Whisper's bare lowercase and every healthy
+  sentence read as wholesale divergence (a month of 116 counted, 0 applied
+  corrections). Tokens now align on words via a casefolded, edge-punctuation-
+  stripped key (diacritics stay significant); matched tokens keep the canvas
+  casing and substitutions carry the canvas trailing punctuation. A
+  substitution-shaped small-edit floor (≤3 tokens) stops the relative
+  change-ratio gate from starving short utterances. Measured after the fix:
+  147 applied / 99 skipped across 12 sessions in one night.
+- **Tail-patch lane is observable per session** — every finalisation logs a
+  `tail_patch_session_receipt applied=X skipped=Y` INFO row, and a session
+  that rejected every patch (≥3 skips, 0 applied) raises a
+  `tail_patch_lane_starved` WARN instead of dying silently.
+- **Quality receipts no longer kill the dictation UI** — a routine engine
+  warning during recording used to paint "Dictation stopped", reset the UI
+  without stopping the engine, and leave an orphaned live microphone stream
+  (hot mic at tray Idle). Receipts stay off the error channel, and the error
+  handler now always stops the recorder before reporting failure.
+- **Explicit To Agent delivers even after the session context expires** — the
+  runtime thread is re-created instead of dropping the user's dictated turn.
 - **Overlay Insert no longer pastes back into Codescribe itself** — the overlay
   is a non-activating panel that can hold the caret (editable FINAL) while
   another app stays frontmost, so the synthetic Cmd+V followed OUR key window

Cargo.toml

@@ -136,6 +136,7 @@ tempfile = "3"
 mockito = "1"
 serial_test = "3"
 hound = "3.5"
+sha2 = "0.10"
 
 [lints.rust]
 # Allow unexpected_cfgs from objc crate's msg_send! macro (uses cargo-clippy cfg internally)