fix: clippy embed ifs + Retranscribe Menu argument order

AGENTS.md

@@ -42,11 +42,32 @@ then update both the code and the relevant contract in the same cut.
   detail lens or explicit fallback.
 - Never revert unfamiliar dirty changes. Isolate responsibilities, verify each
   coherent cut, and stage only the files that belong to its checkpoint.
-- Local implementation turns end in a scoped commit. Never push, merge, or
-  publish a release unless the operator explicitly asks for that action.
+- Local implementation turns end in a scoped commit. Push that work to the
+  active branch. Do not merge to trunk, tag, or publish a GitHub Release
+  unless the operator asked. The daily notarized DMG below is the one
+  release artifact that does not wait for a second ask.
 - Generated UniFFI Swift bindings must match the Rust bridge. Run
   `make app-bindings` after bridge API changes.
 
+## Install cadence (Maciej + Monika)
+
+Operator agreement 2026-08-19.
+
+- After each coherent cut that changes the app, run `make install-if-idle`
+  (or `make install-app` after a live-recording check). That is the daily
+  laptop binary. Do not wait to be asked.
+- **Refuse the install** when a Codescribe take is in flight. Authority is
+  the Transcript Bus: last session has `session_started` and no later
+  `transcript_sealed`. Never tear down `/Applications/Codescribe.app` mid-take.
+- A **notarized slim DMG for Monika is once per calendar day**, not every
+  commit and not "after a batch of key fixes". When the bus is idle, cut
+  `make release-standard` (sign + notarize + `verify-dmg`). One artifact
+  per day is enough; do not recut for later same-day commits unless the
+  operator asks. Say the path and staple result in the turn. That is a
+  local release artifact; still not a silent merge to trunk, tag, or
+  GitHub Release.
+- Ad-hoc `/Applications` from `install-app` is never "the Monika DMG".
+
 ## Verification
 
 - `make check` — static formatting, Clippy, Semgrep, env registry, gate ledger.

CHANGELOG.md

@@ -7,6 +7,94 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- **`make install-app` accepts keys from Get license.** A keyed local
+  install verifies CSK1 with the same public key the site signs. The
+  forgeable development verifier is no longer baked into that path.
+- **Refused paste does not steal the user's clipboard.** Synthetic Cmd+V
+  still snapshots and restores after a confirmed paste into a foreign app.
+  `CopyTargetUnavailable` / target mismatch / Accessibility deny no longer
+  dump the transcript onto `NSPasteboard`. The text parks in the Paste Here
+  slot (⌘⌥V when that chord is bound); the overlay keeps it; the user's
+  previous clipboard stays put. Explicit overlay Copy is unchanged.
+- **Paste status lives in the overlay footer.** Insert that cannot reach
+  the ambulance no longer throws a capsule over the action row. A quiet
+  chip sits next to `local apple` (`⌘⌥V` / `copied` / `no ax`).
+- **Auto-paste may land in the Agent window and in Alacritty.** The overlay
+  canvas is still never a Cmd+V sink (Swift caret probe). The whole
+  Codescribe app is not "self": Agent is a legal ambulance, and a floating
+  overlay that leaves `NSWorkspace` naming Codescribe no longer vetoes a
+  confirmed Alacritty/Zellij activate. Failures still restore the user
+  clipboard and park our buffer.
+- **CS Voice Lab starts with the take.** A keyed `install-app` bake
+  spawns `~/.codescribe/voice-lab` when recording prepares, and the
+  existing Voice Lab buttons ensure `:8765` before opening the
+  console. Production stays inert. The child stops when the take
+  ends (and on quit). Loopback STT `:8444` / `:8446` stay up.
+  `docs/loopback.html` and `~/.codescribe/voice-lab/loopback.html`
+  point at those URLs.
+- **Agent chat shows live capture.** Assistive/Agent hides the overlay,
+  so the composer now renders the growing transcript above the field.
+- **Overlay default stays pinned top-right.** Free motion is only the
+  explicit toggle. A drag without it is ephemeral. Edge-resize always
+  persists, independent of the pin.
+- **Format/Retranscribe keep the overlay hittable.** One-shot Format
+  and file retranscribe no longer hide the panel (including when the
+  tray ticks Assistive), steal focus, or pin MainActor for the LLM /
+  Whisper round-trip. The status pill is a static `formatting` /
+  `retranscribing` phase, not a waveform grind.
+- **Mid-hold Shift attaches `{selection_N}`.** Shift or Command during an
+  already-started Fn hold captures the current selection into the context
+  bucket and overlay marker. It does not open Agent, hide the overlay, or
+  stop the take. Fn+Shift from idle stays dictation, not Assistive.
+- **Fn hold-down attaches a live selection as `{selection_1}`.** A
+  selection already present when Fn goes down is captured immediately.
+  Later Shift pulses still add `{selection_2..n}`. Destination stays
+  dictation.
+- **Layer 1 `cloud_session` stays up on Voice Lab `:8446`.** The live
+  socket opens with `hello` (`stt-ws-v1`); treating that as protocol
+  dropped the lane at take start (`disconnect`, zero frames). Handshake
+  and VAD control are ignored, and the start frame is Voice Lab `set`.
+- **Compound Apple chops take the joined Layer 1 rewrite.** Five short
+  fragments share one Whisper window and apply the aligned sentence
+  swap. Fusion no longer rewrites only the last piece or skips the
+  joined sentence at the 50% change cap.
+- **File retranscribe names the programming domain.** Overlay/Dictionary
+  `cloud:` on `last_session.wav` (remapped loopback `:8444`) sends
+  `vocabulary=programming` — test-locked on the multipart body. Official
+  OpenAI still omits the field. Overlay Format is not HQ authority;
+  compare Whisper file vs raw, never vs Format.
+
+### Changed
+
+- **Supervisor findings own transcript-quality categories.** Engine catalog
+  `codescribe-supervisor-findings/v1` (`core/quality/supervisor.rs`) names
+  every issue class the tree already had — contract forbiddens, clock-lie,
+  speech gaps, Teacher attention, confidence flags, delivery gates, Whisper
+  residue, and the Voice Lab lies (HQ-as-document, omitted
+  `vocabulary=programming`, live overlay paired with last_session.wav).
+  Voice Lab three-judge emits those findings. WER stays a footnote of
+  proposal agreement, not accuracy.
+
+
+- **Layer 1 applies aligned same-utterance wording.** When live Apple and
+  the Whisper window share most words, Layer 1 now substitutes those
+  spans instead of discarding the repair at the 50% change cap. Unrelated
+  dumps and pause-tail inserts still skip.
+- **Layer 1 Whisper windows join about five Apple segments.** Short
+  fragments wait for a sentence-sized window (or a pause) before the
+  background swap, instead of each breath becoming its own failed
+  repair.
+- **Cloud STT names the programming domain.** Loopback and Libraxis file
+  and live requests send `vocabulary=programming`. Official OpenAI file
+  audio omits the field. The client does not classify audio to pick a
+  dictionary. Overlay Format is not that compare — HQ is Whisper file vs
+  raw.
+- **Dev-power corner mark.** A keyed local install paints a small
+  “You use dev power mode” caption in the bottom-right of overlay, Agent
+  chat, and Settings. Production DMGs stay unmarked.
+
 ## [0.14.1] - 2026-08-18
 
 > Patch: everyday-stable 0.14.x. Same slim public SKU as 0.14.0, plus the two
@@ -16,8 +104,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 
 - **STT Test is a file probe.** Settings Test no longer POSTs to a live
-  Voice Lab WebSocket (`STT_ENDPOINT`). Known live sockets map to
-  `/v1/audio/transcriptions`; loopback `:8446` → `:8444`.
+  socket. Known live sockets map to `/v1/audio/transcriptions`.
 - **ChatGPT sign-in no longer requires Responses write.** OAuth persists
   identity after exchange. `api.responses.write` stays a lane Test, so
   Codex public tokens can sign in.
@@ -32,7 +119,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **`make release-stable`** is the everyday cut: slim sign + notarize +
   `verify-dmg`, then install that stapled Developer ID `.app` to
   `/Applications` without re-signing. `make install-app` remains the
-  local-release / Lab path.
+  local-release path.
 - **`make release-full` is fail-closed.** Whisper embed no longer falls
   back to a slim dylib when the HF snapshot is weights-only. It uses the
   composed `~/.codescribe/models` tree from `make download-model`.
@@ -45,9 +132,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- **Developer Lab on keyed `make install-app`.** `CSDeveloperSurface` bakes
-  only when Sparkle + production license public keys resolve on the machine.
-  Public `git clone && make` stays Lab-off. Production DMG refuses the bit.
+- **Developer Lab on a keyed local install.** A public `git clone && make`
+  stays Lab-off. Production DMG refuses the bit.
 - **Lab mode overlay-off.** Developer veto hides the daily HUD without
   flipping the tray "Transcription Overlay" toggle. Leftover UserDefaults
   cannot hide overlay on a production bundle.

Cargo.toml

@@ -161,6 +161,11 @@ strip = true
 # artifact; scripts/build-dmg.sh and CI use the literal `release` profile.
 [profile.local-release]
 inherits = "release"
+# rustc `strip = true` leaves LC_SYMTAB.stroff unaligned. Xcode 27's ld
+# (ld-27036) then dies: "mis-aligned LINKEDIT string pool". Daily
+# `make install-app` uses this profile; keep symbols so the dylib links.
+# Dist `release` still strips — `make release-standard` is a separate cut.
+strip = false
 
 # Diagnostic / crash-reproduction profile.
 # Inherits the optimized release build but keeps full debug info (no strip) so

Makefile

@@ -4,15 +4,15 @@
 # The user-facing app is built by `make app` (xcodebuild); the Rust side no
 # longer ships a standalone `codescribe` tray binary.
 
-.PHONY: all build release release-codescribe release-codescribe-embedded release-qube app app-bindings install install-no-embed config install-app \
+.PHONY: all build release release-codescribe release-codescribe-embedded release-qube app app-bindings install install-no-embed config install-app install-if-idle install-voice-lab \
         start stop restart status logs logs-follow \
         bump bump-patch bump-minor bump-major version \
         lint format test test-quick test-e2e test-e2e-real test-sse test-sse-release test-responses-live test-sse-heavy test-formatting test-all \
         test-engine test-engine-apple test-engine-candle test-teacher \
         demo demo-raw demo-assistive check verify semgrep fix clean help corpus-census test-corpus-parity \
         dist-preflight dist-preflight-signed verify-canaries smoke-canaries \
         dmg dmg-signed release-standard release-full release-dmgs release-stable install-app-release notarize verify-dmg download-model download-e5 download-embedder ensure-models \
-        hooks
+        hooks site-dev
 
 SHELL := /bin/bash
 VERSION_FILE := Cargo.toml
@@ -49,7 +49,7 @@ CODESCRIBE_DIST_CODESIGN_IDENTITY ?= $(if $(strip $(CODESCRIBE_DEVELOPER_ID_IDEN
 # `env -u CODESCRIBE_LICENSE_PUBLIC_KEY_HEX`, and that must keep working — a
 # plain `?=` fallback here would silently re-arm the production key in a local
 # build that deliberately wants the development verifier.
-CODESCRIBE_LICENSE_PUBLIC_KEY_FILE ?= $(HOME)/.vibecrafted/secrets/codescribe/license-public.hex
+CODESCRIBE_LICENSE_PUBLIC_KEY_FILE ?= $(firstword $(wildcard $(HOME)/.codescribe/config/dev/keys/license-public.hex $(HOME)/.vibecrafted/secrets/codescribe/license-public.hex))
 CODESCRIBE_DIST_LICENSE_KEY = $(if $(CODESCRIBE_LICENSE_PUBLIC_KEY_HEX),$(CODESCRIBE_LICENSE_PUBLIC_KEY_HEX),$(shell cat $(CODESCRIBE_LICENSE_PUBLIC_KEY_FILE) 2>/dev/null | tr -d '[:space:]'))
 # Sparkle's update-verification public key has the same missing-local-source
 # problem: release.yml supplies SPARKLE_ED_PUBLIC_KEY as a repository variable,
@@ -58,7 +58,7 @@ CODESCRIBE_DIST_LICENSE_KEY = $(if $(CODESCRIBE_LICENSE_PUBLIC_KEY_HEX),$(CODESC
 # would reject every update"). A local `make release-standard` had no way to
 # supply it, so a locally cut release failed the gate at the very last check —
 # after codesigning, notarisation and stapling had already been paid for.
-CODESCRIBE_SPARKLE_PUBLIC_KEY_FILE ?= $(HOME)/.vibecrafted/secrets/codescribe/sparkle-public.b64
+CODESCRIBE_SPARKLE_PUBLIC_KEY_FILE ?= $(firstword $(wildcard $(HOME)/.codescribe/config/dev/keys/sparkle-public.b64 $(HOME)/.vibecrafted/secrets/codescribe/sparkle-public.b64))
 CODESCRIBE_DIST_SPARKLE_KEY = $(if $(SPARKLE_ED_PUBLIC_KEY),$(SPARKLE_ED_PUBLIC_KEY),$(shell cat $(CODESCRIBE_SPARKLE_PUBLIC_KEY_FILE) 2>/dev/null | tr -d '[:space:]'))
 CODESCRIBE_APP_NAME ?= Codescribe
 CODESCRIBE_DISPLAY_NAME ?= Codescribe
@@ -179,13 +179,36 @@ config:
 	@$(EDITOR) ~/.codescribe/.env
 
 
-install-app:
+# Colon form `make site:dev` is not a target — Make treats `:` as a rule
+# separator. The website lives in site/; this is `npm run dev` from there.
+site-dev:
+	cd site && npm run dev
+
+install-voice-lab:
+	@./scripts/install-voice-lab.sh
+
+install-if-idle:
+	@./scripts/install-if-idle.sh
+
+install-app: install-voice-lab
 	@echo "Building $(CODESCRIBE_APP_NAME).app (SwiftUI, optimized local profile) via scripts/build-app.sh ..."
-	@echo "Local install uses the development license verifier; CODESCRIBE_LICENSE_PUBLIC_KEY_HEX is reserved for distribution builds."
 	@BIT=$$(./scripts/developer-surface-gate.sh); \
-	echo "Developer surface: $$BIT (1 needs legit Sparkle + license public keys on this machine)."; \
-	env -u CODESCRIBE_LICENSE_PUBLIC_KEY_HEX \
-	  CODESCRIBE_DEVELOPER_SURFACE=$$BIT \
+	if [ "$$BIT" != "1" ]; then \
+		echo "Developer surface stayed off after the Voice Lab pack — Sparkle/Ed public keys did not resolve."; \
+		echo "  need: ~/.codescribe/config/dev/keys/{sparkle-public.b64,license-public.hex}"; \
+		echo "  or:   ~/.vibecrafted/secrets/codescribe/{sparkle-public.b64,license-public.hex}"; \
+		exit 1; \
+	fi; \
+	LICENSE=$$(tr -d '[:space:]' < "$(CODESCRIBE_LICENSE_PUBLIC_KEY_FILE)" 2>/dev/null || true); \
+	if [ "$${#LICENSE}" -ne 64 ]; then \
+		echo "install-app: license-public.hex missing or not 64 hex at $(CODESCRIBE_LICENSE_PUBLIC_KEY_FILE)"; \
+		exit 1; \
+	fi; \
+	echo "Developer surface: 1. License verifier from $(CODESCRIBE_LICENSE_PUBLIC_KEY_FILE) (Get license / CSK1)."; \
+	SPARKLE=$$(tr -d '[:space:]' < "$(CODESCRIBE_SPARKLE_PUBLIC_KEY_FILE)" 2>/dev/null || true); \
+	CODESCRIBE_LICENSE_PUBLIC_KEY_HEX="$$LICENSE" \
+	  CODESCRIBE_DEVELOPER_SURFACE=1 \
+	  SPARKLE_ED_PUBLIC_KEY="$$SPARKLE" \
 	  $(MAKE) --no-print-directory app PROFILE=local-release
 	@APP_SRC="macos/build/Build/Products/Release/Codescribe.app"; \
 	if [ ! -d "$$APP_SRC" ]; then \
@@ -1187,7 +1210,9 @@ help:
 	@printf '%s\n' '  make install-no-embed DEV/RECOVERY: no optional embeds (runtime paths only)'
 	@printf '%s\n' '  make release-codescribe-embedded Fat dylib with Whisper baked in (not daily)'
 	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'config' 'Edit ~/.codescribe/.env'
-	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'install-app' 'Local-release install to /Applications (may re-sign; Lab if keys resolve)'
+	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'install-app' 'Local-release install to /Applications'
+	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'install-voice-lab' 'Install the private developer console when this machine can reach it'
+	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'site-dev' 'Astro site at site/ (http://localhost:4321) — not make site:dev'
 	@printf '    $(HELP_C_GREEN)%-18s$(HELP_C_RESET) %s\n' 'release-stable' 'Everyday: notarize slim DMG + install that stapled .app'
 	@printf '\n'
 	@printf '  $(HELP_C_YELLOW)%s$(HELP_C_RESET)\n' 'RELEASE & DISTRIBUTION'

README.md

@@ -405,7 +405,7 @@ make format         # cargo fmt
 ```
 make app              # Debug SwiftUI app build
 make app PROFILE=local-release # Optimized local SwiftUI app build
-make install-app      # Local-release install (may re-sign; Lab only if keys resolve)
+make install-app      # Local-release install to /Applications
 make release-stable   # Everyday: notarize slim DMG + install that stapled .app
 make release-qube     # Build qube CLI tools
 make install          # Install qube CLI tools + repo-local hooks