fix: recording stuck-stop watchdog, keychain persistence, error feedback, overlay stop path

[m-szymanska]

PR type: bugfix (runtime hardening)

Problems addressed

All findings come from an adversarially-verified deep quality recon (42 findings total; the P1s below were CONFIRMED by independent verification):

1. [P1] Hold-to-record path has no stuck-stop watchdog. finish_recording_locked awaited process_recording with no timeout. A hung STT final pass (e.g. Metal/Whisper stall) left the app permanently in Busy with hotkeys ignored. The toggle path already had STOP_TIMEOUT protection; the hold path did not.
2. [P1→follow-through] Stuck-stop recovery leaked session fields. recover_from_stuck_stop bypassed the full session reset, leaking IS_ASSISTIVE_SESSION so the tray misreported an assistant session after recovery (both toggle and hold paths).
3. [P2] Setting the documented CODESCRIBE_DATA_DIR silently disabled the Keychain. is_test_env() treated CODESCRIBE_DATA_DIR (and CI) as "test environment", so API keys and OAuth tokens never persisted across restarts for anyone using the documented data-dir override.
4. [P2] Transcription failure was a silent error!() log. The user got no feedback at all when a recording failed to transcribe.
5. [P3] Paste error dropped the AI-formatted transcript. The formatted text was persisted only after a successful paste; a transient paste failure lost the formatting layer.
6. [P2] Overlay warmup-watchdog/error path left the composer mic dead. fireWarmupWatchdog/onError never ran the stop-side path, so chat.dictationBlocked stayed true until the next successful dictation session.
7. [P2] Valid API keys reported "could not verify". Key-liveness classified HTTP 400 responses (e.g. model_not_found) as network errors, even though a 4xx response proves the key passed auth.

Fixes

• app/controller/mod.rs: shared STOP_TIMEOUT const; hold path wrapped in tokio::time::timeout with the same recover_from_stuck_stop recovery; recovery now performs the full reset_finished_recording_state.
• app/controller/mod.rs: transcription failure now emits the existing EngineEventWire::Warning (already wired end-to-end: tray Error state + on_error on the Swift side); formatted transcript is persisted before paste.
• core/config/keychain.rs: CODESCRIBE_DATA_DIR and CI removed from is_test_env(); CODESCRIBE_DISABLE_KEYCHAIN remains the only user-facing kill switch. Test binaries are still auto-detected (cfg!(test) + cargo deps-path + RUST_TEST_THREADS), so the test suite never touches the real Keychain.
• core/llm/key_liveness.rs: 401/403 → invalid key, 429/402 → quota, other 4xx → key verdict OK (server answered ⇒ auth passed), 5xx/transport → network. No new enum variant; bridge/Swift untouched.
• macos/.../OverlayState.swift: minimal abortRecordingSession path used by warmup watchdog and onError — fires onRecordingStopped exactly once (guarded by finalized), so dictationBlocked resets after failures.
• bridge/src/hotkeys.rs: test-only serialization of hotkey tests that share process-wide state (pre-existing race surfaced by the new watchdog test).

Test plan (commands actually run, all green at final HEAD)

cargo fmt --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test --workspace
make app   # Swift debug build, BUILD SUCCEEDED

New tests: paused-time watchdog regression test (hangs process_recording, asserts Idle + cleared session fields), keychain is_test_env coverage, key-liveness classification cases (400/401/403), Warning-on-failure and save-before-paste invariants.

Smoke notes (manual, recommended before merge)

1. Hold-record with a forced STT stall → app returns to Idle within STOP_TIMEOUT, hotkeys stay alive, tray shows no stale assistant session.
2. CODESCRIBE_DATA_DIR=/tmp/csdata + save an API key in Settings → restart → key still present.
3. Kill dictation during warmup (watchdog fires) → composer mic usable without an app restart.

Out of scope / backlog

Streaming-pipeline behaviorals (stale corrections, unbounded window_text, utterance joining), agent-turn cancellation not aborting spawned tools, multi-turn composer images, audio auto_silence defaults, thermal shedding order, FFI panic strategy — all recorded in the recon report as backlog; deliberately not touched here.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[gemini-code-assist]

Code Review

This pull request introduces several robustness improvements and bug fixes across the codebase. Key changes include surfacing transcription failures to the user via IPC warnings, implementing a watchdog timeout for hold-stop processing to recover to an Idle state if it stalls, and persisting the formatted transcript before attempting to paste to prevent data loss. Additionally, the Keychain-disable policy is refined so that setting CODESCRIBE_DATA_DIR or CI does not disable Keychain persistence, and non-auth 4xx client errors are now treated as successful key liveness checks. The macOS overlay state is also updated to properly abort recording sessions on errors. I have no additional feedback to provide as there are no review comments.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.