Session verification

All automated verification uses synthetic data and isolated temporary roots. It does not inspect real user settings, recordings or credentials, and does not substitute for macOS microphone/provider/UI acceptance.

Automated coverage

• Shared TypeScript/Rust format fixtures: finalized roles and typed/unknown content, parent validation, stable retry IDs, branch-local removals, default/explicit leaves, metadata, strict framing and depth/Unicode boundaries.
• Native storage: true multiprocess append/contention/crash-lock tests, partial-batch retries, preserved tail evidence, exact streamed media, capture ownership and WAV recovery, symlink/path confinement, deletion races and retryable cleanup.
• Roots/search: default empty folders, explicit root errors, canonical deduplication, copied-ID conflicts, literal canonical search, leaf-pinned selections and external append refresh without an authoritative index.
• Recording: stable identities, sanitized event queues, ordered user/assistant publication, failed/unresolved gaps, late evidence, persistence/backpressure halt, acknowledged/uncertain removal and coordinated start/stop/discard.
• Production client/finalizer integration: delayed assistant response.done, bounded drain, deletion timeout/late acknowledgement, explicit rejection and retained canonical content. The wire is fake; production drain is not stubbed.
• Actual Svelte server rendering: canonical-only actions, provisional wording, retention at removal controls and canonical/provisional transcript presentation.
• Continuation transport and runtime: unsupported retired commands, origin and target isolation, device acquisition races, viewless startup telemetry, pause/resume, persistence failure and bounded shutdown retry. SessionPanel browser stories cover streaming, finishing, removal/retry, themes, scrolling and constrained presentation.

src/lib/sessions/lifecycle.test.ts talks through the real native command dispatcher using a test-only stdio bridge and fresh processes. It exercises new capture → search/open → removal → finish → restart, provider-specific sibling branches, evidence-only buffered completions, explicit interrupted-WAV recovery and deletion. The bridge accepts only marked synthetic roots; it is not part of the shipped app.

Run from the repository root:

pnpm test
pnpm lint
pnpm format:check
pnpm check
pnpm check:ipc
pnpm build
pnpm test:settings-ui
pnpm build-storybook
pnpm test:storybook
pnpm docs:build
cargo check --manifest-path src-tauri/Cargo.toml
cargo test --locked --manifest-path src-tauri/Cargo.toml --lib
prek run --all-files
git diff --check

Record results for the exact revision under qualification. Historical file-storage migration results are not evidence that recording retirement or its native/provider acceptance has passed. Run visual capture smoke checks with the session story IDs and tooling documented in docs/visual-previews.md and docs/storybook.md.

Ignored native helper tests are entry points explicitly launched by parent tests, not silently skipped acceptance tests. Type checks and build success do not prove actual hardware/provider operation.

Representative performance

Run node --import tsx scripts/benchmark-sessions.ts for a generated corpus and native streaming-retention measurements. It creates and cleans up synthetic roots; it does not need a persistent index or real provider.

A representative local macOS run used 24 sessions, 72 branches and approximately 12 MiB of protocol-heavy history:

Measurement	Observed
First search in that process	1.975 seconds
Repeated scans	1.763–1.785 seconds
120 exact-media capture batches	5.881 seconds

The benchmark records process RSS, JS heap and on-disk bytes alongside latency and asserts removal/evidence-safe results and durable media references. First scan does not imply a cold OS page cache, repeated scans still read files, and these numbers are not a hard latency guarantee. Large histories and per-event media assets carry real disk/file-count costs; bounded requests/streaming prevent whole-corpus or whole-audio buffering but do not eliminate those costs.

Manual macOS acceptance

Historical acceptance of file-storage capture/recovery does not qualify the continuation-only cutover. The following requirements remain outstanding until actual observations are recorded; automated tests and fallback deletion cannot satisfy them.

Use a disposable macOS account/VM with synthetic settings, isolated roots and test provider credentials. The isolated development launch is:

pnpm tauri dev --config src-tauri/tauri.dev.conf.json

1. Launch with an empty picker, configure Settings, and exercise microphone permission denial/grant, tray actions and all shortcuts.
2. Start and explicitly resume through /session; verify default/explicit input selection, blocked changes during acquisition/recording, paused changes on the next acquisition, and explicit microphone transfer across continuations.
3. Verify non-focus-stealing shortcut startup, deliberate focus, Spaces/monitor placement, closed views, tray reattachment and reopened historical sessions.
4. Exercise Finish, cancellation/discard, removal/deletion failures, saved audio and history, clipboard/notifications and bounded Quit failure, retry and Force Quit. Discard must not delete resumed history or a session with dependent continuations.
5. Confirm no app or live-transcription window is created, stale recording commands cannot start capture, and recording/restoration do not require a view.
6. Verify startup telemetry identifies continuation and generation, ends on success, failure or cancellation, and does not contain transcript/audio/credentials. General OpenTelemetry log export must still work.
7. Qualify each advertised provider/model/protocol against disposable test sessions, including replay rejection, cancellation, multiple continuations and network loss.
8. Exercise configured root errors, external capture Busy, renamed sessions and copied IDs without editing files concurrently with writers. After restart only committed canonical content is restored; do not infer automatic recovery from the repository’s separately tested explicit recovery APIs.

Record actual observations before claiming these checks passed. Cloud/network filesystems, power-loss behavior and concurrent manual log rewriting are not qualified by the local automated suites.