refactor: consolidate Core 2.0 and restore cross-platform behavior

[H-Chris233]

Current 2.0 scope

Windows and macOS must retain their respective Tauri 1.x user features, including the Windows Less Computer capability promised by this PR. Linux receives a usable, framework-independent Core contract and a directory of detailed handoff documents; the egui team owns the remaining Linux Host/UI and Linux product acceptance. Linux application gaps no longer independently block this desktop delivery; shared Core defects still do.

• Authoritative requirements
• Windows/macOS acceptance checklist
• Linux handoff directory

The application remains 2.0.0-Beta.1; the runtime contract is 2.0.0. This PR does not publish a stable release or remove 1.x data compatibility.

Review and repair loop

Current head: 641e44133c9306ba48a6f685f9631dc974a898bd; base/merge-base: beta@fc9824eeccf7218e3b44c1de6c6e284a4c494c81.

dc350780 published the revised requirements and split handoff. A new independent Windows/macOS/shared-product review team then examined the entire PR. Its findings and subsequent validation exposed eight further defects (R29–R36), fixed in 98a0ca38:

• Bind a pending dictation stop to its original session.
• Drain native streaming/final input before restoring the input source and admitting another voice session; committed finalization survives a dropped stop caller.
• Close QA logically before asynchronous old-owner cleanup, preserving a reopened conversation or preview.
• Restore Windows copy-only fallback for an unavailable original target and restore minimized original windows before target verification.
• Make local model activation create/enable/promote its channel only in the final Core metadata transaction, with no UI pre-commit channel writes.
• Complete Windows Less Computer UI and hotkey wiring, per-thread Windows hook ownership, registration rollback checks and precise rebind/cold-start cancellation.
• Treat a released/replaced Less Computer capture as invalid and reject late startup/transcription work without cancelling its successor or an Agent run.

Current review ledger continues the R01–R28 migration review.

The second independent review found R37–R45, repaired in c0807d97: shared native-resource ownership, cancellation/startup cleanup, Less voice feedback and retention, insertion preparation, privacy gating and terminal-state routing. The third independent review found R46–R51, repaired in 90cbd014: Selection capture cancellation, QA routing, safe pre-Agent failure feedback, Core-owned translation intent, first-PCM readiness and delayed-completion ownership.

The fourth fresh team found R52–R54, fixed in 87e09e1c: live Marketplace proxy policy, session-owned terminal Host actions, and rejecting old-PIN authentication queued across PIN rotation.

The fifth fresh team found R55–R56, fixed in 588fb35b: native threads now dispatch cleanup on their Host-owned runtime, and a single existing event lock orders sequence allocation, projection, replay and live delivery. The sixth fresh team found R57, fixed in 5f668b1d: optional output muting and archive-path failures no longer block microphone startup; actual recorder failures still propagate. Two stale platform/provider comments were corrected as well.

The seventh team and main-agent reproduction found R58–R61, fixed in 2d8fd1b7: Windows npm CLI shims, independent macOS Generic model-cache leases and loaded status, live Foundry CPU fallback feedback, and cross-thread QA close/reopen/state-event ordering. Cache cleanup preserves newer activation owners and still-valid older inference; QA Host actions remain outside the state lock and native awaits outside the presentation lock.

The eighth team and main-agent reproduction found R62–R69, fixed in d16324c3: multiline OpenCode prompts over stdin, accurate PasteSent receipts, real Raw pipeline completion and engine cleanup, audio-free QA edit previews, turn-owned QA revert/confirmation/close transactions, atomic physical-key/session reservation, memory-only QA/Selection audio, and immutable completed-Selection history attribution. Direct and QA preview callers, the Linux example/contracts and handoff documents use the updated Core contract.

The ninth fresh Windows/macOS team completed its whole-PR reviews. R70–R72 are included in final repair 641e4413: freeze the native dictation target before context/credential awaits; restore ordinary QA voice capsule feedback and protect already-presented owners with atomic native epochs; resolve only providers required by the active route, while preserving Raw's unavailable optional LLM snapshot for late translation.

Maintainer-directed release cutoff: prioritize 2.0 delivery, stop the repeated review loop after this ninth round, and document low-impact presentation edges instead of expanding the repair. Both reviewers returned their final findings; no tenth round or additional manual desktop-package run is required by this handoff. This is a scoped publication decision, not a claim that every possible edge case or device acceptance has passed.

Deferred QA capsule edges: very fast startup failure before the first Recording event is consumed may omit the capsule error; an old Selection Voice hide timer or a very short cross-session transition can suppress/shorten an as-yet-unpresented QA capsule. The QA panel still receives Core error/terminal events. These are source-level timing risks, not claimed stable device reproductions or demonstrated data/answer corruption. Full display-origin binding and remaining Selection Voice timer unification are not included. See the release-cutoff sections in the requirements-linked acceptance checklist and review ledger.

Local validation of the current repair

• Core: 731 passed / 1 ignored; lifecycle 15 and contracts 6/3/26/18/3/5/25/5/13/16/16 passed.
• Windows Tauri: 460 passed / 1 ignored in the complete serial suite; Rust 1.88 check passed. An earlier parallel attempt hung in an existing global side-combo fixture's unbounded receive, was terminated and is not counted as a pass; the test was not skipped or changed.
• Frontend: TypeScript/Vite build and 68 test entries passed.
• Linux host on Windows: 50 library + 4 host tests passed; native Linux cfg/device tests are separate.
• Core/Linux strict Clippy, dependency direction, secret surface, test isolation, runtime seam, public surface, command/event baseline, scoped formatting and diff checks passed.
• The documented headless_host example runs again; the previously failing cancelled-capture assertion was fixed in Core, not removed.

These fixes include deterministic red-before-green regressions. Native target source contracts verify wiring, not actual clipboard/window behavior. The Windows dual-monitor injection smoke passed once; its last rerun returned SendInput=0 and did not pass. This is recorded as an unstable native-injection verification boundary, not repeated device success.

Evidence and merge boundaries

The documentation-head CI 33983624572, first-repair CI 34002890692, and c0807d97 CI 34006442463 passed Windows, macOS, Linux and Android. They predate the current repair; new-head CI must pass separately. Linux artifact jobs skipped by PR conditions are not counted as artifact validation.

588fb35b CI 34009963206, 5f668b1d CI 34011326177, 2d8fd1b7 CI 34013888722, and d16324c3 CI 34016669726 passed all four platforms. They predate the final ninth-round repair. Its new-head CI is tracked separately below; superseded/cancelled CI jobs are never counted as passes. The manual desktop build for 87e09e1c was intentionally cancelled after new defects were found; final-head package validation is not claimed by this maintainer-directed cutoff.

Final-head CI 34019011155, for 641e44133c9306ba48a6f685f9631dc974a898bd, is queued/running at handoff and is not yet a pass. GitHub reports MERGEABLE, with REVIEW_REQUIRED / BLOCKED; the required approval and final checks remain separate from local validation.

Earlier build/install evidence belongs to 2b315572: desktop build artifacts included Windows NSIS installation/TSF registration and macOS Intel/Apple Silicon builds; Linux validation packages and Android APKs passed their recorded checks. These are not current-head release artifacts.

Real Windows/macOS microphone, target-application input, permissions, native model inference, end-user upgrade/rollback, formal signing/notarization and updater delivery still require applicable device/release evidence. Current 2.0 macOS ordinary dictation reuses the selection path's app/PID restoration; ordinary dictation did not call that restoration path in 1.x. Exact same-app caret restoration is not claimed. Earlier macOS packages were ad-hoc signed, Android debug-signed, Linux metadata unsigned/manual, and Windows MSI was skipped for the non-numeric Beta prerelease.

Internal review does not replace the repository's required GitHub approval. No merge, tag, stable promotion or release is performed by this loop.