Prove Local routing, privacy, Delivery, and Replay end to end

[Anuraj-dev]

Parent

• Map: Offline Local ASR: measured, sandboxed, Fedora-ready #262

What to build: Complete L4 with public-interface evidence from Local selection through real Ready, Start, Recording, inference, deterministic formatting, Delivery, recovery handling, Replay, failure, and Cloud regression paths. Open production admission only when every required gate is satisfied.

Blocked by: #268.

Status: blocked · P1 · L4 integration and proof

• Add hermetic public IPC tests proving Ready admits Start, a real Recording produces one Transcript and one Delivery, Replay performs inference without Delivery, and Cloud capabilities remain unused.
• Cover empty/malformed/maximum PCM, silence, cap-triggered Stop, long text, deterministic replacements, stale/late/duplicate results, Delivery failure, and crash ambiguity.
• Keep PCM memory-only when local recovery is disabled; verify no temporary audio, Transcript cache, logs, diagnostics, or core dump retains content.
• With recovery enabled, prove private permissions, quota, TTL, clock rollback handling, fsync failures, crash boundaries, cleanup after Delivery, and Cloud-selected Replay refusal.
• Trace resolver and socket activity for the real daemon and complete worker process tree with network both available and unavailable.
• Cover cold startup, mode switching, missing/corrupt model, timeout, crash, Replay, doctor, Setup, cleanup, and lingering descendants.
• Fail on any unexpected Cloud capability, IP attempt, credential access, stale Delivery, surprise retention, or unreaped process.
• Preserve existing Groq/Deepgram, dictionaries, DPR/grammar, Delivery, and Replay semantics on the Cloud path.
• Record the Arch pilot host evidence separately from product support evidence.
• Enable production Local admission only after independent review and every L4 acceptance check passes.

Do not include: Fedora release approval, Meeting Mode, automatic recovery Delivery, or uploading private evidence.