Robustness and efficiency hardening pass

- Gate DebugFileLog behind Developer Mode, rotate at 5 MB, and stop
  logging transcript content (lengths only) — previously every dictated
  utterance was written to an unbounded plaintext log in every install
- Move meeting-start title/roster AX scraping and the 15 s roster poll
  off the main thread, with a 1 s AXUIElementSetMessagingTimeout so a
  busy Teams can't stall the app
- Generalize app-audio process collection per meeting app
  (MeetingApp.isProcessFamilyMember) so Zoom/Webex helpers are tapped,
  not just Teams
- skipNaming: use processingJob (not activeJob) so a stale failed job
  can't pin the phase at .processing
- Remove dead partialTranscript plumbing and its 10 Hz polling loop
- Cap the dictation buffer at 4 hours (matches recording max duration)
- Free pipeline sample buffers after their last consuming stage
  (mic after transcription, app after diarization) to cut peak memory
- Validate the cached System Audio TCC grant once per launch so a
  revoked permission no longer shows "Granted" forever
- Track skipped review findings in ROADMAP.md

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: execsumo

ROADMAP.md

@@ -9,6 +9,9 @@ To preserve the focus, performance, and simplicity of Heard as a lean, native, s
 These represent the remaining areas of focus to clean up and stabilize:
 
 ### Active Tech Debt & Known Issues
+- **Watchdog abort can leak a zombie pipeline task.** `PipelineProcessor.abortAndFailCurrentJob` cancels the pipeline task and starts the next job, but FluidAudio may not honor cancellation promptly. A stuck transcribe/diarize call that eventually returns will write into the shared per-job state (`appTrack`, `appTranscription`, `appDiarization`, `transcriptionProgress`) while the next job is using it. Fix: tag each run with a generation/job ID and have stage write-backs verify they still own the current generation before mutating shared state.
+- **App-audio self-test rebuild invalidates `micDelaySeconds`.** `attemptAppAudioRebuild` truncates and reopens the app WAV ~2–4 s after the original start and updates `appStartTime`, but the session's `micDelaySeconds` was computed once in `startRecording` and never recalculated. After a rebuild, mic/app track alignment is off by the rebuild delay, which skews `SegmentDeduplicator.dropMicBleed` and segment interleaving. Fix: recompute the delay (or store a rebuild offset on the session) after a successful rebuild.
+- **PermissionCenter republishes identical state every 3 s.** `refresh()` builds a fresh `statuses` array on every poll tick, so every observing view re-renders 20×/minute for the app's lifetime even when nothing changed — plus a system-wide AX IPC call per tick while Accessibility is ungranted. Fix: make `PermissionStatus` equatable and only assign when the array actually changed. Related: the detector polls at 1 s while the docs (CLAUDE.md/handoff.md) say 3 s — reconcile the cadence or the docs.
 - **In-meeting note editing.** Today the user edits notes by opening the rendered `.md` directly. A future polish: a "Notes" disclosure on each completed job in the menu bar dropdown that lists captured notes and lets the user edit/delete before the transcript is finalized (or rewrite the `.md` if it's already been written).
 - **`Views.swift` size.** All SwiftUI UI components live in a single ~1.9 kLOC file after the Paper design system was implemented. Split this by tab or view area to improve build times and maintenance once early UI iteration is finished.
 - **Menu bar dropdown height clipping.** The menu bar dropdown uses `.window` style and has a fixed max height. The jobs list can clip when many jobs accumulate.

Sources/HeardCore/AppModel.swift

@@ -16,7 +16,6 @@ public final class AppModel: ObservableObject {
 
     // Dictation state (separate from phase — can coexist with meeting recording)
     @Published public var isDictating = false
-    @Published public var partialTranscript = ""
     @Published public var dictationError: String?
     /// Set when AX permission is revoked while dictation is active. Cleared on dismiss or next start.
     @Published public var dictationAXLost = false
@@ -50,11 +49,13 @@ public final class AppModel: ObservableObject {
     public static func bootstrap() -> AppModel {
         try? FileManager.default.ensureHeardDirectories()
 
+        let settingsStore = SettingsStore()
+        DebugFileLog.isEnabled = settingsStore.settings.developerMode
+
         let version = Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "?"
         DebugFileLog.log("=== bootstrap — Heard v\(version) starting ===")
         DebugFileLog.startMainThreadHeartbeat()
 
-        let settingsStore = SettingsStore()
         let speakerStore = SpeakerStore()
         let queueStore = PipelineQueueStore()
         let modelCatalog = ModelCatalog()
@@ -237,6 +238,7 @@ public final class AppModel: ObservableObject {
                     try self.recordingManager.startRecording(
                         title: snapshot.title,
                         meetingPID: snapshot.meetingPID,
+                        source: snapshot.source,
                         rosterNames: snapshot.rosterNames
                     )
                     self.phase = .recording
@@ -337,7 +339,6 @@ public var filteredSpeakers: [SpeakerProfile] {
                 // can take several seconds, keeping the HUD up and blocking further
                 // hotkey presses via dictationToggleInFlight the whole time).
                 isDictating = false
-                partialTranscript = ""
                 dictationError = nil
                 if settingsStore.settings.showDictationHUD { DictationHUD.shared.hide() }
                 dictationManager.modelKeepAliveSeconds = TimeInterval(settingsStore.settings.modelKeepAlive * 60)
@@ -364,8 +365,7 @@ public var filteredSpeakers: [SpeakerProfile] {
                     isDictating = true
                     dictationError = nil
                     if settingsStore.settings.showDictationHUD { DictationHUD.shared.show() }
-                    // Observe partial transcript and watch for AX revocation
-                    observeDictationPartials()
+                    // Watch for AX revocation while dictation is active
                     startAXPolling()
                     DebugFileLog.log("START branch completed — isDictating=true")
                 } catch {
@@ -542,17 +542,6 @@ public var filteredSpeakers: [SpeakerProfile] {
         hotkeyManager.activate()
     }
 
-    private func observeDictationPartials() {
-        Task { [weak self] in
-            guard let self else { return }
-            // Poll the dictation manager's partial transcript (lightweight since it's @Published)
-            while self.isDictating {
-                self.partialTranscript = self.dictationManager.partialTranscript
-                try? await Task.sleep(for: .milliseconds(100))
-            }
-        }
-    }
-
     /// Polls AXIsProcessTrusted() while dictation is active. If access is revoked mid-session,
     /// stops dictation and raises dictationAXLost so the menu bar can show a re-grant banner.
     private func startAXPolling() {
@@ -581,7 +570,6 @@ public var filteredSpeakers: [SpeakerProfile] {
     private func stopDictationIfActive() {
         guard isDictating else { return }
         isDictating = false
-        partialTranscript = ""
         dictationError = nil
         if settingsStore.settings.showDictationHUD { DictationHUD.shared.hide() }
         Task {
@@ -789,7 +777,9 @@ public var filteredSpeakers: [SpeakerProfile] {
         }
         namingCandidates.removeAll()
         showNamingPrompt = false
-        phase = queueStore.activeJob == nil ? .dormant : .processing
+        // processingJob (not activeJob) — a stale .failed job in the queue must
+        // not pin the phase at .processing after the prompt closes.
+        phase = queueStore.processingJob == nil ? .dormant : .processing
     }
 
     public func renameSpeaker(id: UUID, to name: String) {

Sources/HeardCore/AudioProcessing.swift

@@ -63,15 +63,29 @@ public struct PreprocessedTrack {
     public let samples: [Float]
     public let sampleRate: Double // always 16000
     public let vadMap: VadSegmentMap
+    /// Captured at init so it stays valid after `releasingSamples()`.
+    public let duration: TimeInterval
 
     public init(samples: [Float], sampleRate: Double, vadMap: VadSegmentMap) {
         self.samples = samples
         self.sampleRate = sampleRate
         self.vadMap = vadMap
+        self.duration = Double(samples.count) / sampleRate
     }
 
-    public var duration: TimeInterval {
-        Double(samples.count) / sampleRate
+    private init(sampleRate: Double, vadMap: VadSegmentMap, duration: TimeInterval) {
+        self.samples = []
+        self.sampleRate = sampleRate
+        self.vadMap = vadMap
+        self.duration = duration
+    }
+
+    /// Copy with the sample buffer freed. The 16 kHz buffer for a multi-hour
+    /// meeting runs to hundreds of MB; later pipeline stages only need the
+    /// vadMap and duration, so callers drop the samples once the last
+    /// audio-consuming stage has finished.
+    public func releasingSamples() -> PreprocessedTrack {
+        PreprocessedTrack(sampleRate: sampleRate, vadMap: vadMap, duration: duration)
     }
 }
 

Sources/HeardCore/DebugFileLog.swift

@@ -4,9 +4,20 @@ import Foundation
 /// NSLog/unified-log diagnostics aren't reaching `log stream` reliably and
 /// we need a guaranteed observation channel for live debugging.
 ///
+/// Disabled unless the user turns on Developer Mode (Settings → General).
+/// Never log transcript or note content here — only metadata such as lengths.
+///
 /// Tail it with:
 ///   tail -F ~/Library/Application\ Support/Heard/dict-debug.log
 public enum DebugFileLog {
+    /// Mirrors `AppSettings.developerMode`. Set at bootstrap and whenever
+    /// settings persist. Plain bool read from multiple threads; a torn read
+    /// at worst drops or emits one extra line.
+    nonisolated(unsafe) public static var isEnabled = false
+
+    /// Rotate (truncate) the log once it exceeds this size.
+    private static let maxFileBytes: UInt64 = 5_000_000
+
     private static let queue = DispatchQueue(label: "com.execsumo.heard.debuglog")
     private static let formatter: DateFormatter = {
         let f = DateFormatter()
@@ -25,7 +36,7 @@ public enum DebugFileLog {
     /// later, main was unresponsive for those 8 seconds.
     @MainActor
     public static func startMainThreadHeartbeat() {
-        guard heartbeatTimer == nil else { return }
+        guard isEnabled, heartbeatTimer == nil else { return }
         var tick = 0
         heartbeatTimer = Timer.scheduledTimer(withTimeInterval: 1.0, repeats: true) { _ in
             tick += 1
@@ -38,6 +49,7 @@ public enum DebugFileLog {
     }
 
     public static func log(_ message: String) {
+        guard isEnabled else { return }
         let ts = formatter.string(from: Date())
         let line = "[\(ts)] \(message)\n"
         NSLog("Heard: [DICT-DBG] \(message)")
@@ -46,9 +58,15 @@ public enum DebugFileLog {
             let data = Data(line.utf8)
             if FileManager.default.fileExists(atPath: url.path) {
                 if let handle = try? FileHandle(forWritingTo: url) {
-                    defer { try? handle.close() }
-                    _ = try? handle.seekToEnd()
-                    try? handle.write(contentsOf: data)
+                    let size = (try? handle.seekToEnd()) ?? 0
+                    if size > maxFileBytes {
+                        try? handle.close()
+                        try? FileManager.default.removeItem(at: url)
+                        try? data.write(to: url)
+                    } else {
+                        try? handle.write(contentsOf: data)
+                        try? handle.close()
+                    }
                 }
             } else {
                 try? FileManager.default.createDirectory(

Sources/HeardCore/DictationManager.swift

@@ -37,9 +37,6 @@ public enum DictationError: Error, LocalizedError {
 public final class DictationManager: ObservableObject {
 
     @Published public private(set) var state: DictationState = .idle
-    /// Unused by the batch engine — kept @Published so existing UI bindings
-    /// continue to compile. Always empty.
-    @Published public var partialTranscript: String = ""
 
     private var asrManager: AsrManager?
     private var asrModels: AsrModels?
@@ -52,6 +49,13 @@ public final class DictationManager: ObservableObject {
     private var micBufferContinuation: AsyncStream<AVAudioPCMBuffer>.Continuation?
     private var micForwardTask: Task<Void, Never>?
     private var bufferCount = 0
+    private var bufferCapWarned = false
+
+    /// Hard cap on buffered audio: 4 hours at 16 kHz (matches the recording
+    /// manager's max duration). A dictation session left running accumulates
+    /// ~230 MB/hour; past the cap further audio is dropped rather than letting
+    /// memory grow without bound.
+    private static let maxBufferSamples = 4 * 3600 * 16_000
 
     /// Called when transcription completes for a session with the final text.
     public var onUtterance: ((String) -> Void)?
@@ -114,7 +118,7 @@ public final class DictationManager: ObservableObject {
         }
 
         audioBuffer.removeAll(keepingCapacity: true)
-        partialTranscript = ""
+        bufferCapWarned = false
 
         try startMicCapture()
         state = .listening
@@ -163,11 +167,11 @@ public final class DictationManager: ObservableObject {
             let result = try await mgr.transcribe(
                 samples, decoderState: &decoderState, language: .english
             )
-            DebugFileLog.log("DictationManager.stop transcribe returned — rawText=\"\(result.text)\" (len=\(result.text.count))")
+            DebugFileLog.log("DictationManager.stop transcribe returned — rawLen=\(result.text.count)")
             let boosted = await rescoreWithVocabulary(result: result, samples: samples)
             let normalized = TextNormalizer.shared.normalize(result: boosted).text
             let trimmed = normalized.trimmingCharacters(in: .whitespacesAndNewlines)
-            DebugFileLog.log("DictationManager.stop final text=\"\(trimmed)\" (len=\(trimmed.count))")
+            DebugFileLog.log("DictationManager.stop final len=\(trimmed.count)")
             guard !trimmed.isEmpty else {
                 DebugFileLog.log("DictationManager.stop empty after normalize — skipping inject")
                 return
@@ -341,6 +345,13 @@ public final class DictationManager: ObservableObject {
     }
 
     private func appendSamples(_ samples: [Float]) {
+        guard audioBuffer.count < Self.maxBufferSamples else {
+            if !bufferCapWarned {
+                bufferCapWarned = true
+                NSLog("Heard: Dictation buffer hit the 4-hour cap — dropping further audio until stop")
+            }
+            return
+        }
         audioBuffer.append(contentsOf: samples)
         bufferCount += 1
         if bufferCount == 1 {

Sources/HeardCore/RosterReader.swift

@@ -62,7 +62,11 @@ public enum RosterReader {
         // their own when genuinely denied, so the result is the same either way.
         guard let pid = teamsPID else { return parseWindowTitle() }
 
-        let app = AXUIElementNode(AXUIElementCreateApplication(pid))
+        let element = AXUIElementCreateApplication(pid)
+        // Bound each AX round-trip so a busy/hung Teams can't stall the caller
+        // for the system default timeout on every node of the tree walk.
+        AXUIElementSetMessagingTimeout(element, 1.0)
+        let app = AXUIElementNode(element)
         let names = readRosterFromNode(app)
         return names.isEmpty ? parseWindowTitle() : names
     }