fix(macos): distinguish no-audio startup and allow cancelled recorder cleanup

[LeonardNJU]

Scope

Fix confirmed macOS recording-state and cancellation hazards found while investigating another zero-audio startup incident. This is not a claim that the trigger of the system audio-service stall is permanently solved.

• Show microphone startup until the first real PCM event, then listening.
• Distinguish no microphone startup from genuinely short recorded audio, including asynchronous completion.
• Allow cancelled macOS recorder startup to unwind instead of SIGKILL after 250 ms. The existing 8-second recorder watchdog and final 9-second parent bound remain.
• Reject a new F9 recorder while the previous cancelled helper is still being reaped.
• Do not start microphone I/O if cancellation arrived during device setup.

Evidence and validation

The installed Apple-signed 5.0.8 InputMethod/Settings/recorder signatures and audio-input entitlements verified. Actual F9 requests were authorized by TCC. The signed Settings capture reported authorization=authorized but zero audio blocks after 8 seconds. The recorder was waiting in AudioOutputUnitStart / AudioDeviceStart / StartAndWaitForState. An independent AVAudioRecorder probe also reported authorized access but hung before returning from recordForDuration. A run-loop pumping experiment did not help and is not included.

HAL StartIO/Running logs printed during cancellation were accompanied by zero frames: these are not proof of successful recording or ordinary long DSP cold-start latency. The earlier diagnosis based on those messages was too strong.

A normal user-authorized coreaudiod restart restored the old installed build before this patch. The same helper then completed three one-second captures; independent AVAudioRecorder captured 48,000 frames. Recovery cannot be attributed to this patch.

• macOS CTest: 11/11 PASS, including the new cancelled-startup cleanup/overlap test.
• Native repository contracts: PASS.
• Local deployment: same Apple signing identity, full embedded payload update, new process and exact binary hashes verified, backup retained.
• Post-deployment signed Settings microphone smoke: success, 73,920 frames, 77 waveform blocks.
• Local build marker: 5.0.8+audio.895c86e.
• Public Latest remains v5.0.7; no release published or modified.

Long-idle/sleep-wake recurrence prevention is not yet demonstrated. See docs/diagnostics/macos-audio-startup.md for the evidence and recovery boundary. Windows prototype worktree and installed Linux environment are untouched.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[LeonardNJU]

Integrated into master in dddc37a with the current delayed-startup UI preserved. Local macOS 12/12 tests and native contracts passed; the installed signed combined build is 5.0.8+audio.dddc37a. A separate controlled comparison restored both AVAudioRecorder and VocoType capture by stopping only system-audio-spectrum; coreaudiod PID stayed unchanged. Details and limitations are recorded in docs/diagnostics/macos-audio-startup.md.