Harden output lifecycle, control responsiveness, and release validation

[iamfatness]

Recording requests could appear live before successful media writes, Stop could re-arm outputs after a lost reply, and Zoom authentication could block the command loop. This branch separates output intent from observed lifecycle/finalization, guards process generations in the shells, and moves Zoom join/authentication onto a cancellable worker with a bounded input mailbox.

The changes also add atomic configuration replacement and visible backup-recovery warnings, require authentication for LAN HTTP control, separate OSC exposure, generate a shared lifecycle/version/operation contract slice, extract native route binding, and make release publication depend on automated checks plus evidence for the exact signed candidate. Commits separate security, contracts, native behavior, release gates, and shell/client adoption.

Validation: portable native and .NET suites, renderer unit/integration, Node/show-engine suites, shared contract fixtures, release evidence tests, full Windows native Release build and WinUI publish. Synthetic 30-second auth/join delays kept Stop p95 below 18 ms. Real D3D11/Media Foundation output reached completed/finalized and passed ffprobe, full decode and generated-image content checks.

The short recording test also found an existing throughput ceiling: branch 51.13 effective fps/65 drops versus unmodified baseline 660f626 at 50.72 fps/62 drops, with identical adapter flags/compiler/SDK and workload. These are finalization/decode results, not 60fps or soak acceptance.

Mac CI compiled and passed the Swift shell (173 checks) and native stub/Metal/AVFoundation/CoreAudio/capture suites. The macOS recording cadence drill still fails (branch 19.3/24.1 fps; historical main 29.4/25.4 fps). Its requirement is unchanged; runner variability does not exclude a regression statistically. TSan also found a synchronous stub snapshot race; the fix and a concurrent regression pass 619 local native tests, and the Linux ThreadSanitizer rerun passed without race warnings.

Hosted Windows MediaCore (487), Control (53), WinUI (750) and bridge tests passed after provisioning the pinned Windows App Runtime. The earlier cd83c3b revision also passed the WinUI publish gate.

The review follow-up bounds retained recording media across generations while preserving accepted tails, makes rejected held frames retryable, keeps output polling active without Zoom capture, retries explicit Windows Stop targets, and reconciles macOS recording commands across failures and stale completions. Request-only handshakes work while ordinary commands remain gated; incompatible bootstrap or solicited handshakes terminate without recovery. The release harness accepts successful PowerShell scripts without masking script/native failures.

Follow-up local validation on a17790a: native 621 (20 asynchronous encoder cases), MediaCore 489 (11 handshake cases), WinUI 758, and release evidence 23 passed. Hosted CI on this revision passed Windows tests/publish, native stub and Metal tests, ThreadSanitizer, renderer/integration checks, and all 196 macOS shell checks. The only failed CI job remains the existing macOS recording-cadence drill, at 30.9 fps against its unchanged 60 fps requirement.

Recording cadence and designated-rig acceptance remain open release requirements. Live Zoom, simultaneous two-hour record/stream soak, physical faults, clean-machine install/update and signed-candidate evidence have not been run. The release rig/environment/harness must be provisioned before publication can pass. Full legacy protocol generation, durable participant identity/native Take and outbound backpressure remain explicitly tracked in docs/architecture-remediation-plan.md, contracts/README.md and docs/architecture-ownership.md.

Detailed results and procedures: docs/architecture-validation.md, docs/architecture-migration.md, docs/release-evidence.md and docs/recording-finalization-validation.md. No release is included.

Final merge review fixed a delayed macOS live snapshot re-arming recording after Stop. Live snapshots now preserve stopped intent, while explicit Stop retries remain available. Six regression checks were added. The macOS build and all 202 shell checks passed on 5e14c1d. Remaining CI reruns were still running at merge; unchanged Windows/native/ThreadSanitizer suites had passed on a17790a. The macOS cadence drill remains failed (21.0 fps on this final run) against the unchanged 60 fps requirement.