After a suspend the pulse input stepped back ~2 h and ffmpeg never exited, so
nothing restarted it. A guard inside the recorder's own unit watches the log for
the Non-monotonic DTS line (zero in a healthy recorder) and restarts the
recorder, at most once per 120 s so it cannot flap.

The tray is up exactly when the rig is up. parvagues-sc Wants it, so any
bring-up brings it; Quit is the single exit and ends the session when the rig
runs (the tray never leaves by itself under a running rig), and just closes the
tray when it does not. Drops the End session / Quit tray only split.

How to end a session (music-work end, what it will and will not do, exit codes),
the tray Quit that tells the truth, and what is still unverified (the extension
tile needs a log out/in; the first real end-session run).

Quit used to close only the tray. Now, with the rig up, it asks: End session,
Quit tray only, or Cancel. End session runs in its own transient unit, because
the script's last step stops perf-tray.service and a child of the tray would be
killed mid-way through switching music mode off.

The tray's Quit only closed the tray, and music mode could not be left while
SuperDirt (a headless unit) or Ardour ran, so 'I quit everything' was false.
This stops the SuperDirt watchdog first (or it restarts the sound), then
SuperDirt (the black box stops with it), then hands over to music-work off.
It refuses while a take is rolling, never closes Ardour (it may hold unsaved
work; a second run finishes once Ardour is closed), and reports every outcome
as a desktop notification.

Measured: on a quiet sink the segment muxer held the Opus pages in a buffer; a
segment was still 0 bytes after 25 s. A kill or a power cut would lose the quiet
stretch, and 'is the file growing' could not tell a healthy recorder from a dead
one (the health check cried 'rig is down' on a working recorder). With
segment_format_options flush_packets=1 the file grows every second, in silence
too.

Rules a future session must see: SuperDirt takes no microphone (and the knob to
change that), Master follows the default output and respects hand-wiring, the
black box records whenever the rig is up, lcxl3-driver stays manual. The TODO
now holds the stem auto-take design with real numbers (16 GB/hour for 12
strips) and the retention decisions it needs.

recording_check reads the newest .opus segment mtime (never systemd): rig up and
no segment landing in 30 s is FAIL, naming the cause (unit not installed, no
segment, stale segment). The tray offers a one-click start of the recorder unit
only while that check fails.

The recorder resolves its sink once, at start. Master following the default
output would otherwise leave it recording the old sink's monitor: silence,
reported as RUNNING. try-restart only touches a recorder that is already
running.

The gig-record probe was ADVISE; the unit was not installed and two hours of
playing were recorded nowhere. A missed gig recording cannot be recovered and
an unneeded one costs 72 MB an hour, so with SuperDirt running it blocks (a
cold rig still skips). It now names the not-installed case instead of a bare
rc.

gig-record was on-demand, meaning only if a converge remembered; on 2026-10-11
it never ran and its unit was not even installed. parvagues-sc now Wants it
(a recorder that cannot start must never stop the sound), and it is PartOf the
sound so it is not left recording silence after the rig is down.

master_sink() took the first thing Master was linked to, so a spectrogram tap
listed before the real sink pointed the recorder at a source that does not
exist: RUNNING while capturing nothing. Only alsa_output/bluez_output count.
It also quit awk at the first hit, so under pipefail a large pw-link graph
gave SIGPIPE (141) and killed 'check' and, by the same race, 'start'.

Ardour's real binary is ardour-8.4.0~ds1 and its process name is ArdourGUI. The
launcher's exe pattern could not match the Debian ~ds1 suffix, so it believed
Ardour was down and spawned a second instance on the same session (the 09-05
duplicate, recorded as 'not reproducible', was never measured against this
build). The gate's pgrep -x names never matched either, so its 'Ardour is open'
precondition was always false and SC -> Ardour and gig-record-on-target were
skipped on every run.

Master tracks the default sink (HDMI, the jack, a Bluetooth headset) only while
its wiring is the one autoroute made; anything else (qjackctl, several sinks)
is custom and left alone, and disconnecting all of Master's outputs hands
control back. The new link is made before the old one is cut. The default-sink
lookup runs every 2nd tick, not every tick.

SuperDirt takes no mic: capture -> SuperCollider:in_* links are cut, with
TIDAL_AUTOROUTE_SC_MICS=1 to keep them, documented in the script header.

Only rule 4's own start calls are capped; once started, the unit's
Restart=always retries forever by design. The first drill would have 'failed'
for the right reason (the repairer beats the observer's debounce), so it now
stops the repairer first.

Linking it to the default speaker as well would leak the whole set into the room
when monitoring on a headset.