How to end a session (music-work end, what it will and will not do, exit codes),
the tray Quit that tells the truth, and what is still unverified (the extension
tile needs a log out/in; the first real end-session run).

Quit used to close only the tray. Now, with the rig up, it asks: End session,
Quit tray only, or Cancel. End session runs in its own transient unit, because
the script's last step stops perf-tray.service and a child of the tray would be
killed mid-way through switching music mode off.

The tray's Quit only closed the tray, and music mode could not be left while
SuperDirt (a headless unit) or Ardour ran, so 'I quit everything' was false.
This stops the SuperDirt watchdog first (or it restarts the sound), then
SuperDirt (the black box stops with it), then hands over to music-work off.
It refuses while a take is rolling, never closes Ardour (it may hold unsaved
work; a second run finishes once Ardour is closed), and reports every outcome
as a desktop notification.

Measured: on a quiet sink the segment muxer held the Opus pages in a buffer; a
segment was still 0 bytes after 25 s. A kill or a power cut would lose the quiet
stretch, and 'is the file growing' could not tell a healthy recorder from a dead
one (the health check cried 'rig is down' on a working recorder). With
segment_format_options flush_packets=1 the file grows every second, in silence
too.

Rules a future session must see: SuperDirt takes no microphone (and the knob to
change that), Master follows the default output and respects hand-wiring, the
black box records whenever the rig is up, lcxl3-driver stays manual. The TODO
now holds the stem auto-take design with real numbers (16 GB/hour for 12
strips) and the retention decisions it needs.

recording_check reads the newest .opus segment mtime (never systemd): rig up and
no segment landing in 30 s is FAIL, naming the cause (unit not installed, no
segment, stale segment). The tray offers a one-click start of the recorder unit
only while that check fails.

The recorder resolves its sink once, at start. Master following the default
output would otherwise leave it recording the old sink's monitor: silence,
reported as RUNNING. try-restart only touches a recorder that is already
running.

The gig-record probe was ADVISE; the unit was not installed and two hours of
playing were recorded nowhere. A missed gig recording cannot be recovered and
an unneeded one costs 72 MB an hour, so with SuperDirt running it blocks (a
cold rig still skips). It now names the not-installed case instead of a bare
rc.

gig-record was on-demand, meaning only if a converge remembered; on 2026-10-11
it never ran and its unit was not even installed. parvagues-sc now Wants it
(a recorder that cannot start must never stop the sound), and it is PartOf the
sound so it is not left recording silence after the rig is down.

master_sink() took the first thing Master was linked to, so a spectrogram tap
listed before the real sink pointed the recorder at a source that does not
exist: RUNNING while capturing nothing. Only alsa_output/bluez_output count.
It also quit awk at the first hit, so under pipefail a large pw-link graph
gave SIGPIPE (141) and killed 'check' and, by the same race, 'start'.

Ardour's real binary is ardour-8.4.0~ds1 and its process name is ArdourGUI. The
launcher's exe pattern could not match the Debian ~ds1 suffix, so it believed
Ardour was down and spawned a second instance on the same session (the 09-05
duplicate, recorded as 'not reproducible', was never measured against this
build). The gate's pgrep -x names never matched either, so its 'Ardour is open'
precondition was always false and SC -> Ardour and gig-record-on-target were
skipped on every run.

Master tracks the default sink (HDMI, the jack, a Bluetooth headset) only while
its wiring is the one autoroute made; anything else (qjackctl, several sinks)
is custom and left alone, and disconnecting all of Master's outputs hands
control back. The new link is made before the old one is cut. The default-sink
lookup runs every 2nd tick, not every tick.

SuperDirt takes no mic: capture -> SuperCollider:in_* links are cut, with
TIDAL_AUTOROUTE_SC_MICS=1 to keep them, documented in the script header.

Only rule 4's own start calls are capped; once started, the unit's
Restart=always retries forever by design. The first drill would have 'failed'
for the right reason (the repairer beats the observer's debounce), so it now
stops the repairer first.

Linking it to the default speaker as well would leak the whole set into the room
when monitoring on a headset.

A Bluetooth headset (bluez_output.*) now counts as a hardware clock, so
monitoring on it no longer raises a permanent critical. When pw-top goes quiet
the clock check is WARN, never NA: cannot-measure is a third state. 'Recovered'
is only said for a real recovery (not when the rig closed or the probe went
blind). A health.json left by a gig-log that died uncleanly reads as not
observed instead of aging into a red stale dot on every day it is not running.

Sprint 12 entry, one learning line, and the follow-ups: the two owner decisions
(Master sinks, built-in mics), the witnessed drills, the work blocked on
uncommitted changes in gig-up.sh and rig_units.py, and the measured idle CPU of
the watchers.

health_item() turns the health.json gig-log publishes into one more panel item,
through the same tray_summary() the tray renders, so the two faces cannot
disagree. A stale observer is 'broken', no observer is 'absent'; neither can
read as up.

Reads the health.json gig-log publishes and renders tray_summary(): a red dot
for down or a stale observer, amber for degraded, nothing when healthy. A
single owner-unit action (start lcxl3-driver) appears only while the surface
check fails; the tray never writes the graph. A missing file reads as 'not
observed', never as ok.

Four faults on 2026-10-11 fell between the gate and the per-unit watchdogs, each
leaving every unit active. rig_health judges the signal path from what gig-log
already reads: the pw-top stream (are Ardour/SuperCollider clocked by a sound
card or by the MIDI bridge), /proc/asound (raw LCXL3 present but no driver
port), and the gear sample (sclang up, scsynth dead). Hysteresis, atomic
health.json with a heartbeat, notify + evidence snapshot only on a failure
transition. Steady state adds no fork.

The loop re-issued all 24 orbit links every 2 s and every pw-link connects to
the PipeWire daemon: 12 min of CPU in 85 min, about 15% of a core at idle.
Index the existing links from the one snapshot in pure bash and link only the
absent pairs.

A sink node re-created under a running Ardour left Master with no hardware
output: every unit active, the rig silent. Additive only (never prunes), off
switch TIDAL_AUTOROUTE_MASTER=0, ports taken from the graph not assumed FL/FR.
The control-surface assertion used an old PipeWire port spelling and was a
silent no-op on 1.0.5; resolve it from the live graph. One pw-link snapshot per
tick instead of three.

Bash regex instead of a grep fork, and the driver's own virtual port as proof
of service so systemctl is only asked when the raw board is present without
it.

gig-up picks the painter once at launch; a board that enumerates later never
got one and no fader reached Ardour. The unit stays manual (it crash-loops and
Conflicts= the v2 painter on a v2-only box), so the loop that already knows
which generation is plugged in re-runs the chooser: start, not restart, raw
kernel client only, never the v2 painter, bounded retries with a cooldown.

The LCXL LEDs probe exits 0 with no surface on the bus, so its only failure
is hardware present and its translator down: no faders reach Ardour, no paint.
That is 'there is no gig', not advice. It sat as one WARN among eleven under
two stale FAILs and went unread.

Rung 1 (epp=balance_power, ceiling 65%) is the pilot's resting posture, so
the fixed 'must be 100%' check turned every launch into a NO-GO whose fixes
fought the pilot. Pass when the knobs match the declared rung; FAIL only when
they disagree (a second writer). Stale or absent state keeps the old strict
behaviour.

start: pre-checks (disk, gig-log, autoroute service, routing, portal
token), screen capture on the default sink's monitor, arm, then a
per-orbit verify that never kills the video. State written before
verify, values quoted (the session path has a space). stop: SIGINT
sweep by output filename for the sandboxed recorder, transport halt,
take summary. Camera opt-in (--cam); no notification on the happy path.

Verify reads the capture files, never a self-report: missing or flat
per orbit. Never binds UDP 3820 (gig-log owns Ardour's OSC feedback);
reads gig-log's rec lines instead. The master-rec toggle is only sent
when that stream says OFF, the orbit list comes from the session XML,
and halt stops the transport a stop must never forget.

algolia devcon26: gig folder — intro loop (4K + portrait w/ audio), header art, jingle wav, extracted palette