The xpswatch tray lane measured ~1.9 tray signals/s at idle: refresh()
re-pushed icon (sparkline sample made every pixmap 'new'), tooltip and
menu rows every 2s, each push a NewIcon/PropertiesChanged the shell turns
into StTextureCache growth (the gnome-shell heap). Icon now publishes
only on (temp, gear, trim, badge) change, tooltip on text change with a
10s floor, rows/headers only on change.

After a suspend the pulse input stepped back ~2 h and ffmpeg never exited, so
nothing restarted it. A guard inside the recorder's own unit watches the log for
the Non-monotonic DTS line (zero in a healthy recorder) and restarts the
recorder, at most once per 120 s so it cannot flap.

The tray is up exactly when the rig is up. parvagues-sc Wants it, so any
bring-up brings it; Quit is the single exit and ends the session when the rig
runs (the tray never leaves by itself under a running rig), and just closes the
tray when it does not. Drops the End session / Quit tray only split.

How to end a session (music-work end, what it will and will not do, exit codes),
the tray Quit that tells the truth, and what is still unverified (the extension
tile needs a log out/in; the first real end-session run).

Quit used to close only the tray. Now, with the rig up, it asks: End session,
Quit tray only, or Cancel. End session runs in its own transient unit, because
the script's last step stops perf-tray.service and a child of the tray would be
killed mid-way through switching music mode off.

The tray's Quit only closed the tray, and music mode could not be left while
SuperDirt (a headless unit) or Ardour ran, so 'I quit everything' was false.
This stops the SuperDirt watchdog first (or it restarts the sound), then
SuperDirt (the black box stops with it), then hands over to music-work off.
It refuses while a take is rolling, never closes Ardour (it may hold unsaved
work; a second run finishes once Ardour is closed), and reports every outcome
as a desktop notification.

Measured: on a quiet sink the segment muxer held the Opus pages in a buffer; a
segment was still 0 bytes after 25 s. A kill or a power cut would lose the quiet
stretch, and 'is the file growing' could not tell a healthy recorder from a dead
one (the health check cried 'rig is down' on a working recorder). With
segment_format_options flush_packets=1 the file grows every second, in silence
too.

Rules a future session must see: SuperDirt takes no microphone (and the knob to
change that), Master follows the default output and respects hand-wiring, the
black box records whenever the rig is up, lcxl3-driver stays manual. The TODO
now holds the stem auto-take design with real numbers (16 GB/hour for 12
strips) and the retention decisions it needs.

recording_check reads the newest .opus segment mtime (never systemd): rig up and
no segment landing in 30 s is FAIL, naming the cause (unit not installed, no
segment, stale segment). The tray offers a one-click start of the recorder unit
only while that check fails.

The recorder resolves its sink once, at start. Master following the default
output would otherwise leave it recording the old sink's monitor: silence,
reported as RUNNING. try-restart only touches a recorder that is already
running.

The gig-record probe was ADVISE; the unit was not installed and two hours of
playing were recorded nowhere. A missed gig recording cannot be recovered and
an unneeded one costs 72 MB an hour, so with SuperDirt running it blocks (a
cold rig still skips). It now names the not-installed case instead of a bare
rc.

gig-record was on-demand, meaning only if a converge remembered; on 2026-10-11
it never ran and its unit was not even installed. parvagues-sc now Wants it
(a recorder that cannot start must never stop the sound), and it is PartOf the
sound so it is not left recording silence after the rig is down.

master_sink() took the first thing Master was linked to, so a spectrogram tap
listed before the real sink pointed the recorder at a source that does not
exist: RUNNING while capturing nothing. Only alsa_output/bluez_output count.
It also quit awk at the first hit, so under pipefail a large pw-link graph
gave SIGPIPE (141) and killed 'check' and, by the same race, 'start'.