[silverstein]

Cursor movement and branch selection could credit unspoken lines, while report writes and session shutdown had privacy and race problems. This change ties coverage to speech evidence, creates private reports atomically, makes diagnostic replay opt-in, bounds recording verification, and preserves the live report when a check fails.

The frontend uses the canonical report, shows timer and recording-check states, preserves native keyboard behavior, and contains modal focus. Coverage is labeled as a sentence-level estimate: the percentage counts words in covered lines, not individually matched spoken words. PR CI now checks the core, frontend, process lifecycle, and native macOS compilation.

Validation on Apple silicon macOS:

• 111 core unit tests and 13 integration/replay tests passed.
• 14 frontend tests and 4 native app/process tests passed.
• Strict core Clippy and staged whitespace checks passed.
• Swift speech helper and Rust/Tauri application compiled.
• Browser checks with a mocked Tauri bridge confirmed report states, modal focus wrapping, and inert background content.

Real microphone, speech permissions, and capture behavior still need native smoke checks before release. The existing 50% sentence threshold and main-line monotonic recording alignment remain. Critical numeric tokens must match exactly, but that alone does not reject a sentence with an incorrect value if enough other words match. Optional branches are excluded from adherence. See docs/ENGINEERING-REVIEW.md for the remaining evaluation work.

Adapted from Astra's supplied patch against e773588, with a corrected coverage label and local macOS validation.