[PaleHazy]

Summary

• add an authenticated hosted control-plane adapter without embedding billing or product logic in the public recorder
• replace process-global Discord capture state with per-guild requests, active sessions, and transition locks while preserving the existing self-hosted mode
• poll fresh full-snapshot guild policy and durable start/stop commands, enforce channel/notice/consent/entitlement/generation gates, and reserve usage by command immediately before voice join
• renew hosted reservation authority at least every ten seconds against the rolling 90-second lease contract, durably persist extensions or shortenings, and reject auth/conflict/timeout/malformed/mismatched/near-expiry/overlong responses
• synchronously close affected WAV writers on heartbeat or ownership loss, with an independent one-second local authority watchdog enforcing the last accepted deadline
• persist command idempotency, encrypted bounded final-usage delivery, and crash recovery derived from durable mixed-audio WAV checkpoints
• add cross-process database ownership heartbeats, stale-only recovery claims, claim-token fencing, Helm/env wiring, regression coverage, and hosted deployment documentation

Safety and impact

Hosted occupancy auto-start is disabled. Every hosted start is command-bound and renews control-plane authority plus durable recovery ownership before voice handlers are enabled. Active reservation continuation tolerates only its own usage_cap_exhausted snapshot state; entitlement, privacy, consent, channel, storage, generation, heartbeat, and ownership failures still stop capture.

The capture authority deadline is distinct from the bounded final-settlement window. Final units are clamped to checkpointed mixed audio, reserved units, and the last persisted authority window. Exact final consume remains encrypted in the existing durable outbox and may retry only during the 30-minute stopping settlement window. Crash recovery settles abandoned capture; it never renews or resumes recording authority.

All currently advertised hosted storage providers remain deliberately unsupported by the worker, so hosted recording cannot start from this PR. Self-hosted local/PVC capture remains unchanged. This patch does not delete or purge artifacts beyond existing fail-closed behavior.

Validation

• cargo fmt --check
• cargo clippy --all-features --all-targets --locked -- -D warnings
• cargo test --all-features --locked with disposable PostgreSQL: 49 passed, including renewal/shortening, mismatch, near/far expiry, auth, revocation, timeout, outage, watchdog, old-schema upgrade, crash settlement, and two-pool ownership fencing
• cargo audit with only the repository-documented reviewed exceptions: no vulnerabilities, four allowed unmaintained warnings
• helm lint charts/call-scribe
• hosted Helm render and immutable-digest negative smoke
• docker compose --env-file .env.docker.example config --quiet
• git diff --check
• final Codex Security diff scan: complete two-file source worklist, no remaining heartbeat-scope finding after the independent watchdog hardening

Remaining release gates

• resolve the six separately scoped public storage-security findings before enabling a hosted storage destination; they were intentionally not implemented in this heartbeat patch
• implement and verify a destination adapter that uploads, verifies delivery, applies retention, and deletes transient local raw data before enabling any hosted storage provider
• obtain required review and green GitHub checks, then run live Discord/voice/control-plane/storage end-to-end evidence before deployment