Record what the radio was doing, and turn PTT into a recording

[jwussler]

Stacked on #1 — review that first; the diff here is just this change.

The premise was wrong, and checking cost less than building

"Port recording like the C# has" — it's already ported. src/recorder.cpp does WAV writing, continuous record and the replay ring, wired at main.cpp:213 with unit tests, and AUDIT-CSHARP.md:42 has had it as ✅ the whole time.

The real gap: a recording carried no provenance. hamdeck-rec-<local time>.wav and nothing else — no frequency, no mode, and its one timestamp in local time while every log worth matching against is UTC. "Who was that" was unanswerable by construction.

What changed

• A .json sidecar beside every recording — UTC start/end, frequency at start and end, mode, and the operator's overs. Manual, replay and auto alike.
  • Provenance is pushed from the poll loop, not pulled. Pulling took the poller's lock while holding the recorder's, from the poll thread, waiting on the one API path that nests them the other way.
  • A replay's started_utc is derived from the sample count — the ring holds what happened before the press, so stamping it "now" matches the audio to the wrong contact.
  • "overs": null ≠ "overs": []. Null is "not tracked"; an empty array would claim the operator never transmitted.
• QsoRecorder — the C# PTT auto-record (Views/MainWindow.xaml.cs:420), ported rather than invented: start on the rising edge, each over pushes the idle deadline, stop on idle or a QSY measured from where the QSO started. Must not start on a tune, and a tune must not move the remembered PTT state. Off by default — it records whoever you're talking to, unasked.
• RadioPoller::OnPoll — one fan-out point for anything reacting to rig state, instead of a second loop competing for the CAT port.

The gates, each proven to fail

reintroduced	caught by
NoteOver before the file opens	overs == 2 — the over that starts each QSO went unlisted
localtime_r for the sidecar	the local-vs-UTC hour comparison
replay stamped when saved	age >= 19 && age < 60
auto-record starting on a tune	!q.active()

⚠️ The UTC test was blind and passed anyway. The build box runs UTC, so localtime_r and gmtime_r agree and the assertion held just as happily against a local-time stamp. It now pins TZ to a POSIX string (glibc parses it with no tzdata, so a bare container can't silently drop back to UTC), asserts the two clocks actually differ, and compares the filename's local hour to the sidecar's UTC hour. Only then does localtime_r fail it.

Proven on the built host, not only in tests

Simulated rig, ptt_record_seconds: 3, keyed via /api/ptt/on, unkeyed, waited out the timer:

hamdeck-qso-09-02-2026-135540.wav   3.0 s, 1ch/16bit/22050, rms 5656 peak 7997
{ "trigger": "idle", "started_utc": "...13:55:40Z", "ended_utc": "...13:55:43Z",
  "freq_hz_start": 14074000, "mode": "USB", "overs": [ one, closed ] }

Not in this PR

The identification half, and a re-measurement of MONI — CARRYOVER.md:207 says it can't be captured, WsAudioClient.cs:205 says the operator hears themselves through it. Both describe the same station. Details in WIP.md.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EqubrbjLXwz1GrVgmTcrf9