fix(coordinator): marshal capsule show/hide to main thread [高]

[appergb]

User description

Summary

`emit_capsule` runs window state changes (`show()` / `hide()` / position helpers) inline on whichever thread invoked it. The level handler in `coordinator/dictation.rs` invokes `emit_capsule` at ~30 Hz from inside cpal's `process_callback` — i.e. the audio callback thread. NSWindow / HWND APIs expect the main thread; calling them from the audio thread risks:

• macOS: `dispatch_assert_queue_fail` SIGTRAP if the AppKit runloop assertion fires
• Windows: `SendMessage` deadlock against the GUI thread
• Either platform: the audio callback misses its deadline and triggers `kAudioUnitErr_TooManyFramesToProcess` (macOS) / dropped frames (Windows)

The 30 Hz throttle bounds frequency but doesn't change per-call risk.

Change

Wrap the window-touching half of `emit_capsule` in `app.run_on_main_thread`:

• `window.show` / `window.hide`
• `maybe_position_capsule_bottom_center`
• `show_capsule_window_no_activate`
• `restore_main_window_key_if_active` (macOS-only)

`app.emit_to` stays inline since Tauri's event bus is thread-safe. Closure captures `Arc` clone + `AppHandle` clone + Copy primitives (`translation`, `show_capsule`, `visible`) — no `CapsulePayload` clone needed.

The pattern is already established in this file — see `stop_qa_hotkey_listener` (line 326) for the same reasoning around Carbon hotkey drop running off the AppKit thread.

Why this is safe

• emit_to and run_on_main_thread are independent — the JS frontend processes the event asynchronously regardless, so the existing happens-before between "frontend hears event" and "OS window visible" is preserved (both were already async from JS's perspective).
• run_on_main_thread is fire-and-forget; emit_capsule's existing semantics (returns immediately, no result) are unchanged.
• Window state changes for begin/end/cancel paths still run — just slightly later (one main-runloop turn). At human time scales (<16 ms) this is invisible.

Audit linkage

Audit ID 3.2.2 (CONFIRMED 高). See `docs/audit-2026-05-10-validated.md` (local).

Test plan

• `cargo test --lib` — 31/31 pass.
• `cargo check --lib` clean.
• CI build — to be verified.
• Manual functional verification: dictate for ≥30 s on macOS while watching for SIGTRAP / Console.app crash logs; verify capsule still appears at session start. To be done after merge.

---

PR Type

Bug fix, Enhancement

---

Description

• Marshal window ops to main thread to avoid audio-thread crash

• Read show_capsule pref inside main-thread closure

• Capture visible/translation at call site for frame consistency

• Keep emit_to synchronous on calling thread

---

Diagram Walkthrough

flowchart LR
  A["emit_capsule (audio thread)"] --> B["compute visible, capture translation"]
  B --> C["run_on_main_thread closure"]
  C --> D["read latest show_capsule pref"]
  D --> E["maybe_position, show/hide capsule window"]
  B --> F["app.emit_to (inline, thread-safe)"]

Loading

File Walkthrough

Relevant files

Bug fix

coordinator.rs Thread-safe capsule window ops and fresh preference reading openless-all/app/src-tauri/src/coordinator.rs Wraps capsule window show/hide/positioning calls in app.run_on_main_thread to prevent main-thread-only API violations from the audio callback thread. Moves the show_capsule preference read inside the main-thread closure so the latest user setting is always used, eliminating stale-pref flashes. Computes visible and loads translation before spawning the closure, aligning window state with the actual capsule payload for the current frame. Preserves the synchronous app.emit_to call on the calling thread (Tauri event bus is thread-safe), maintaining the existing happens‑before order between event delivery and window visibility. +26/-8

---

[github-actions]

PR Reviewer Guide 🔍

(Review updated until commit e458605)

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

有问题...?

[appergb]

pr_agent 反馈处理

"Stale State" — 已修

84ee3d9：把 show_capsule 的 prefs 读取挪进 run_on_main_thread 闭包内，消除「用户改 show_capsule 偏好后下一帧才生效」的 16-33ms 窗口。visible / translation 仍在 call-site 计算 —— 它们是这一帧 capsule:state event 的 payload 内容，必须跟下发给 JS 的 payload 同步，不能闭包跑时再读。

"Ticket compliance ❌ #169" — 误报

issue #169 在 commit 7ac0421a (closes #169，2026-05-02) 已修。当前 beta 状态：

• coordinator.rs:326-340 stop_qa_hotkey_listener 已经 wrap app.run_on_main_thread：

  pub fn stop_qa_hotkey_listener(&self) {
      let app = self.inner.app.lock().clone();
      if let Some(app) = app {
          let inner = Arc::clone(&self.inner);
          let _ = app.run_on_main_thread(move || {
              inner.qa_hotkey.lock().take();
          });
      } else {
          self.inner.qa_hotkey.lock().take();
      }
  }

• lib.rs:347-355 的 RunEvent::Exit 调链已经把六个 stop_*_hotkey_listener 串好：stop_hotkey_listener / stop_qa_hotkey_listener / stop_combo_hotkey_listener / stop_translation_hotkey_listener / stop_switch_style_hotkey_listener / stop_open_app_hotkey_listener。
• 后四个兄弟函数走 take_*_on_main_thread helpers，每个都用 app.run_on_main_thread marshal Carbon teardown。

PR #389 是 audit 3.2.2（emit_capsule 在音频回调线程上动 NSWindow），跟 issue #169（Carbon RemoveEventHotKey 在 RunEvent::Exit 非主线程上 drop）是两个独立的事；PR diff 不动 hotkey teardown 路径是设计如此，不是合规缺失。

[github-actions]

Persistent review updated to latest commit 84ee3d9

[github-actions]

Persistent review updated to latest commit e458605