fix(rb-07): runtime capabilities derive accelerators honestly

get_runtime_capabilities was returning `accelerators = ["cpu",
"vulkan"]` and `whisper.supports_gpu = true` regardless of build
config or runtime state. On a macOS build it falsely advertised
"vulkan" (the backend actually resolves via MoltenVK as Metal); on a
whisper-disabled build it claimed GPU support for an engine that
hadn't been linked.

Added `compose_accelerators(whisper_enabled, loader_available, target)`
— a pure helper that always emits "cpu" first and appends the
platform-appropriate GPU name only when whisper is compiled in AND the
Vulkan loader resolves. `supported_accelerators()` wraps it with the
live `cfg!(feature = "whisper")`, loader probe, and target OS.

`get_runtime_capabilities` now calls `supported_accelerators()` and
sets `whisper.supports_gpu = cfg!(feature = "whisper")`. Parakeet
stays CPU-only.

Five tests in `commands::models::tests` cover the permutation matrix:
whisper on/off, loader present/missing, macOS vs other. Both feature
configurations (`--features whisper` and `--no-default-features`)
build and pass tests.

Macos Metal-loader resolution on real hardware stays on the
ship-gate checklist — the detection logic is verifiable from Linux
but runtime behaviour is not.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/issues/README.md

@@ -18,14 +18,13 @@ should be mirrored as real GitHub issues on `jakejars/kon`.
 | RB-01 | [c1-live-session-race.md](c1-live-session-race.md) | `src-tauri/commands/live.rs` | large |
 | RB-03 | [c4-transcript-profile-fk.md](c4-transcript-profile-fk.md) | `crates/storage/migrations.rs` + `database.rs` | large |
 
-## MAJOR (7 open, 2 resolved)
+## MAJOR (6 open, 3 resolved)
 
 | # | File | Area | Fix scope |
 |---|---|---|---|
 | RB-04 | [run-live-session-monolith.md](run-live-session-monolith.md) | `src-tauri/commands/live.rs` | large |
 | RB-05 | [poll-inference-channel-fatality.md](poll-inference-channel-fatality.md) | `src-tauri/commands/live.rs` | medium |
 | RB-06 | [native-capture-worker-join.md](native-capture-worker-join.md) | `src-tauri/commands/audio.rs` | medium |
-| RB-07 | [runtime-capabilities-accelerators.md](runtime-capabilities-accelerators.md) | `src-tauri/commands/models.rs` | medium |
 | RB-08 | [power-assertion-macos-objc2.md](power-assertion-macos-objc2.md) | `src-tauri/commands/power.rs` | medium |
 | RB-10 | [llm-prompt-preflight.md](llm-prompt-preflight.md) | `crates/llm/lib.rs` | medium |
 | RB-11 | [keystore-thread-safety.md](keystore-thread-safety.md) | `crates/cloud-providers/keystore.rs` | medium |
@@ -35,6 +34,7 @@ should be mirrored as real GitHub issues on `jakejars/kon`.
 | # | File | Area | Resolution |
 |---|---|---|---|
 | RB-02 | [c3-migrations-atomicity.md](c3-migrations-atomicity.md) | `crates/storage/migrations.rs` | Each migration now runs inside a `pool.begin()` / `tx.commit()` transaction alongside its `schema_version` insert. Regression test injects a poisoned v9 migration and asserts neither the partial schema change nor the version row persists. DRY'd `run_migrations_up_to` test helper onto the same code path. |
+| RB-07 | [runtime-capabilities-accelerators.md](runtime-capabilities-accelerators.md) | `src-tauri/commands/models.rs` | Introduced `compose_accelerators(whisper_enabled, loader_available, target)` as a pure helper; `supported_accelerators()` reads `cfg(feature = "whisper")`, `vulkan_loader_available()`, and target OS then delegates. `get_runtime_capabilities` uses it in place of the hard-coded `["cpu", "vulkan"]`. Whisper's `supports_gpu` now follows the feature flag. Five regression tests cover all permutations. |
 | RB-09 | [decoder-partial-audio-on-error.md](decoder-partial-audio-on-error.md) | `crates/audio/decode.rs` | Packet-loop now propagates all non-EOF `SymphoniaError`s as `AudioDecodeFailed`; per-packet decode errors bubble via `?`. Mock-`MediaSource` regression test confirms mid-stream I/O errors surface instead of returning partial audio. |
 | RB-12 | [hotkey-linux-device-filter.md](hotkey-linux-device-filter.md) | `crates/hotkey/linux.rs` | Extracted `device_supports_combo` helper; `try_attach_device` now reads the configured `HotkeyCombo` from the watch channel and checks support for that trigger key. Four regression tests land in `linux::tests`. |
 

docs/issues/runtime-capabilities-accelerators.md

@@ -4,6 +4,39 @@
 **Path:** `src-tauri/src/commands/models.rs:435-489`
 **Source:** [2026-04-22 code review](../code-review-2026-04-22.md)
 **Labels:** release-blocker, major, ui-integrity
+**Status:** RESOLVED (2026-04-22)
+
+## Resolution
+
+Added a pure `compose_accelerators(whisper_enabled, loader_available,
+target) -> Vec<String>` helper. It always emits `"cpu"` first and
+appends `"metal"` (macOS) or `"vulkan"` (Linux/Windows) only when
+whisper is compiled in *and* `vulkan_loader_available()` resolves the
+platform's loader shim.
+
+`supported_accelerators()` reads `cfg!(feature = "whisper")`, runs the
+live loader probe, and delegates to the helper.
+`get_runtime_capabilities` calls `supported_accelerators()` in place
+of the hard-coded `vec!["cpu", "vulkan"]`. Whisper's `supports_gpu`
+is now `cfg!(feature = "whisper")` — false on whisper-disabled
+builds.
+
+Five regression tests in `commands::models::tests` cover:
+
+- `cpu_only_when_whisper_disabled` (both targets)
+- `cpu_only_when_loader_missing` (both targets)
+- `macos_with_loader_advertises_metal`
+- `non_macos_with_loader_advertises_vulkan`
+- `cpu_is_always_first_entry` (contract the frontend relies on)
+
+Both `cargo test -p kon --lib` and `cargo test -p kon --lib
+--no-default-features` pass the new suite; both `cargo build -p kon`
+and `cargo build -p kon --no-default-features` compile clean.
+
+Runtime GUI verification on a real macOS box is still on the ship-gate
+checklist — the detection logic is correct in code; Metal-loader
+resolution on hardware is not something we can unit-test from a Linux
+CI.
 
 ## Problem