chore: rebrand from Kon/Corbie to Magnotia

Replace all instances of the legacy product names "Kon" and "Corbie" with
"Magnotia" across user-facing copy, code identifiers, package names, bundle
ids, file paths, and documentation. Preserves the unrelated "konsole" (KDE
terminal) reference and the parent CORBEL company name.

- Renames 10 Rust crates (kon-* → magnotia-*) and the tauri binary
- Updates package.json, tauri.conf.json (productName + identifier)
- Renames CSS classes (kon-rh-* → magnotia-rh-*) and animations
- Renames brand and roadmap docs
- Regenerates Cargo.lock and package-lock.json

Verified: svelte-check passes; pure-rust crates compile under new names.

docs/issues/README.md

@@ -7,9 +7,9 @@ tags: [issues, release-blockers]
 
 # Release-blockers
 
-Issues here must land before Kon v0.1 ships. Each is sourced from
+Issues here must land before Magnotia v0.1 ships. Each is sourced from
 `docs/code-review-2026-04-22.md`. When `gh` CLI is available, these
-should be mirrored as real GitHub issues on `jakejars/kon`.
+should be mirrored as real GitHub issues on `jakejars/magnotia`.
 
 ## CRITICAL (0 open, 3 resolved)
 
@@ -28,13 +28,13 @@ No open CRITICAL blockers.
 | RB-01 | [c1-live-session-race.md](c1-live-session-race.md) | `src-tauri/commands/live.rs` | Added `LiveTranscriptionState.lifecycle: tokio::sync::Mutex<()>` and hold it across the async spans of both `start_live_transcription_session` and `stop_live_transcription_session`. The running-slot check/insert and stop/take/join sequence are now serialized, so concurrent starts can no longer both pass the empty-slot check and a start during stop blocks until the previous worker fully joins. Two async regression tests cover both races. |
 | RB-02 | [c3-migrations-atomicity.md](c3-migrations-atomicity.md) | `crates/storage/migrations.rs` | Each migration now runs inside a `pool.begin()` / `tx.commit()` transaction alongside its `schema_version` insert. Regression test injects a poisoned v9 migration and asserts neither the partial schema change nor the version row persists. DRY'd `run_migrations_up_to` test helper onto the same code path. |
 | RB-03 | [c4-transcript-profile-fk.md](c4-transcript-profile-fk.md) | `crates/storage/migrations.rs` + `database.rs` | Added a transactional v9 rebuild of `transcripts` that enforces `profile_id REFERENCES profiles(id) ON DELETE RESTRICT`, reassigns any orphaned transcript provenance to `DEFAULT_PROFILE_ID`, rebuilds dependent `segments` / FTS state, and preserves valid profile references. `insert_transcript` now rejects unknown profile ids up front, and `delete_profile` returns a clear reassign-first error when transcripts still reference the profile. Regression tests cover migration reconciliation, invalid inserts, and delete rejection. |
-| RB-04 | [run-live-session-monolith.md](run-live-session-monolith.md) | `src-tauri/commands/live.rs` | Replaced the 200+ line `run_live_session` loop with an explicit `LiveSessionRuntime` + `LiveLoopState` structure. Capture startup, runtime mic-error draining, audio chunk processing, overflow handling, stop-tail flush, inference dispatch/drain, and WAV finalisation each live in focused helpers, preserving behaviour while making the lifecycle auditable enough for RB-01 follow-up. Existing live tests and the full `kon` lib suite stay green. |
+| RB-04 | [run-live-session-monolith.md](run-live-session-monolith.md) | `src-tauri/commands/live.rs` | Replaced the 200+ line `run_live_session` loop with an explicit `LiveSessionRuntime` + `LiveLoopState` structure. Capture startup, runtime mic-error draining, audio chunk processing, overflow handling, stop-tail flush, inference dispatch/drain, and WAV finalisation each live in focused helpers, preserving behaviour while making the lifecycle auditable enough for RB-01 follow-up. Existing live tests and the full `magnotia` lib suite stay green. |
 | RB-05 | [poll-inference-channel-fatality.md](poll-inference-channel-fatality.md) | `src-tauri/commands/live.rs` | `poll_inference` now treats result-channel loss as a listener-lifecycle problem rather than a transcription failure. On the first `result_channel.send(...)` error it marks the live result listener as lost, emits a single warning that transcription will continue in the background, and keeps processing later chunks without retrying the dead channel. Regression test simulates a dead result listener and asserts chunk processing continues with only one warning. |
 | RB-06 | [native-capture-worker-join.md](native-capture-worker-join.md) | `src-tauri/commands/audio.rs` | `NativeCaptureState.stop_tx` replaced by `worker: AsyncMutex<Option<CaptureWorker>>`. `CaptureWorker` bundles the stop sender and the spawned task's `JoinHandle`; `stop_worker(worker)` sends stop then `await`s termination. Both `start_native_capture` (prior-worker stop) and `stop_native_capture` use the helper. Removed the 50ms sleep — the join barrier is exact. Two regression tests cover the lifecycle guarantee and the already-exited case. |
 | RB-07 | [runtime-capabilities-accelerators.md](runtime-capabilities-accelerators.md) | `src-tauri/commands/models.rs` | Introduced `compose_accelerators(whisper_enabled, loader_available, target)` as a pure helper; `supported_accelerators()` reads `cfg(feature = "whisper")`, `vulkan_loader_available()`, and target OS then delegates. `get_runtime_capabilities` uses it in place of the hard-coded `["cpu", "vulkan"]`. Whisper's `supports_gpu` now follows the feature flag. Five regression tests cover all permutations. |
 | RB-09 | [decoder-partial-audio-on-error.md](decoder-partial-audio-on-error.md) | `crates/audio/decode.rs` | Packet-loop now propagates all non-EOF `SymphoniaError`s as `AudioDecodeFailed`; per-packet decode errors bubble via `?`. Mock-`MediaSource` regression test confirms mid-stream I/O errors surface instead of returning partial audio. |
 | RB-10 | [llm-prompt-preflight.md](llm-prompt-preflight.md) | `crates/llm/lib.rs` | Added an explicit prompt-budget preflight before context creation. If `prompt_tokens + max_tokens + reserve` exceeds the 8192-token cap, `generate` now returns a typed `EngineError::PromptTooLong { ... }` instead of failing late inside inference. Regression tests cover both the over-budget and exact-budget boundaries. |
-| RB-11 | [keystore-thread-safety.md](keystore-thread-safety.md) | `crates/cloud-providers/keystore.rs` | Replaced the `std::env::set_var` stub with a process-global `OnceLock<Mutex<HashMap<...>>>` keystore, keeping the API safe from any thread. Retrieval still falls back to read-only `KON_API_KEY_*` env vars for externally supplied secrets. Two regression tests cover store/retrieve and provider isolation. |
+| RB-11 | [keystore-thread-safety.md](keystore-thread-safety.md) | `crates/cloud-providers/keystore.rs` | Replaced the `std::env::set_var` stub with a process-global `OnceLock<Mutex<HashMap<...>>>` keystore, keeping the API safe from any thread. Retrieval still falls back to read-only `MAGNOTIA_API_KEY_*` env vars for externally supplied secrets. Two regression tests cover store/retrieve and provider isolation. |
 | RB-12 | [hotkey-linux-device-filter.md](hotkey-linux-device-filter.md) | `crates/hotkey/linux.rs` | Extracted `device_supports_combo` helper; `try_attach_device` now reads the configured `HotkeyCombo` from the watch channel and checks support for that trigger key. Four regression tests land in `linux::tests`. |
 
 ## Remaining blocker
@@ -51,7 +51,7 @@ for file in docs/issues/rb-*.md c1-*.md c3-*.md c4-*.md run-*.md poll-*.md \
             native-*.md runtime-*.md power-*.md decoder-*.md llm-*.md \
             keystore-*.md hotkey-*.md
   set -l title (head -1 "$file" | sed 's/^# //')
-  gh issue create --repo jakejars/kon --title "$title" --body-file "$file" \
+  gh issue create --repo jakejars/magnotia --title "$title" --body-file "$file" \
       --label release-blocker
 end
 ```

docs/issues/c3-migrations-atomicity.md

@@ -27,7 +27,7 @@ call returns `Err`, and post-call `SELECT COUNT(*) FROM poison_marker`
 fails with "no such table" while `MAX(schema_version)` remains at 8.
 
 SQLite DDL participates in transactions, so this is sufficient for the
-Kon schema. If any future migration needs a statement that implicitly
+Magnotia schema. If any future migration needs a statement that implicitly
 commits (`VACUUM`, `REINDEX`, `ATTACH`) — none do today — it must be
 split into its own non-transactional migration. Reviewer's job to flag.
 
@@ -43,7 +43,7 @@ split into its own non-transactional migration. Reviewer's job to flag.
 
 ## Fix scope
 
-Medium. Wrap each migration in `pool.begin()` / `tx.commit()`. The version update and the migration statements all execute on the same `Transaction` handle. Needs careful review of any migration that uses implicit commits (SQLite `VACUUM`, `REINDEX`, `ATTACH` — none of which Kon currently uses, but the review pattern should guard against future additions).
+Medium. Wrap each migration in `pool.begin()` / `tx.commit()`. The version update and the migration statements all execute on the same `Transaction` handle. Needs careful review of any migration that uses implicit commits (SQLite `VACUUM`, `REINDEX`, `ATTACH` — none of which Magnotia currently uses, but the review pattern should guard against future additions).
 
 ## Dependencies
 

docs/issues/decoder-partial-audio-on-error.md

@@ -12,7 +12,7 @@
 explicit end-of-stream `UnexpectedEof`:
 
 - `SymphoniaError::ResetRequired` → error (mid-stream discontinuity).
-- Any other packet-read error → `KonError::AudioDecodeFailed`.
+- Any other packet-read error → `MagnotiaError::AudioDecodeFailed`.
 - `decoder.decode(&packet)` errors → bubble via `?` instead of
   counter-then-skip.
 

docs/issues/hotkey-linux-device-filter.md

@@ -27,13 +27,13 @@ ship-gate checklist — code path is correct; runtime GUI check is deferred.
 
 `try_attach_device` claims to check whether an input device supports the configured hotkey's key, but the implementation tests for hard-coded `KEY_A` or `KEY_R` instead of consulting the actual `HotkeyCombo` that was configured. Hotkeys bound to any other key (which is most of them) can be silently skipped even when the device supports them.
 
-This is a correctness bug in a user-facing feature. A user who binds Kon to `Ctrl+Shift+D` and sees "no hotkey fires" has no obvious path to diagnose it.
+This is a correctness bug in a user-facing feature. A user who binds Magnotia to `Ctrl+Shift+D` and sees "no hotkey fires" has no obvious path to diagnose it.
 
 ## Acceptance
 
 - Device attachment consults the actual configured `HotkeyCombo.trigger` key code.
 - Regression test: `try_attach_device` called with a mock device that supports `KEY_D` attaches when the configured hotkey's trigger is `D`, does not attach when the trigger is a key the device doesn't support.
-- Manual verification: bind `Ctrl+Shift+D` in Settings, confirm it fires in a running Kon.
+- Manual verification: bind `Ctrl+Shift+D` in Settings, confirm it fires in a running Magnotia.
 
 ## Fix scope
 

docs/issues/keystore-thread-safety.md

@@ -17,7 +17,7 @@ Additional details:
 
 - Stored keys now live in-memory only for the life of the process.
 - `retrieve_api_key` checks the in-memory keystore first, then falls
-  back to read-only `KON_API_KEY_<PROVIDER>` environment variables so
+  back to read-only `MAGNOTIA_API_KEY_<PROVIDER>` environment variables so
   externally injected secrets still work.
 - Module docs now describe the real tradeoff clearly: safe from any
   thread, but non-persistent until a proper OS keychain backend lands.

docs/issues/power-assertion-macos-objc2.md

@@ -13,7 +13,7 @@ passes for both `x86_64-apple-darwin` and `aarch64-apple-darwin`.
 Remaining acceptance gap: manual runtime verification on a real macOS
 machine (`pmset -g assertions`, background live session). Diagnostic
 reports now also include a `## Power assertions` section that lists any
-currently active Kon assertion guards (`reason`, `backend`, `acquired`)
+currently active Magnotia assertion guards (`reason`, `backend`, `acquired`)
 at report time, which gives the tester an in-app breadcrumb alongside
 `pmset`.
 
@@ -25,25 +25,25 @@ The stub was deliberate (A.1 #9 acceptance concession — untestable on Linux wi
 
 ## Acceptance
 
-- `objc2` + `objc2-foundation` deps added to the kon crate, gated `cfg(target_os = "macos")`.
+- `objc2` + `objc2-foundation` deps added to the magnotia crate, gated `cfg(target_os = "macos")`.
 - `begin_activity` calls `[NSProcessInfo processInfo] beginActivityWithOptions:(NSActivityUserInitiated | NSActivityLatencyCritical) reason:reason]` and retains the returned activity handle.
 - `end_activity` calls `endActivity:` on the retained handle.
-- Manual-test on a real macOS box: 10-minute background live session completes without throttling; `pmset -g assertions` shows Kon's activity during capture.
+- Manual-test on a real macOS box: 10-minute background live session completes without throttling; `pmset -g assertions` shows Magnotia's activity during capture.
 
 ## Manual verification checklist
 
-1. Launch Kon on a real macOS machine and start a live transcription session.
+1. Launch Magnotia on a real macOS machine and start a live transcription session.
 2. While capture is running, background the app for at least several minutes.
-3. In Terminal, run `pmset -g assertions` and confirm Kon appears with a
+3. In Terminal, run `pmset -g assertions` and confirm Magnotia appears with a
    user-initiated / no-idle-style assertion while the session is active.
-4. While the session is still running, generate a Kon diagnostic report
+4. While the session is still running, generate a Magnotia diagnostic report
    and confirm the `## Power assertions` section lists an active entry
-   such as `reason=kon live dictation session`, `backend=macos`,
+   such as `reason=magnotia live dictation session`, `backend=macos`,
    `acquired=true`.
 5. Stop the session and rerun `pmset -g assertions` or regenerate the
    diagnostic report to confirm the assertion disappears.
 6. Repeat once for the LLM cleanup path if desired
-   (`reason=kon LLM cleanup`).
+   (`reason=magnotia LLM cleanup`).
 
 ## Fix scope
 

docs/issues/runtime-capabilities-accelerators.md

@@ -29,9 +29,9 @@ Five regression tests in `commands::models::tests` cover:
 - `non_macos_with_loader_advertises_vulkan`
 - `cpu_is_always_first_entry` (contract the frontend relies on)
 
-Both `cargo test -p kon --lib` and `cargo test -p kon --lib
---no-default-features` pass the new suite; both `cargo build -p kon`
-and `cargo build -p kon --no-default-features` compile clean.
+Both `cargo test -p magnotia --lib` and `cargo test -p magnotia --lib
+--no-default-features` pass the new suite; both `cargo build -p magnotia`
+and `cargo build -p magnotia --no-default-features` compile clean.
 
 Runtime GUI verification on a real macOS box is still on the ship-gate
 checklist — the detection logic is correct in code; Metal-loader