feat(A.2 #19): progressive WAV write during live capture

The Vec<f32> in-memory accumulator on run_live_session had three
failure modes: (a) a crash during transcription took the recording
with it, (b) RAM grew linearly with session length, (c) OOM killed
the capture thread silently.

New kon_audio::WavWriter wraps hound::WavWriter<BufWriter<File>> with
an append-friendly API and a 500 ms-granularity header flush. On any
abort after a flush the on-disk file is a valid, playable WAV. Unit
test (brief item #19 acceptance) simulates the abort with
std::mem::forget and asserts the pre-flush samples are recoverable.

Live capture now:
- resolves the destination path at start_live_transcription_session
  time via a new resolve_recording_path helper extracted from
  persist_audio_samples,
- opens a WavWriter before any samples arrive, sample rate taken from
  LocalEngine::capabilities() (#13 wiring) with 16 kHz fallback,
- feeds the resampler output through WavWriter::append inside
  append_resampled_audio — drops the writer with a user-visible
  warning if a write fails mid-session,
- calls flush() at stop (after resampler tail), finalise() on clean
  exit, and drops-to-last-flushed state on abort.

LiveSessionSummary.audio_samples → audio_path: the path is already
written by the time stop_live_transcription_session runs; no
post-session write step remains for live capture.
persist_audio_samples is kept for the offline save_audio command.

crates/audio/src/lib.rs

@@ -12,4 +12,4 @@ pub use decode::decode_audio_file;
 pub use resample::resample_to_16khz;
 pub use streaming_resample::StreamingResampler;
 pub use vad::SpeechDetector;
-pub use wav::{read_wav, write_wav};
+pub use wav::{read_wav, write_wav, WavWriter};

crates/audio/src/wav.rs

@@ -1,8 +1,101 @@
+use std::io::BufWriter;
 use std::path::Path;
 
 use kon_core::error::{KonError, Result};
 use kon_core::types::AudioSamples;
 
+/// Append-friendly WAV writer for long-running captures.
+///
+/// The in-memory `Vec<f32>` used by `run_live_session` to persist audio
+/// on session end (brief item #19) has three failure modes: (a) a crash
+/// during transcription takes the recording with it; (b) RAM bloat at
+/// long session lengths; (c) an OOM kills the capture loop. `WavWriter`
+/// replaces that pattern with an on-disk writer that periodically
+/// flushes the WAV header so the file on disk is a valid, playable WAV
+/// at any point the process is interrupted.
+///
+/// The writer samples at the rate / channel count supplied at
+/// construction; callers read those from
+/// `LocalEngine::capabilities()` (brief item #13 wiring) rather than
+/// hardcoding 16 kHz / mono.
+pub struct WavWriter {
+    inner: hound::WavWriter<BufWriter<std::fs::File>>,
+    samples_since_flush: usize,
+    flush_every: usize,
+}
+
+impl WavWriter {
+    /// Sample count between automatic header flushes. Flushing costs
+    /// two seeks per call; 8000 samples at 16 kHz = 500 ms, so the
+    /// worst-case "last half second is lost on crash" bound holds.
+    const DEFAULT_FLUSH_EVERY_SAMPLES: usize = 8_000;
+
+    /// Create a new WAV file at `path`, truncating any previous content.
+    /// Header reflects zero samples until the first `flush` or
+    /// `finalize`.
+    pub fn create(path: &Path, sample_rate: u32, channels: u16) -> Result<Self> {
+        let spec = hound::WavSpec {
+            channels,
+            sample_rate,
+            bits_per_sample: 16,
+            sample_format: hound::SampleFormat::Int,
+        };
+        let file = std::fs::File::create(path).map_err(KonError::Io)?;
+        let buffered = BufWriter::new(file);
+        let inner = hound::WavWriter::new(buffered, spec).map_err(|e| {
+            KonError::Io(std::io::Error::other(format!("WAV create failed: {e}")))
+        })?;
+        Ok(Self {
+            inner,
+            samples_since_flush: 0,
+            flush_every: Self::DEFAULT_FLUSH_EVERY_SAMPLES,
+        })
+    }
+
+    /// Append f32 samples in `[-1.0, 1.0]`. Samples outside that range
+    /// are clamped (matching `write_wav`). Automatically flushes the
+    /// header every `flush_every` samples so the on-disk file stays a
+    /// valid WAV even if the process is killed between appends.
+    pub fn append(&mut self, samples: &[f32]) -> Result<()> {
+        for &sample in samples {
+            let clamped = sample.clamp(-1.0, 1.0);
+            let int_sample = (clamped * i16::MAX as f32) as i16;
+            self.inner.write_sample(int_sample).map_err(|e| {
+                KonError::Io(std::io::Error::other(format!("WAV write failed: {e}")))
+            })?;
+        }
+        self.samples_since_flush += samples.len();
+        if self.samples_since_flush >= self.flush_every {
+            self.flush()?;
+        }
+        Ok(())
+    }
+
+    /// Force an immediate header flush. Leaves the file in a valid-WAV
+    /// state up to the current sample count. Callers do not need to
+    /// call this explicitly — `append` flushes every
+    /// `Self::DEFAULT_FLUSH_EVERY_SAMPLES` — but may do so at natural
+    /// boundaries (end-of-utterance, UI events) for tighter recovery.
+    pub fn flush(&mut self) -> Result<()> {
+        self.inner.flush().map_err(|e| {
+            KonError::Io(std::io::Error::other(format!("WAV flush failed: {e}")))
+        })?;
+        self.samples_since_flush = 0;
+        Ok(())
+    }
+
+    /// Finalise the WAV: writes the terminal header state and closes
+    /// the file. Call on clean session end. A dropped-without-finalize
+    /// writer leaves a playable file up to the last flush; callers
+    /// that care about the unflushed tail should always finalise.
+    pub fn finalize(self) -> Result<()> {
+        self.inner.finalize().map_err(|e| {
+            KonError::Io(std::io::Error::other(format!("WAV finalize failed: {e}")))
+        })?;
+        Ok(())
+    }
+}
+
 /// Write f32 PCM samples to a 16-bit WAV file.
 pub fn write_wav(path: &Path, audio: &AudioSamples) -> Result<()> {
     let spec = hound::WavSpec {
@@ -58,6 +151,72 @@ pub fn read_wav(path: &Path) -> Result<AudioSamples> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn wav_writer_survives_crash() {
+        // Property under test: a `WavWriter` that has been flushed but
+        // never finalised leaves a valid, readable WAV on disk. This
+        // is the crash-safety guarantee — if the kon process aborts
+        // mid-session, the on-disk file up to the last flush is
+        // recoverable.
+        //
+        // `std::mem::forget` is the canonical way to simulate an
+        // abort inside a unit test: it skips the Drop impl (which
+        // would otherwise finalise the hound writer for us) and
+        // mirrors what happens when the OS reaps the process without
+        // giving Rust a chance to run destructors.
+        let temp_dir = std::env::temp_dir();
+        let path = temp_dir.join("kon_test_wav_writer_survives_crash.wav");
+        let _ = std::fs::remove_file(&path);
+
+        let mut writer = WavWriter::create(&path, 16_000, 1).unwrap();
+        let flushed_samples = vec![0.1_f32; 16_000]; // 1s
+        writer.append(&flushed_samples).unwrap();
+        writer.flush().unwrap();
+
+        // Post-flush, append another second that will NOT be reflected
+        // in the header if the writer dies before the next flush.
+        let unflushed_tail = vec![0.2_f32; 16_000];
+        writer.append(&unflushed_tail).unwrap();
+
+        // Abort — Drop does not run, the hound finaliser is skipped.
+        std::mem::forget(writer);
+
+        let loaded = read_wav(&path).unwrap();
+        assert_eq!(loaded.sample_rate(), 16_000);
+        assert!(
+            loaded.samples().len() >= 16_000,
+            "expected at least the flushed 16000 samples, got {}",
+            loaded.samples().len()
+        );
+        // The flushed portion is readable and approximately correct.
+        for s in &loaded.samples()[..16_000] {
+            assert!(
+                (s - 0.1).abs() < 0.01,
+                "flushed sample {s} deviates from 0.1 beyond 16-bit quantisation slack",
+            );
+        }
+
+        let _ = std::fs::remove_file(&path);
+    }
+
+    #[test]
+    fn wav_writer_append_then_finalize_roundtrips() {
+        let temp_dir = std::env::temp_dir();
+        let path = temp_dir.join("kon_test_wav_writer_finalize.wav");
+        let _ = std::fs::remove_file(&path);
+
+        let mut writer = WavWriter::create(&path, 16_000, 1).unwrap();
+        writer.append(&vec![0.0_f32; 8_000]).unwrap();
+        writer.append(&vec![0.5_f32; 8_000]).unwrap();
+        writer.finalize().unwrap();
+
+        let loaded = read_wav(&path).unwrap();
+        assert_eq!(loaded.sample_rate(), 16_000);
+        assert_eq!(loaded.samples().len(), 16_000);
+
+        let _ = std::fs::remove_file(&path);
+    }
+
     #[test]
     fn wav_roundtrip() {
         let temp_dir = std::env::temp_dir();