Complete managed macOS platform bring-up

PROGRESS.md

@@ -10,16 +10,16 @@ up instantly. Newest status at the top.
 
 ## ▶ Where we left off / next action
 
-- **In progress (2026-09-16): managed macOS client and default audio path.** Added a
+- **In progress (2026-09-18): managed macOS client and selectable audio path.** Added a
   separate .NET 10 AppKit solution with application/menu lifecycle, guest/account connection,
   explicit TOFU approval, channel selection, roster/chat, disconnect state, accessibility
   labels, sandbox entitlements and deterministic disposal. Voice join now opens bounded
-  stereo playback, subscribes, announces a managed microphone stream, converts the default
+  stereo playback, subscribes, announces a managed microphone stream, converts the selected
   Core Audio input to interleaved 48 kHz int16 and feeds `VoiceCat.Audio`; leave/disconnect
   tears the path down. Channel changes suspend and resume voice so streams renegotiate.
-  Playback uses `AVAudioSourceNode` plus the shared tested `PcmRing`; the render callback
-  allocates no managed memory and never locks or blocks. Current AppKit/AVFoundation calls
-  compile warning-free against Microsoft's 26.4.10259 macOS reference assembly. Added a
+  Playback uses `AVAudioSourceNode` plus the shared tested `PcmRing`, converting to Core Audio's
+  native planar Float32 layout; the render callback allocates no managed memory and never locks
+  or blocks. Added a
   macOS CI gate for the real workload, native Opus/RNNoise shim and Apple solution. Local
   server profiles now persist validated host, port, authentication mode and identity through
   `VoiceCat.Core`; malformed profile files do not prevent startup, writes replace atomically,
@@ -31,11 +31,27 @@ up instantly. Newest status at the top.
   successful authentication and removed when remembering is disabled or the profile is deleted.
   The composer can now target the current channel or any connected user, and labels private
   messages with the other participant.
-  Workload installation remains
-  blocked by this Windows machine's unrelated Visual Studio
-  iOS/Android MSI repair failure, so device execution is not claimed. **Next:** run the
-  macOS CI/device capture-playback test and ten-minute listen gate, then add non-default devices,
-  moderation/settings, ScreenCaptureKit,
+  On Apple Silicon macOS 27, SDK/workload set 10.0.401 now builds against the explicit
+  `net10.0-macos27.0` preview target. The build selects native arm64 Homebrew `protoc`,
+  deduplicates the media dylib during app bundling and uses macOS 27's error-returning
+  AVFoundation overloads while preserving macOS 14–26 calls. Debug disables hardened runtime
+  so its ad-hoc-signed .NET dylibs load without a developer identity; Release remains hardened.
+  The arm64 bundle is valid, launches successfully and displays the connection window on a
+  physical macOS 27 host. The app now creates missing private-file parent directories on first
+  launch, requests microphone authorization explicitly, and enumerates/selects actual Core Audio
+  input and output devices; changing either device while joined restarts voice cleanly. Native
+  validation on macOS also exposed a PCM-tap teardown race:
+  disabling either external sink is now a quiescence barrier, so callback state can be released
+  safely without adding locks or waits to the real-time path. **Verified:** managed locked
+  restore and warning-free Release build; 188/196 managed tests passed with eight optional
+  native/published-server oracle tests skipped; native `dev` build and 29/29 CTest tests passed;
+  both PCM teardown regressions plus external playback passed five consecutive runs. Live testing
+  selected the internal MacBook microphone, proved nonzero mic energy at a peer, and played a
+  clean sustained peer tone in the DTX-disabled Music Room. Lobby's later hiss was confirmed as
+  expected Opus DTX comfort noise for a synthetic sine, not playback corruption. Per user
+  direction, final listen quality will be exercised in real multi-human calls after feature
+  completion rather than an artificial ten-minute tone. **Next:** add moderation/settings,
+  ScreenCaptureKit,
   VoiceOver verification, signing and notarization.
 
 - **Done (2026-09-16): Linux production packaging checkpoint.** Added a real TLS 1.3