android: a refused connect is not proof the microphone is fine

micOk was set from `e !is MicUnavailableException` on every failed streaming
attempt, so ANY non-mic failure wrote micOk=true. The order is what makes that
wrong: the socket connects BEFORE the mic opens, so while the household is
paused — listener closed — every attempt fails on the connect, and a phone whose
microphone was genuinely dead kept reporting a healthy one.

That is not a hypothesis about the OnePlus's nine silent hours on 2026-09-06; it
is the mechanism. The app retried every two seconds, could not open AudioRecord,
and #887's check — built precisely to catch a dead mic — called it healthy
throughout, which is worse than having no check.

⚠ #1468 recorded this as "micOk is evidently derived from permission state
rather than from whether AudioRecord actually opened". That was wrong and the
truth is narrower: it IS derived from the open. A non-mic failure was clearing
it afterwards.

The rule is now `if (failure is MicUnavailableException) false else previous` —
a failure that never reached the microphone reports nothing about it, in either
direction — and `true` is only written where the mic actually opened, which the
success path already did. It moved out of StreamService into MicState with
MicUnavailableException, because a rule nothing can reach is a rule nothing can
test, and there was no test for this transition at all.

Four now, and two of them fail against the old rule: a mic failure must survive
a hundred later refused connects, and a network failure must not invent a mic
failure either. Checked by restoring the old expression and watching exactly
those two go red.

⚠ THIS DOES NOT FIX THE PHONES. It fixes the app; the phones run what is
installed on them.

Author: pippijn

android/app/src/main/kotlin/org/recall/mic/MicState.kt

@@ -8,6 +8,32 @@ import kotlinx.coroutines.flow.asStateFlow
 // Shared tag for UI-state-change logging; filter with `adb logcat -s recall-ui:I`.
 const val UI_LOG = "recall-ui"
 
+/** Mic-init failure — distinct so the status can't blame the network for it. */
+internal class MicUnavailableException(
+    message: String,
+) : Exception(message)
+
+/**
+ * What a FAILED streaming attempt says about the microphone.
+ *
+ * Only a mic failure says anything about the mic. Anything else — a refused
+ * connect, a dropped socket — means the attempt never got as far as opening it,
+ * and reports nothing either way.
+ *
+ * ⚠ This used to be `e !is MicUnavailableException`, which read a network failure
+ * as PROOF THE MIC IS FINE and cleared a real fault. The order is what makes that
+ * wrong: the socket connects BEFORE the mic opens, so during a household pause —
+ * when the host's listener is closed — every attempt fails on the connect, and a
+ * phone whose microphone was genuinely broken kept reporting micOk=true. That is
+ * exactly what happened for nine hours on 2026-09-06: the app retried every two
+ * seconds, could not open AudioRecord, and the fleet check built to catch a dead
+ * mic (#887) called it healthy throughout.
+ *
+ * `true` is only ever written where the mic ACTUALLY OPENED.
+ */
+internal fun micOkAfter(previous: Boolean, failure: Throwable): Boolean =
+    if (failure is MicUnavailableException) false else previous
+
 /**
  * Live streaming state published by [StreamService] and observed by the UI. Same
  * process, so this is just shared in-memory state (StateFlow is thread-safe) — no

android/app/src/main/kotlin/org/recall/mic/StreamService.kt

@@ -237,7 +237,7 @@ class StreamService : Service() {
                 // without touching the notification (a zombie must not re-post one
                 // after Stop) and without a pointless network call.
                 if (!running) break
-                MicState.setMicOk(e !is MicUnavailableException)
+                MicState.setMicOk(micOkAfter(MicState.micOk.value, e))
                 if (e is MicUnavailableException) {
                     // Blaming the network would send whoever reads it debugging the
                     // wrong thing — the connect succeeded; the microphone didn't.
@@ -350,11 +350,6 @@ class StreamService : Service() {
         )
     }
 
-    /** Mic-init failure — distinct so the status can't blame the network for it. */
-    private class MicUnavailableException(
-        message: String,
-    ) : Exception(message)
-
     /**
      * Enter the foreground with the microphone type. Returns false if the OS
      * refuses (a mic-type start from the background — e.g. BOOT_COMPLETED — throws

android/app/src/test/kotlin/org/recall/mic/MicOkTest.kt

@@ -0,0 +1,46 @@
+package org.recall.mic
+
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.io.IOException
+
+/**
+ * What a failed streaming attempt is allowed to conclude about the microphone.
+ *
+ * ⚠ This exists because the answer was inverted for a network failure, and that
+ * inversion hid a dead microphone for nine hours behind a check built to catch
+ * exactly that.
+ */
+class MicOkTest {
+    @Test
+    fun `a mic failure marks the mic bad`() {
+        assertFalse(
+            micOkAfter(previous = true, failure = MicUnavailableException("no AudioRecord")),
+        )
+    }
+
+    @Test
+    fun `a network failure does not clear an earlier mic failure`() {
+        // ⚠ THE BUG. The socket connects BEFORE the mic opens, so during a
+        // household pause — listener closed — every attempt fails on the connect.
+        // Reading that as "the mic is fine" is what kept micOk=true through nine
+        // hours of a phone that could not open AudioRecord.
+        assertFalse(micOkAfter(previous = false, failure = IOException("connection refused")))
+    }
+
+    @Test
+    fun `a network failure does not invent a mic failure either`() {
+        // It says nothing in either direction: the attempt never reached the mic.
+        assertTrue(micOkAfter(previous = true, failure = IOException("connection refused")))
+    }
+
+    @Test
+    fun `a mic failure is sticky across later network failures`() {
+        // The retry loop is what made this matter: one bad open followed by a
+        // hundred refused connects must still report a bad mic.
+        var ok = micOkAfter(previous = true, failure = MicUnavailableException("no AudioRecord"))
+        repeat(100) { ok = micOkAfter(previous = ok, failure = IOException("connection refused")) }
+        assertFalse(ok)
+    }
+}