Ask to save the interview before anything discards it

[alpha5611331]

Closes #114.

What changes

Clear, Start and closing the app all empty the transcript and the suggestions. Those live only in main-process memory - nothing reaches disk until an export - so all three now ask first, through one dialog offering Word, Markdown, discard or cancel.

hasHistory, and why the length check had to go

setPlaceholderState() seeds the panels with one transcript and two suggestions so an empty app has something to show, on launch and again after every Clear. transcripts.length === 0 is therefore never true, and a prompt keyed on it would fire on every Clear of a freshly launched app asking the user to save sample copy.

AppState.hasHistory is derived in withHistory() and never set by a caller. Only the transcript and suggestion services write the three history keys and they only ever write real content, so a write to any of them retires the placeholder and the flag is recomputed from what the write leaves behind. The untouched arrays are emptied in the same write: clearAll() runs before every session so mixed state is not reachable today, but a real transcript beside two lines of sample suggestion copy is the one shape that would carry placeholder text into an exported report.

This fixes a live defect on the export path. exportTranscript guarded on the same lengths, so Export on a machine that had never run an interview passed the guard, billed a summarize call on "Transcripts will be here", and wrote the model's answer into a document presented as a record of the candidate's interview. Both that guard and nothingToExport now read the flag.

The close path

Clear and Start are renderer-initiated and confirm before they act. A close is decided in main - the window button, Cmd+Q, app.quit() - and the renderer would hear about it too late to matter. window-close-guard.ts vetoes the close, sends app:save-history-prompt, and the renderer closes the window itself by replying with window:close-confirmed or window:close-cancelled.

Three pieces of state, each for a failure the others do not cover:

• closeConfirmed lets the answered close through rather than re-prompting on it.
• prompting stops a second close - the window button pressed while the dialog is up - stacking another prompt.
• quitting, set from before-quit, is what makes Cmd+Q work. Vetoing the close cancels the quit, so confirming calls app.quit() again rather than win.close(); otherwise the app sits there with one window fewer. Cancelling resets it, or the next Cmd+Q would take that branch for a session the user just chose to keep.

The guard gives up on a renderer that is destroyed or crashed. Exactly one reply has to come back, and an app that cannot be closed at all is worse than one that closes unasked.

Smaller decisions

• The dialog is mounted once in MainFrame: the three actions do not share a screen. Stealth mode does not render the control panel, and the close prompt has no component of its own.
• Cancelling at the system save dialog leaves the prompt open rather than reading as a decision to discard, and so does a failed export - going ahead there would destroy the interview on the one path where keeping it did not work.
• The export success toast moved to export-success-toast.tsx, shared by the export menu and the prompt, so "where did that file go" has the same answer either way.
• The start confirmation is asked before the macOS permission gate: a user about to be sent into System Settings should not have answered a question the trip makes moot.

Checks

pnpm lint, both tsc configs, pnpm build and pnpm test:main all pass locally. test/save-history.test.mjs pins the flag through placeholder, real ingest, clear and re-seed, that an export of the placeholder is refused, and (source-level) the four close-guard invariants above. The electron test stub gained BrowserWindow, desktopCapturer and dialog, which named imports need at link time for tools.service to load at all.

🤖 Generated with Claude Code

[gitar-bot]

Gitar is working

_Gitar