fix(18): stop ends everything — pills clear, pump/prep failures roll the session back

Creator ruling 2026-09-01 (stuck REC pill after the failed first recording):
- StopStream clears RecordPillOn + OnAirPillOn — intent resets with reality.
- OnFramePumpFailed: dispatcher-marshalled FULL rollback via StopStream (was:
  toast + Error-status only when live — record-only sessions zombied with
  IsRecording=true over a dead encoder; the 20:34 attempt proved it). Toast copy
  says 'Recording stopped' vs 'stream pipeline stopped'.
- Same zombie class in the three go-live prep failure branches: StreamStatus.Error
  limbo replaced by StopStream() (audio loop + recording + pills unwind; a created
  broadcast still gets the close-out).
- AudioMixer.StopLive made explicitly idempotent (Stop() twice, rollback paths that
  never reached StartLive).
- Seams: OnFramePumpFailed + IsRecording setter internal (InternalsVisibleTo; test
  pattern mirrors LayoutPathOverride).
ONE integration test: SessionTeardownTests (real window + temp DB: pump death with
lit pill -> no zombie, no End button, Offline). AudioPipelineTests confirmed to hang
STANDALONE (pre-existing, the declared-known audio class) — ai.md test-count
paragraph corrected to stop claiming a suite total that cannot currently be measured.

ai.md

@@ -125,15 +125,19 @@ FfmpegEncoderTests, FramePumpTests, the TASK 8/11/12 audio chain (AudioPipelineT
 the Socials fediverse-heal roundtrip, AboutHubTests, NotificationAreaIntegrationTests (TASK 24),
 GlobalHotkeyTests + HotkeyConfigTests (TASK 20), WebcamMenuGateTests (TASK 26), ChatLayerGateTests
 (TASK 27), BroadcastPullOutTests (TASK 29), DefaultRecordFolder fallback (TASK 30), WebView2ManagerTests
-(TASK 17), RecordingFileTests + OnAirSignTests (TASK 18) —
-**247 total (246 pass — the ONE remaining known failure is
+(TASK 17), RecordingFileTests + OnAirSignTests (TASK 18), SessionTeardownTests (2026-09-01
+rollback) — **~250 total (exact whole-suite count not claimable — the full run hangs and
+`AudioPipelineTests` hangs even STANDALONE (confirmed 2026-09-01 — treat the class as
+un-runnable until the audio channel-init fix lands). Every other class passes individually
+through the Windows dotnet.exe host, including the real-`MainWindow`/RealApp tests — 247 pass
+was the last full-suite number (2026-08-31); since then: the ONE remaining known failure is
 `AudioPipelineTests.Mix_HonorsProviderGains…` (the creator-declared known, suspected WASAPI
-channel declaration/init). The former "known" `RoundClipInteractionTests.Round_Clip_Corner_Is_Grabbable…`
-was root-caused and FIXED 2026-09-01: two stale-test layers from the component refactor (namescoped
-`FindName` + `VisualTreeHelper.HitTest` used where `UIElement.InputHitTest` models input — see
-MyMistakes recipe), no product bug. Full-suite vstest still hangs headless — but per-class runs
-THROUGH THE WINDOWS dotnet.exe HOST DO EXECUTE the real-`MainWindow`/RealApp tests fine (verified
-same day; the old "GUI suites can't run from here" was an overstatement.)**
+channel declaration/init), `RoundClipInteractionTests.Round_Clip_Corner_Is_Grabbable…` was
+root-caused and FIXED 2026-09-01 (two stale-test layers — namescoped `FindName` +
+`VisualTreeHelper.HitTest` used where `UIElement.InputHitTest` models input; see MyMistakes
+recipe; no product bug), and three tests were ADDED (locator dead-pin 404, EndBroadcast
+close-out, SessionTeardown rollback). "GUI suites can't run from here" was an overstatement —
+per-class Windows-host vstest runs them fine.)**
 
 Reward-event capture (monetization awareness, see the Monetization section) will add its integration
 tests here when it ships: one real chat-poll payload containing all seven reward event types →
@@ -548,6 +552,14 @@ green when a session is actually recording, the ON-AIR dot when actually live.
   (`OpenFolderDialog`), persisted through `LayoutStore.Load/SaveRecordFolder` (`RecordFolder` key).
 - **Explicit sign-out only:** `StopStream` no longer clears the session/token. Sign out via Logout /
   Change Account. Stopping a recording leaves the creator signed in.
+- **Stop ends everything; failures roll back (2026-09-01):** `StopStream` also clears both intent
+  pills (`RecordPillOn`/`OnAirPillOn`) — a lit pill with no session behind it is a lie. Every
+  frame-pump death and every go-live prep failure now runs the full `StopStream` teardown instead of
+  leaving a limbo (`StreamStatus.Error` with `IsRecording=true` over a dead encoder — the first-launch
+  zombie recording). Toast copy distinguishes "Recording stopped" from "stream pipeline stopped";
+  `AudioMixer.StopLive` is idempotent-safe for rollbacks that never reached StartLive. Seams:
+  `OnFramePumpFailed` + `IsRecording` setter made internal (test-only, InternalsVisibleTo).
+  Test: `SessionTeardownTests`.
 - `EncoderOptions.StreamEnabled/RecordEnabled/RecordPath` gate outputs; record+stream is one ffmpeg with two
   output blocks. Rest of the engine (FramePump/encoder) is unchanged — `BuildEncoderOptions` now always
   returns an options (with flags from the pills + `_activeRecordPath`), so record-only reaches the pump.