@@ -37,8 +37,29 @@ pub enum Verdict {
     /// Late again, but this device was already warned about. Logged by the
     /// caller, never re-surfaced: a warning per utterance is nagging.
     SlowAgain { latency: Duration },
+    /// Audio arrived, but the whole utterance was silence.
+    ///
+    /// The reported case: AirPods paired to this Mac while actually playing
+    /// from an iPhone. A headset holds one audio link at a time, so macOS
+    /// still lists the device, the stream still opens, and the samples are
+    /// all zero. Every existing signal says success. From the user's side
+    /// the key does nothing and no error appears, which is indistinguishable
+    /// from the app being broken.
+    ///
+    /// Carries the user-facing line, because "no audio" without a probable
+    /// cause just relocates the confusion.
+    SilentCapture { message: String },
 }
 
+/// Peak amplitude below which a chunk is treated as digital silence.
+///
+/// Not zero: a live microphone in a quiet room still returns dither and
+/// noise floor, typically above 1e-4. A stream that is genuinely not
+/// capturing returns exact zeroes or values orders of magnitude smaller, so
+/// this threshold separates "nobody spoke" from "nothing is connected"
+/// without needing either to be calibrated.
+const SILENCE_PEAK: f32 = 1e-5;
+
 /// Tracks open->first-sample latency per utterance and which devices have
 /// already been warned about.
 ///
@@ -57,6 +78,12 @@ pub struct StartupWatch {
     device: Option<String>,
     /// Devices measured slower than the pre-roll window at least once.
     slow: Vec<String>,
+    /// Whether any chunk this utterance rose above the silence floor.
+    heard_anything: bool,
+    /// Devices already warned about for silence, kept separate from
+    /// `warned` because the two faults are unrelated: a headset can be fast
+    /// AND silent, and being told about one should not suppress the other.
+    silent_warned: Vec<String>,
 }
 
 impl StartupWatch {
@@ -66,12 +93,17 @@ impl StartupWatch {
             warned: Vec::new(),
             device: None,
             slow: Vec::new(),
+            heard_anything: false,
+            silent_warned: Vec::new(),
         }
     }
 
     /// The stream was just opened (key-down).
     pub fn on_open(&mut self, now: Instant) {
         self.opened_at = Some(now);
+        // Per utterance, not per session: a headset that worked a minute ago
+        // can be stolen by a phone between one keypress and the next.
+        self.heard_anything = false;
     }
 
     /// Capture reported which device actually won.
@@ -87,6 +119,48 @@ impl StartupWatch {
         self.opened_at = None;
     }
 
+    /// Observe one chunk of captured audio.
+    ///
+    /// Cheap by construction: a peak scan over a chunk already in cache,
+    /// with an early exit once anything audible is found, so the common
+    /// case (the user is talking) stops at the first non-trivial sample.
+    pub fn on_audio(&mut self, samples: &[f32]) {
+        if self.heard_anything {
+            return;
+        }
+        if samples.iter().any(|s| s.abs() > SILENCE_PEAK) {
+            self.heard_anything = true;
+        }
+    }
+
+    /// The utterance ended. Was anything actually captured?
+    ///
+    /// Deliberately judged here rather than per chunk: real speech begins
+    /// with silence while the speaker draws breath, so a chunk-level test
+    /// would fire on every normal utterance. Only the complete utterance
+    /// separates "they had not started yet" from "this device is not
+    /// delivering audio at all".
+    pub fn on_utterance_end(&mut self) -> Verdict {
+        if self.heard_anything {
+            return Verdict::Fine;
+        }
+        let device = self.device.clone().unwrap_or_else(|| "microphone".into());
+        if self.silent_warned.iter().any(|d| d == &device) {
+            // Already told them once. Repeating it every utterance is how a
+            // useful warning becomes noise the user learns to ignore.
+            return Verdict::Fine;
+        }
+        self.silent_warned.push(device.clone());
+        Verdict::SilentCapture {
+            message: format!(
+                "no audio captured from \"{device}\" -> if this is a Bluetooth \
+                 headset, it may be connected to another device (a phone or \
+                 tablet); disconnect it there, or pick a different input in \
+                 System Settings > Sound"
+            ),
+        }
+    }
+
     /// First audio chunk of this utterance arrived. Returns the verdict;
     /// subsequent chunks are free (the `take` empties the slot).
     pub fn on_first_audio(&mut self, now: Instant) -> Verdict {
@@ -212,4 +286,89 @@ mod tests {
         let mut w = StartupWatch::new();
         assert_eq!(w.on_first_audio(t()), Verdict::Fine);
     }
+
+    /// The reported fault: AirPods paired to this Mac while playing from an
+    /// iPhone. The stream opens, reports success, and delivers zeroes.
+    #[test]
+    fn an_utterance_of_pure_silence_is_reported_with_a_cause() {
+        let mut w = StartupWatch::new();
+        w.on_device("Jessie's AirPods");
+        w.on_open(Instant::now());
+        for _ in 0..50 {
+            w.on_audio(&[0.0f32; 512]);
+        }
+        match w.on_utterance_end() {
+            Verdict::SilentCapture { message } => {
+                assert!(message.contains("AirPods"), "names the device: {message}");
+                assert!(
+                    message.contains("another device"),
+                    "names the probable cause: {message}"
+                );
+            }
+            other => panic!("expected SilentCapture, got {other:?}"),
+        }
+    }
+
+    /// The false positive that would make this feature worse than useless.
+    ///
+    /// Real speech starts quiet: the speaker draws breath, the room has a
+    /// noise floor. If a near-silent opening triggered the warning, it would
+    /// fire on ordinary dictation and users would learn to ignore it, which
+    /// costs more than never having built it.
+    #[test]
+    fn a_quiet_room_with_real_speech_is_not_silence() {
+        let mut w = StartupWatch::new();
+        w.on_device("MacBook Pro Microphone");
+        w.on_open(Instant::now());
+        // Several chunks of noise floor, then actual speech.
+        for _ in 0..20 {
+            w.on_audio(&[1e-6f32; 512]);
+        }
+        w.on_audio(&[0.02f32; 512]);
+        assert_eq!(w.on_utterance_end(), Verdict::Fine);
+    }
+
+    /// Warn once per device, not once per utterance. A warning that repeats
+    /// every time becomes noise the user filters out, taking the useful
+    /// warnings with it.
+    #[test]
+    fn the_silence_warning_does_not_nag() {
+        let mut w = StartupWatch::new();
+        w.on_device("Some Headset");
+
+        w.on_open(Instant::now());
+        w.on_audio(&[0.0f32; 512]);
+        assert!(matches!(
+            w.on_utterance_end(),
+            Verdict::SilentCapture { .. }
+        ));
+
+        w.on_open(Instant::now());
+        w.on_audio(&[0.0f32; 512]);
+        assert_eq!(
+            w.on_utterance_end(),
+            Verdict::Fine,
+            "same device, second failure: already warned"
+        );
+    }
+
+    /// State must reset per utterance: a headset can be stolen by a phone
+    /// between one keypress and the next, so hearing audio once must not
+    /// vouch for every later utterance.
+    #[test]
+    fn hearing_audio_once_does_not_vouch_for_the_next_utterance() {
+        let mut w = StartupWatch::new();
+        w.on_device("Some Headset");
+
+        w.on_open(Instant::now());
+        w.on_audio(&[0.05f32; 512]);
+        assert_eq!(w.on_utterance_end(), Verdict::Fine);
+
+        w.on_open(Instant::now());
+        w.on_audio(&[0.0f32; 512]);
+        assert!(
+            matches!(w.on_utterance_end(), Verdict::SilentCapture { .. }),
+            "the next utterance is judged on its own audio"
+        );
+    }
 }
@@ -845,19 +845,53 @@ type TypingChoice = NoTypingStrategy;
 /// WHICH typing path ran: "synthetic-keys-batched" is expected to be ~1ms,
 /// "synthetic-keys-paced" is the deliberate slow path for ttys, and seeing
 /// the wrong one against a given app is the diagnosis.
+/// Whether a failed typing attempt is known to have delivered NOTHING.
+///
+/// Retrying is only safe when the answer is yes. See the call site for the
+/// corruption that results otherwise.
+#[cfg(all(target_os = "macos", feature = "display"))]
+fn retry_is_safe(e: &text_target::TargetError) -> bool {
+    // Unsupported is produced before any event is posted; every other
+    // variant can follow a partially delivered sequence.
+    matches!(e, text_target::TargetError::Unsupported(_))
+}
+
 #[cfg(all(target_os = "macos", feature = "display"))]
 fn type_with_strategy(text: &str, typing: TypingChoice) -> Result<String, String> {
     use text_target::targets::keys::{CgEventTarget, TypingStrategy};
     use text_target::TextTarget;
     match typing {
         TypingStrategy::Batched => match CgEventTarget.insert(text) {
             Ok(()) => Ok("synthetic-keys-batched".into()),
-            // A refused batch (no trust, event creation failed) still has
-            // the paced path to try before giving up on typing entirely.
-            Err(e) => match ax_edit::synth::type_text(text) {
+            // Retry ONLY when the batched attempt is known to have delivered
+            // nothing. Anything else and the paced path types the whole
+            // string on top of a partial one.
+            //
+            // This shipped broken and was caught in live use: dictating into
+            // Discord a second time produced
+            //   "  tthhee  qquuiicckk  bbrroowwnn the quick brown"
+            // which is the text with every character doubled, then a clean
+            // copy. Discord's editor was left in a state where the batched
+            // post failed partway, the fallback retyped everything, and the
+            // field ended up unusable until the app was restarted.
+            //
+            // `Unsupported` is the safe case: `CgEventTarget::insert` returns
+            // it before posting anything (empty text, or no Accessibility
+            // trust), so nothing reached the field. `Transport` is not safe:
+            // it means event creation failed mid-sequence, after earlier
+            // chunks were already posted.
+            Err(e) if retry_is_safe(&e) => match ax_edit::synth::type_text(text) {
                 Ok(()) => Ok(format!("synthetic-keys-paced (batched refused: {e})")),
                 Err(e2) => Err(format!("batched: {e}; paced: {e2}")),
             },
+            // Partial delivery. Report it rather than retrying: half a
+            // sentence the user can see and fix beats a doubled one they
+            // have to decipher, and silently making it worse is the failure
+            // mode that cost a Discord restart per utterance.
+            Err(e) => Err(format!(
+                "batched typing failed after posting some text ({e}); \
+                 not retyping, because that would duplicate what landed"
+            )),
         },
         TypingStrategy::PerCharPaced => match ax_edit::synth::type_text(text) {
             Ok(()) => Ok("synthetic-keys-paced".into()),
@@ -1397,4 +1431,38 @@ mod tier_tests {
         // appending, and the caller passes the character whenever it has it.
         assert!(!needs_leading_space(None));
     }
+
+    /// A failed write may only be retried when it delivered nothing.
+    ///
+    /// The live failure this encodes, probed straight out of Discord:
+    ///
+    ///   "  tthhee  qquuiicckk  bbrroowwnn the quick brown"
+    ///
+    /// which is " the quick brown" with every character doubled, followed by
+    /// a clean copy. The batched CGEvent path had posted some chunks before
+    /// failing, the caller treated the whole attempt as failed, and the
+    /// paced path retyped the entire string on top.
+    ///
+    /// The rule is about what the error PROVES, not which error it is:
+    /// `Unsupported` is returned before anything is posted, so a retry is
+    /// safe. `Transport` means the sequence broke partway, so it is not.
+    #[test]
+    #[cfg(all(target_os = "macos", feature = "display"))]
+    fn only_a_provably_empty_failure_may_be_retried() {
+        use text_target::TargetError;
+
+        // Returned before a single event is posted (empty text, or missing
+        // Accessibility trust), so nothing reached the field.
+        assert!(
+            retry_is_safe(&TargetError::Unsupported("no trust")),
+            "a refusal that posted nothing is safe to retry"
+        );
+
+        // Returned when event creation failed mid-sequence, which says
+        // nothing about how many earlier chunks already landed.
+        assert!(
+            !retry_is_safe(&TargetError::Transport("event creation failed".into())),
+            "a partial write must never be retyped"
+        );
+    }
 }
@@ -261,7 +261,19 @@ pub async fn run(
                 // their words away to fix a stuck mic trades one silent
                 // data loss for another.
                 commit(&mut engine, &mut segmenter, &feed, &mut in_flight, &mut listening);
-                stop_capture(mic.as_mut(), &mut listening, &mut startup, &mut capture_opened_at);
+                if let Some(msg) = stop_capture(
+                    mic.as_mut(),
+                    &mut listening,
+                    &mut startup,
+                    &mut capture_opened_at,
+                ) {
+                    // The whole utterance was digital silence. Say so, with
+                    // the likely cause: without this the key appears to do
+                    // nothing at all, which reads as a broken app rather
+                    // than a headset that belongs to a phone right now.
+                    eprintln!("outloud: {msg}");
+                    engine.transition(OverlayState::Error, Some(msg));
+                }
             }
 
             // Warm hold expiring: close the device the user is no longer
@@ -569,7 +581,17 @@ pub async fn run(
                                 // moment the advice applies.
                                 engine.live_detail(message);
                             }
+                            // Only `on_utterance_end` produces this, and it
+                            // is matched where that is called. Listed rather
+                            // than swept into a catch-all so that routing it
+                            // to the wrong place stays a compile error.
+                            Verdict::SilentCapture { .. } => {}
                         }
+                        // Watch for a stream that opens, reports success and
+                        // delivers nothing: a Bluetooth headset claimed by
+                        // another device looks identical to a working one
+                        // until you inspect the samples.
+                        startup.on_audio(&samples);
                         engine.live_audio(&samples);
                         let mut endpoint = false;
                         for ev in segmenter.push(&samples) {
@@ -712,13 +734,22 @@ fn stop_capture(
     listening: &mut bool,
     startup: &mut StartupWatch,
     opened_at: &mut Option<Instant>,
-) {
+) -> Option<String> {
     *listening = false;
     *opened_at = None;
     if let Some(m) = mic {
         m.close();
     }
     startup.on_close();
+
+    // Every route out of listening passes through here, which is why the
+    // silence check lives in this function rather than at each of the three
+    // commit sites: a fault that only some exits detect is a fault users
+    // will hit through the exit nobody instrumented.
+    match startup.on_utterance_end() {
+        Verdict::SilentCapture { message } => Some(message),
+        _ => None,
+    }
 }
 
 fn commit(