Add hardening regressions and update operational docs

README.md

@@ -86,6 +86,8 @@ Create `~/.config/aman/config.json` (or let `aman` create it automatically on fi
 
 Recording input can be a device index (preferred) or a substring of the device
 name.
+If `recording.input` is explicitly set and cannot be resolved, startup fails
+instead of falling back to a default device.
 
 Config validation is strict: unknown fields are rejected with a startup error.
 
@@ -97,6 +99,8 @@ Hotkey notes:
 AI cleanup is always enabled and uses the locked local Llama-3.2-3B GGUF model
 downloaded to `~/.cache/aman/models/` during daemon initialization.
 Model downloads use a network timeout and SHA256 verification before activation.
+Cached models are checksum-verified on startup; mismatches trigger a forced
+redownload.
 
 Use `-v/--verbose` to enable DEBUG logs, including recognized/processed
 transcript text and llama.cpp logs (`llama::` prefix). Without `-v`, logs are
@@ -136,6 +140,7 @@ Service notes:
 - Press it again to stop and run STT.
 - Press `Esc` while recording to cancel without processing.
 - `Esc` is only captured during active recording.
+- Recording start is aborted if the cancel listener cannot be armed.
 - Transcript contents are logged only when `-v/--verbose` is used.
 
 Wayland note: