Condition
Privacy activity existed as clues scattered across the desktop.
Microphones, cameras, location, screen sharing, screenshots, and recording expose their state through different Linux interfaces. A user could be sharing something sensitive without one clear place to see what was active, which application owned it, or why a control failed.
That view also had to stay consistent across multiple monitors. Adding another bar could not mean adding another set of background watchers.
Cause
The signals disagree about when state becomes true.
An observer restart can make an active session vanish without a real stop event. A successful command can return before the requested device state takes effect. Duplicate observers can then race over state and IPC ownership.
If every bar widget monitored the system for itself, each new display would multiply those blind spots and introduce another version of the truth.
Correction
Keep one source of truth and make controls prove themselves.
One long-lived service owns normalized sessions, observers, controls, health, notifications, history, and IPC. Every bar widget reads the same shared state without starting another monitoring stack.
A control remains pending until observed state matches the request or a bounded timeout expires. During observer recovery, source-owned sessions become uncertain without inventing stop events, and the first incomplete snapshot cannot trigger a false new-activity alert.
Confirm
Seven device classes now speak through one bounded service.
The plugin adds per-application context, per-endpoint audio controls, named privacy modes, diagnostics, and optional bounded history. Activity becomes something the user can inspect and act on instead of a loose collection of system signals.
Persistent observers report heartbeats and restart with bounded backoff. The service sends no network telemetry, and its command helpers accept only narrow allowlisted actions.