Recordings lost their first ~2 seconds; Whisper couldn't install when URLSession can't reach Hugging Face

[nicw]

Two small fixes, one branch (based on granite-shadow-transcription, so it carries that line's history — the fixes themselves are the last 3 commits, +~600/−20 across 4 files).

Problem 1 — every recording trimmed its opening words

The VAD model loaded from scratch inside start() on every session (~2s on an M2 Max), and the mic tap only exists after — so the first couple of words of every memo and call were simply never captured. Nic noticed it as "initial audio is trimmed."

Fix: load the VAD model once and reuse it — a single-flight load kicked at app launch ([ENGINE-VAD-PRELOAD] in the log), with start() falling back to loading it on demand if the preload hasn't finished or failed. The mic tap now goes up immediately on record.

Problem 2 — some networks make Whisper uninstallable in-app

On Nic's network (documented in the benchmark-results doc), Apple's URLSession cannot connect to the HF Xet CDN at any timeout while curl connects in ~30ms — so WhisperKit's downloader always fails and the model picker's auto-revert kicks in every time. Graceful, but Whisper could never actually be installed from the app.

Fix: when the SDK download throws, a curl-based fetcher (CurlModelFetcher, /usr/bin/curl via Process) takes over: lists the variant via the HF tree API, downloads into the exact HubApi layout WhisperKit loads from, tokenizer included. TOME_FORCE_CURL_MODEL_FETCH=1 forces the path for testing on a healthy network.

Live-verified end-to-end: forced-fallback run fetched the full 1.5 GB variant in 51 seconds and the model loaded and served (lastGood flipped to whisper). VAD preload confirmed firing in the launch log.

---

Reviewer's notes (Claude)

• Cancellation: a cancelled provisioning cycle terminates the curl child via withTaskCancellationHandler + per-file Task.checkCancellation — no zombie multi-GB downloads. Continuation resumes exactly once (no terminationHandler; cancel's terminate() unblocks the same waitUntilExit, an isCancelled flag converts that resume to CancellationError).
• Resume semantics: -C - was deliberately dropped — with --fail it 416s on already-complete files and kills re-runs. Replaced by size-check skip against the tree listing's byte sizes (file-granularity resume, no 416 class at all). Tokenizer files have no listed size and always redownload — intentional, they're tiny.
• VAD reuse safety: verified against the pinned FluidAudio source — VadManager wraps an immutable CoreML model; per-run streaming state is external (makeStreamState), and two live transcribers already share one instance today. stop() never nil'd the manager.
• No shell interpolation: curl args go as an argv array to Process — spaces in "Application Support" are a non-issue.
• Observability: fetch outcome (COMPLETED / FAILED + reason) now hits the unified log; previously a fetch failure was visible only in the Settings failure line, which cost us a confused test cycle.
• Tests: 161/161 (7 new: tree-JSON parsing, URL/path derivation, progress math, size-skip decision). Known minor left as-is: stdout is drained to EOF before stderr (with -sS stderr stays tiny; documented).
• One unverified-by-human bit: the trim fix is log-verified (preload fires before any recording) but Nic hadn't yet done the say-a-word-at-record-instant ear test when this PR was opened — daily use will confirm it immediately.

🤖 Generated with Claude Code