fix(#510 audit): Load-Anyway everywhere, reclaim-aware gate, single-owner dedup + rendered tests

.husky/pre-push

@@ -52,6 +52,12 @@ if [ -n "$PUSHED_JS" ]; then
 
   echo "▶ Architecture gate (dependency-cruiser)..."
   npm run depcruise
+
+  # knip runs in CI (the "architecture" job) as a hard 0-gate, but was NOT in this local hook, so
+  # unused-export failures only surfaced after a wasted CI round-trip (twice). Run it here too. It
+  # analyses the whole project (not just the push range), so keep it in the JS block.
+  echo "▶ Dead-code gate (knip)..."
+  npm run knip
 fi
 
 if [ -n "$PUSHED_SWIFT" ]; then

App.tsx

@@ -20,6 +20,7 @@
 import { loadProFeatures } from './src/bootstrap/loadProFeatures';
 import { checkProStatus } from './src/services/proLicenseService';
 import { hydrateDownloadStore } from './src/services/downloadHydration';
+import { initActiveDownloadPersistence } from './src/services/activeDownloadPersistence';
 import { restoreQueuedDownloads } from './src/services/restoreQueuedDownloads';
 import { startLoadPolicySync } from './src/services/loadPolicySync';
 import { registerCoreDownloadProviders } from './src/services/modelDownloadService/registerProviders';
@@ -153,6 +154,10 @@
    */
   const recoverDownloadState = useCallback(() => {
     (async () => {
+      // Persist the in-flight download set for the rest of the session (idempotent) BEFORE the first
+      // hydrate, so a download started this run is durably recorded and can be stranded as a
+      // failed/retriable card — not vanish — if the app is hard-killed mid-transfer (iOS URLSession).
+      initActiveDownloadPersistence();
       await hydrateDownloadStore().catch((error) => {
         logger.error('[App] Failed to hydrate download store during startup:', error);
       });
@@ -195,7 +200,7 @@
     })().catch((error) => {
       logger.error('[App] Download-state recovery failed:', error);
     });
   }, [setDownloadedModels, setDownloadedImageModels]);
 
   const initializeApp = useCallback(async () => {
     try {

__tests__/integration/audio/audioBubbleSpeechTextSingleSource.redflow.test.tsx

@@ -0,0 +1,59 @@
+/**
+ * RED-FLOW (integration) — the audio bubble's Play button must speak the SINGLE-SOURCE speech text.
+ *
+ * commit 592bc456 made prepareMessageForSpeech (= stripMarkdownForSpeech(stripControlTokens(content)))
+ * the ONE transform every speech caller routes through, so the spoken text can never diverge. The audio
+ * bubble's Play/re-synth handler instead hand-composed its own transform — stripMarkdownForSpeech(transcript)
+ * ONLY, skipping stripControlTokens. So a transcript that still carries control/reasoning tokens (a raw
+ * <think>…</think> block, a tool-call block) would be spoken aloud with those tokens, and the transform is
+ * defined twice (drift risk) instead of once.
+ *
+ * This mounts the REAL AudioMessageBubble, arrives at the Play control via a real tap, and asserts the text
+ * the bubble DISPATCHES to the TTS service equals prepareMessageForSpeech(transcript) for a markdown +
+ * control-token input — the single source of truth.
+ *
+ * RED on HEAD: the bubble dispatches stripMarkdownForSpeech(transcript), which leaves the <think> block in
+ * → ≠ prepareMessageForSpeech(transcript).
+ */
+import React from 'react';
+import { render, fireEvent } from '@testing-library/react-native';
+import { AudioMessageBubble } from '@offgrid/pro/audio/ui/AudioMessageBubble';
+import { useTTSStore } from '@offgrid/pro/audio/ttsStore';
+import { prepareMessageForSpeech } from '@offgrid/core/utils/messageContent';
+
+// The file player decodes real audio off a native module — the one genuine IO boundary. Stub the decode.
+jest.mock('@offgrid/pro/audio/audioFilePlayer', () => ({
+  decodeFileWaveform: jest.fn(async () => [] as number[]),
+}));
+
+const initialTTSState = useTTSStore.getState();
+afterEach(() => {
+  jest.clearAllMocks();
+  useTTSStore.setState(initialTTSState, true);
+});
+
+describe('audio bubble Play speaks the single-source speech text (red-flow)', () => {
+  it('dispatches prepareMessageForSpeech(transcript) — control tokens stripped, not just markdown', () => {
+    // A raw transcript with a reasoning block AND markdown — exactly the content a speech caller must
+    // never voice verbatim.
+    const transcript = '<think>internal reasoning the user must not hear</think>\n## Answer\nThe **capital** is `Paris`.';
+
+    // Capture what the bubble DISPATCHES to the TTS service (the intent the View hands the store).
+    let dispatchedText: string | undefined;
+    useTTSStore.setState({
+      play: async (_messageId: string, opts: { text: string }) => { dispatchedText = opts.text; },
+    } as never);
+
+    // No audioPath → the fileless synth (re-synth) path: tapping Play calls play(id, { text: <speech text> }).
+    const { getByLabelText } = render(
+      <AudioMessageBubble messageId="m1" audioPath="" waveformData={[]} durationSeconds={0} transcript={transcript} />,
+    );
+
+    fireEvent.press(getByLabelText('Play'));
+
+    // The bubble must speak the SINGLE-SOURCE output. RED on HEAD: it dispatched stripMarkdownForSpeech only,
+    // so the <think> block is still present → ≠ prepareMessageForSpeech(transcript).
+    expect(dispatchedText).toBe(prepareMessageForSpeech(transcript));
+    expect(dispatchedText).not.toMatch(/internal reasoning/); // the reasoning block must be gone
+  });
+});

__tests__/integration/audio/ttsSpeakMemoryRefusalLoadAnyway.redflow.test.ts

@@ -0,0 +1,102 @@
+/**
+ * RED-FLOW (integration) — a TTS memory refusal on the SPEAK path must surface a dismissible failure
+ * card with a "Load Anyway" affordance, never a silent dead-end.
+ *
+ * DEVICE: in voice/chat mode, tapping the speaker triggers speakMessage → initializeEngine({override:true}).
+ * The override load evicts every evictable resident to free maximum RAM; if a native unload REJECTS, the
+ * residency manager returns { fits: false } even under override. Pre-fix, ttsStore.initializeEngine threw a
+ * PLAIN Error there, caught it into `state.error` (static red text on the Settings panel only), and the
+ * speak path then bailed silently (dispatchPlayback {t:'ended'}) — the speaker icon just stopped. No alert,
+ * no card, no Load Anyway. This violates "any memory refusal on any model type offers Load Anyway".
+ *
+ * This drives the REAL store speak() → REAL ttsPlayback.speakMessage → REAL initializeEngine → REAL
+ * modelResidencyManager over the device-memory harness. Fakes ONLY at the device boundary: a fake TTS
+ * engine (idle + downloaded), and a resident text model whose native unload() REJECTS (the reason override
+ * can't free room). Assert the USER-FACING outcome: a `tts` failure lands in the real failure store, marked
+ * overridable with an onLoadAnyway (what the ModelFailureCard renders as "Load Anyway").
+ *
+ * RED on HEAD: the refusal throws a plain Error → isOverridableMemoryError === false → the failure store is
+ * empty (speak bailed silently); no card, no Load Anyway.
+ */
+import { modelResidencyManager } from '../../../src/services/modelResidency';
+import { setDeviceMemory, resetDeviceMemory } from '../../harness/deviceMemory';
+import { ttsRegistry } from '../../../pro/audio/engine';
+import { useTTSStore } from '../../../pro/audio/ttsStore';
+import { useModelFailureStore } from '../../../src/stores/modelFailureStore';
+
+// Device boundary: a minimal TTS engine that is idle + fully downloaded, and whose initialize() would
+// succeed IF residency let it. The refusal happens in residency (before initialize), so initialize is
+// never reached in the refusal case.
+function makeFakeEngine() {
+  let phase: 'idle' | 'ready' = 'idle';
+  return {
+    id: 'faketts',
+    displayName: 'Fake TTS',
+    capabilities: { peakRamMB: 400, generateAndSave: false },
+    getPhase: () => phase,
+    isSupported: () => true,
+    isFullyDownloaded: () => true,
+    getRequiredAssets: () => [{ id: 'model', sizeBytes: 400 * 1024 * 1024 }],
+    checkAssetStatus: async () => [],
+    getOverallDownloadProgress: () => 1,
+    getVoices: () => [],
+    getActiveVoice: () => null,
+    setVoice: async () => {},
+    getLastDownloadError: () => null,
+    getBridgeComponent: () => null,
+    hydrateDownloaded: () => {},
+    on: () => () => {},
+    off: () => {},
+    once: () => () => {},
+    initialize: async () => { phase = 'ready'; },
+    release: async () => { phase = 'idle'; },
+    destroy: async () => { phase = 'idle'; },
+    speak: async () => {},
+    stop: () => {},
+    pause: () => {},
+    resume: () => {},
+    setSpeed: () => {},
+  } as unknown as never;
+}
+
+describe('TTS speak-path memory refusal is overridable (Load Anyway) — red-flow', () => {
+  afterEach(() => {
+    resetDeviceMemory();
+    useModelFailureStore.getState().clear();
+  });
+
+  it('surfaces a dismissible tts failure card with Load Anyway (not a silent bail)', async () => {
+    // 12GB device. The voice model is a sidecar; the evict-everything force (override → singleModel)
+    // evicts every evictable PEER sidecar to free maximum RAM before loading.
+    setDeviceMemory({ platform: 'ios', totalGB: 12, availGB: 0.2, policy: 'balanced' });
+    useModelFailureStore.getState().clear();
+
+    // A resident peer sidecar (whisper) whose NATIVE unload REJECTS — the override force tries to evict it
+    // to free room, the native unload fails, so makeRoomFor returns { fits:false } even under override.
+    // This is the reachable device refusal on the evict-everything speak-turn force.
+    modelResidencyManager.register(
+      { key: 'whisper', type: 'whisper' as never, sizeMB: 1500, canEvict: () => true },
+      async () => { throw new Error('native unload rejected'); },
+      1,
+    );
+
+    ttsRegistry.register('faketts', makeFakeEngine);
+    await useTTSStore.getState().setEngine('faketts');
+
+    // The user taps the speaker on an assistant message (the real store speak action).
+    await useTTSStore.getState().speak('hello there', 'msg-1');
+
+    // USER-FACING artifact: mount the REAL ModelFailureCard (no props, no mocks — it reads the real
+    // failure store the speak refusal just populated) and assert the user SEES the "Load Anyway" button
+    // on the tts failure card, not a silent bail. RED on HEAD: plain Error → no tts failure in the store
+    // → the card renders nothing → the button is absent.
+    /* eslint-disable @typescript-eslint/no-var-requires */
+    const React = require('react');
+    const { render } = require('@testing-library/react-native');
+    const { ModelFailureCard } = require('../../../src/components/ModelFailureCard');
+    /* eslint-enable @typescript-eslint/no-var-requires */
+    const view = render(React.createElement(ModelFailureCard));
+    expect(view.queryByTestId('model-failure-load-anyway-tts')).not.toBeNull();
+    expect(view.queryByTestId('model-failure-tts')).not.toBeNull(); // the tts failure card itself is on screen
+  });
+});

__tests__/integration/audio/whisperRealtimeBlockedRecovers.redflow.test.tsx

@@ -0,0 +1,81 @@
+/**
+ * DEVICE-CONFIRMED (rendered UI) — the realtime hold-to-talk dictation path must RECOVER from a memory
+ * refusal, not dead-end. Product rule: ANY memory refusal on ANY model type offers recovery — never a
+ * silent dead-end.
+ *
+ * The defect: on a tight device a heavier generation (text) model owns RAM, so the whisper sidecar's
+ * load is BLOCKED by the single-model rule (makeRoomFor → fits=false → loadModel returns 'blocked', it
+ * does NOT throw). The realtime path called whisperStore.loadModel() DIRECTLY: a 'blocked' return is not
+ * a throw, so it fell through to whisperService.startRealtimeTranscription, which throws 'No Whisper model
+ * loaded' → the mic press failed with an error, no transcript, no recovery. The Audio-mode file path
+ * already recovers via ensureWhisperForTranscription (free the generation model, retry loadWhisper); the
+ * realtime path did not.
+ *
+ * Real stack: mount the REAL ChatScreen on a NON-audio (llama) model — so chat-mode hold-to-talk takes the
+ * whisper REALTIME path (Voice.ts startWhisperRecording), not the direct-audio or file path. The text model
+ * is resident, whisper is DOWNLOADED-not-loaded, and the budget is pinned tight so the whisper sidecar
+ * cannot co-reside → the first load blocks. Only device leaves are faked (whisper, llama, RAM, fs).
+ *
+ * Arrive via the REAL hold-to-talk gesture (tapMic grant → releaseMic release), then the (faked) realtime
+ * stream delivers the utterance. The USER-FACING outcome under test: the transcript lands in the composer
+ * (dictation recovered) — proving blocked → free generation model → retry → whisper loaded → transcript.
+ *
+ * RED before the fix: the realtime path called loadModel() directly; 'blocked' fell through to
+ * startRealtimeTranscription → 'No Whisper model loaded' → error state → the composer stays EMPTY.
+ * GREEN: routed through ensureWhisperForTranscription (the same recovery the file path uses) → transcript
+ * in the input.
+ *
+ * The discriminator: on a tight device, WITHOUT the free→retry the load stays blocked → no resident
+ * whisper → startRealtimeTranscription throws → the composer never receives text.
+ */
+import { setupChatScreen } from '../../harness/chatHarness';
+
+jest.mock('@react-navigation/native', () => ({
+  useNavigation: () => ({ navigate: () => {}, goBack: () => {}, setOptions: () => {}, addListener: () => () => {} }),
+  useRoute: () => require('../../harness/chatHarness').routeHolder,
+  useFocusEffect: () => {}, useIsFocused: () => true,
+}));
+
+describe('realtime hold-to-talk dictation recovers when whisper load is blocked (free→retry) — device', () => {
+  it('frees the generation model, loads whisper, and the transcript lands in the composer', async () => {
+    const h = await setupChatScreen({ engine: 'llama', platform: 'android', whisper: true });
+    const { useWhisperStore } = require('../../../src/stores/whisperStore');
+    const { modelResidencyManager } = require('../../../src/services/modelResidency');
+
+    // DOWNLOAD-ONLY whisper: the completed-download boundary artifact (file on disk + downloadedModelId) with
+    // NO resident load — so the realtime turn's first load attempt runs for real (and blocks on the tight budget).
+    const docs = h.boundary.fs!.DocumentDirectoryPath;
+    h.boundary.fs!.seedFile(`${docs}/whisper-models/ggml-tiny.en.bin`, 75 * 1024 * 1024);
+    await useWhisperStore.getState().refreshPresentModels();
+    useWhisperStore.setState({ downloadedModelId: 'tiny.en', isModelLoaded: false });
+
+    // Pin the budget tight: the resident text model fills it, so the whisper sidecar cannot co-reside →
+    // makeRoomFor returns fits=false → whisperStore.loadModel returns 'blocked'.
+    modelResidencyManager.setBudgetOverrideMB(700);
+
+    h.render();
+    const view = h.view!;
+
+    // Precondition (anti-false-green): the composer is empty.
+    const inputBefore = await h.rtl.waitFor(() => view.getByTestId('chat-input'));
+    expect(inputBefore.props.value ?? '').toBe('');
+
+    // REAL chat-mode hold-to-talk on a non-audio (llama) model → the whisper REALTIME path.
+    await h.tapMic();      // grant → onStartRecording → the whisper realtime dictation path
+    await h.settle(200);   // let the (blocked→free→retry) load resolve and the realtime session start
+    await h.releaseMic();  // release → onStopRecording (whisper path finalizes)
+
+    // The realtime stream delivers the finished utterance (final event, isCapturing:false).
+    await h.rtl.act(async () => {
+      h.boundary.whisper!.emitRealtime({ text: 'take a note', isCapturing: false });
+    });
+    await h.settle(800); // MIN_TRANSCRIBING_TIME + the finalResult → onTranscript effect
+
+    // THE FIX — dictation RECOVERED: the transcript is in the INPUT BOX.
+    // RED before: the realtime path dead-ended on 'blocked' (startRealtimeTranscription threw
+    // 'No Whisper model loaded') → the composer stayed empty.
+    await h.rtl.waitFor(() => {
+      expect(view.getByTestId('chat-input').props.value ?? '').toContain('take a note');
+    }, { timeout: 4000 });
+  });
+});

__tests__/integration/audio/whisperStartSupersededNoGhost.redflow.test.tsx

@@ -0,0 +1,59 @@
+/**
+ * RED-FLOW (UI, rendered) — #558 CodeRabbit 🔴: no GHOST recording if the mic is released while the
+ * whisper model is still loading.
+ *
+ * The realtime dictation start now awaits ensureModelReady() (which can free the generation model and
+ * reload whisper — seconds on device). If the user RELEASES the mic during that await, the start's
+ * continuation must NOT proceed to activate a recording — the stop already ran, so a session started
+ * after it would never be stopped (a ghost recording that holds the mic forever).
+ *
+ * Fix under test: a session-intent nonce (useWhisperTranscription) captured before the await; stop/cancel
+ * bump it; the start aborts if it changed. Mounts the real ChatScreen; holds the whisper load via the
+ * device-boundary fake (holdNextLoad), releases the mic mid-load, then resolves the load — and asserts NO
+ * realtime session is active. RED (revert the nonce guard): the continuation runs after release →
+ * startRealtimeTranscription fires → realtimeActive() true (the ghost). Only the device leaves are faked.
+ */
+import { setupChatScreen } from '../../harness/chatHarness';
+
+jest.mock('@react-navigation/native', () => ({
+  useNavigation: () => ({ navigate: () => {}, goBack: () => {}, setOptions: () => {}, addListener: () => () => {} }),
+  useRoute: () => require('../../harness/chatHarness').routeHolder,
+  useFocusEffect: () => {}, useIsFocused: () => true,
+}));
+
+describe('realtime dictation: releasing the mic during model load starts NO ghost recording (#558)', () => {
+  it('aborts the superseded start — no realtime session after release-during-load', async () => {
+    const h = await setupChatScreen({ engine: 'llama', platform: 'android', whisper: true });
+    const { useWhisperStore } = require('../../../src/stores/whisperStore');
+
+    // Whisper downloaded-not-loaded, so the mic press must load it (the async gap the race lives in).
+    const docs = h.boundary.fs!.DocumentDirectoryPath;
+    h.boundary.fs!.seedFile(`${docs}/whisper-models/ggml-tiny.en.bin`, 75 * 1024 * 1024);
+    await useWhisperStore.getState().refreshPresentModels();
+    useWhisperStore.setState({ downloadedModelId: 'tiny.en', isModelLoaded: false });
+
+    h.render();
+
+    // HOLD the whisper load open (device-shaped: a real ggml init takes seconds) so the start is parked
+    // inside the ensureModelReady() await when we release the mic.
+    h.boundary.whisper!.holdNextLoad();
+
+    await h.tapMic();     // start begins → awaits ensureModelReady() → whisper load HELD
+    await h.settle(150);  // the start is now parked in the await
+    await h.releaseMic(); // RELEASE during the load → stopRecording bumps the session nonce
+    await h.settle(50);
+
+    // Precondition (anti-false-green): the load really was in flight when we released — no session yet.
+    expect(h.boundary.whisper!.realtimeActive()).toBe(false);
+
+    // Now let the load resolve. The superseded start must NOT resurrect a recording.
+    await h.rtl.act(async () => { h.boundary.whisper!.releaseLoad(); });
+    await h.settle(300);
+
+    // TERMINAL artifact: no realtime session is active and none was subscribed — the ghost never started.
+    // RED (revert the nonce guard): the continuation proceeds post-release → startRealtimeTranscription →
+    // realtimeActive() true.
+    expect(h.boundary.whisper!.realtimeActive()).toBe(false);
+    expect(h.boundary.whisper!.hasRealtimeSubscriber()).toBe(false);
+  }, 30000);
+});