fix: address PR #471 review comments (10/11)

Swift SDK:
- RunAnywhere.swift: atomically check-or-create _servicesInitTask under a
  DispatchQueue so concurrent completeServicesInitialization() callers
  can't spawn duplicate init tasks. Also clear the task on success (not
  just failure) so the completed Task is released. (coderabbit
  #3082258780, greptile #3082192287)
- CppBridge+VAD.swift: clear loadedModelId before calling
  rac_vad_component_load_model — the C side unloads first, so on load
  failure our Swift mirror must already be nil for a retry to work.
  (coderabbit #3082258776)
- WhisperKitSTTService.swift: replace legacy vDSP_measqv+sqrt with the
  Swift-overlay vDSP.rootMeanSquare(_:). (coderabbit #3082258785)

Commons (C++):
- onnx_backend.cpp (VAD model resolution): collect all *.onnx files,
  sort lexicographically, pick the first — previously picked whatever
  readdir() happened to return first, which is filesystem-dependent.
  (coderabbit #3082258759)
- vad_component.cpp: if model_service->ops->start() returns
  non-success, fully roll back (destroy impl, free service, clear
  is_model_loaded/loaded_model_id) and propagate the error instead of
  lying about a loaded-but-not-running service. (coderabbit #3082258769)

Playground (YapRun + keyboard extension):
- PlaygroundViewModel.swift: gate FlowSessionManager.shared.isActive
  check behind #if os(iOS) — FlowSessionManager is iOS-only and the
  unguarded reference broke the macOS target. (coderabbit #3082258684)
- FlowSessionManager.swift: guard deliverResult() with
  `case .transcribing = sessionPhase` so a Task.detached that completes
  after endSession()/killSession() doesn't overwrite SharedDataBridge
  with a discarded result. (coderabbit #3082258728)
- KeyboardViewController.swift: remove the unconditional
  UIPasteboard.general.string = text copy — duplicating every dictated
  utterance to the global pasteboard is a privacy leak. (coderabbit
  #3082258734)
- SharedDataBridge.swift: (1) audioLevel setter now posts
  audioLevelChanged so peer-process caches refresh; (2) drop the
  _cachedHeartbeat cache entirely and read/write UserDefaults directly
  — heartbeat ticks every second without a state transition so the
  cache was stale by definition. (coderabbit #3082258739)

Not addressed:
- rac_vad_component_is_loaded returning rac_bool_t (coderabbit
  #3082258749) — intentionally left as rac_bool_t to match the
  established project convention for is_X query APIs (rac_stt_
  component_is_loaded, rac_server_is_running, rac_framework_is_
  platform_service, ~20 more). Changing only the VAD one would break
  consistency without a concrete call-site benefit.

Verification:
- sdk/runanywhere-commons: 51/51 existing tests pass (test_core,
  test_extraction, test_download_orchestrator).
- sdk/runanywhere-commons ONNX backend: builds clean.
- sdk/runanywhere-swift: `swift build` complete (425 modules).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sanchitmonga22

Playground/YapRun/YapRun/Features/Playground/PlaygroundViewModel.swift

@@ -68,11 +68,14 @@ final class PlaygroundViewModel {
             return
         }
 
-        // Prevent conflict with active voice keyboard session
+        // Prevent conflict with active voice keyboard session (iOS-only).
+        // FlowSessionManager is compiled `#if os(iOS)` so this check is skipped on macOS.
+        #if os(iOS)
         guard !FlowSessionManager.shared.isActive else {
             errorMessage = "Voice keyboard session is active. End it first."
             return
         }
+        #endif
 
         let permitted = await audioCapture.requestPermission()
         guard permitted else {

Playground/YapRun/YapRun/Features/VoiceKeyboard/FlowSessionManager.swift

@@ -257,6 +257,16 @@ final class FlowSessionManager: ObservableObject {
                 try await RunAnywhere.transcribe(audio)
             }.value
             logger.info("Transcription complete: \"\(text)\"")
+
+            // Task.detached drops structured cancellation, so endSession()/killSession()
+            // cannot cancel the transcription in flight. If the session was torn down
+            // while transcription was running, discard the result rather than writing
+            // it to SharedDataBridge after the session is idle.
+            guard case .transcribing = sessionPhase else {
+                logger.info("Session no longer transcribing — discarding result")
+                return
+            }
+
             wordCount += text.split(separator: " ").count
 
             if #available(iOS 16.1, *) {

Playground/YapRun/YapRunKeyboard/KeyboardViewController.swift

@@ -151,10 +151,10 @@ final class KeyboardViewController: UIInputViewController {
         SharedDataBridge.shared.lastInsertedText = text
         SharedDataBridge.shared.transcribedText = nil
 
-        // Copy to clipboard if we have full access
-        if hasFullAccess {
-            UIPasteboard.general.string = text
-        }
+        // Intentionally NOT copying to UIPasteboard: duplicating every dictated
+        // utterance to the global pasteboard is a privacy leak (other apps with
+        // pasteboard access would see it). A future opt-in setting or an
+        // explicit "Copy" action can gate a pasteboard write if users want one.
     }
 
     // MARK: - URL Opening

Playground/YapRun/YapRunKeyboard/SharedDataBridge.swift

@@ -73,13 +73,11 @@ final class SharedDataBridge {
     // Caches are invalidated via Darwin notifications from the main app.
     private var _cachedSessionState: String
     private var _cachedAudioLevel: Float
-    private var _cachedHeartbeat: Double
 
     private init() {
         defaults = UserDefaults(suiteName: SharedConstants.appGroupID)
         _cachedSessionState = defaults?.string(forKey: SharedConstants.Keys.sessionState) ?? "idle"
         _cachedAudioLevel = defaults?.float(forKey: SharedConstants.Keys.audioLevel) ?? 0
-        _cachedHeartbeat = defaults?.double(forKey: SharedConstants.Keys.lastHeartbeat) ?? 0
         registerCacheObservers()
     }
 
@@ -102,13 +100,11 @@ final class SharedDataBridge {
     func refreshAllFromDefaults() {
         _cachedSessionState = defaults?.string(forKey: SharedConstants.Keys.sessionState) ?? "idle"
         _cachedAudioLevel = defaults?.float(forKey: SharedConstants.Keys.audioLevel) ?? 0
-        _cachedHeartbeat = defaults?.double(forKey: SharedConstants.Keys.lastHeartbeat) ?? 0
     }
 
     /// Refresh only session state from UserDefaults.
     private func refreshStateFromDefaults() {
         _cachedSessionState = defaults?.string(forKey: SharedConstants.Keys.sessionState) ?? "idle"
-        _cachedHeartbeat = defaults?.double(forKey: SharedConstants.Keys.lastHeartbeat) ?? 0
     }
 
     /// Refresh only audio level from UserDefaults.
@@ -165,17 +161,23 @@ final class SharedDataBridge {
         set {
             _cachedAudioLevel = newValue
             defaults?.set(newValue, forKey: SharedConstants.Keys.audioLevel)
+            // Post so the peer process (keyboard extension ↔ main app) refreshes
+            // its own _cachedAudioLevel — otherwise readers see stale values.
+            DarwinNotificationCenter.shared.post(
+                name: SharedConstants.DarwinNotifications.audioLevelChanged
+            )
         }
     }
 
     // MARK: - Heartbeat
 
+    /// Heartbeat is written ~every second by FlowSessionManager without a state
+    /// transition, so caching + Darwin-notification invalidation would require
+    /// a notification per second. Instead, read through to UserDefaults every
+    /// time so remote readers always see a fresh value.
     var lastHeartbeatTimestamp: Double {
-        get { _cachedHeartbeat }
-        set {
-            _cachedHeartbeat = newValue
-            defaults?.set(newValue, forKey: SharedConstants.Keys.lastHeartbeat)
-        }
+        get { defaults?.double(forKey: SharedConstants.Keys.lastHeartbeat) ?? 0 }
+        set { defaults?.set(newValue, forKey: SharedConstants.Keys.lastHeartbeat) }
     }
 
     // MARK: - Last Inserted Text
@@ -220,7 +222,6 @@ final class SharedDataBridge {
         defaults?.set(Float(0), forKey: SharedConstants.Keys.audioLevel)
         defaults?.set(Double(0), forKey: SharedConstants.Keys.lastHeartbeat)
         _cachedAudioLevel = 0
-        _cachedHeartbeat = 0
         sessionState = "idle"
     }
 }

sdk/runanywhere-commons/src/backends/onnx/onnx_backend.cpp

@@ -17,9 +17,11 @@
 #include <dirent.h>
 #include <sys/stat.h>
 
+#include <algorithm>
 #include <cctype>
 #include <cstdio>
 #include <cstring>
+#include <vector>
 
 #include "rac/core/rac_logger.h"
 
@@ -1153,23 +1155,28 @@ bool ONNXVAD::load_model(const std::string& model_path, VADModelType model_type,
     model_path_ = model_path;
     struct stat path_stat;
     if (stat(model_path.c_str(), &path_stat) == 0 && S_ISDIR(path_stat.st_mode)) {
-        std::string resolved;
+        // Collect every `.onnx` filename and sort lexicographically so the
+        // choice is deterministic across runs (readdir() order is
+        // filesystem-dependent and not stable).
+        std::vector<std::string> candidates;
         DIR* dir = opendir(model_path.c_str());
         if (dir) {
             struct dirent* entry;
             while ((entry = readdir(dir)) != nullptr) {
                 std::string filename = entry->d_name;
                 if (filename.size() > 5 &&
                     filename.substr(filename.size() - 5) == ".onnx") {
-                    resolved = model_path + "/" + filename;
-                    RAC_LOG_DEBUG("ONNX.VAD", "Found VAD model file: %s", resolved.c_str());
-                    break;
+                    candidates.push_back(std::move(filename));
                 }
             }
             closedir(dir);
         }
-        if (!resolved.empty()) {
-            model_path_ = resolved;
+        if (!candidates.empty()) {
+            std::sort(candidates.begin(), candidates.end());
+            model_path_ = model_path + "/" + candidates.front();
+            RAC_LOG_DEBUG("ONNX.VAD", "Found VAD model file: %s (%zu candidate%s)",
+                          model_path_.c_str(), candidates.size(),
+                          candidates.size() == 1 ? "" : "s");
         } else {
             RAC_LOG_ERROR("ONNX.VAD", "No .onnx file found in directory: %s", model_path.c_str());
             return false;

sdk/runanywhere-commons/src/features/vad/vad_component.cpp

@@ -447,11 +447,22 @@ extern "C" rac_result_t rac_vad_component_load_model(rac_handle_t handle,
     component->is_model_loaded = true;
     component->loaded_model_id = model_id ? strdup(model_id) : nullptr;
 
-    // Start the model-based VAD
+    // Start the model-based VAD. If start fails, roll back so `is_model_loaded`
+    // does not lie about a non-running service.
     if (component->model_service->ops && component->model_service->ops->start) {
         result = component->model_service->ops->start(component->model_service->impl);
         if (result != RAC_SUCCESS) {
-            RAC_LOG_WARNING("VAD.Component", "Model VAD start returned non-success, continuing");
+            log_error("VAD.Component", "Model VAD start failed: %d — rolling back load", result);
+            if (component->model_service->ops->destroy) {
+                component->model_service->ops->destroy(component->model_service->impl);
+            }
+            free(const_cast<char*>(component->model_service->model_id));
+            free(component->model_service);
+            component->model_service = nullptr;
+            component->is_model_loaded = false;
+            free(component->loaded_model_id);
+            component->loaded_model_id = nullptr;
+            return result;
         }
     }
 

sdk/runanywhere-swift/Sources/RunAnywhere/Foundation/Bridge/Extensions/CppBridge+VAD.swift

@@ -77,6 +77,12 @@ extension CppBridge {
 
             let handle = try getHandle()
 
+            // `rac_vad_component_load_model` unloads any previously loaded model
+            // first. If the subsequent load fails, the C++ side is already
+            // unloaded, so clear our mirror before the call so a retry isn't
+            // skipped by the `loadedModelId != modelId` fast path above.
+            loadedModelId = nil
+
             let result = modelPath.withCString { pathPtr in
                 modelId.withCString { idPtr in
                     modelName.withCString { namePtr in

sdk/runanywhere-swift/Sources/RunAnywhere/Public/RunAnywhere.swift

@@ -71,6 +71,9 @@ public enum RunAnywhere {
     /// Concurrent callers of completeServicesInitialization() await this shared task
     /// instead of racing through the init logic with an unprotected boolean guard.
     private static var _servicesInitTask: Task<Void, Error>?
+    /// Serializes the check-and-set on `_servicesInitTask` so two concurrent callers
+    /// can't both observe `nil` and spawn duplicate init tasks.
+    private static let _servicesInitLock = DispatchQueue(label: "com.runanywhere.sdk.servicesInit")
 
     // MARK: - SDK State
 
@@ -316,24 +319,28 @@ public enum RunAnywhere {
             return
         }
 
-        // If another task is already running Phase 2, join it instead of
-        // starting a duplicate. This prevents the race between the background
-        // Task.detached spawned by initialize() and any caller that reaches
-        // completeServicesInitialization() via ensureServicesReady().
-        if let existingTask = _servicesInitTask {
-            try await existingTask.value
-            return
-        }
-
-        let task = Task<Void, Error> {
-            try await _performServicesInitialization()
+        // Atomically check-or-create the shared init task. Without the lock, two
+        // concurrent callers could both see `_servicesInitTask == nil` and spawn
+        // duplicate init tasks (e.g., the background Task.detached from initialize()
+        // racing a caller via ensureServicesReady()).
+        let task: Task<Void, Error> = _servicesInitLock.sync {
+            if let existingTask = _servicesInitTask {
+                return existingTask
+            }
+            let newTask = Task<Void, Error> {
+                try await _performServicesInitialization()
+            }
+            _servicesInitTask = newTask
+            return newTask
         }
-        _servicesInitTask = task
 
         do {
             try await task.value
+            // Clear on success so the completed Task is released; subsequent calls
+            // hit the fast path via `hasCompletedServicesInit`.
+            _servicesInitLock.sync { _servicesInitTask = nil }
         } catch {
-            _servicesInitTask = nil
+            _servicesInitLock.sync { _servicesInitTask = nil }
             throw error
         }
     }

sdk/runanywhere-swift/Sources/WhisperKitRuntime/WhisperKitSTTService.swift

@@ -191,9 +191,7 @@ public actor WhisperKitSTTService {
     /// Root-mean-square energy using Accelerate (O(n) vectorized).
     private func rmsEnergy(_ samples: [Float]) -> Float {
         guard !samples.isEmpty else { return 0 }
-        var meanSquare: Float = 0
-        vDSP_measqv(samples, 1, &meanSquare, vDSP_Length(samples.count))
-        return sqrt(meanSquare)
+        return vDSP.rootMeanSquare(samples)
     }
 
     /// In-place gain using Accelerate (O(n) vectorized).