fix(ios-voice): fold the #199 post-merge review notes

[kpmmmurphy]

The second claude-review round on #199 landed after the merge with two cosmetic notes; this folds both.

• Generation-stamped progress tick — a cancelled download's last queued didWriteData could paint one frame of stale percentage over a fresh re-pick. The closure now guards on voicePrepareGeneration == generation, like the rest of the file.
• Built-in pick clears a stale .failed banner — voiceLoad is reset unconditionally on an explicit Built-in pick (was: only while active). The Mac's selectVoiceTier shares the rough edge; tracked under Mac: picking Built-in mid-download lets the finished M1K3 Voice download swap in anyway #200.

Verify-by-launch (app glue, no pure seam). iOS simulator shell builds.

🤖 Generated with Claude Code

https://claude.ai/code/session_01K2kJAPEHTFU34uKiGArFSP

[netlify]

✅ Deploy Preview for m1k3 canceled.

Name	Link
🔨 Latest commit	f37b5ac
🔍 Latest deploy log	https://app.netlify.com/projects/m1k3/deploys/6a99e986218b290008a34a5a

[claude]

Review — PR #202

Small, tightly-scoped fix folding two cosmetic notes from the #199 post-merge review. Both changes check out — verified against the surrounding state machine, not just the diff.

1. Generation-stamped progress tick (AppCore+VoiceOutput.swift:83-87)

guard let self, voicePrepareGeneration == generation, case .downloading = voiceLoad else { return }

Confirmed real: prepareM1K3Voice() only bumps voicePrepareGeneration when voicePrepareTask == nil, and the only way to get a new task while an old one exists is via selectVoiceTier(.builtin) cancelling it first. A cancelled task's kokoro.prepare progress closure can still have a Task { @MainActor ... } already queued on the main actor before the cancellation is observed downstream — without the generation check, that stale tick would land after the next generation has already re-set voiceLoad = .progress(0) and painted a wrong percentage over the fresh download. This mirrors the exact pattern already established for warmGeneration in warmSelectedBrain() (AppCore.swift:445-465), so it's consistent with precedent elsewhere in this file rather than a new idiom. Good catch, correct fix.

2. Built-in pick clears a stale failure unconditionally (AppCore+VoiceOutput.swift:54-56)

voiceLoad = .idle (was: if voiceLoad.isActive { voiceLoad = .idle })

.failed is not .isActive (see ModelLoadState.isActive, Sources/M1K3Inference/ModelLoadState.swift:47-52), so a prior download failure left the banner up under a row that now correctly reads Built-in. Checked VoiceOutputSection.swift — voiceLoad is read-only for rendering there, so the unconditional reset is safe; no other state depends on the transition being conditional. Also confirmed the PR description's claim: the Mac's selectVoiceTier (AppEnvironment.swift:2353) still has the old if voiceLoad.isActive guard, so the "shared rough edge, tracked under #200" note is accurate, not just asserted.

Other checks — Concurrency: both closures are already @MainActor-isolated with the standard guard let self weak-capture; the new generation check adds no new isolation surface, no bare locks. Provenance: the added Review: header line is additive to the existing Signed: block, doesn't rewrite prior entries — correct MurphySig discipline. Tests: none added, and per CLAUDE.md this is app-glue (M1K3iOSApp/, not Sources/*) — verify-by-launch is the right bar, MLX/Kokoro can't run under swift test anyway. Architecture: no logic leaked anywhere it shouldn't be, no new deps.

Nothing to flag — clean, well-verified fix, nice tie-back to the warmGeneration precedent.