Delete Natural Voice tokens the desktop discards, and never reset the saved voice on a failed read

[nedtwigg]

Two follow-ups to #1191 on the desktop side of Natural Voice, ported from the superseded #1200 onto #1191's design. Hosted is unchanged: no revokedAt, no revoke endpoint, no new migration.

• Tokens the desktop throws away are deleted at Hosted. The host now sends Natural Voice: tokens nobody sees, live until a year idle #1191's own-token delete (DELETE /api/voice/token with that bearer, via the existing forgetAtHosted) for a token it discards without keeping. That covers three cases:

  • a poll answer that lands after the approval was cancelled
  • a token that Turn off overtakes during the saving notification
  • a token that fails to save

  Before this, such a token stayed live at Hosted until a year idle. The delete is best effort and never awaited, and it sends nothing under Nowhere, the same as Turn off.

• Turn off also deletes a token it clears mid-save. Turn off used to read the token to delete before queueing its clear. If a save was already queued, that read missed the new token, and the clear then removed it from disk without deleting it at Hosted. The read now happens inside the serialized section, after any save queued first.

• A failed read during Turn off never resets the saved voice. clearToken treated a failed read as defaults and wrote the whole record. Standalone's file store rewrites the whole file, so a transient lock reset the chosen voice. That broke the ManagedVoiceStore.read contract.

  • The file store's write now merges the one changed field into a fresh read. If that read also fails, the write fails instead of resetting the voice.
  • clearToken no longer caches defaults it did not read.
  • VS Code's store already writes each field under its own key, so it needed no change.

• Spec: alert.md → "Managed voice" now says the host deletes every approved token it discards unsaved, not only on Disconnect.

Test plan

• lib/src/host/managed-voice-host.test.ts: one new test for the mid-save Turn off and one for a Turn off whose reads fail. Three existing tests now assert the delete: a late token after cancel, a Turn off during the saving notification, and a failed save. Each was mutation-checked: removing each fix line makes exactly its own test fail.
• ManagedVoiceSection.test.tsx, vscode-ext/test/managed-voice.test.ts
• tsc -b in lib; tsc --noEmit in standalone and vscode-ext
• spec-lint, md-unwrap, outbound lint

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	e1ff5bb
Status:	✅  Deploy successful!
Preview URL:	https://3769a29b.mouseterm.pages.dev
Branch Preview URL:	https://voice-discarded-tokens.mouseterm.pages.dev

View logs