fix(core): ort-silero VAD init panic degrades to whisper-silero instead of crashing the recording sidecar (#408)

[silverstein]

Closes #408.

Incident

A live recording on the SOTA dev build (parakeet,metal,vad-ort,engine-sherpa) died mid-meeting: live-transcript-status.json showed state: failed, diagnostic: "sidecar panicked: Failed to initialize ORT API". The mic kept recording to WAV the whole time — only the live-transcript sidecar crashed. Config had vad_engine = "ort-silero"; the previous dev build didn't compile vad-ort so it silently fell back, but the SOTA build actually tried to init ORT and the ort crate panicked (OrtGetApiBase().GetApi() → null → .expect("Failed to initialize ORT API")) instead of returning an error — below the Result boundary the fallback chain relied on.

Fix

A VAD init failure must never crash a live recording. OrtSileroVad::new_catching_unwind wraps construction in catch_unwind, converting a panic into OrtSileroError::Panic, so ORT init failure now follows the same recoverable path as a missing model or an uncompiled feature: ort-silero → whisper-silero → energy, with an honest tracing::warn!. Same honest-degradation principle as #395/#396. Regression test ort_silero_init_panic_falls_back_to_whisper_silero injects the exact incident panic and asserts fallback to Silero with nothing escaping.

Review

Fresh-context adversarial review found no blockers: AssertUnwindSafe narrowly scoped to construction; ort's global API pointer uses OnceLock/call_once_force (a caught init panic isn't permanently poisoned); whisper-silero uses whisper-rs (no ort), isolating the fallback. Tests (vad-ort,streaming + --no-default-features), fmt, clippy green.

Root cause: narrowed, not fixed here

The two-static-onnxruntime hypothesis was refuted in cargo test — co-compiling engine-sherpa + vad-ort still inits ORT fine in a debug binary. The panic only manifests in the packaged, signed .app process (release linkage + init order), so root-causing needs an app-bundle repro. Tracked on #408, feeds #369. This PR closes the incident class regardless.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
useminutes.app	Ready	Preview, Comment	Jul 3, 2026 9:12pm