Bug-hunt round 47: missing CHANGELOG entry for round 46's installer fixes

[REPPL]

Round 47 of the autonomous bug-hunt loop (state tracked on #24).

Confirmed findings

Nitpick (1)

Round 46's installer fixes had no CHANGELOG.md entry — round 46 (commit d0db53a, PR #65) fixed install.sh's Linux local-ffmpeg branch to also install ffprobe (install.sh, Linux branch), and fixed a missing -f/--fail flag on the whisper.cpp model-download curl recipe in internal/transcribe/whispercpp.go and docs/how-to/transcribe-a-recording.md. That round's only edit to CHANGELOG.md was an unrelated rescope of an existing [0.2.0] bullet — neither fix got an entry anywhere. Both are user-facing (a missing ffprobe silently zeroes the derived audio offset; a missing curl -f writes an HTTP error body into a .bin model file at exit 0, failing only later and confusingly at whisper-cli load time), and this repo has an established practice of backfilling exactly this gap (round 27 for round 26's fix, and round 30's own dedicated PR #47 for round 30's own fix). Added a bullet to [Unreleased]'s "Checks and installer:" group.

Considered and rejected

• record's Ctrl+C handling during macOS device probing (internal/record/record.go/recorders.go) — a signal-handling context is installed before startRecorders' device probe runs, which doesn't consult it for up to ~17s. Both refuters killed it: the ordering is a documented, tested, deliberate fix for a worse prior defect (an untracked regression test pins the exact "cancel during probe" state), the claimed "signal silently discarded" mechanism misreads signal.NotifyContext (cancellation is latched immediately, not lost), and the claimed misdiagnosis (an aborted session read as a TCC permission block) is a pre-existing gap in classifyMissingOutput unrelated to the probe window — any early Ctrl+C hits it, probe or not.
• demo's case-sensitive loopbackHost match on "localhost" (internal/demo/demo.go) — both refuters found no realistic caller: the two name-bearing header sources (Host, Origin) are populated by browser/Node URL parsers that lowercase hosts before any header exists, on every documented integration path. Fails closed with a logged reason; no real risk.
• WriteFileAtomicNoFollow replacing a non-regular file at its target path, unlike its sibling WriteFileNoFollow (internal/session/session.go) — already adjudicated refuted in round 30 (.abcd/work/DECISIONS.md). rename(2) never opens the target, so the hazard the sibling's stricter check exists to prevent is absent by construction; a planted FIFO/socket carries no real threat, and the sidecar's own repair path (an explicit -offset re-run) depends on the replace succeeding.
• docs/how-to/transcribe-a-recording.md omitting ffprobe as a dependency — split verdict, discarded. One refuter found Homebrew's ffmpeg formula bundles ffprobe, narrowing real exposure to the tutorial's documented no-Homebrew macOS ("local") install path; the other found that residual path real and worth a one-line fix. Discarded per the loop's tie-breaking rule.
• The same macOS install.sh branch lacking a residual-gap warning message (unlike its Linux sibling, which warns on ffprobe install failure) — split verdict, discarded. One refuter found round 46's own commit message called the branch "untouched" as a considered decision; the other found the warning-message question distinct and un-adjudicated. Discarded per the loop's tie-breaking rule.
• The [0.4.0] CHANGELOG entry's audio.wav file-mode claim, made stale by round 45's existing-file mode preservation — both refuters killed it: this repo's own precedent (round 46 editing a released [0.2.0] bullet) only corrects a released entry that was already wrong at release time; this one was true on the day it was written and at release, and no live reference doc (docs/reference/*) makes the now-superseded claim.

Verification

go build, gofmt -l ., go vet ./..., go test ./..., go test -race ./... all clean; pipeline smoke (merge + report against a scratch copy of examples/sample-session) succeeded; sh -n install.sh && bash -n install.sh clean. This round's fix is documentation-only (a CHANGELOG bullet), so no new test applies.

---

Assisted-by: Claude:claude-sonnet-5