Bug-hunt round 46: missing ffprobe dependency, curl -f omission, stale CHANGELOG claim

[REPPL]

Round 46 of the autonomous bug-hunt loop (state tracked on #24).

Four parallel dimension sweeps (code bugs in cmd//internal/; docs vs functionality; infrastructure; internal doc consistency) surfaced three candidates. All three survived two independent adversarial refuters each and are fixed here; all are nitpick-severity (no substantive/behaviour-breaking defect this round).

Confirmed findings (3 nitpicks)

1. Local Linux install never installs ffprobe, and docs don't disclose it as a fallback cause

• install.sh's install_ffmpeg_local (Linux branch, was around line 343) downloads and verifies the johnvansickle static ffmpeg tarball, which bundles ffprobe alongside ffmpeg, but only ever installed ffmpeg — ffprobe was extracted and discarded.
• internal/transcribe/ffmpeg.go's deriveOffset (~line 207) does exec.LookPath("ffprobe") and silently returns offset=0, false when it's missing — a third, undocumented cause of the default 0: audio creation time unavailable fallback, alongside a missing/unreadable creation_time tag.
• docs/explanation/how-alignment-works.md:19 and docs/reference/cli.md:67 named only the tag-based causes. A reader who follows docs/tutorials/getting-started.md:19-20's documented no-Homebrew "local" install path on Linux gets ffmpeg with no ffprobe, and every subsequent transcribe -audio silently falls back to offset 0, permanently, with nothing pointing at the actual cause.

Fixed: install.sh now installs ffprobe from the same already-downloaded, already-verified tarball. Both docs pages now name a missing ffprobe as a cause. The macOS local-install branch (evermeet publishes ffprobe as a separate signed download) is left as-is — adding a new, untested network-fetch-and-verify path was judged out of proportion for this round — and is now accurately reflected as the residual gap.

2. whisper.cpp model-download guidance and its doc mirror omit curl -f

• internal/transcribe/whispercpp.go:141 (resolveModel's not-found error) and docs/how-to/transcribe-a-recording.md:54 both printed a curl -L ... -o ... <url> recipe for the ggml model download, omitting -f/--fail.
• Without -f, an HTTP error response (a moved or withdrawn Hugging Face asset) is written into the destination .bin file and curl exits 0 — confirmed by direct local test against a 404. The reader gets a "successful" download that only fails, confusingly, at whisper-cli load time. install.sh's own equivalent guidance for the same URL and destination already used curl -fL (it differs from the other two only by --create-dirs vs mkdir -p, an intentional equivalent).

Fixed: both sites now use curl -fL, matching install.sh. New TestResolveModelGuidanceFailsClosedOnHTTPError (internal/transcribe/transcribe_test.go) pins the guidance text, confirmed to fail before the change and pass after.

3. Released CHANGELOG.md [0.2.0] entry pairs a CLI-wide subject with an unqualified network-calls claim

• CHANGELOG.md's testimony analyze bullet under the released ## [0.2.0] section closed with "The CLI holds no API keys and makes no network calls." This is the only occurrence of the phrase family in the repo that is both CLI-wide and unqualified: three occurrences scope the subject to analyze (README.md, docs/reference/cli.md, docs/how-to/analyse-a-session.md), and three keep "The CLI" as subject but qualify the predicate to "adds no network dependency" (AGENTS.md, internal/analyze/analyze.go, .abcd/work/CONTEXT.md) — a narrower, still-true claim about the analysis layer's own design. CHANGELOG's blunter "makes no network calls" is a claim of zero runtime network activity anywhere in the CLI, falsified by demo's rrweb CDN load (already present at v0.2.0's release) and transcribe's ASR model fetch.

Fixed: rescoped the bullet's closing sentence to analyze — the bullet's actual subject, and true of it at the stronger predicate — without altering the substance of the release's historical record.

Dimensions with zero findings

Code bugs (cmd/, internal/) and infrastructure (CI/release workflows vs AGENTS.md, install.sh vs its own docs, examples/sample-session vs the schemas the code reads/writes) both came back clean after full sweeps against the current code, with no re-litigation of anything already fixed or rejected in .abcd/work/DECISIONS.md's prior 45 rounds.

Verification

Two independent adversarial refuters per finding, each explicitly tasked with proving it wrong, unreproducible, or intended behaviour. All three findings survived both refuters (no split verdicts, no discards this round); the refuters' scrutiny narrowed and corrected each finding's framing before the fix (e.g. identifying that whispercpp.go's guidance string, not the docs, was the un-reviewed baseline for finding 2).

This round's own merge-gate review (docs-accuracy lens) additionally caught an earlier draft of finding 3's writeup overclaiming that "every other occurrence uses the analyze-scoped form" and a grammatically mis-attached "whose ffprobe" in the finding-1 doc edit; both are corrected in this PR (see the docs: fix merge-gate review findings commit) rather than left standing.

go build, gofmt -l ., go vet ./..., go test ./..., go test -race ./... all clean; pipeline smoke (merge + report against a scratch copy of examples/sample-session) succeeded; sh -n install.sh && bash -n install.sh and the CI installer flag-handling checks (--help, --dir, --bogus) all pass. No go.mod change. .abcd/work/DECISIONS.md carries the round's entry.

---

Assisted-by: Claude:claude-sonnet-5