install.sh: macOS local-ffmpeg install omits ffprobe, so `transcribe -audio` silently derives a 0 offset (mis-timed transcript)

[REPPL]

Summary

install_ffmpeg_local's darwin branch installs only ffmpeg and never ffprobe, so a macOS user who takes the local ffmpeg path ends up with no ffprobe on PATH. testimony transcribe -audio FILE derives the audio→session offset by shelling out to ffprobe (to read the recording's creation_time); with ffprobe absent it silently falls back to a 0 offset, mis-timing every utterance of an external recording.

This is the exact outcome the Linux branch was fixed to prevent in round 46 (commit d0db53a, "missing ffprobe dependency") — the sibling fix was never applied to darwin.

Wrong assumption

"Installing ffmpeg is enough for transcribe." The offset-derivation path needs a second binary, ffprobe. The Linux local install provisions it; the macOS local install does not.

Trigger (state → observed vs. correct)

1. Fresh macOS without Homebrew. dep_ffmpeg forces the local path: choose "Install ffmpeg (no Homebrew found)" "local" "local" (install.sh:264).
2. curl -fsSL .../install.sh | sh -s -- --yes → the darwin branch of install_ffmpeg_local installs ffmpeg only (install.sh:324) and no ffprobe.
3. testimony transcribe -audio phone-recording.m4a -session DIR, where the recording's creation_time is, say, 300 s after the session's t0.

• Observed: deriveOffset — exec.LookPath("ffprobe") fails (internal/transcribe/ffmpeg.go:207-209) → returns (0, false) → resolveOffset returns offset 0 with provenance "default 0: audio creation time unavailable" (internal/transcribe/transcribe.go:312). mapSegments adds offset 0 to every segment start/end and word time (internal/transcribe/transcribe.go:518, :545), so every utterance is written ~300 s off its true session time. On the external -audio path the wrong 0 is also durably persisted to audio.offset.json (transcribe.go:172-178) and read back on every later bare re-run. Exit 0. The mis-timing propagates into timeline.jsonl, report.md, and analyze finding times — the evidence record.
• Correct: offset derived as creation_time − t0 (≈ +300 s), exactly as on Linux (and on macOS with Homebrew ffmpeg, which bundles ffprobe).

The runtime provenance note is itself misleading: it says the creation time is unavailable, when in fact the tag is present and it is the binary that is missing — so the operator is pointed at the wrong remedy.

Location

• Defect: install.sh:289-325 (darwin branch of install_ffmpeg_local), specifically the single ffmpeg-only install -m 0755 "$tmp2/ffmpeg" ... at install.sh:324 — no counterpart to the Linux ffprobe install.
• Sibling that WAS fixed: install.sh:352-353 (Linux), rationale at install.sh:345-351 and commit d0db53a.
• Runtime consequence: internal/transcribe/ffmpeg.go:207-209 → internal/transcribe/transcribe.go:312, :518.

CWE anchor

No single precise CWE; this is the playbook's sibling-site completeness meta-rule — an incomplete fix (round 46) leaving a latent sibling on the other platform. (The runtime symptom is closest to CWE-909 Missing Initialization of Resource, but the root cause is the incomplete sweep, not the graceful Go fallback, which is correct by design.)

Sibling sweep (all ffmpeg-provisioning paths checked)

• install_ffmpeg_local Linux branch — installs ffmpeg and ffprobe ✓ (hardened, round 46).
• install_ffmpeg_local darwin/evermeet branch — installs ffmpeg only ✗ ← this gap. (evermeet.cx publishes ffprobe as a separate info/ffprobe/release download; the script fetches only info/ffmpeg/release, so the ffmpeg zip does not carry it and nothing installs it.)
• dep_ffmpeg brew path — brew install ffmpeg bundles ffprobe ✓.

Validator confirmations (both lenses, independent)

• Reachability lens: "the darwin local-ffmpeg branch installs only ffmpeg and never ffprobe, so on a supported, reachable macOS-without-Homebrew install the exec.LookPath("ffprobe") in deriveOffset fails and resolveOffset silently returns offset 0, mis-timing an external -audio transcript — the exact outcome the Linux branch was added to prevent."
• Correctness lens: "the macOS local branch silently violates that sibling intent, leaving macOS-local users with durable, misdiagnosed, wrong-offset evidence that Linux users are protected from — for no principled reason."

Fix direction (not a patch)

Fetch and install evermeet's separately-published ffprobe build alongside ffmpeg in the darwin branch (mirroring the Linux ffprobe install).