fix(audio): stop the system-audio tap poisoning the mic picker, and revive two dead mic fallbacks

Production 2.8.7 report: every meeting failed with
  Microphone failed to start (Failed: Input device 'NativelySystemAudioTap'
  not found. Available devices: iPhone Microphone, MacBook Air Microphone)

NativelySystemAudioTap is Natively's OWN CoreAudio aggregate (speaker/
core_audio.rs), not a microphone. It was sitting in the launcher's
preferredInputDeviceId. Three independent defects put it there and then let
it take the mic channel down for the whole meeting.

(a) The tap was offerable as a microphone.
    kAudioAggregateDeviceIsPrivateKey hides the aggregate from OTHER
    processes, not from ours: cpal's host.input_devices(), running inside the
    Natively main process, enumerates it for as long as the tap is live —
    sorted between the real mics. Opening Settings during a meeting therefore
    offered Natively's own tap as an input, and one click persisted it. The
    tap does not exist when the mic channel starts, so every LATER meeting
    died. Verified by probe against live CoreAudio, not inferred.

(b) resolve_input_device hard-errors with no fallback, and the error arrives
    too late for the fallback ladder that exists.
    reconfigureAudio now resolves the saved input against the live
    enumeration BEFORE constructing anything (no HAL open, so it cannot light
    the macOS orange mic indicator) and falls back to the default with a
    fellBack:true broadcast. That broadcast is what raises the amber
    "couldn't be opened — using <device> instead" banner whose Reset button
    already cleared preferredInputDeviceId: the self-heal UI existed and was
    simply unreachable, because the input path threw instead of broadcasting.

(c) Both mic fallback ladders were dead code, and recovery could not re-arm.
    MicrophoneCapture is deliberately lazy (constructing natively lights the
    mic indicator), so `new MicrophoneCapture(id)` cannot throw for a missing
    device — the native handle is built inside start(). Every
    `try { new MicrophoneCapture(id) } catch { new MicrophoneCapture() }` was
    therefore unreachable, and each recovery attempt retried the identical
    dead id. Worse, that retry's start() emits 'error' synchronously before
    throwing, re-entering the handler while _micRecoveryInProgress is true, so
    the guard dropped it: attempts froze at 1 and the 3-attempt terminal
    banner could never fire either.
    Fixed by falling back on the surface that actually throws (new
    MicrophoneCapture.retargetDevice() — no destroy/recreate, so the
    wireMicCapture wiring survives and no teardown races a fresh device open)
    and by driving the three attempts in a loop where failure is observed
    directly.

Trigger is macOS-only; defects (b) and (c) are not. microphone.rs has no cfg
gates and MicrophoneCapture.ts / setupMicRecoveryHandler have no platform
branches, so any stale saved mic on Windows hit the same dead fallback — and
WASAPI renumbering ("(2- USB Audio Device)", the case normalize_device_name
exists for) makes that more common there, not less. The Rust Err is
deliberately NOT loosened: resolve_input_device is shared by both backends and
that behaviour cannot be exercised from macOS.

New electron/audio/inputDeviceSelection.mjs is the single choke point (filter +
Rust-mirrored availability resolver), imported by AudioDevices, main.ts and
App.tsx; App.tsx also discards an already-poisoned preference on meeting start.

Validation:
  Tested physically on macOS      — (a) + the gate, probed against live
                                    CoreAudio with the tap running and stopped
  Covered by automated macOS branch tests — (c), via the fake-native harness
  Reviewed but not executed on Windows
  Requires physical Windows verification
Commands: npm run typecheck:electron, npm run typecheck:ts7, npm test
(8465 tests, 8400 pass; the 2 OllamaManagerGating failures reproduce at HEAD
in a clean worktree — a local Ollama server is running), audio +
mic-recovery suites 421/421. Both new suites mutation-probed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EHzx467QuEy3gNxZFU9uts

Author: Hardening v2.7

electron/audio/AudioDevices.ts

@@ -1,4 +1,5 @@
 import { loadNativeModule } from './nativeModuleLoader';
+import { filterSelectableInputDevices } from './inputDeviceSelection.mjs';
 
 // NativeModule may be null if the Rust binary isn't built yet (new clone without `npm run build:native`).
 // All methods below handle this gracefully by returning empty arrays.
@@ -17,7 +18,16 @@ export class AudioDevices {
             return [];
         }
         try {
-            return getInputDevices();
+            // Natively's own system-audio tap is an aggregate device that cpal
+            // enumerates as an INPUT while a meeting is capturing (private
+            // aggregates are hidden from other processes, not from ours). Left
+            // unfiltered it appears in the mic dropdown, gets persisted as
+            // preferredInputDeviceId, and then breaks every later meeting —
+            // the tap does not exist yet when the mic channel starts. Filtering
+            // at this single choke point also keeps the I/O-conflict fallback,
+            // the built-in-mic lookup and the last-resort candidate ladder in
+            // main.ts from ever selecting it.
+            return filterSelectableInputDevices(getInputDevices());
         } catch (e) {
             console.error('[AudioDevices] Failed to get input devices:', e);
             return [];

electron/audio/MicrophoneCapture.ts

@@ -84,6 +84,35 @@ export class MicrophoneCapture extends EventEmitter {
         return 0;
     }
 
+    /**
+     * Re-point this wrapper at a different input device.
+     *
+     * Exists for the "saved device is gone" retry: because init is LAZY, a bad
+     * device id cannot be detected until start() constructs the native monitor
+     * and throws. At that moment the wrapper holds no native handle (the
+     * construction-failure branch in start() never assigns this.monitor), so
+     * the cheapest correct retry is to re-target THIS instance and start again
+     * — no destroy/recreate, so the caller keeps its wireMicCapture() wiring
+     * and there is no teardown racing a fresh device open on the HAL.
+     *
+     * Deliberately refuses to run on a live wrapper: swapping deviceId while a
+     * cpal stream is open would silently desync this.deviceId from the device
+     * actually being captured.
+     */
+    public retargetDevice(deviceId?: string | null): void {
+        if (this.monitor || this.isRecording) {
+            throw new Error(
+                '[MicrophoneCapture] retargetDevice() requires an inactive wrapper with no native monitor',
+            );
+        }
+        this.deviceId = deviceId || null;
+        // A wrapper that has never captured successfully must not re-open the
+        // mic during stop()'s post-teardown pre-warm (same rule start()'s
+        // failure path enforces).
+        this.preWarmEnabled = false;
+        console.log(`[MicrophoneCapture] Re-targeted to device: ${this.deviceId || 'default'}`);
+    }
+
     /**
      * Start capturing microphone audio
      */

electron/audio/__tests__/InputDeviceSelection2026_08_26.test.mjs

@@ -0,0 +1,170 @@
+// Regression tests for the "Input device 'NativelySystemAudioTap' not found"
+// meeting failure (2026-08-26, v2.8.7 production).
+//
+// Chain: speaker/core_audio.rs builds a PRIVATE CoreAudio aggregate named
+// NativelySystemAudioTap to capture system audio. "Private" hides it from other
+// processes, NOT from ours — cpal's host.input_devices() enumerates it inside
+// the Natively main process while the tap is live, so it appeared in the
+// microphone dropdown and could be persisted as preferredInputDeviceId. The mic
+// channel starts BEFORE the tap is created, so every later meeting resolved a
+// device that did not exist, and Rust's resolve_input_device() hard-errors with
+// no default fallback.
+//
+// These are behavioural tests against the real module (no source assertions):
+// electron/audio/inputDeviceSelection.mjs is the single choke point that the
+// picker (AudioDevices), the pipeline (main.ts) and the launcher (App.tsx) all
+// share.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  INTERNAL_CAPTURE_DEVICE_NAMES,
+  filterSelectableInputDevices,
+  isInternalCaptureDevice,
+  normalizeDeviceName,
+  resolveRequestedInputDevice,
+} from '../inputDeviceSelection.mjs';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+// The exact list the failing production machine enumerated, plus the tap in the
+// position cpal actually returned it (between the two real mics — which is why
+// it was plausible to click).
+const DEVICES_WITH_TAP = [
+  { id: 'default', name: 'Default Microphone' },
+  { id: 'iPhone Microphone', name: 'iPhone Microphone' },
+  { id: 'NativelySystemAudioTap', name: 'NativelySystemAudioTap' },
+  { id: 'MacBook Air Microphone', name: 'MacBook Air Microphone' },
+];
+
+const DEVICES_WITHOUT_TAP = [
+  { id: 'default', name: 'Default Microphone' },
+  { id: 'iPhone Microphone', name: 'iPhone Microphone' },
+  { id: 'MacBook Air Microphone', name: 'MacBook Air Microphone' },
+];
+
+test('the system-audio tap is never offered as a selectable microphone', () => {
+  const selectable = filterSelectableInputDevices(DEVICES_WITH_TAP);
+  assert.deepEqual(
+    selectable.map(d => d.id),
+    ['default', 'iPhone Microphone', 'MacBook Air Microphone'],
+    'BUG: NativelySystemAudioTap is back in the mic picker. Selecting it poisons ' +
+    'preferredInputDeviceId and breaks every subsequent meeting.',
+  );
+});
+
+test('filtering keeps real devices untouched and tolerates junk input', () => {
+  assert.deepEqual(filterSelectableInputDevices(DEVICES_WITHOUT_TAP), DEVICES_WITHOUT_TAP);
+  assert.deepEqual(filterSelectableInputDevices(null), []);
+  assert.deepEqual(filterSelectableInputDevices(undefined), []);
+  assert.deepEqual(filterSelectableInputDevices([null, undefined]), []);
+});
+
+test('isInternalCaptureDevice matches case and dash variants, not real mics', () => {
+  assert.equal(isInternalCaptureDevice('NativelySystemAudioTap'), true);
+  assert.equal(isInternalCaptureDevice('nativelysystemaudiotap'), true);
+  assert.equal(isInternalCaptureDevice('  NativelySystemAudioTap  '), true);
+  assert.equal(isInternalCaptureDevice('MacBook Air Microphone'), false);
+  assert.equal(isInternalCaptureDevice(''), false);
+  assert.equal(isInternalCaptureDevice(null), false);
+  assert.equal(isInternalCaptureDevice(undefined), false);
+});
+
+test('a stored tap id resolves as MISSING so callers fall back to default', () => {
+  // This is the production failure: the preference survives, but the tap is not
+  // in the list at mic-start time because it has not been created yet.
+  const resolution = resolveRequestedInputDevice('NativelySystemAudioTap', DEVICES_WITHOUT_TAP);
+  assert.equal(resolution.status, 'missing');
+  assert.deepEqual(resolution.available, ['iPhone Microphone', 'MacBook Air Microphone']);
+});
+
+test('no preference resolves to default without consulting the list', () => {
+  for (const value of [null, undefined, '', '   ', 'default', 'DEFAULT', ' Default ']) {
+    assert.equal(
+      resolveRequestedInputDevice(value, DEVICES_WITHOUT_TAP).status,
+      'default',
+      `expected "${value}" to mean "system default"`,
+    );
+  }
+});
+
+test('the synthetic "default" row is never a match candidate', () => {
+  // Rust's host.input_devices() does not return it — list_input_devices()
+  // prepends it. Matching it here would let a stored "Default Microphone"
+  // resolve in JS and then fail in Rust.
+  const resolution = resolveRequestedInputDevice('Default Microphone', DEVICES_WITHOUT_TAP);
+  assert.equal(resolution.status, 'missing');
+  assert.ok(!resolution.available.includes('Default Microphone'));
+});
+
+test('the synthetic default ID resolves as default, never as missing', () => {
+  // main.ts's I/O-conflict and HFP auto-switches pick a replacement mic out of
+  // AudioDevices.getInputDevices(), whose first row is the synthetic
+  // { id: 'default' }. They pass its .id through normalizeDeviceId(), which maps
+  // 'default' -> undefined, so the availability gate is skipped entirely. This
+  // pins the second line of defence: even if 'default' DID reach the gate it
+  // must not be reported as an unavailable device, or the auto-switch would
+  // raise an amber banner naming "default" as missing.
+  assert.equal(resolveRequestedInputDevice('default', DEVICES_WITHOUT_TAP).status, 'default');
+  assert.equal(resolveRequestedInputDevice('default', []).status, 'default');
+});
+
+test('resolution tiers mirror Rust resolve_input_device (exact < case < fuzzy)', () => {
+  const devices = [{ id: 'MacBook Air Microphone', name: 'MacBook Air Microphone' }];
+
+  const exact = resolveRequestedInputDevice('MacBook Air Microphone', devices);
+  assert.equal(exact.status, 'matched');
+  assert.equal(exact.tier, 0);
+
+  const caseInsensitive = resolveRequestedInputDevice('macbook air microphone', devices);
+  assert.equal(caseInsensitive.status, 'matched');
+  assert.equal(caseInsensitive.tier, 1);
+
+  // WASAPI index prefix — the case normalize_device_name exists for.
+  const fuzzy = resolveRequestedInputDevice(
+    '(2- USB Audio Device)',
+    [{ id: 'USB Audio Device', name: 'USB Audio Device' }],
+  );
+  assert.equal(fuzzy.status, 'matched');
+  assert.equal(fuzzy.tier, 2);
+});
+
+test('an exact match wins over a fuzzy one regardless of enumeration order', () => {
+  const devices = [
+    { id: '(2- USB Audio Device)', name: '(2- USB Audio Device)' },
+    { id: 'USB Audio Device', name: 'USB Audio Device' },
+  ];
+  const resolution = resolveRequestedInputDevice('USB Audio Device', devices);
+  assert.equal(resolution.status, 'matched');
+  assert.equal(resolution.tier, 0);
+  assert.equal(resolution.id, 'USB Audio Device');
+});
+
+test('normalizeDeviceName mirrors the Rust implementation', () => {
+  assert.equal(normalizeDeviceName('(2- USB Audio Device)'), 'usb audio device');
+  assert.equal(normalizeDeviceName('AirPods Pro – Hands-Free'), 'airpods pro - hands-free');
+  assert.equal(normalizeDeviceName('  AirPods Pro  '), 'airpods pro');
+  assert.equal(normalizeDeviceName(''), '');
+  assert.equal(normalizeDeviceName(null), '');
+});
+
+test('the internal-device name matches the aggregate Rust actually creates', () => {
+  // A rename on either side silently re-opens the bug: the picker would stop
+  // filtering the real device while filtering a name that no longer exists.
+  const coreAudioSource = readFileSync(
+    path.resolve(__dirname, '../../../native-module/src/speaker/core_audio.rs'),
+    'utf8',
+  );
+  const match = /let\s+agg_name\s*=\s*cf::String::from_str\("([^"]+)"\)/.exec(coreAudioSource);
+  assert.ok(match, 'could not find agg_name in native-module/src/speaker/core_audio.rs');
+  assert.ok(
+    INTERNAL_CAPTURE_DEVICE_NAMES.includes(match[1]),
+    `BUG: core_audio.rs creates an aggregate named "${match[1]}" but ` +
+    `INTERNAL_CAPTURE_DEVICE_NAMES is ${JSON.stringify(INTERNAL_CAPTURE_DEVICE_NAMES)}. ` +
+    'The mic picker will offer it again.',
+  );
+});

electron/audio/__tests__/MicRetargetOnMissingDevice2026_08_26.test.mjs

@@ -0,0 +1,136 @@
+// Regression test for the mic-recovery dead fallback (2026-08-26).
+//
+// setupMicRecoveryHandler carried
+//     try { new MicrophoneCapture(savedId) } catch { new MicrophoneCapture() }
+// which can never fire: MicrophoneCapture is LAZY (its constructor must not
+// touch the HAL, or the macOS orange mic indicator lights outside a meeting),
+// so a missing/unopenable device is only detected inside start(), where the
+// NATIVE monitor is constructed. Every recovery attempt therefore retried the
+// identical dead device id — the production symptom was
+//     [MicRecovery] Recovery attempt #1 failed: Failed: Input device
+//     'NativelySystemAudioTap' not found.
+// repeating with no fallback and no terminal banner.
+//
+// The fix is retargetDevice(): after a failed start the wrapper holds no native
+// handle, so the caller re-points THIS instance at the system default and
+// starts again — keeping its wireMicCapture() wiring and avoiding a deferred
+// teardown racing a fresh device open.
+//
+// Harness: the fake-native-module injection used by
+// MicFailedStartReleasesHandle2026_08_14, against the dist bundle.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import Module from 'node:module';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const distRoot = path.resolve(__dirname, '../../../dist-electron/electron/audio');
+
+const constructedWith = [];
+
+const fakeNativeModule = {
+    getHardwareId: () => 'fake',
+    verifyGumroadKey: async () => 'fake',
+    getInputDevices: () => [],
+    getOutputDevices: () => [],
+    SystemAudioCapture: function () {
+        return { start() {}, stop() {}, getSampleRate: () => 16000 };
+    },
+    // Mirrors Rust resolve_input_device(): an unknown id throws at CONSTRUCTION
+    // of the native monitor, `null`/default always succeeds.
+    MicrophoneCapture: function (deviceId) {
+        constructedWith.push(deviceId ?? null);
+        if (deviceId === 'NativelySystemAudioTap') {
+            throw new Error(
+                "Failed: Input device 'NativelySystemAudioTap' not found. " +
+                'Available devices: iPhone Microphone, MacBook Air Microphone',
+            );
+        }
+        return {
+            start() {},
+            stop() {},
+            getSampleRate: () => 16000,
+            getNativeSampleRate: () => 48000,
+        };
+    },
+};
+
+const origLoad = Module._load;
+Module._load = function patched(request) {
+    if (request === 'electron') {
+        return { app: { getAppPath: () => '/tmp/fake', isPackaged: false, isReady: () => false } };
+    }
+    if (request.endsWith('.node') || request.includes('native-module')) {
+        return fakeNativeModule;
+    }
+    return origLoad.apply(this, arguments);
+};
+
+const { MicrophoneCapture } = await import(
+    pathToFileURL(path.join(distRoot, 'MicrophoneCapture.js')).href
+);
+
+test('constructing with a missing device does NOT throw — only start() does', () => {
+    constructedWith.length = 0;
+    const cap = new MicrophoneCapture('NativelySystemAudioTap');
+    cap.on('error', () => {});
+
+    assert.equal(
+        constructedWith.length,
+        0,
+        'BUG: the wrapper constructed a native monitor eagerly. Lazy init is what keeps ' +
+        'the macOS orange mic indicator off outside a meeting — and it is why any ' +
+        'fallback wrapped around `new MicrophoneCapture(id)` is dead code.',
+    );
+
+    assert.throws(() => cap.start(), /not found/);
+    assert.deepEqual(constructedWith, ['NativelySystemAudioTap']);
+});
+
+test('retargetDevice(null) + start() recovers onto the system default', () => {
+    constructedWith.length = 0;
+    const cap = new MicrophoneCapture('NativelySystemAudioTap');
+    cap.on('error', () => {});
+
+    assert.throws(() => cap.start(), /not found/);
+
+    // The recovery path: no destroy, no re-wire.
+    cap.retargetDevice(null);
+    cap.start();
+
+    assert.deepEqual(
+        constructedWith,
+        ['NativelySystemAudioTap', null],
+        'BUG: after a failed start the wrapper must retry on the default device. ' +
+        'Retrying the same id is the loop that left the mic dead for the whole meeting.',
+    );
+});
+
+test('listeners survive the retarget (no destroy/recreate)', () => {
+    const cap = new MicrophoneCapture('NativelySystemAudioTap');
+    let errors = 0;
+    let started = 0;
+    cap.on('error', () => { errors += 1; });
+    cap.on('start', () => { started += 1; });
+
+    assert.throws(() => cap.start(), /not found/);
+    assert.equal(errors, 1, 'the failed start must still emit error for the recovery handler');
+
+    cap.retargetDevice(null);
+    cap.start();
+    assert.equal(started, 1, "BUG: 'start' listener was lost — retarget must not tear the wrapper down");
+});
+
+test('retargetDevice refuses to run on a live wrapper', () => {
+    const cap = new MicrophoneCapture(null);
+    cap.on('error', () => {});
+    cap.start();
+
+    assert.throws(
+        () => cap.retargetDevice('MacBook Air Microphone'),
+        /inactive wrapper/,
+        'BUG: swapping deviceId under a live cpal stream desyncs the wrapper from the ' +
+        'device actually being captured.',
+    );
+});

electron/audio/inputDeviceSelection.d.mts

@@ -0,0 +1,24 @@
+export interface EnumeratedInputDevice {
+  id: string;
+  name: string;
+}
+
+export type InputDeviceResolution =
+  | { status: 'default' }
+  | { status: 'matched'; id: string; name: string; tier: 0 | 1 | 2 }
+  | { status: 'missing'; available: string[] };
+
+export const INTERNAL_CAPTURE_DEVICE_NAMES: readonly string[];
+
+export function normalizeDeviceName(value: string | null | undefined): string;
+
+export function isInternalCaptureDevice(idOrName: string | null | undefined): boolean;
+
+export function filterSelectableInputDevices<T extends EnumeratedInputDevice>(
+  devices: T[] | null | undefined,
+): T[];
+
+export function resolveRequestedInputDevice(
+  requestedId: string | null | undefined,
+  devices: EnumeratedInputDevice[] | null | undefined,
+): InputDeviceResolution;