feat: mute all microphones at once#5

P3: This .accessibilityLabel replaces the button's combined title and subtitle, so VoiceOver never hears the subtitle's warning "N microphones can't be muted" — the one piece of information that must not vanish for non-visual users. Include the unprotected-device warning in the label when it is shown.

✅ Addressed in c8b9b98

Fixed in c8b9b98. The label now names the devices that can't be muted.

P1: record treats a failed mute read as an original false, so release can unmute a device that was already muted. Skip the mute write when its pre-mute state cannot be read.

✅ Addressed in c8b9b98

Fixed in c8b9b98. record now returns nil when the original value was never read, and apply then leaves that control alone (a refused mute escalates to the gain lock; a device with no usable lock is reported as can't-be-muted).

P2: record leaves gain unrecorded when the read fails, but the controller can still write zero; release then skips restoration and may leave the device at zero gain. Skip the gain write unless the original gain was captured.

✅ Addressed in c8b9b98

P3: The 2-second watchdog (startWatchdog → reconcile → hold → apply) re-attempts and re-logs every failing HAL write indefinitely. A device whose mute or zeroGain write persistently fails (dead virtual device, denied driver, or a device whose mute is readable as false but not settable) logs Failed to mute…/Failed to zero gain… every two seconds for as long as the mute is engaged, plus once per property notification via enforce. The same pattern repeats for a default-input swap that never succeeds (Failed to move default input off…) and for devices that refuse restoration after disengage (Failed to restore…). This produces unbounded log growth and constant HAL churn for one permanently failing device. Rate-limit the error logging and back off the per-device retry (e.g., only re-attempt a failed write when its property actually changes, and log once per device per escalation).

✅ Addressed in c8b9b98

Fixed in c8b9b98. Each refused write (mute, zero gain, restore, default swap) is logged once and cleared when it next succeeds. The retry itself stays on purpose: a mute that fails once may take later, and this is a privacy control. The extra cost is one property write per device every 2 s, only while a device is refusing.

P2: The input control remains interactive before engine.start(): SystemVolumeController initially reports canSetVolume = true with an unknown endpoint, so gain and mute writes fail while the microphone tile is still waiting. Include engine.isStarted in editable so the controls stay disabled until Core Audio initialization completes.

✅ Addressed in c8b9b98

Fixed in c8b9b98. The slider and its mute tap now also require engine.isStarted.

P2: A failed restore stays in state.restore, but this branch stops the watchdog and removes device listeners before attempting it. Schedule retries while restore entries remain, or a still-present device that later accepts writes can remain muted or at zero gain indefinitely.

✅ Addressed in c8b9b98

Fixed in c8b9b98. After unmuting, the watchdog keeps running while a present device still has a pending restore, and stops once none does. Absent devices are restored when the device list changes.

P2: The dimmed "frozen" gain slider is still live: ControlSlider installs an app-side NSEvent scroll-wheel monitor on hover that writes the value binding unconditionally, and .disabled(!editable) does not gate it. Scrolling over the slider while the global mute is engaged therefore calls inputVolume.setVolume, moves the thumb, and writes input gain to the HAL — exactly what the freeze is meant to prevent, and the mute policy's hold/watchdog will treat any non-zero gain as a breach and escalate the device to its tampered zero-gain lock. Guard the binding setter so no write happens while frozen.

✅ Addressed in c8b9b98

Fixed in c8b9b98. ControlSlider reads isEnabled: it no longer installs the scroll monitor while disabled and removes it when it becomes disabled. This also covers every other disabled slider.

P3: escalate always logs "holding it with gain at zero too", but for a device where .mute failed and canZeroGain is false, no gain lock can be or is applied (added computes to empty). The warning is then misleading: it claims a protection layer that does not exist, which is exactly the case the UI relies on to call the device "unprotected". Only log the gain-lock claim when device.controls.canZeroGain is true, or word the message as an attempted lock/escaped mute.

✅ Addressed in c8b9b98

Fixed in c8b9b98. The message only claims the gain lock when the device has one.

P1: This marks an aggregate protected based on member capabilities even when hold() failed to mute a member. If that aggregate is the default input, it remains selected and can still capture from the live mic; determine aggregate coverage from whether each member was actually silenced.

✅ Addressed in c8b9b98

P2: releaseForQuit() does nothing until the detached HAL probe lets micMute.start() set isReady. Quitting during that startup window after a crash can leave the persisted microphone mute active with no app running to restore it; restore the saved state before allowing this termination path to finish.

Won't fix, by design; documented in releaseForQuit in c8b9b98. Before isReady the launch probe hasn't heard back from coreaudiod, so a HAL call during termination could hang the quit. Devices a previous run muted stay muted (fail closed) and the next launch adopts the persisted state.

P3: The sentence “A mute something else takes off” is ungrammatical and makes the behavior hard to understand; say “If another process unmutes a device, Sliders re-mutes it within milliseconds.”

✅ Addressed in c8b9b98

Fixed in c8b9b98.

P3: This menu is never given an explicit appearance, but the related Sliders menu in StatusItemMenu.swift needed menu.appearance = NSApp.effectiveAppearance because "the status bar window is pinned dark" and otherwise the menu inherits that and ignores the system theme. This menu is presented from the same kind of NSStatusBarWindow, so it can render pinned dark even when the system theme is light. Set the appearance here too.

✅ Addressed in c8b9b98

Fixed in c8b9b98. The menu takes NSApp.effectiveAppearance in menuNeedsUpdate.

P3: The scene doc comment above still says "The five scenes mirror the product's headline states…" while the array now holds eight scenes, including the newly added 08-microphone-muted. Update the comment to the real scene list and add the muted-mic headline state.

✅ Addressed in c8b9b98

Fixed in c8b9b98.

P3: The accessibility label is fixed to "Microphones muted" even when unprotectedDeviceNames is non-empty, while the tooltip and menu report "Microphones muted, except X". VoiceOver users hear a label that contradicts the actual state and are never told which mics remain live. Set the label in update() from the same conditional that builds the tooltip.

✅ Addressed in c8b9b98

Fixed in c8b9b98. The accessibility label is set in update() from the same text as the tooltip.

P1 Original microphone settings are lost

apply() changes a control even when reading its original value failed:

• A missing mute reading becomes false, so release can unmute a microphone the user had already muted.
• A missing gain reading leaves no saved gain, but Sliders still writes zero. Release then skips restoring it, or a later pass saves zero as the original.

Do not change a control until its original value is known, and add tests for failed reads.

Fixed in c8b9b98. MicMutePolicy.record returns nil for a never-read original, and apply then leaves the control alone. Covered by the new unreadableOriginal test.

P2 Default microphone restore is forgotten

restoreDefault() deletes defaultSwap before finding the original device or successfully restoring it. If that device is unplugged when the user unmutes, or the restore write fails, the saved choice is lost permanently. Keep the record for retry and clear it only after restoration succeeds or the user has chosen another default.

Fixed in 0d2467c. restoreDefault keeps the swap record until the write succeeds, or until the default has moved off to (a newer choice wins). A refused write is retried by the watchdog; an absent from is retried when the device list changes.

P2 New microphone choice is forgotten

swapDefaultIfUnprotected() always keeps the first from, even after the user selects a different microphone that cannot be muted. For example:

• Sliders replaces input A with protected input B.
• The user selects unprotectable input C, which Sliders also replaces with B.
• Unmuting restores A instead of the user's newer choice C.

Save the newer choice when replacing it, while keeping the protected input active during mute.

Fixed in 0d2467c. A swap now records the current default as from. Our substitute is protectable, so swapping again means someone picked another unprotectable device, and that pick is what gets restored.

P1 security Aggregate input can stay live

isCoveredBySubDevices checks whether members advertise controls, not whether those controls worked. If an aggregate has no working controls and a member refuses both writes, hold() still reports the aggregate as silent. Sliders then hides its warning and leaves it as the default input, so apps using it can still hear the microphone. Calculate coverage from the members' actual mute results.

How this was verified: Aggregate coverage uses only isSettable, while hold() accepts that coverage even when mute and gain writes fail.

Fixed in c8b9b98. Aggregate coverage is now computed in reconcile from the members hold() actually silenced.

Default input restore is dropped

Medium Severity

restoreDefault clears defaultSwap before the default is actually moved back. If from is briefly missing, to has already gone away, or the HAL write fails, the original default is forgotten and later release retries never restore it.

^{Reviewed by Cursor Bugbot for commit 8345037e6e4b3014213ad10f2fa5c6460ba05b28. Configure here.}

Fixed in 0d2467c, same change as the Greptile thread above.

Mute icon can stay hidden

Medium Severity

Unmuting sets isVisible to false on an NSStatusItem with an autosaveName, which persists that hidden state. The next launch that mutes again creates a new item, restores the saved hidden visibility, and can overwrite the following isVisible = true on a later turn, so the red mic never appears while mute is engaged.

^{Reviewed by Cursor Bugbot for commit 8345037e6e4b3014213ad10f2fa5c6460ba05b28. Configure here.}

Fixed in 0d2467c. makeItem clears the persisted NSStatusItem Visible/VisibleCC keys for this autosave name before setting it. Only the position is restored.

P2: restoreDefault decides whether to keep the swap record by looking the current default up in MicInputDevice.all(), and MicInputDevice.init(id:) filters devices out — a channel count that transiently reads 0 (sleep/wake, Bluetooth reconnect), an aggregate with no active sub-devices, or Sliders' own plumbing. If the current default is still to but filtered out, the lookup yields nil, the guard fails, and state.defaultSwap is dropped even though the default never moved. The record is then gone for good, so from is never restored and nothing retries it — the exact failure 0d2467c was designed to close. Compare the default's UID read directly from the HAL (currentID.readDeviceUID() == swap.to) and only drop the record when the identity is actually readable and different; keep it when indeterminate.

✅ Addressed in ad35f20

Fixed in ad35f20. restoreDefault reads the default's UID straight from the HAL (readDeviceUID()), and keeps the record whenever that read fails.

P3: The same failing key is used for two different refusal reasons in apply: the "Can't read ... before changing it" path (record returns nil) and the "Failed to mute/zero gain" path (write refused). Because failing keeps the key until a successful clearFailure, a device that first can't be read and later fails the write (or vice versa, in whichever order) never logs the second, distinct reason — it's swallowed as a duplicate. Use separate keys for the two reasons so each episode is reported once.

✅ Addressed in ad35f20

Default restore stops after read failure

Medium Severity

restoreDefault keeps defaultSwap when the current default's UID cannot be read, but it returns false. reconcile treats that as nothing left to retry and stops the watchdog. After mute and gain restores have already succeeded, no later pass is scheduled, so the default input stays on the substitute device.

^{Reviewed by Cursor Bugbot for commit ad35f20f7d7d02f282b6d4e2e358a515e03652dc. Configure here.}

Scroll stays off after re-enable

Low Severity

The scroll monitor is created only in onHover, and only when isEnabled is already true. onChange removes it when the slider disables, but does not install it when the slider enables again. A pointer that is already over the slider never regains scroll-to-adjust after global mute ends, or once input becomes live.

^{Reviewed by Cursor Bugbot for commit ad35f20f7d7d02f282b6d4e2e358a515e03652dc. Configure here.}