The Wrong Speaker Is a Privacy Bug

"If the right speaker isn't there, say so. Never quietly play private audio on whatever speaker happens to be."

Output Has a Named Destination

Bellows plays to a specific output — a named audio interface, opened as a 48 kHz stereo stream with a small gain trim. That specificity is deliberate: the sound is going to a particular device in a particular room. So the interesting question isn't the happy path, it's what happens when that device can't be found at playback time — unplugged, renamed, asleep.

Rerouting Is Not Graceful Degradation

The instinct baked into a lot of audio code is to fall back to the system default output so something plays. For a notification chime, fine. For a voice engine speaking private words, that fallback is a leak: the sentence meant for a specific speaker now plays wherever the OS default points — maybe a shared room, maybe a screen share, maybe a Bluetooth headset that reconnected in someone else's pocket. Nothing warned anyone. Bellows refuses this. Device resolution fails loud instead of silently moving private audio elsewhere.

The Same Instinct as a Missing Voice

You've seen this shape already, in Track 3: a missing voice binding fails loud rather than substituting a convenient wrong voice. A missing device is the same principle one layer down. In both, the "helpful" substitution produces a confident success that betrays the request — wrong voice, or right voice in the wrong room. The safe answer to a missing precondition, whether it's a binding or a speaker, is an explicit error, not a guess.

Code

Resolve the exact device or fail -- never reroute·python

def open_output(preferred: str) -> Stream:
    dev = find_device(preferred)          # e.g. the named studio interface
    if dev is None:
        # DO NOT fall back to the system default. Private audio could play
        # on the wrong speaker, in the wrong room, with no warning at all.
        raise AudioDeviceUnavailable(preferred)
    return dev.open(samplerate=48000, channels=2, gain_db=-3.0)

# A wrong-speaker success is a PRIVACY failure, not a graceful degradation.
# Same instinct as a missing voice binding: stop by name, never substitute.

Exercise

Find a 'graceful degradation' in a system you know where a missing target is quietly replaced by a default — a fallback output, a default recipient, a nearest region, a catch-all channel. Ask whether the substitute could ever expose something to the wrong audience. If it could, describe the leak, and decide where the line is between acceptable fallback and privacy breach.

Hint

Graceful degradation is safe when any target is acceptable. It becomes a breach the moment the specific target mattered for privacy. 'Play somewhere' is fine for a chime and dangerous for a sentence meant for one room.