Controls batch 12a: subscriptions survive restarted and removed owners; spectrum carries; meter frames follow the strip count (#1584 D6a, #1395, #1618, #1290 d1, #1106)

[tamashi095]

Controls batch 12a: no acknowledged subscription is lost at a swap any more, spectrum captures carry, and the browser keeps meter frames running across a strip-count change. An acknowledged subscribe survives its effect owner's restart, and a removed owner's subscription ends with one OBSERVATION_ENDED event per commit (both hosts). Spectrum captures and collections carry by key and pair at promotion on the control side; a capture that does not carry settles honestly. The browser publishes the successor's correctly shaped meter frame from the first block after a strip-count swap, and the spectrum hop probe that failed CI on four PRs waits on its deadline.

Closes #1395
Closes #1618
Closes #1106

#1584 stays open: this batch is its D6a (core); D6b (browser) is in batch 12b, and the C ABI Observe edit (D1-D5, D7, D8) follows. #1290 stays open: (d1) is here; (d2) is in batch 12b.

What changed

• Subscribe to an effect's observation tap with a transaction edit #1584 D6a ObservationBindings (controls) is owned by SessionState beside the monitor overlay and travels to every successor in SuccessorBase (root ruling). Each successor arms its taps at preparation with a prepared arm on ObservationLane whose window starts at its first accumulated block, so a restarted owner keeps an acknowledged subscribe, applied or still pending; a carried tap's own state wins. A binding whose target is gone ends with one reliable OBSERVATION_ENDED (0x8011) per commit carrying every ended key (root ruling A), its room reserved beside SESSION_COMMITTED and its size checked at preparation; a lane full of unread events is BACKPRESSURE with nothing changed; an event that cannot fit one control frame refuses the commit as a resource limit. Same on both hosts, with a parity row. The browser admits an Observe inside process(), so push_effect_observe records per-slot state in preallocated storage and the next service() folds it (command() services first).
• #1395a/#1395b A spectrum capture or collection whose key (target, channels), kind, rate and quantum are unchanged carries its observer through the swap (one-shot state included; a collection's selection follows its entry); the control side pairs the readers at promotion (SpectrumService::adopt_successor), never in the swap block.
• Settle a one-shot spectrum capture across a plan swap #1618 A capture that does not carry settles at promotion: a one-shot starts the successor's capture Invalid with its generation (one CaptureInvalid read, then a new arm completes), a stream ends, a lost collection selection releases its arm.
• Replace the running browser session in the Rust host #1290 (d1) The meter frame, its header and a carried-from table travel with the PlanShape; the worklet cuts each set's views in the message handler that commits and switches by reference when the active header reads retired, so process() never cuts a view or allocates (root ruling). WebMeterHeader grows 72 -> 80 bytes (retired, frame and successor pointers); the ABI mirrors follow.
• Bound the browser spectrum hop probe by its deadline, not a poll count #1106 The browser spectrum hop probe waits for two windows one hop apart on a 10 s deadline with a 5 ms yield and a permanent planted 750 ms slow start; a new qualification row and four self-test mutations hold it. The old 512-poll loop fails the planted start in chromium and webkit.

Evidence

• Full CI-equivalent local set (batch-gates.sh: fmt, workspace clippy, workspace tests, the doc job, bench and realtime policies, the host-core feature matrix and loom step, fixtures, ABI, protocol parity and allocation audit, cross-targets, the AudioWorklet build/check with the boot budget, SDK headless, expected resources, fuzz) plus trace-graph-audit.sh; browser qualification (--check-matrix --self-test-mutations) in chromium, firefox and webkit: all green on the final head 5f378f426 (SDK headless 528 pass, 0 fail; trace-graph-audit 1,000,000 blocks); each browser prints "all qualification gates passed".
• Browser boot growth 20,447,232 bytes (unchanged; 8 pages under the 20 MiB pin).
• audit capi pcm_digest bf7dcedd1d92621f (unchanged), 0 allocations.
• Re-pins, each recorded with its reason: COMPLETE_SCHEMA_HASH (D6a adds event 0x8011, then the fold makes it one event per commit with repeated keys); two C ABI capabilities vectors; WebMeterHeader ABI mirrors; capi_retained_bytes ceiling 181,696 -> 205,312 (the review fold charges a frame-bounded OBSERVATION_ENDED reserve per cell and the bindings table; measured 186,614 plus 10 %, rounded to 64).

Review

One opus-high review of the batch diff: PASS with findings, no blocker. Root's question answered: the in-process() Observe path allocates nothing (lookups and one enum write into preallocated storage; the allocating fold runs only from the service step and command()). Folded: the meter-header successor-pointer checks were always true on 64-bit native hosts and now compare full-width addresses (red on a missing pointer); the OBSERVATION_ENDED cells are charged by a frame-bounded ceiling, and the bindings table and its after() copy are charged; the observation slots are built with fallible allocation before the commit; a control-plane test shows an over-frame end event refuses as a resource limit with nothing changed; two dead public methods deleted; doc and error-name fixes.

Issues to file

• Pair carried meter and observation readers on the C ABI #1674 (filed by root) pair-carried-meter-and-observation-readers-on-the-c-abi (placeholder in this branch).
• Successor (from D6a): cap the observation bindings at admission by the number of keys one control frame holds, so the over-frame refusal cannot be reached.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}