Controls batch 12b: the browser accepts structural edits; the last host difference is gone (#1562b, #1584 D6b, #1290 d2)

[tamashi095]

Controls batch 12b: the browser accepts structural edits. The sequenced web.apply.rebuild_pending refusal and the core hook behind it are gone, so a rebuild-path transaction runs through the one core path on both hosts. The browser keeps meters, acknowledged subscriptions and spectrum captures running across the swap, the SDK follows the new structure, and a rebuild can add any valid source.

Closes #1562

#1584 stays open (its C ABI Observe edit, D1-D5, D7, D8, follows). #1290 stays open for (b), which waits for supersession (#1310); (d1) and (d2) are done and (e) needs no code.

What changed

• Subscribe to an effect's observation tap with a transaction edit #1584 D6b build_plan_shape sets a browser successor's arm bits from the ObservationBindings the core carries in SuccessorBase: a restarted effect's acknowledged subscription keeps publishing windows from the adoption block; a removed insert's ends with one OBSERVATION_ENDED and no slot.
• Replace the running browser session in the Rust host #1290 (d2) The preparer leaves each plan's spectrum captures and pairing beside its tables; the browser promotes them in commit order at the start of the service step through SpectrumService::adopt_successor with the engine's real carry outcome, so a running stream, an armed one-shot and a collection selection continue across a rebuild; a stream that does not carry ends together with its analysis.
• #1562b-W web.apply.rebuild_pending, the browser preparer's override, allow_rebuild and the test-only structural command are deleted; every structural transaction goes through control_command. WebMeterHeader grows 80 -> 88 bytes with structure_epoch; the worklet re-reads sources and observation bindings at each map request; the browser SDK names meter frames and observation maps by the strip order of their epoch. A new structural-apply qualification row checks the rebuild path in three browsers.
• #1562b-K RuntimePreparer::refuse_rebuild and its call are deleted. The SDK names meter frames by the control list of the epoch they carry, resolves named effect rows from the list's section headers just before encoding, re-addresses observation records to the strip's current index, and ends managed subscriptions on OBSERVATION_ENDED.
• Review B1 (root ruling A) The browser sizes its ID staging at the StableId maximum (a new session::STABLE_ID_MAXIMUM_BYTES = 127, now the one constant) and its source PCM and plane staging at the grammar's channel maximum (255), so a rebuild can add any valid source; copy_id_into_staging returns a typed error, never a panic.

Evidence

• Full CI-equivalent local set (batch-gates.sh incl. bench and realtime policies, host-core feature matrix and loom) plus trace-graph-audit.sh; browser qualification in chromium, firefox and webkit with --check-matrix --self-test-mutations (including the new structural-apply row): all green on the final head d32a9ca3b (SDK headless 550 pass, 0 fail; trace-graph-audit 1,000,000 blocks); each browser prints "all qualification gates passed".
• Publish the applied-revision watermark in the browser status #1349's rebuild leg (deferred to #1562b since batch 8): a rebuild then a live edit before the swap; the browser status words stay at the initial revision until the swap block, then equal the C ABI's miso_engine_v1_plan_watermark at all four rates.
• Parity: control_parity.rs now scripts six rebuild steps (output route gain and mute, delay_samples, the multiband and delay prepared bypass) with browser and C ABI identical per block; a new row adds the longest-ID stereo source by rebuild to a mono-boot session at four rates.
• Browser boot-budget growth 20,447,232 bytes (unchanged); wasm memoryBytes after boot 2,883,584 -> 3,014,656 (the staging); bridge_retained_bytes 1,631,181 -> 1,764,878 with its ceilings re-pinned from measurements. audit capi pcm_digest bf7dcedd1d92621f, 0 allocations.
• ABI mirrors (88-byte meter header) regenerated with the repository generators; check-abi-layout-v1.py and its self-test pass.

Review

One opus-high review of 12b's diff: FAIL on one BLOCKER, fixed here (B1: the browser's source staging was sized from the boot session, so a rebuild adding a stereo or longer-ID source trapped the wasm instance or went sticky after its ack; root ruled the maxima sizing). Folded: observation records wait for (or refuse on) an observation map of a different structure epoch than the list that addresses them, so a subscribe cannot arm another effect's tap during the commit-to-adoption window; a dropped stream's analysis ends at promotion; meter frames the SDK cannot name are counted; an OBSERVATION_ENDED older than a binding's arm is ignored; a live epoch-moving leg in the header-epoch test; a stale decision-record line. Integration fixes: a private doc link, and the meter-epoch evals wait on their condition instead of a 20 ms timer.

Issues to file (placeholder specs in this branch)

• Cap the observation bindings by what one ended event holds #1676 (filed by root) cap-the-observation-bindings-by-what-one-ended-event-holds (root: also sizes the ended-event reserve by capacity).
• Address observation records by stable key in the core #1677 (filed by root) address-observation-records-by-stable-key-in-the-core.
• Refuse an effect-row edit whose effect changed, in the core #1678 (filed by root) refuse-an-effect-row-edit-whose-effect-changed-in-the-core.
• Expose the armed tap mask from host-core #1679 (filed by root) expose-the-armed-tap-mask-from-host-core.

Open questions sent to root: a launch maximum for source channels (the staging uses the grammar's 255; a ruling of 2 would shrink it to about 1 KB), and whether a session with no source should boot.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}