Controls batch 13a: mono/stereo sources only, empty sessions boot, automation row fixes, spectrum one-shot fix (#1681, #1682, #1631, #1632, #1616, #1679)

[tamashi095]

Controls batch 13a: an app can open an empty mixer and add stems by structural edits on both hosts, and sources are mono or stereo only (owner answers of 2026-10-15). The batch also keeps a one-shot spectrum window out of the continuous stream, copies a successor's armed taps from the core's mask, re-runs the automation row rule when a row's activity changes, and makes two rows non-automatable.

Closes #1616
Closes #1679
Closes #1631
Closes #1632
Closes #1681
Closes #1682

What changed

• Keep a one-shot spectrum window out of the continuous stream #1616 try_read_continuous_record (crates/host-core/src/spectrum.rs) loads the stream epoch once before its bounded pop loop and discards every record of another epoch. So a one-shot window that render pushes between the switch's drain and its mode store is never read as a continuous window. Make the spectrum one-shot handoff safe across threads #1609's one-record invalidation rule is subsumed and deleted, so render does two fewer atomic stores on a failure.
• Refuse a source with more than two channels #1681 One validator rule: Source::channels is 1 or 2, with the new typed code source.channels.unsupported, at load and in every structural edit, on both hosts. session::SOURCE_CHANNELS_LAUNCH_MAXIMUM = 2 is the one limit. The browser staging, the C ABI's plane bound and the SDK (new ABI-layout constant maximumSourceChannels) read it. The browser's source PCM staging falls from 130,560 to 1,024 bytes. On the C ABI, a chunk of three or more planes is now RESULT_INVALID_ARGUMENT at the boundary.
• Expose the armed tap mask from host-core #1679 EffectObservationHandle carries armed_taps, which the core sets exactly when the lane armed a tap. The browser's build_plan_shape copies it, and its duplicate binding match is deleted.
• Boot an empty session on both hosts #1682 An empty session (no source, track or route) boots on the core, the C ABI and the browser, and grows and shrinks by structural transactions. The one refusal on the path (EmptySources in prepare_graph_source_set) is deleted. HostPrepareCaps::maximum_source_channels is deleted, because the validator is the one limit. The browser fixes two sizes at zero: the meter lease reads the configured window instead of the strip meters, and the master ring is sized when no strip meter exists. On an empty mixer the meters publish the master's own windows. A boot that designates a master strip over an empty session is still refused (host.observation.master_track); see Designate the browser master strip after boot #1683.
• Run the automation row rule when a row's activity changes #1631 The classifier re-runs automation_diagnostics when controls::activity_changed holds (strip set or order, or a matrix_or_pan variant change), not only when the automation table changes. So a mode switch that strands a stored pan entry is refused control.inactive before any commit.
• Make a send's follows_mute and a strip's matrix_mode non-automatable #1632 The follows_mute and matrix_mode rows declare an AutomationRule::Excluded with a reason and a reopen condition, and they are refused control.automation.target on both hosts. The SDK tables and the control-list fixture follow.

Evidence

• The full local CI-equivalent set (batch-gates.sh: fmt, bench and realtime policies, the host-core feature matrix and loom, clippy, the workspace tests, the doc job, all check-* scripts, the cross targets, the web build, the SDK headless suite with 551 passing, and the fuzz check) passes on the integrated tree. The first run was cut short when the disk filled; the rerun passes.
• Browser qualification in chromium 151, firefox 153 and webkit 26.5 with --check-matrix --self-test-mutations on the integrated tree: each prints "all qualification gates passed", including Boot an empty session on both hosts #1682's new empty-boot-* gates. Render allocations are 0 in every row, empty-boot and empty-boot-first-stem among them.
• Parity rows in hosts/host-web/tests/control_parity.rs: Refuse a source with more than two channels #1681 (a three-channel source is refused alike at load and by structural edit, four rates); Boot an empty session on both hosts #1682 (empty boot, identical silence, list, state and snapshot bytes, then the first stem added by one transaction and heard bit for bit alike, four rates); Run the automation row rule when a row's activity changes #1631 (a mode switch under a stored pan entry is refused alike, four rates).
• Zero render allocations on the empty plan, across the first strip's swap and while the stem plays: crates/host-core/tests/empty_boot.rs, crates/capi/tests/empty_boot.rs (at 44.1, 48, 88.2 and 96 kHz) and hosts/host-web/tests/empty_boot.rs (render-locked allocator).
• audit capi: pcm_digest bf7dcedd1d92621f (unchanged), 0 allocations. Browser boot high-water growth 20,447,232 bytes (unchanged).
• Re-pins from measurements:
  • Refuse a source with more than two channels #1681: sourcePcmStagingBytes 130,560 to 1,024; the bridgeRetainedBytes ceiling 1,812,352 to 1,667,648; the simd128 memoryBytes 3,014,656 to 2,883,584.
  • Make a send's follows_mute and a strip's matrix_mode non-automatable #1632: the control-list fixture and the generated SDK tables.
  • Integration (Make a send's follows_mute and a strip's matrix_mode non-automatable #1632): check-browser-expected-resources measured the simd128 initial and before-dispose memoryBytes at 2,818,048, one 64 KiB page less than 2,883,584. I bisected this to 167fc10 (Make a send's follows_mute and a strip's matrix_mode non-automatable #1632); the stream did not run this gate. A smaller boot is benign, so it is re-pinned from the measurement in 8fa4543. The set-control timeline row stays 2,883,584.
• Make a send's follows_mute and a strip's matrix_mode non-automatable #1632 holds each exclusion by reference: an inline pair of strings grew the live-only control_command peak heap past Shrink the peak heap of a live-only commit #1615's 78,000 ceiling (81,451). The reference gives a 77,347 first peak and 72,588 steady.

Review

One opus-high review of the 13a diff (origin/main...8fa4543, plus the numbering commit): PASS with findings, no BLOCKER or MAJOR. The reviewer ran the focused tests and the #1616 loom model, and proved the #1616 epoch arm and the #1631 classifier step red on revert. No ack precedes a drop: #1631 and #1681 refuse before commit, and #1616 discards only records that are not windows of the current stream. Folded in 9d12d49:

• The Make a send's follows_mute and a strip's matrix_mode non-automatable #1632 list test pinned an exclusion's reopen wording; it now asserts only that a reason and a reopen condition exist.
• The Keep a one-shot spectrum window out of the continuous stream #1616 comment said only control moves the epoch; it now names render's failure path too.

Recorded, no change:

• On both hosts, three or more planes return RESULT_INVALID_ARGUMENT with no last-error diagnostic.
• Make a send's follows_mute and a strip's matrix_mode non-automatable #1632's preparation and session-validator codes share one check rather than having a new test.
• On an empty session, spectrum capture, solo and monitor, and input liveness are not exercised (follow-up, not a gate).
• A continuous record that render pushes in the same block as a failure can still be read once. This race predates the batch; Make the spectrum one-shot handoff safe across threads #1609's flag had the same window.

Departures recorded in the specs

• Keep a one-shot spectrum window out of the continuous stream #1616: Make the spectrum one-shot handoff safe across threads #1609's invalidation fields are removed, because the epoch check subsumes them.
• Refuse a source with more than two channels #1681: no per-host channel cap; the validator rule is the one limit. A three-plane C ABI chunk is now RESULT_INVALID_ARGUMENT with no last-error diagnostic.
• Boot an empty session on both hosts #1682: crates/capi/tests/empty_boot.rs joins the realtime policy's unsafe allowlist, like every capi test binary that calls the C entries.
• Run the automation row rule when a row's activity changes #1631: the browser parity gate is a separate test, not a script row, because a rebuild route refusal is a non-ok entry result on both hosts.
• Make a send's follows_mute and a strip's matrix_mode non-automatable #1632: the exclusion is held by reference (the heap ceiling above).

Issues filed from this batch's specs

• Refuse a source with more than two channels #1681 refuse-a-source-with-more-than-two-channels (implemented here; closes with this PR).
• Boot an empty session on both hosts #1682 boot-an-empty-session-on-both-hosts (implemented here; closes with this PR).
• Designate the browser master strip after boot #1683 designate-the-browser-master-strip-after-boot (successor of Boot an empty session on both hosts #1682; stays open). Since an empty session boots, a master strip cannot be named at boot; Designate the browser master strip after boot #1683 makes the master designation something the app sets or changes after boot, through the one core path.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}