Controls batch 13b: stored-automation start (#1635-#1639), core-owned observation addressing and limits (#1676-#1678)

[tamashi095]

Controls batch 13b: stored automation gets its compiler, the fader stage gets timed operations, and every plan holds the session's jump lengths. The protocol retires the stored transport position and the unused span kinds. Observation taps are addressed by stable key and capped in the core, and an effect-row edit whose effect changed is refused in the core, on both hosts.

Closes #1635
Closes #1636
Closes #1637
Closes #1638
Closes #1639
Closes #1676
Closes #1677
Closes #1678

What changed

• Retire the protocol's stored transport position #1635 TRANSPORT_SET field 2, the snapshot's field 2 and the TRANSPORT_STATE event's field 3 (the stored transport position) are retired. A retired field is refused at decode in both flag forms (UNKNOWN_REQUIRED_FIELD mandatory, MALFORMED_FRAME optional), before any change and before any event is reserved. retired_code_rows() gains the two TRANSPORT_SET rows.
• Retire the automation span kinds and the sample rate that no producer uses #1636 AutomationSpanKind is {Point} and AutomationRate is {Block, None}. The retired values are refused and never reallocated. automation_segment_value and the Sample rate are deleted. The protocol half was already gone, so nothing on the wire moved.
• Compile stored automation into per-cell events in node time #1637 New crate crates/automation (no_std + alloc, depends on math only). It compiles stored automation into per-cell programs (ProgramBuilder, CellProgram) and generates events in node time on render (CellState, NodeSpan, CellEvents), allocation-free. The G5 scalar corpus is appended to the wasm gate corpus.
• Apply timed operations inside a block on the strip fader stage #1638 The fader stage takes timed operations inside a block: FaderOperation, a fixed-size FaderOperationSink on the render stack, and the pull trait FaderOperationSource. process_with cuts the block at each offset, so a split moves no bit. A lane's gain is held during a mute or unmute ramp (mute_ramp, carried across a swap). The live F22 rule: set_fader_gain on a muted lane only remembers the gain. New counter fader_operations_stopped. Nothing feeds timed operations to the fader stage until Render moving stored fader automation, seeks and latency #1647: no caller of process_with or try_process_settled_with_matrix_and_operations exists outside crates/builtins (checked on the integrated tree). Root ruled that Apply timed operations inside a block on the strip fader stage #1638 closes on its rescoped record: the unmute-ramp reissue mechanism is Render moving stored fader automation, seeks and latency #1647's design (its batch 13b amendment: requirement, constraints 1-7, gate 8 cases (a)-(e)), and Classify fader automation edits as carried rebuilds #1648 carries it.
• Hold the automation jump lengths in a plan cell #1639 Every graph plan holds one latest-target cell of the session's fader, mute and pan ramp lengths (GraphJumpLengths). Render reads it once per block at block entry, after the live snapshot. A control_smoothing change on a session whose automation reads a length is a live edit that writes the cell under the transaction's stamp, after every fallible check and before publication. Preparation refuses a handle set without the writer, so every epoch holds one.
• Cap the observation bindings by what one ended event holds #1676 One core cap on observation bindings: how many keys one OBSERVATION_ENDED frame holds with maximum IDs (1 KiB: 3, 4 KiB: 12, the browser's 16 KiB: 51). A batch is admitted whole by admit_and_push_observation_batch before any push. The browser refuses past the cap with the new command reason 15 observationLimit (RESULT_UNSUPPORTED, never backpressure; reasons 12-14 stay retired), and the SDK does not retry it. A tap named twice in one batch is refused. The ended-event reserve is charged by min(slots, cap) keys, not by the frame size.
• Address observation records by stable key in the core #1677 A browser observation record names its tap by stable key (strip ID, rack, effect ID, tap ID), resolved in the core by SessionState::resolve_observation_key on the newest committed plan. The record is 272 bytes (was 48); the command staging grows from 12,288 to 69,632 bytes, allocated at boot. The SDK's index remapping is deleted.
• Refuse an effect-row edit whose effect changed, in the core #1678 SET_CONTROL's address is its own message with an optional field 7, the effect the edit was written for. The core refuses a stale edit with control.effect.changed on both hosts (MisoControlRefusal in the SDK). The SDK's effectRowResolver is deleted. A stored automation target refuses field 7 in every section (review fold, root ruling).

Evidence

• The full local CI-equivalent set (batch-gates.sh: fmt, bench and realtime policies, the host-core feature matrix and loom, workspace clippy, the workspace tests, the doc job, every check-* script, the cross targets, the web build, the SDK headless suite, the fuzz check) passes on the integrated tree (head cddff37), with the SDK headless suite at 559 of 559. A first run on 4bbbcb2, before the review fold, was green too.
• Browser qualification in chromium, firefox and webkit with --check-matrix --self-test-mutations on cddff37: chromium 151.0.7922.34, firefox 153.0 and webkit 26.5 each print "all qualification gates passed". Render allocations are 0 in every row, observation-armed and observation-disarmed among them.
• Browser boot high-water growth: 20,447,232 bytes against the 20 MiB pin (20,971,520), unchanged from batch 13a.
• audit capi: pcm_digest bf7dcedd1d92621f (unchanged from main), 0 allocations, 0 locks, 0 syscalls.
• Allocation counts: Hold the automation jump lengths in a plan cell #1639's block that applies a write, Compile stored automation into per-cell events in node time #1637's event generator and Apply timed operations inside a block on the strip fader stage #1638's process_with (1,000 blocks) allocate and free nothing (bench_support::alloc thread counters).
• No pinned digest moved for Apply timed operations inside a block on the strip fader stage #1638's F22 live rule (no fixture moves a fader on a muted lane); fader_ramp gate 2 holds the rule for the timed operations and the live setter.
• The AArch64 legs of Compile stored automation into per-cell events in node time #1637 (scalar f64 corpus pins) and Apply timed operations inside a block on the strip fader stage #1638 (Simd4 on NEON) run only in CI: this host has no AArch64 toolchain.

Re-pins (each from a measurement)

• COMPLETE_SCHEMA_HASH, once for Retire the protocol's stored transport position #1635 and Refuse an effect-row edit whose effect changed, in the core #1678 together: 0xcc9a_7bcc_502c_4936 to 0x0c71_96f8_6abe_6d57. Each branch alone gave 0x3316_54b3_24d0_76e8 (Retire the protocol's stored transport position #1635) and 0x63ff_2e60_976e_0e21 (Refuse an effect-row edit whose effect changed, in the core #1678); neither stood on main. The parity strings, fuzz/corpus/complete-schema-manifest.md and docs/CONTROL_PROTOCOL_CONFORMANCE.md follow. The corpus stays 46 frames.
• Realtime policy floors 28 files / 129 regions to 32 / 149: Compile stored automation into per-cell events in node time #1637's three regions, Apply timed operations inside a block on the strip fader stage #1638's three, Hold the automation jump lengths in a plan cell #1639's two, and the count the tree had already reached before Compile stored automation into per-cell events in node time #1637 (the floors had fallen behind).
• capi_retained_bytes ceiling 205,312 to 182,400 (Cap the observation bindings by what one ended event holds #1676: the reserve is charged by slots, not by the frame). Measured 165,782 on the W lane, 165,934 on the integrated tree (+168, Hold the automation jump lengths in a plan cell #1639's cell), within the ceiling.
• Hold the automation jump lengths in a plan cell #1639's plan byte rows, each "the jump-length cell, Hold the automation jump lengths in a plan cell #1639 D1" (the cell is 168 bytes in 2 allocations, measured by gate 1; a count is 24 bytes; the revision gate 72):
  • host-core the_graph_row_counts_the_plans_gate_and_a_count_it_made_and_holds: no strip controls 72 to 264; the preparation's own count 96 to 264; the session's count 72 to 240.
  • host-core live_send_lanes_are_charged_against_the_graph_cap: live less idle is the route lanes only (was route lanes + 24); the live total is 118,304 on the head.
  • host-web the_graph_row_charges_the_plans_gate_and_not_the_sessions_superseded_count: 72 to 240.
  • capi graph_session_plus_plan_bytes measures 315,966 (main 315,798, +168), within its ceiling of 346,432.
• Browser expected resources: no row re-pinned. On the integrated tree bridgeRetainedBytes is 1,542,682 of 1,667,648 and graphSessionPlusPlanBytes 30,370 of 35,648. The review fold charges Address observation records by stable key in the core #1677's producer-to-instance table in the arm table (producer_slots); no exact row moved.
• Fixtures: crates/protocol/tests/fixtures/set-control-frames.json (Refuse an effect-row edit whose effect changed, in the core #1678's expectedEffect), the C ABI transport vectors (Retire the protocol's stored transport position #1635), and the generated SDK tables and .d.ts copies (Cap the observation bindings by what one ended event holds #1676 reason 15, Address observation records by stable key in the core #1677 record layout).

Review

Per-issue adversarial reviews (opus-high): #1637 PASS at attempt 3; #1638 three record FAILs and then the root rescope; #1676 PASS at attempt 2 with three minors folded; #1639 PASS with five minors folded (a typed writer, the cell's bytes measured, a C ABI test that a successor is seeded from the committed model, red on a constant seed).

One opus-high batch review of origin/main...4bbbcb2: FAIL on docs only. The code held: render stays allocation-, lock- and syscall-free; no ack precedes a drop on any new path (#1635 decode refusal, #1678 prepare refusal, #1676 whole-batch admission before any push, #1639 write after every fallible step); the hosts share the core; no placeholder code. Folded in 94a953f (code) and cddff37 (docs):

• MAJOR: the SDK README described the deleted resolver; it now describes the core refusal.
• MAJOR: Render moving stored fader automation, seeks and latency #1647's gate 8 had lost its acceptance criteria; they are back, with constraint 7 (the move at E replaces any cell gain operation there). Apply timed operations inside a block on the strip fader stage #1638's record names gate 8 cases (c) and (e).
• MAJOR (root ruling): Classify fader automation edits as carried rebuilds #1648's amendment now says the rows that render are rebuilds that seed the jump-length cell; a row that does not render yet reads no length, and its rendering slice does the same.
• MINOR (records): Apply timed operations inside a block on the strip fader stage #1638's gates 6 and 7 and Hold the automation jump lengths in a plan cell #1639's gate 6 browser legs now carry the integrated-tree evidence (5cfc37e, docs only, after the gated cddff37).
• Minors: the SDK coalescing key carries the expected effect; an observation change with no slot is refused before any push; an empty record ID is malformed; the scalar fader's gain_held/ramp_remaining return None past lane 1; the SDK cap error carries a diagnostic code; test claims match their assertions; stale prose after Retire the protocol's stored transport position #1635/Retire the automation span kinds and the sample rate that no producer uses #1636/Refuse an effect-row edit whose effect changed, in the core #1678; Cap the observation bindings by what one ended event holds #1676's attempt-1 text is marked superseded; Subscribe to an effect's observation tap with a transaction edit #1584, Prepare stored fader automation and render it flat #1646, Render stored mute automation on the strip #1651 amendments.

Recorded for root, no change here: #1676's cap assumes two 127-byte IDs per key (#1685 below). A SetMute that does not change the mute state still retargets the fader ramp (now a #1651 constraint).

Departures recorded in the specs

• Retire the protocol's stored transport position #1635: the refusal statuses are UNKNOWN_REQUIRED_FIELD / MALFORMED_FRAME, as for the retired track fields, not INVALID_FIELD.
• Retire the automation span kinds and the sample rate that no producer uses #1636: no wire re-pin; the protocol half was already gone.
• Compile stored automation into per-cell events in node time #1637: eight departures in its record (fallible NodeSpan::new, builder limits, reposition drops the held event).
• Apply timed operations inside a block on the strip fader stage #1638: the reissue mechanism moved to Render moving stored fader automation, seeks and latency #1647 (root ruling).
• Hold the automation jump lengths in a plan cell #1639: the cell is attached after bind; D3's row set is automation_jump_row; every plan charges its own superseded count; a control_smoothing change with no reading automation writes nothing (closed by Classify fader automation edits as carried rebuilds #1648's rebuild rule).
• Cap the observation bindings by what one ended event holds #1676: reason 15 observationLimit (root ruling); no C ABI parity row, because the C ABI observe edit is Subscribe to an effect's observation tap with a transaction edit #1584.
• Refuse an effect-row edit whose effect changed, in the core #1678: field 7 is on a new SetControlAddress message, not on the shared control address.

Issues to file from this batch's specs

• Admit observation bindings by the exact encoded bytes of the ended event #1685 (filed by root) admit-observation-bindings-by-the-exact-encoded-bytes-of-the-ended-event (root: first K slice of batch 14).
• Remove the redundant span kind and end from prepared automation spans #1686 (filed by root) remove-the-redundant-span-kind-and-end-from-prepared-automation-spans.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}