Controls batch 13b: stored-automation start (#1635-#1639), core-owned observation addressing and limits (#1676-#1678)

.github/ISSUE_SPECS/1584-subscribe-to-an-effects-observation-tap-with-a-transaction-edit.md

@@ -584,3 +584,13 @@ shipped module sha256 is `179a933a...c3c1ae`; no export, layout or JS file chang
   arm was sent and ignores an `OBSERVATION_ENDED` event of a commit at or before it: that event ended
   an earlier arm of the same tap. `ControlTransactionQueue.readCommittedRevision()` reads it from the
   core.
+
+## Amendment (controls coordinator, batch 13b)
+
+- **The C ABI observe edit uses the core's two calls.** The edit of D1-D5 resolves its tap with
+  `SessionState::resolve_observation_key` (#1677: the stable key on the newest committed plan, never
+  a plan position) and admits and queues its changes with
+  `SessionState::admit_and_push_observation_batch` (#1676: one naming per tap, the key-count cap,
+  then the room, whole or nothing), both in `crates/control-plane/src/control.rs`. The browser's
+  record calls the same two, so the cap and the stable key hold alike on both hosts. The edit adds
+  no admission or key lookup of its own.

.github/ISSUE_SPECS/1635-retire-the-protocol-transport-position.md

@@ -146,3 +146,61 @@ Checked against `12d4a4f9d`.
 - **Anchors moved.** The stored position is `transport_position` (`crates/host-core/src/control_provider.rs:339`,
   seed `:405`, set `:1186-1187`, snapshot `:1179`). #1315 has landed and kept `TRANSPORT_SET`.
   Decision 17 does not touch the transport. Batch P1, ready.
+
+## Decision record: #1635 (batch 13b)
+
+**Shipped.** `TRANSPORT_SET` field 2, `TransportSnapshot` field 2 and `TransportStateEvent` field 3
+(the stored position) are retired. Each message has a `RETIRED` spec in `crates/protocol/src/schema.rs`
+(`transport_set`, `transport_snapshot`, `transport_state_event`) and its decoder reads through
+`schema_spec_retiring`, so a retired field is refused in either flag form: optional as
+`InvalidTlv` (`MALFORMED_FRAME`), mandatory as `UnknownRequiredField`
+(`UNKNOWN_REQUIRED_FIELD`). The remaining field IDs keep their numbers (snapshot 1 and 3; event 1, 2,
+4 and 5). `TransportSetRequest`, `TransportSnapshot`, `TransportStateEvent`,
+`ReliablePayload::TransportState` and `ReliableSlot::transport_state` lose `position`; the encoded
+lengths are 16 (set), 48 and 64 (event without and with origin; were 64 and 80). The provider trait
+keeps its shape; host-core's provider and `MockProvider` lose `transport_position`. D5: a set with a
+position is refused at decode, before any change and before any event reservation, so no ack
+precedes a drop.
+
+**Re-pins** (reason "#1635 retires the stored transport position"): `COMPLETE_SCHEMA_HASH`
+`0xcc9a_7bcc_502c_4936` to `0x3316_54b3_24d0_76e8` with its history line in
+`crates/conformance/src/protocol_corpus.rs`; the two parity strings in
+`scripts/check-protocol-wasm-parity.sh`; `fuzz/corpus/complete-schema-manifest.md` (hash, history
+line, and the prose that named an optional transport position); `docs/CONTROL_PROTOCOL_CONFORMANCE.md`;
+the C ABI vectors with a transport frame in `crates/capi/src/runtime/tests.rs` (the two snapshot
+vectors, `TRANSPORT_20`/`TRANSPORT_21`, the `RESPONSES` snapshot, and the three event vectors),
+re-derived mechanically by deleting the position field and fixing the payload length and field count.
+The corpus frame count stays 46.
+
+Integrated in batch 13b: one re-pin from `0xcc9a_7bcc_502c_4936` to `0x0c71_96f8_6abe_6d57` for #1635 and #1678 together.
+
+**Departures.**
+
+- D3 says `retired_code_rows` gains one row per retired field. A `RetiredCodeRow` is a command frame
+  an endpoint answers, so only `TRANSPORT_SET` field 2 can be a row. It has two rows, one per flag
+  form (`retired.transport_set_field_2.mandatory`, `.optional`). The snapshot and event fields are
+  refused by `b3a_transport_goldens_truncation_and_direct_codec_are_strict` in both flag forms.
+- Gate 1's status: the refusals answer `UNKNOWN_REQUIRED_FIELD` (mandatory) and `MALFORMED_FRAME`
+  (optional), the statuses the retiring machinery maps to for the track fields, not `INVALID_FIELD`.
+- Corpus `counter_command_frame` now gives `TRANSPORT_SET` an exact revision 7 (a set requires one).
+- Anchors had moved (queue.rs `:61`/`:138`, host-core `:337`); followed the code. Mechanical edits
+  outside the listed paths: `hosts/host-web/tests/protocol_cross_host.rs` (the `TransportSetRequest`
+  literal and the unused `SampleTime` import). The SDK mirrors no transport frame; no SDK input changed.
+
+**Gates.**
+
+1. Refused: `a_transport_set_with_the_retired_position_changes_nothing` (both flag forms: status, revision,
+   session, reliable lane and `TRANSPORT_GET` state unchanged) and
+   `retired_and_console_refused_codes_meet_their_conformance_rows` (rows 16+4+7+13+1+4+10+2+1).
+   Decoder: `b3a_transport_goldens_truncation_and_direct_codec_are_strict`.
+2. State still works: `a_transport_set_answers_the_state_and_queues_one_event_with_it`,
+   `b3a_transport_btlv_is_typed_idempotent_and_emits_reliable_state` (event golden re-pinned, 64 bytes).
+3. `cargo test --locked -p protocol` (163), `-p conformance` (`frozen_corpus_bytes_and_typed_decoders_are_unchanged`),
+   `-p host-core --lib control_provider`, `-p capi --lib runtime` (114), all green;
+   `bash scripts/check-protocol-wasm-parity.sh` ok (simd128); `scripts/run-protocol-allocation-audit.sh`
+   ok; `audit capi`: zero allocations, locks and syscalls, `pcm_digest` `bf7dcedd1d92621f`, equal to base.
+4. `scripts/check-cross-targets.sh` was not run here (coordinator's batch gate); the change adds no
+   memset-style code.
+
+**Successor.** `docs/CONTROL_PROTOCOL_SEMANTICS.md:23` still says "locating transport cancels
+nothing"; reword when that file is next in scope (outside this slice's authorized paths).

.github/ISSUE_SPECS/1636-retire-the-span-kinds-and-sample-rate-no-producer-uses.md

@@ -165,3 +165,39 @@ Checked against `12d4a4f9d`.
   add `crates/controls/src/effect_rows.rs` to the authorized paths.
 - **Anchors.** `AutomationRate` is now `crates/effect-contract/src/lib.rs:415`; re-read the rest at
   filing. Batch P1, ready.
+
+## Decision record: #1636 (batch 13b)
+
+**Shipped.** `AutomationSpanKind` is `{Point=1}` and `AutomationRate` is `{Block=2, None=3}`;
+`from_raw` refuses 2 to 4 and 1 (comments name the values retired, never reallocated).
+`automation_segment_value` is deleted; `valid_runtime_span` checks only a `Point`; the descriptor
+check (`parameter_automation_smoothing_valid`) accepts only `Block` for an automatable parameter;
+`validate_automation_block` no longer re-checks the kind. The metadata tool's rate name and the
+independent gate's `RATES` lose `sample`; the gate's self-test gains the mutation "the retired
+sample automation rate returns". `controls`' `parameter_class` loses its `Sample` arm and the test
+that existed only for it. The conformance reference mock keeps only `Point` spans: its per-lane
+`active` span state is gone, so its state payload is 20 bytes per lane (was 56). The randomized
+generator draws only `Point` spans at the block's first sample. The delay's malformed-span test
+uses a `Point` whose end sample differs from its start. Fixtures that declared `Sample` declare
+`Block` (`live_window.rs` loses its `Sample` row: `NOT_LIVE` is 2). The policy manifest row, the
+docs (`EFFECT_CONTRACT_V1.md`, `CONTROL_PROTOCOL_SEMANTICS.md`) and two comments are updated.
+
+**Departures.**
+- The protocol half was already gone (amendment): no `ParameterAutomationRate`, no parameter
+  descriptor frame, so D3 has nothing to re-pin. `COMPLETE_SCHEMA_HASH` and the wasm-parity strings
+  do not move (`check-protocol-wasm-parity.sh` passes unchanged), and `retired_code_rows` gains no
+  row: there is no frame that can carry rate 1. Gate 1 is held by `retired_automation_values_are_refused`
+  and the truth table in `crates/effect-contract/src/lib.rs`.
+- Mechanical edits outside the listed paths: `crates/effect-contract/tests/live_window.rs`,
+  `crates/host-core/src/prepare.rs` (a comment), `docs/CONTROL_PROTOCOL_SEMANTICS.md`.
+- The registry has no rate line any more, so `CONTROL_PROTOCOL_REGISTRY.md` is unchanged.
+
+**Gates.** `cargo test --locked` for effect-contract, effect-compiler, conformance (randomized
+included), controls, delay, parameter-metadata, compressor, gate-expander, soft-clip,
+true-peak-limiter, parametric-eq, multiband-compressor, transient-shaper, protocol and host-core
+(`--features test-support`) and `capi --lib runtime`: all pass. `check-effect-runtime-policy.sh`,
+`test-effect-runtime-policy.sh`, `check-protocol-wasm-parity.sh`, `check-sdk-generated.sh`,
+`check-workspace-policy.sh`, `check-parameter-metadata-v1.py --self-test`: pass. Clippy
+`-D warnings` (all-targets, all-features) on the touched crates and `cargo fmt --all`: clean.
+`audit capi`: `pcm_digest` `bf7dcedd1d92621f` (same as base), zero allocations, locks and
+syscalls; protocol allocation audit ok.