Controls batch 14a: exact-byte observation admission, automation target checks at preparation, master strip after boot (#1685, #1645, #1686, #1683)

[tamashi095]

Controls batch 14a: observation subscriptions are admitted by the exact bytes of the event that ends them, builtin automation is validated against its rows before any ack, prepared automation spans lose the fields no producer fills, and an app sets the master strip after boot through one core row on both hosts.

Closes #1685
Closes #1645
Closes #1686
Closes #1683

What changed

• Admit observation bindings by the exact encoded bytes of the ended event #1685 The core admits observation subscriptions by the exact encoded bytes of the OBSERVATION_ENDED event a commit could emit. This replaces Cap the observation bindings by what one ended event holds #1676's key count, which assumed two 127-byte IDs per key. A key is 64 + pad8(strip ID) + pad8(effect ID) bytes, measured with the real codec at compile and checked against it. Each observation slot keeps its key size in existing padding, so admission allocates nothing (counted 0). The refusal is ObservationLimit { index, event_bytes, frame_bytes }, whole and before any ack. The browser keeps reason 15 observationLimit and RESULT_UNSUPPORTED. The ended-event reserve charges a ceiling over every admissible key set. At the browser's 16 KiB frame, a 64-track session subscribes a meter tap on every insert. The C header now gives the rule for maximum_control_frame_bytes: 64 insert meters with IDs of 8 bytes or less need 5,184 bytes, and 6,208 bytes with 16-byte IDs (root ruling).
• Validate builtin automation targets against their rows at preparation #1645 controls::automation_diagnostics refuses a builtin automation whose segment shape a row cannot take (control.automation.shape, e.g. a polarity flip written linear). It also refuses an input-filter curve that puts the HPF at or above the LPF (control.automation.order), for every pair of stored values up to 128 samples apart, because render leads or lags each stored filter value by up to 64 samples. Preparation, the classifier and session-validator call it, so both hosts refuse alike, before any ack. Review fold: a static HPF or LPF edit on a strip with filter automation also meets the order rule, on the full classifier and the fast path (Render stored input HPF and LPF automation #1660 keeps only the classification of such edits).
• Remove the redundant span kind and end from prepared automation spans #1686 PreparedAutomationSpan is {channel, parameter_index, sample, value}. AutomationSpanKind is deleted, and its retired values stay documented. The validation verdicts are unchanged for every valid point. A test that existed only for a removed field is deleted. No rendered bit moved.
• Designate the browser master strip after boot #1683 The master strip is a core monitor row, master, on every strip. It is held by strip ID in the control plane's monitor overlay, like solo, and is never saved or snapshotted. SET_CONTROL keeps the revision and reports path monitor, and at most one strip is master. A transaction that removes the master strip ends the designation. The browser boot word liveControlMasterTrackPlusOne designates the first plan only; every later plan follows the overlay by ID. This fixes a latent defect: a rebuild reused the boot index after a strip was inserted before the master. The SDK generates strip.master(enabled).

Evidence

• The full local CI-equivalent set (batch-gates.sh) passes on the integrated tree (head c211890, after the review fold). The SDK headless suite passes 560 of 560. The first run's fuzz check failed on fuzz/Cargo.lock, because Validate builtin automation targets against their rows at preparation #1645 adds the automation crate to controls. The lockfile is updated offline in c19b867, and cargo check --locked on the fuzz manifest passes.
• Browser qualification with --check-matrix --self-test-mutations on c211890 passes in chromium 151.0.7922.34, firefox 153.0 and webkit 26.5. Render allocations are 0 in every row.
• Browser boot high-water growth: 20,512,768 bytes, one page more than batch 13b and within the 20 MiB pin (20,971,520).
• audit capi: pcm_digest bf7dcedd1d92621f (unchanged), 0 allocations, locks and syscalls.
• Parity rows in hosts/host-web/tests/control_parity.rs: Designate the browser master strip after boot #1683, designate, move, refuse and clear the master after an empty boot. Admit observation bindings by the exact encoded bytes of the ended event #1685 has no C ABI observe edit yet (Subscribe to an effect's observation tap with a transaction edit #1584), so its core admission is tested through SessionState, which every host calls.

Re-pins (each from a measurement)

• simd128 memoryBytes (initialStatus, beforeDisposeStatus): 2,818,048 to 2,883,584, one 64 KiB page (Designate the browser master strip after boot #1683: one more own row per strip in the catalog, plus the overlay's master). Measured on the base and on the head.
• Admit observation bindings by the exact encoded bytes of the ended event #1685's ended-event reserve (observation_reserve_bytes, (active, token)): at 4 KiB with 51 slots or more, (26,616, 3,720) to (27,880, 3,928); at 16 KiB with 64 slots, (113,118, 15,810) to (101,792, 15,904). No pinned row moved, because the C ABI allocator oracle reads the function itself.
• fuzz/Cargo.lock gains automation (Validate builtin automation targets against their rows at preparation #1645).

Review

One opus-high batch review of origin/main...96a5ee5: FAIL, with no blocker. No ack precedes a drop on any path: #1685 admits before anything is queued and the commit reserves room for the ended event before preparing; #1683 validates the master write before commit and writes the overlay after the last fallible step. Folded in 64bd6b9 (records) and c211890 (code):

• MAJOR (Admit observation bindings by the exact encoded bytes of the ended event #1685): the binding-table reserve was not a ceiling. The table keeps its high-water capacity, while the ID text belongs to a later armed set. The reviewer's sequence (129 short taps, disarm, 51 longest taps) holds 31,386 B against the old charge of 26,640 B. The new charge (capacity peak plus text peak) is 31,568 B, and the new test is red on the old formula. No pinned row moved.
• MAJOR (Remove the redundant span kind and end from prepared automation spans #1686): a fuzz modulus change made the duplicate-descriptor case unreachable; it is restored.
• MAJOR (Validate builtin automation targets against their rows at preparation #1645, root ruling (a)): the order rule checked the stored curve only, but render leads a filter value by up to 64 samples (grid lookahead) and lags it by up to 64 (jump ramp). The rule now holds the HPF below the LPF for every stored pair up to 128 samples apart (ORDER_REACH), so stored automation is never accepted and later refused in render. The reviewer's counterexample is a refused case, and the test is red at a reach of 64. Render stored input HPF and LPF automation #1660 must keep each reach at or below 64 samples, or widen the rule in the same change.
• Minors: Designate the browser master strip after boot #1683's master now takes effect at adoption (only pending shapes are updated once a replacement is published). New tests: a boot-word master follows its strip through a live write and a rebuild; solo and master on one strip are two writes on both paths. The parity test reads typed fields, and the registry names the master row. Validate builtin automation targets against their rows at preparation #1645 drops a per-comparison String clone, gains three asserts, and deletes two tests that duplicated Refuse automation on effect parameters that are not block-rate #1335's. Line widths and stale specs (Render stored input HPF and LPF automation #1660, Process an effect node in pieces at automation events #1662, Admit observation bindings by the exact encoded bytes of the ended event #1685 sizing) are fixed.
• Recorded: Designate the browser master strip after boot #1683's master row is core state on both hosts; the C ABI reading is Read the master strip's meter on the C ABI #1690 (decision 17 C1).

Departures recorded in the specs

• Admit observation bindings by the exact encoded bytes of the ended event #1685: 64 keys cannot fit one event at 4 KiB, since a key takes at least 80 bytes (ruling A: one ended event per commit). Root accepted this. The C header now gives the sizing rule.
• Validate builtin automation targets against their rows at preparation #1645: the shape and order rules live in controls, not in builtins-compiler (amendment). Gate 3's stage index is 4. The live_delta test target needs the control-provider feature.
• Designate the browser master strip after boot #1683: the designation is a monitor row, not a session field, so it is never saved and keeps the revision.

Issues to file from this batch's specs

• Pin the browser wasm memory as a ceiling #1691 (filed by root) pin-the-browser-wasm-memory-as-a-ceiling (root ruling: an exact memoryBytes pin that moves one page with unrelated changes becomes a ceiling with a recorded margin).
• The successors of Designate the browser master strip after boot #1683 (Retire the browser master boot word #1689, retire the browser master boot word; Read the master strip's meter on the C ABI #1690, read the master strip's meter on the C ABI) are in the batch 15 docs.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}