Controls batch 14b: first live commit bounded, effect-owner candidate at begin, input-section carry, live window by cells, SDK response codes from the core (#1620, #1621, #1623, #1624, #1630)

[tamashi095]

Controls batch 14b: the first live edit of a large session costs what a later one costs, the effect control owner keeps its edit candidate only during a transaction, a per-node live effect window is sized by its live cells, a strip's input section carries across a plan swap and then retargets, and the SDK's response preview takes its frame codes from the engine and leaves every refusal to the core.

Closes #1620
Closes #1621
Closes #1623
Closes #1624
Closes #1630

What changed

• Bound the first live commit of a large session #1620 (root ruling C1) The in-place commit path accepts a SetControl that adds a parameter entry and charges the added entry exactly. session::owners_growth and ResourceEstimate::after_owners_edit run the compile's own cap checks. A list that gets shorter, or an addition that does not fit, takes the full path, which gives the typed refusal before any commit. The committed model and canonical snapshot equal the full path's; a differential gate proves this. Before, the first live edit that wrote a parameter the sparse list did not hold took the full path: 77 KB at 1 track, 198 KB at 64, 663 KB at 256. Now the first call is 757 allocations and a 72,865-byte peak at 1, 64 and 256 tracks alike.
• Build the effect control owner's candidate at begin #1624 (coordinator ruling B') EffectControlOwner builds its candidate rows and touched mask in begin, with a fallible reservation (EffectControlOwnerError::Allocation, refused before the stamp), and frees them at commit or discard. One owner state holds the candidate, so the phase and the candidate cannot disagree. The retained saving is 780 B per EQ. This is boot and idle retention; a transaction that begins an EQ allocates the same bytes transiently.
• Size the per-node live effect window by its live cells #1621 A per-node live effect window holds the lane's live parameter cells, not the automation capacity. The estimate charges the same bytes. Departure: the bind check is window <= capacity, the rule banks already use; the lane still refuses a window shorter than its cells, so no live value can drop.
• Carry, then retarget a strip input section across a plan swap #1630 A surviving strip's input section carries across a plan swap whenever its structure and sample rate match. A live difference retargets through the successor's input cells, on its gate, in the same stamped block as the strip, effect and route retargets. The result is bit-equal to a plan that made the same edit live, at both lane widths. Review fold (root ruling): the input, fader and matrix carry drains count a carried value that the successor's retarget replaces, so D15-2's live_values_superseded is exact on every carry path.
• Generate the SDK's RESPONSE_GET codes and drop its own checks #1623 A generated SDK module holds the RESPONSE_GET field IDs and codes, taken from protocol::schema and the strict decoders; the SDK's hand copies are deleted. The SDK refuses only a value that has no wire spelling. Review fold (root ruling): the core refuses a non-finite grid endpoint (response.grid) and a non-finite override (new code response.override.value) on both hosts, with a parity row. Before, these came back as a generic protocol.failure. The encoder stays strict, and the wire format is unchanged.

Evidence

• The full local CI-equivalent set (batch-gates.sh) passes on the integrated tree (head 5f51ba9). The SDK headless suite passes 564 of 564. The run before the last fix caught two stale pins from Carry, then retarget a strip input section across a plan swap #1630's carry marks, the graph fixture and the audit's builtins resource grid; they are regenerated and re-pinned in 538537d.
• Browser qualification with --check-matrix --self-test-mutations on 10496f1, which has the same browser code as the head: chromium 151.0.7922.34, firefox 153.0 and webkit 26.5 all pass. Render allocations are 0 in every row.
• audit capi: pcm_digest bf7dcedd1d92621f (unchanged), 0 allocations, locks and syscalls.
• 0 allocations and frees on Carry, then retarget a strip input section across a plan swap #1630's swap block (bench_support::alloc thread counters).
• The four-lane (AArch64/NEON) builtin_bank_bytes row runs only in CI. Its ceiling (21,056) was not re-measured here; the +384-byte carry marks are expected to fit under it.

Re-pins (each from a measurement)

• capi_retained_bytes ceiling 182,400 to 175,296 (Build the effect control owner's candidate at begin #1624: measured 166,374 to 159,354 = nine EQs times 780 B).
• REFERENCE_EFFECT_CONTROL_BUDGET 21,376 to 13,632 (Build the effect control owner's candidate at begin #1624: 19,377 to 12,357).
• builtin_bank_bytes, eight lanes, ceiling 15,680 to 17,280 (Carry, then retarget a strip input section across a plan swap #1630 review fold: carry marks, 15,321 to 15,705).
• control_command_heap (debug), under a written slack rule (measured plus 2,000, rounded up to the next 1,000), reason Build the effect control owner's candidate at begin #1624: steady peak 73,000 to 75,000, steady requested 104,000 to 106,000. The new first-call rows from Bound the first live commit of a large session #1620 are a 75,000 peak and 106,000 requested.
• Realtime policy floor: 149 to 150 regions (Carry, then retarget a strip input section across a plan swap #1630's carry marks).
• The audit's STRIP_PREPARATION_BYTES goes from 1,136 to 1,160 (+8 per cell reader, three readers; the change does not depend on lane width), with the builtins fixture resources.jsonl regenerated and its manifest digest re-pinned (ACCEPTED_MANIFEST_SHA256). The graph fixture direct-route has builtin_bank_bytes 7,047 to 7,239.
• Browser boot high-water growth: 20,512,768 to 19,857,408 (Build the effect control owner's candidate at begin #1624).

Review

One opus-high batch review of c211890...23d7c52: FAIL, with no realtime or acked-batch defect. Folded in 3c49a8b (part B) and 81aa9ef (part A):

• BLOCKER (Size the per-node live effect window by its live cells #1621): a superseded test (console-workload paired_spans, a required release job) still refused a window below the capacity. It now refuses only a window longer than the capacity.
• MAJOR (Generate the SDK's RESPONSE_GET codes and drop its own checks #1623): no CI check compared the generated response-frame asset (or Generate the SDK's session key tables from the engine's walk #1569's session-key asset) with its generator on an SDK-only change. The sdk job now runs cargo test -p parameter-metadata --test response_frame --test session_keys. No paths filter is used, and the verdict table is unchanged.
• MAJOR (Generate the SDK's RESPONSE_GET codes and drop its own checks #1623, root ruling): typed core refusals for non-finite values on both hosts (response.grid, response.override.value), with a parity row.
• Root ruling (Carry, then retarget a strip input section across a plan swap #1630): carried values that the successor replaces are counted exactly (D15-2).
• Minors: Build the effect control owner's candidate at begin #1624 reserves fallibly and keeps one owner state. The heap ceilings follow a written slack rule. Carry, then retarget a strip input section across a plan swap #1630 gains a successor input-ramp test. Bound the first live commit of a large session #1620 makes OwnersGrowth private. Generate the SDK's RESPONSE_GET codes and drop its own checks #1623 makes the SDK refuse a non-number and an unknown reply section. Stale prose is fixed.
  A focused opus-high verification of the fold commits: PASS, with two minors folded in 1fe8b5a. A later write after adoption is now tested not to count as a second carried value (red with the marks left set), and add_carried's doc names both of its callers. That doc edit is under crates/engine/src/realtime, doc comment only, made in one attempt.

Departures recorded in the specs

• Bound the first live commit of a large session #1620: an in-place commit with a shorter list still takes the full path. The gate tests live in crates/host-core/tests/in_place_commit.rs, where the two-path harness is.
• Size the per-node live effect window by its live cells #1621: check_automation_window accepts window <= capacity.
• Generate the SDK's RESPONSE_GET codes and drop its own checks #1623: ResponseConfigurationKind replaces literal kind codes in the codec. A literal same-frame C ABI comparison is not possible, so the hosts agree by request content and by the shared refusal table.
• Build the effect control owner's candidate at begin #1624: two exact allocations, not one (one would need unsafe).
• Carry, then retarget a strip input section across a plan swap #1630: the join also requires the same sample rate. This is defensive, because the control plane already refuses a rate change. input_records and filter_edits move into prepare.rs.

Issues to file

• None. Successors are recorded in the specs: the SDK's remaining hand copies in control-frame.ts, live-response.ts and browser/engine.ts.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}