Controls batch 15b: owners carry across supersession, latency floors carry, declared discontinuity, held source blocks, seek tests, browser plan latency (#1698, #1285, #1323, #1318, #1319, #1688)

[tamashi095]

Controls batch 15b: the source and latency chain's first half. A plan's latency no longer drops during playback: a successor keeps its predecessor's per-node arrival floors, and a host can declare a discontinuity to reset them. A superseding candidate carries every owner it keeps unchanged from the running plan. Held source blocks are reported apart from underruns. The browser reads the plan latency from the core, as the C ABI does.

Closes #1698
Closes #1285
Closes #1323
Closes #1318
Closes #1319
Closes #1688

What changed

• Carry an owner a superseding candidate keeps unchanged from P0 from P0's state #1698 Across a withdrawn candidate A, B's base is the running plan P0's own inventory (PlanStateInventory::across_withdrawn). So every owner B keeps unchanged from P0 carries from P0, as the direct P0 -> B swap does, including an owner A restarted or removed. Sources keep the host contract (docs/CONTROL_PROTOCOL_SEMANTICS.md: a declaration change against the newest committed session restarts the feed at generation 1, frame 0): a P0 source row stays only when A carried it vacant, and the batch 15a guard drops_acked_fresh_source stays for all four cases (root ruling 2026-10-16). Removed: PreparedHost::carried_base, restricted_to, the carried_base_retained_bytes epoch term and graph::installed_carry_reads. The issue's title now names owners only.
• Keep every node's latency from dropping during playback #1285 A successor compiles with its predecessor's per-node arrival floors (GraphBuiltinsCompileRequest::input_floors; pdc::timings compensates every incoming edge to max(arrival, floor)). The inventory keeps the floored arrivals, so a chain of successors keeps them, and a supersession takes P0's floors. A restarted strip still starts at rest with no duck until Duck-swap a strip whose state cannot continue across a plan swap #1324. Header paragraph "Latency across a replacement (issue 1285)".
• Reset latency floors at a host-declared discontinuity #1323 SessionState::declare_discontinuity prepares a successor without floors, published Next, through the same supersession, donation, guard and observation path as a rebuild. A transaction that supersedes a waiting discontinuity successor is prepared at the discontinuity (the combined twin). Both hosts forward to the core: C miso_engine_v1_declare_discontinuity (FEATURE_DECLARE_DISCONTINUITY = 1 << 8, frozen list 18) and browser miso_engine_web_v1_declare_discontinuity, with a parity row. GraphCompileReport::raised_arrivals is a report field only: no program, canonical byte or fixture changes.
• Report held source blocks apart from underruns #1318 A block with no PCM while a seek is held counts as held, not as an underrun (SourceReadReport.held*, consumer telemetry held_frames/held_blocks). The graph's underrun flag folds only real underruns, so a held block no longer marks a spectrum window starved, on both hosts alike. No rendered sample moves.
• Test held seeks across swaps and supersession, and add a seek to audit capi #1319 Tests for held seeks across a swap, a supersession and a taken candidate (capi runtime tests). audit capi now issues a seek_at after its structural transaction and feeds generation 2.
• Report the plan latency on the browser #1688 The browser copies the core's plan resources (latency and tail; tail_words moved into control-plane and is shared with the C ABI) into a 64-byte record: miso_engine_web_v1_plan_latency_read / _ptr (browser exports 102 -> 105 with Reset latency floors at a host-declared discontinuity #1323's). ABI layout, checker, self-test fixture and SDK mirrors regenerated.

Evidence

• The full local CI-equivalent set (batch-gates.sh) passes at 470752d: fmt, bench and realtime policy (150 marked regions in 32 files), host-core feature matrix and loom, workspace clippy, the workspace tests, the doc job (cargo doc -D warnings), all 15 shell gates, the web build and check, check-sdk-headless (564 of 564), the 7 Python gates and the fuzz check.
• Browser qualification passes at 470752d on Chromium 151.0.7922.34, Firefox 153.0 and WebKit 26.5 (--check-matrix --self-test-mutations); render-locked allocations are 0 in every scenario.
• audit capi: 0 allocations, deallocations, locks and syscalls. pcm_digest moves from bf7dcedd1d92621f to 4f52089e4a8cf83c (Test held seeks across swaps and supersession, and add a seek to audit capi #1319, accepted by root): the audit now issues a seek_at after its structural transaction and feeds generation 2, so call 4 plays a generation-2 quantum where it was silent. No code pins the old value.
• Parity rows (hosts/host-web/tests/control_parity.rs): a declared discontinuity resets the floors alike; the plan-latency record equals the C ABI report before and after every block of the scripted run; a rebuild that adds latency moves both alike at the adopting block; removing a limited track keeps the floored latency alike.
• Carry an owner a superseding candidate keeps unchanged from P0 from P0's state #1698: on the base, the owner cases restart [t1,t2] / [t2,t3] and the bits differ at block 0, at Simd8 and Simd4; with the fix they are bit-identical to the direct P0 -> B twin.

Re-pins (each from a measurement)

• capi_retained_bytes (reference session, x86-64): 168,810 -> 167,514 (Carry an owner a superseding candidate keeps unchanged from P0 from P0's state #1698: one 216-byte Option<PlanStateInventory> less in each of six provider epochs) -> 167,754 (Keep every node's latency from dropping during playback #1285: input_floors and raised_arrivals in every epoch's inventory, +240). The 175,296 ceiling stays.
• Browser bridge retained bytes 1,549,094 of 1,667,648; no browser expected-resources row moved.

Review

• Carry an owner a superseding candidate keeps unchanged from P0 from P0's state #1698's D1 mechanism went to root before code: sources cannot carry from P0 without breaking the host contract, so Carry an owner a superseding candidate keeps unchanged from P0 from P0's state #1698 carries owners only and the guard stays (root ruling 2026-10-16).
• Batch review (opus-high): PASS, no blocker or major. Seven minors, all folded in 470752d: the capi row re-measured after Keep every node's latency from dropping during playback #1285 (167,754); amendments to Remove a strip in two phases: ramp out, then a scheduled swap #1325 and Duck-swap the strips a latency growth restarts, and fall back to the transition when a warm successor cannot adopt #1397 (the removed carried_base), Render moving stored fader automation, seeks and latency #1647 (a(n) is the floored arrival), Keep every node's latency from dropping during playback #1285 and Carry an owner a superseding candidate keeps unchanged from P0 from P0's state #1698; the discontinuity parity row also compares the browser latency record; rewraps; a stale doc link.

Successor work found

• The SDK has no planLatency() call on the new browser exports yet (a non-goal of Report the plan latency on the browser #1688).
• The Report the plan latency on the browser #1688 spec's claim that a track delay_samples edit moves the plan latency is stale: a track delay shifts the output but not the PDC report.
• Give a plan a source-read clock that leads its render clock #1396 adds the source-read-offset term to runs_behind_natural_timing; Classify a latency-growth edit and publish its warm successor from the control plane #1403 drops its PrimedCandidate record on a discontinuity supersession; Give every plan a timeline that carries like a source #1641's timeline consumer joins the discontinuity carry (noted in Reset latency floors at a host-declared discontinuity #1323's record).

Spec bodies to sync after merge

#1698 (title and body), #1285, #1323, #1318, #1319, #1688, #1310, #1344, #1325, #1397, #1647.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}