Controls batch 17: stored fader automation renders on both hosts, with VCA offsets and hand moves

[tamashi095]

Controls batch 17: stored fader automation (the R1 group). A session's fader automation now renders on both hosts: it is prepared into one cell program per automated lane, moves sample-exactly in node time through latency and seeks, carries across plan swaps, composes with VCA offsets, and takes a hand move as a stored dB offset (OQ1). Live level values are composed in the canonical floating-point environment on every control-thread entry (#1709). A Reposition swap while a live level move may still ramp is reported as a fallback on the watermark (conservative); the move's exact length across that swap is split to #1711.

Closes #1646
Closes #1647
Closes #1648
Closes #1649
Closes #1650
Closes #1709

What changed

• Prepare stored fader automation and render it flat #1646 prepare stored fader automation (ba240b6 D6 order; 37150ce preparation; U1 fold 63d27a2, 6c8cf3a, 275ff76; validator b844501; schema 66da5d0).
  • D6 (class B, root F16): the VCA offsets are summed first, then the member is added (session::vca_offsets_sum, vca_compose_db; VcaSum is an offsets accumulator with compose(member)). Every caller follows.
  • Every builtins preparation form compiles one cell program per automated fader lane (tracks and submixes), seeds each cell's event state, holds the lane's S (controls::effective, one author) in a three-word offsets cell, and sets the prepared value inside CanonicalFpEnv. The scalar oracle installs the same program (R17-4).
  • Preparation (builtins body, both graph lowerings, host-core's static composition, and since Compose live level values inside the canonical floating-point environment #1709 the whole of prepare_host_runtime_*) runs inside CanonicalFpEnv; a hostile caller word (FTZ, DAZ, round toward zero) prepares the canonical bits.
  • The session validator refuses an automation sample at or past 2^53 (automation::TIME_LIMIT, numeric.out_of_schema_range), for every entry, as the program builder does; the SDK and the published JSON Schema mirror it. Tests that used u64::MAX as a valid sample use 2^53 - 1.
• #1650a / #1650b store a hand move on an automated fader as a dB offset (5c8781b, 3cf702b; R17-1, R17-6).
  • Every automation entry carries a required offset { left_db, right_db }; only a driven strip fader_db lane takes a non-zero value, any other lane must hold +0.0 (control.automation.offset). Trim and send offsets moved to Render stored input trim and polarity automation #1658 and Render stored send gain, mute and matrix automation #1654 (R17-6).
  • On a lane a rendered entry drives, SET_CONTROL fader_db reads and writes the entry's offset; S = own offset + reaching VCA offsets. R17-1: the driving entries are owners of the in-place edit, so the in-place and full paths give the same reply and bits on both hosts. A change of the static fallback on an automated lane is a Structure rebuild. The list's automated flag is a descriptor field (ControlEntry field 35; SDK decode).
• Render moving stored fader automation, seeks and latency #1647 render moving stored fader automation (4667ff6, 1fbb0bc, 1832719; U2 fold 59ca8e3; U2 fold 2 86271e0; attempt 4 9314605).
  • R17-2: the graph compiler installs each builtin bank's floored input arrivals a(n). R17-3: before chain.run the graph sets each builtin slot's block time (timeline span at r + ΣP - a(n), held jump lengths) through builtin_processor_mut; no rack edit. R17-5: the source timeline reader takes a signed first sample (checked, saturating).
  • One event driver per fader stage turns cell events (grid, jump, held, set) into timed fader operations, composed with S; bank, fused fader-matrix bank and scalar oracle share it. Restart Set for a lane a successor adds; seeks set the lane exactly (also inside a node block, behind latency).
  • Gate 8 (the held-ramp obligation): a lane that owes a move when a live unmute ramp ends at E is moved there by a SeekMode::Ramp landing aimed at target_at(E + J) (R17-9); a seek Set exactly at E sets the lane and discharges (R17-8); a live write that frees a held lane releases the cell's hold at the next free block entry, owed or not (R17-10, fold 2). D1.2 removed: unobservable after R17-9 and R17-10.
  • The never-read refusal and stop counters were deleted (root: accepted with a one-line unreachability proof and a safe release path at every debug_assert site).
• Classify fader automation edits as carried rebuilds #1648 classify and carry fader automation edits (96fb3db, d300cd3; U3 fold 9dcf288; attempt 3 0fac00e; root B17-R13 split 1bd0494, 5fa5dd5, 6cea893; B17-R14 flag d5c85be; B17-R15 0c42f6b).
  • A fader automation add, remove, segment or target edit is a rebuild (LiveRebuild::Automation); the offset is not compared. An automated lane takes no FaderDb record on any path. This closes Hold the automation jump lengths in a plan cell #1639's gap: an edit that needs jump lengths not yet written rebuilds, and the successor reads its own lengths.
  • The carry moves each automated channel's cell state and held-ramp obligation; an unchanged table continues verbatim; a changed one repositions and jumps over J when the composed gain differs; a removed ride is released by the strip join's FaderDb record.
  • The carry reads each lane's offsets cell (U3a), so a live level edit keeps its ramp and the superseded count stays exact at a swap. A Reposition swap holds a free stage's running ramp again, compares the curve where that ramp ends, and lands a moved target over max(J, remaining) (attempt 3). A step of the cell's own at the swap block's first sample is compared there and lands over J, as a fresh plan does (B17-R13 guard).
  • Current difference (split to Keep a live level move's own length across a Reposition swap #1711): a live level move with less than J left at a Reposition swap is stretched to J (heard 24, 26 and 30 blocks: 928, 672 and 160 samples left, J = 960; up to 3.1e-3 from the uninterrupted engine). B17-R14 reports it: the control plane marks such a rebuild CandidateOutcome::TransitionFallback, so the watermark reports OUTCOME_TRANSITION_FALLBACK, never EXACT, for it. The condition is conservative (any transaction rebuild of a session with fader automation while any level move may still ramp; a flagged rebuild keeps the window open over J, B17-R15), so it over-reports; it never under-reports in the gated cases. The flag's doc text (abi.rs, the C header comment, docs/C_ABI_V1_QUALIFICATION.md, both d.ts) says so. Keep a live level move's own length across a Reposition swap #1711 replaces it with the exact behaviour and deletes it.
  • A cell's own J jump still running at a Reposition swap lands over J again toward the new table: that is D2's specified behaviour (no user length; a fresh plan with the new table also jumps), not a deviation.
• Compose VCA offsets with stored fader automation #1649 compose VCA offsets with stored fader automation (5e82ba2; U3 fold 9dcf288, ae0c160).
  • A live VCA move over an automated lane writes the lane's offsets cell (S as f64 plus the fader-row jump length) in one slot; the banks and the oracle read it at the drain and jump to the composed gain. A missing cell is refused INTERNAL before the stamp (never an ack before a drop).
• Compose live level values inside the canonical floating-point environment #1709 compose live level values inside CanonicalFpEnv (fdea587; R17-7; U3 fold ae0c160).
  • Guards at SessionState::command, declare_discontinuity_serviced, compile_children (session JSON parse depends on the rounding mode), ControlCatalog::build / stage_live, and the whole of prepare_host_runtime_*. Never on the render thread. Gates on both hosts are red without the guard.
• Placeholders committed: Index the automation entries per strip once per build #1710 (index automation entries per strip once per build; weekly performance pass); Keep a live level move's own length across a Reposition swap #1711 (keep a live level move's own length across a Reposition swap; deletes the B17-R14 flag).

Evidence

• audit capi pcm_digest bffc21e857b5e134, unchanged across the batch (the audit session has no automation and no VCA where the D6 order differs). 0 violations, 0 allocations.
• Re-pins, each measured, with reasons:
  • COMPLETE_SCHEMA_HASH 0x0c71_96f8_6abe_6d57 -> 0x5eb9_ad2e_d137_f3be (#1650a: Automation field 4) -> 0x5cab_2cf3_b4e4_767f (#1650b: ControlEntry field 35). 46 frames.
  • C header: a doc-comment-only addition to the watermark section (the B17-R14 flag text); no symbol, constant or layout changed; check-capi-abi.sh passes with no pin moved.
  • Realtime policy 153 -> 160 marked regions (GraphBlockTime impl, the fader bank's set_block_time, the lane automation impl, the event driver, bank helpers, oracle render, offsets read). No file under crates/engine/src/realtime/ was edited.
  • builtins dependency-boundary policy: automation added to builtins-compiler's list and the mutation fixture (Prepare stored fader automation and render it flat #1646 preparation builds the program; automation is a leaf). session depends on automation (TIME_LIMIT); control-plane on lane; fuzz lock updated.
  • Bytes (x86-64 AVX2): lane slot 224 B at the U2 fold, 304 B after U3a (the carried offsets state); at 224 B one automated lane with one segment charged 2,044 B (program 68 + 64, 8 x 224, offsets cell 120), cross-checked against retained heap with thread-scoped alloc counters; the charge test stays green at the head. Every fader bank +16 B (empty box), every live-controlled strip FaderCells +8 B; an automated controlled strip +80 B writer box. No fixture moved.
• Gates: all green on codex/controls-batch-17k at 0c42f6b (tree identical to codex/controls-batch-17 at f4da4f2): fmt; bench policy; realtime policy 160 regions; host-core clippy default / no-default / all features and the loom spectrum handoff; workspace clippy -D warnings; no-feature release and debug checks; workspace tests (all features); the doc job; builtins, console and effect-runtime fixtures; graph determinism; effect contract; host-core policy; protocol wasm parity; SDK generated and types; C ABI; protocol allocation audit; builtins and builtins-graph trace audits; test-web-audioworklet; check-cross-targets; web build, check-web-audioworklet, SDK headless; CI path routing, test-support CI, browser expected resources, SDK deletions, command reason and kind vocabularies, script reachability; fuzz check; audit capi pcm_digest bffc21e857b5e134, 0 allocations.
• Browsers: chromium, firefox and webkit qualification (--check-matrix --self-test-mutations) all pass at 0c42f6b.
• Boot growth: 19,857,408 bytes, unchanged (pin 20,971,520).
• capi_retained: 168,650 of 175,296 (168,378 at batch 16a; +248 B for FaderCells and the lane slots through Compose VCA offsets with stored fader automation #1649/Classify fader automation edits as carried rebuilds #1648; +24 B for the B17-R14 Option<LevelMoveWindow> in the control plane's SessionState).

Review

Fresh opus-high adversarial reviewers, one per review unit, then focused fold verifications.

• U1 (Prepare stored fader automation and render it flat #1646 + #1650a): FAIL (MAJOR: prepared fader outside CanonicalFpEnv) -> fold 63d27a2 + policy 6c8cf3a + Compose live level values inside the canonical floating-point environment #1709 placeholder -> fold verification PASS; leftovers 275ff76, schema bound 66da5d0.
• U2 (Render moving stored fader automation, seeks and latency #1647): FAIL (4 gate-power MAJORs, 1 render defect) -> fold 59ca8e3 (R17-8/9/10) -> verification FAIL (stale hold) -> fold 2 86271e0 (D1.2 removed, B17-R11) -> verification FAIL (F1 render regression) -> attempt 4 9314605 -> PASS. Render moving stored fader automation, seeks and latency #1647: 4 of 5 attempts.
• U3 (Classify fader automation edits as carried rebuilds #1648 + Compose VCA offsets with stored fader automation #1649 + #1650b): FAIL (MAJOR: the swap carry skipped the offsets cell) -> U3a 9dcf288, U3b ae0c160 -> verification found a Reposition swap cutting a live edit's ramp to J -> Classify fader automation edits as carried rebuilds #1648 attempt 3 0fac00e -> verification FAIL (remaining < J stretched to J with EXACT; a step at the swap's first sample skipped). Root B17-R13: split (step guard + Keep a live level move's own length across a Reposition swap #1711), B17-R14: conservative fallback flag -> focused verification FAIL (one MAJOR: a second Reposition inside the first one's stretched landing read EXACT) -> B17-R15 one-line fix 0c42f6b -> re-check PASS (ramps 200/500/4000, the second rebuild 1-7 blocks later: all report the fallback; the fix is red-checked by a_second_reposition_inside_a_stretched_landing_reports_a_fallback). Classify fader automation edits as carried rebuilds #1648: 3 of 5 attempts plus the split landing; no further attempt.
• Root rulings: R17-1..R17-10, B17-R11..B17-R15 (recorded in the specs' decision records).
• Every new gate of the B17-R13..R15 landing was checked red once on its mutation: the step guard (8.6e-2 without the guard; the +1 case under the whole-block landing), the flag (set_outcome removed: EXACT), the rebuild-path fold, and the J fold.

Issues filed for this batch

• Compose live level values inside the canonical floating-point environment #1709 "Compose live level values inside the canonical floating-point environment" (.github/ISSUE_SPECS/1709-compose-live-level-values-inside-the-canonical-fp-environment.md): closes in this PR (R17-7).
• Index the automation entries per strip once per build #1710 "Index the automation entries per strip once per build" (.github/ISSUE_SPECS/1710-index-automation-entries-per-strip-once-per-build.md): weekly performance pass, stays open.
• Keep a live level move's own length across a Reposition swap #1711 "Keep a live level move's own length across a Reposition swap" (.github/ISSUE_SPECS/1711-keep-a-live-level-moves-own-length-across-a-reposition-swap.md): stays open. First item: find out why the stage target moves during a heard move (0.398 at 12 blocks, 0.335 at 24, against 0.3018), a possible defect of its own. Then the deferred jump (D1), deletion of the B17-R14/R15 flag path (D2), and gates G1-G3.
• Every placeholder mention in the specs and the flag's doc text now carries its number (45f4165).

Bodies to sync after merge

• Prepare stored fader automation and render it flat #1646, Render moving stored fader automation, seeks and latency #1647, Classify fader automation edits as carried rebuilds #1648, Compose VCA offsets with stored fader automation #1649, Store a hand move on an automated fader as a dB offset #1650: bodies from their specs in this PR (decision records, attempt counts: Render moving stored fader automation, seeks and latency #1647 4 of 5; Classify fader automation edits as carried rebuilds #1648 3 of 5 plus the B17-R13 split landing).
• Render stored send gain, mute and matrix automation #1654 and Render stored input trim and polarity automation #1658: R17-6 amendments (send and trim offsets).
• Store a hand move on an automated fader as a dB offset #1650 title -> "Store a hand move on an automated fader as a dB offset" (R17-6); Render stored input trim and polarity automation #1658 and Render stored send gain, mute and matrix automation #1654 own the trim and send offsets.

CI fold

• The first CI run failed on AArch64 (NEON Simd4): rendering_fader_events_allocates_nothing counted in-bank lane indices and assumed one eight-lane bank. c484f2b keys the check on the eight tracks (one Jump per track at its own sample), so it holds at every bank width. No product code changed.

🤖 Generated with Claude Code