Controls batch 18: stored mute automation, and following sends that track it in render

[tamashi095]

Controls batch 18: stored mute automation and the sends that follow it (the R2 must-land group). A session's mute automation now renders on both hosts: a strip lane mutes and unmutes at the exact samples the session names, over the session mute length, and composes with solo, VCA mutes and a hand mute (OQ1 = C: the stage mute is curve || terms). Every send into a submix that follows an automated mute follows the curve at its tap's arrival, so it mutes exactly the audio the strip mutes, latency included. Live edits of such a send write its route cell from the shared commit.

Closes #1651
Closes #1652
Closes #1653

What changed

• Render stored mute automation on the strip #1651 render stored mute automation on the strip (T1 0e078aa, T2 e7848d0, T3a 377fcd8, gate power 4084522, T3b 103e1e5, T5 266a272, T4 1d2e2bc; U1 fold 6bf8986).
  • A SetMute that repeats the lane's mute state leaves the fader stage as it was (the batch 13b rule): it no longer restarts a fader ramp in flight or holds fader events.
  • controls::fader_row splits the fader row from the rendered rows, so a mute entry gives no lane a hand offset, turns no fader edit into an offsets write and flags no mute-only rebuild.
  • Mute cells go into the plan's one program after the fader cells (a fader-only session builds the same program and bits). The one fader event driver walks mute cursors and pushes a SetMute only when curve || terms changes, at the exact sample over the session mute length. A seek sets it exactly; a seek that leaves the mute unchanged lets the ramp finish (R18-1). The bank forms, the fused fallback and the scalar oracle share the driver.
  • Inside a block, the fader piece is cut at each mute event: a mute holds the fader to the block end; an unmute over M frees it at E = o + M, where owed events move. An in-block curve unmute also ends an older fader-cell hold (CellState::release_hold_by, shorten-only, in crates/automation; path approved by root).
  • Terms are the effective strip mute (static or hand mute, VCA mute, solo). The Mute record the shared commit already sends is the terms write; no new record type.
  • A mute entry change is a rebuild on both hosts. The carry adopts the mute channels (continued_cells bits 2 and 3); the swap block composes once at node time; a hand or VCA mute committed in the same transaction as a mute-curve rebuild lands over its own ramp (U1 fold, MAJOR-2); a lost mute cell gets a Mute record of the effective mute.
  • R18-2: the control listing marks a mute row that an entry drives automated, on both hosts.
• Follow an automated mute on following sends in render #1652 follow an automated mute on following sends in render (#1652a d49c0c1, #1652b 062be53, #1652d graph carry 3d063f0, #1652c 6f758cb, policy comment 31f7245; U2a fold 1 977d696; U2a fold 2 1132a1a).
  • A route into a submix whose source strip has a mute entry gets a seven-word route cell on every plan (open transform, one flags word, ramp) and its own boxed render state; six-word routes keep their code, bytes and bits.
  • The route op reads its cell at block entry, then walks the source's mute cells in the tap's node time timeline(r + ΣP - a(tap)) and retargets only when the coefficients' bits change, over the session mute length (exact on a seek).
  • R18-5: per-column ramps. Each source column has its own indexed ramp, so a curve step restarts only its own column; an open column's live move keeps its length across a carry, and per-lane steps each end with the strip's mute. One new lane kernel entry, route_mix_column_ramps_block, has the six-word kernel's vector shape (simd128, NEON, AVX2, outlined scalar tail; 0 panic sites in the wasm instantiation); with equal ramps it is that kernel bit for bit.
  • A following route that opens inside a block records its activation offset, so its destination reduces [0, o) without it (no signed zero reaches the bus or the session output).
  • The carry keeps a route's ramp by route ID whatever its kind in either plan; follow cursors are placed fresh; a carried first block applies the join's record with the heard curve first, then the curve jumps over J.
  • graph depends on crates/automation (R18-3; a leaf crate). The graph policy pin and its fixture gain automation in the same commit.
  • Current difference (Carry a following route's column moves exactly into a six-word successor #1713): a rebuild that carries a following route into a six-word route (its source strip automates a mute lane in the committed plan and none in the successor) can re-time a carried column's move: the six-word successor holds one ramp. The control plane marks such a rebuild CandidateOutcome::TransitionFallback, so the watermark reports OUTCOME_TRANSITION_FALLBACK, never EXACT, for it. It is conservative: it is set whether or not a column moves at the swap. The doc text (abi.rs, the C header comment, docs/C_ABI_V1_QUALIFICATION.md, both d.ts) says so. Carry a following route's column moves exactly into a six-word successor #1713 carries the columns exactly and deletes the flag.
• Write a following send's route cell from the shared commit #1653 write a following send's route cell from the shared commit (283c480).
  • A route gain, matrix or mute edit, a follows_mute toggle, and a change of the source's terms (hand mute, VCA mute, solo) write the seven-word cell through the live path on both hosts, only when a word's bits change; no folded follow record. The strip's terms and the route's cell share one stamp.
  • Before the first write the commit refuses (Internal) a record with no producer of its kind or with automated bits that disagree with the plan (never an ack before a drop). The in-place commit equals the full path (R17-1).
• Review test gaps (e7938ee, tests and docs only) and Carry a following route's column moves exactly into a six-word successor #1713 renumber (259f6dd).
• Docs: the closed batch 17 specs (Prepare stored fader automation and render it flat #1646-Store a hand move on an automated fader as a dB offset #1650, Compose live level values inside the canonical floating-point environment #1709) are removed (5fc3b7b); Keep a live level move's own length across a Reposition swap #1711 gains the owed-discharge item (9a3eb4b, root ruling).

Evidence

• audit capi pcm_digest bffc21e857b5e134, unchanged across the batch (the audit session has no stored automation). 0 violations, 0 allocations.
• Re-pins and sizes, each measured, with reasons:
  • Realtime policy 160 -> 168 marked regions (follow flags and record, the route op, ColumnRamps, the mute-drain apply_mute_value, follow_mute_jump, cursors). No file under crates/engine/src/realtime/ was edited.
  • graph policy: automation added to graph's dependency pin and fixture (R18-3). The builtins policy scan stays clean.
  • C header: a doc-comment-only addition (the Carry a following route's column moves exactly into a six-word successor #1713 flag text); no symbol, constant or layout changed; check-capi-abi.sh passes.
  • Bytes (x86-64): lane slot 304 -> 392 B for an automated lane (mute channels and the mute jump word); LIVE_FOLLOW_ROUTE_OWNER_BYTES 352 B (a following route only); LIVE_ROUTE_OWNER_BYTES 72 B unchanged; RouteCarryStep 8 B unchanged (following-route checks live in a side table); RouteActivity 64 -> 80 B once per plan with live or gated routes (the activation offsets box, charged by size_of; root accepted). The charge test covers the attach (the_following_route_charge_covers_its_attach_and_bind).
  • capi_retained: 168,746 of 175,296 (168,650 on main; +96 B: a 16 B follow-routes box in each of six provider epochs).
  • Boot growth: 19,857,408 bytes, unchanged; simd128 artifact 4,384,816 B (4,281,649 B at batch 17: the route op, the column-ramp kernel and the mute driver) (pin 20,971,520).
• Gates: batch-gates.sh all green on codex/controls-batch-18r at e7938ee except the Documentation job (two private intra-doc links in graph, one redundant link in host-core), fixed in a6574be. That commit and the Skip the grid walk for step-only automation cells #1714/Index the automation entries per strip once per build #1710 docs commit change only doc comments, one parity test and specs; on the final tree 782a0a3 these were re-run green: fmt; realtime policy 168; workspace clippy -D warnings; no-feature release and debug checks; the whole doc job; workspace tests (all features); check-sdk-generated; check-capi-abi; check-cross-targets; check-host-core-policy; CI path routing; script reachability; test-support CI. The e7938ee run also passed: bench policy; host-core clippy default / no-default / all features and the loom spectrum handoff; builtins, console and effect-runtime fixtures; graph determinism; effect contract; protocol wasm parity; SDK types; protocol allocation audit; builtins and builtins-graph trace audits; test-web-audioworklet; web build, check-web-audioworklet, SDK headless; browser expected resources, SDK deletions, command reason and kind vocabularies; fuzz check; audit capi pcm_digest bffc21e857b5e134, 0 allocations.
• Browsers: chromium, firefox and webkit qualification (--check-matrix --self-test-mutations) all pass at e7938ee (no render change after it).

Review

Fresh opus-high adversarial reviewers, one per review unit, then a focused verification of every fold that touched render.

• U1 (Render stored mute automation on the strip #1651): FAIL (MAJOR-1: an offsets hold not shortened by an in-block curve unmute froze a ride at mute length 0; MAJOR-2: R18-4 refuted for the strip, a same-transaction hand mute's ramp dropped at a reposition while the watermark said EXACT; three MINOR test gaps) -> fold 1 6bf8986 -> verification PASS. Leftovers (test and comment only) a6574be.
• U2a (graph side of Follow an automated mute on following sends in render #1652): FAIL (MAJOR-1 signed zeros from an opening route; MAJOR-2 R18-4 refuted for routes, one shared ramp re-timed an open column's move; MAJOR-3 a carried record took the curve's jump length) -> R18-5 per-column ramps, fold 1 977d696 -> verification FAIL narrow (seven->six re-timing EXACT; a wasm panic path in the new kernel) -> fold 2 1132a1a (conservative flag, kernel clamp) -> verification PASS.
• U2b (#1652c host side + Write a following send's route cell from the shared commit #1653 + fold 2 host part): PASS (two MINOR test gaps and three NITs, closed in e7938ee).
• T1 gate power (root check): one batch 17 gate had been void since the D1.2 removal; restored in 4084522. The owed-discharge gap it showed moved to Keep a live level move's own length across a Reposition swap #1711.
• Root rulings: R18-1 (seek leaves an unchanged mute ramp running), R18-2 (listing flag), R18-3 (graph -> automation), R18-4 (withdrawn for routes and the strip), R18-5 (per-column ramps); the Carry a following route's column moves exactly into a six-word successor #1713 flag; the crates/automation path for release_hold_by.

Placeholders to file

• Skip the grid walk for step-only automation cells #1714 "Skip the grid walk for step-only automation cells" (.github/ISSUE_SPECS/1714-skip-the-grid-walk-for-step-only-automation-cells.md; weekly performance pass, phase 2).
• Already filed: Carry a following route's column moves exactly into a six-word successor #1713 (phase 2). Index the automation entries per strip once per build #1710 is amended to cover the mute entries; Keep a live level move's own length across a Reposition swap #1711 gains the owed-discharge item.
• A question for the app, not a spec: the effective_mute readback reports the terms (static, VCA, solo), not curve || terms.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}