Controls batch 20: stored automation renders the same bits on the browser artifact, native and the C ABI

[tamashi095]

Controls batch 20: stored automation renders to the same bits on the shipped browser artifact, the native browser host and the C ABI. This is the last batch of finish line A for the stored-automation program (#1058). It adds no engine code.

Closes #1669

What changed

• Compare stored automation bits across the browser and native hosts #1669 is narrowed to the rows the engine renders today (owner, 2026-10-17; docs commit 562cb97). The rows are the strip fader, the strip mute, the VCA offset, the VCA mute, and a following send that tracks its source's mute and its VCA's mute. The matrix fixture and the pan, trim, polarity, filter, EQ, effect-parameter and send-row rows are listed in the spec as phase-2 extensions (Render stored pan and matrix automation #1657, Render stored input trim and polarity automation #1658, Render stored input HPF and LPF automation #1660, Render stored parametric EQ automation #1667, Render stored send gain, mute and matrix automation #1654 behind Land a removed send row exactly across a live move #1718). A following send at a latent tap is a phase-2 extension too (R20-1). Compare stored automation bits on AArch64 and across seek times #1670 has a matching amendment: one fixture and one pin (R20-3). The closed specs Render stored VCA offset and mute automation #1655 and Keep a live level move's own length across a Reposition swap #1711 are removed.
• One fixture, hosts/host-web/tests/browser-v1/automation-session.json (807b474, review fold 30a1dd8). It has two tracks, one submix and a VCA over both tracks. t1-bus is a pre-fader following send and t2-bus is a non-following one for contrast. There are five entries: t1's fader on both lanes with a stored offset, t1's mute on the left lane, t2's fader on the right lane, the VCA offset on the right lane with a stored offset, and the VCA mute on both lanes. The shapes are step and linear (every row refuses exponential), with steps on and off the grid, gaps, holds, and segments that cross the seek target.
• One transcript of 96 blocks of 128 frames. The PCM comes from an integer formula that is exact in f32 in Rust and in JavaScript. Before block 40 there is one plain session seek, generation 2, to timeline 30,000.
• Browser equals native. The direct oracle's new leg runAutomationTimeline renders the fixture through the shipped simd128 artifact. Before it prints anything, it asserts the digest equals directOracle.nativeAutomationPcmF32leSha256. The native test native_automation_timeline_digest_pins_the_wasm_parity (in hosts/host-web/src/tests.rs) renders the fixture through AudioWorkletEngineHost on x86-64 and checks it against the same pin. The pin was written only after both sides were measured equal: a81d883b3f83eaf629bd78db149d1a39825c821c6cb2e9a53506341a97ed1363. The test also proves that the automation is heard: with the entries cleared, the bits change before and after the seek, and a different fader value at the seek changes block 40. No new digest owner is added; this extends the oracle's existing pins. scripts/check-browser-expected-resources.py adds the digest to DIGEST_PATHS and adds a self-test mutation for it.
• The C ABI equals the browser host. The new case the_automation_fixture_renders_alike_on_both_hosts_across_one_session_seek in hosts/host-web/tests/control_parity.rs (5894031) renders the fixture through both hosts with the seek. It compares every block's two planes bit for bit, with no digest. The cross-host harness (Report live_values_superseded in the browser status and prove both hosts drain strip cells alike #1399/Prove that both hosts give the same result for the same control edits #1560) was already on main.

Evidence

• Bits. simd128 == native x86-64 == C ABI on all 96 blocks. No cross-host or cross-target difference was found in any delivered row.
• Plants (R20-2; PR evidence only, reverted; run at 5894031, before review fold 1):
  • P1, +1 ulp on every return of value_at and value_before: the native pin test is red, and the oracle's automation leg is red (only that leg). G5 is red in cases 146-151 (automation/*), natively and in the wasm leg, and so is G6's caller-FTZ check, which uses the same pins. D4 is green, as expected, because both hosts share one core.
  • P2, next_up on db_gain: the native pin test is red. The oracle is red, but it stops at its first leg (the identity session, direct-oracle.mjs:561). A copy that keeps going after a failure shows all four digest legs red, the automation leg among them. D4 is green.
  • P3, one low bit flipped after miso_engine_v1_render_f32_planar for absolute samples >= 5120: D4 is red at block 40, left plane. The pin test and the oracle are green, because capi is not in the wasm artifact (cargo tree -i capi on wasm32 is empty).
  • Why the pre-fold results still hold: the fold only removed mute masking at the seek, so more of the automation now reaches the output. P1 and P2 change lanes that are open in both versions, and P3 does not depend on the fixture. The reviewer confirmed this.
• Measurements (all equal to main; the range changes no code under crates/, tools/ or sdk/): audit capi pcm_digest bffc21e857b5e134, unchanged (0 render errors, 0 allocations). capi_retained 168,746 of 175,296. Boot growth 19,857,408 bytes (pin 20,971,520). simd128 artifact 4,480,805 B. Realtime policy 171 marked regions. The oracle's automation leg reports memoryBytes 2,949,120, one 64 KiB page above the other legs; it is pinned exactly, as the other legs are (Ceiling the direct oracle's status memory bytes #1720).
• Gates: batch-gates.sh all green on codex/controls-batch-20 at 30a1dd8: fmt; bench and realtime policy; host-core clippy default / no-default / all features and the loom spectrum handoff; workspace clippy -D warnings; no-feature release and debug checks; workspace tests (all features); the whole documentation job; builtins, console and effect-runtime fixtures; graph determinism; effect contract; host-core policy; protocol wasm parity; SDK generated and types; C ABI; protocol allocation audit; builtins and builtins-graph trace audits; test-web-audioworklet; check-cross-targets; web build, check-web-audioworklet, SDK headless; CI path routing, test-support CI, browser expected resources (artifacts and self-test, 33 mutations), SDK deletions, command reason and kind vocabularies, script reachability; fuzz check. G5 (cargo test --locked --release -p lane -p math -p wasm-gates --features math/lane) green.
• Browsers: chromium, firefox and webkit qualification (--check-matrix --self-test-mutations) all pass at 30a1dd8.

Review

• One fresh opus-high adversarial review of the range. FAIL with one MAJOR: at timeline 30,000 every member lane was inside a closed mute, so the fader and VCA-offset landings at the seek were only remembered and never heard. The step at 3001 also sat inside a VCA unmute hold.
• Fold 1 (30a1dd8) moved the VCA mute steps so the right lanes are open at the seek, while t1's left lane still lands inside its own closed mute. The pin was re-minted from both sides, and a landing-heard assertion was added, which is red on the old fixture. The fold also fixed MINOR m1 (the Compare stored automation bits on AArch64 and across seek times #1670 seek bound: 1,440 samples = 480 mute hold + 960 fader ramp, no inserts, four pin tests) and the NIT (the self-test mutation).
• The fold check PASSED. Its pin matches the reviewer's own simd128 probe of the same edit. The fold touched no render code, so no further verification was needed.
• Root rulings R20-1 (no insert), R20-2 (plants P1-P3), R20-3 (Compare stored automation bits on AArch64 and across seek times #1670 amendment).

Not in this PR

• The phase-2 rows listed above, and Compare stored automation bits on AArch64 and across seek times #1670 (AArch64 and seek-time invariance on this fixture).

Placeholders to file

• Ceiling the direct oracle's status memory bytes #1720 "Ceiling the direct oracle's status memory bytes" (.github/ISSUE_SPECS/1720-ceiling-the-direct-oracle-status-memory-bytes.md). Every oracle leg pins beforeDisposeStatus.memoryBytes to the byte, but under AGENTS.md and Replace exact resource-byte and record-hash pins with ceilings and live reports #1060 a resource size should be a ceiling. This is test hygiene, not a defect.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}