Mixer: preserve routing and settings through failures

[emaspa]

Summary

Keep this PR in draft until full-app acceptance on hardware is complete.

Routing and settings

• Preserve the current mute state of sends and mix masters absent from an older profile instead of opening newer routes at unity.
• Reconcile late combine legs with saved levels and mutes. Pending cells use bounded backoff without a terminal retry cutoff, and disappear when their channel or mix is removed.
• Deep-copy insert parameter dictionaries when exporting settings and scenes so concurrent edits cannot invalidate serialization.
• Close the settings saver before mixer teardown so a pending debounce or disposal cannot overwrite the final snapshot with cleared state.
• Capture meter streams before starting their reader threads, avoiding process-disposal races at startup.

Plugin safety and recovery

• Drain native plugin stderr with bounded buffering, including output without newlines.
• Stage plugin replacements beside the installed bundle, with rollback if copying or replacement fails.
• Supply CLAP plugins with their declared audio-bus arrays, silent spare inputs and discard outputs. Share bus-layout validation between scanning and loading so unsupported layouts are not offered as usable inserts.
• Reject oversized audio quanta before writing fixed-size fallback buffers.
• Detect a plugin stuck inside the same audio callback rather than treating independent helper heartbeats as proof of processing progress. Idle and suspended nodes remain healthy.

Transport and regression coverage

• Use one fragment deadline per WebSocket message and cap fragment count instead of allocating a timer per fragment.
• Add managed reliability and native audio/CLAP regression tests, and run the new native suites in CI.
• Document profile recall, replacement safety and stalled-plugin recovery.

No version, API or layout-format changes.

Automated verification

• Locked restore: passed.
• Release build with warnings as errors, both ordinary and native-host-enabled: 0 warnings, 0 errors.
• .NET tests: 351 passed, 0 failed. Baseline was 333.
• Native clean build and tests: 26 passed (7 audio, 9 CLAP, 10 editor), 0 failed.
• CLAP layout harness: passed with AddressSanitizer and UndefinedBehaviorSanitizer.
• OpenDeck plugin tests: 5 passed. JavaScript syntax and manifest checks passed.
• Shellcheck, version agreement, locked packaging restores, OpenAPI and RPM checks: passed.

CI scanner correction

The first CI run caught an uninitialized output layout when input-layout validation short-circuited. The scanner now reads both directions unconditionally and retains the input-first refusal reason. A pattern-initialized build reproduced garbage output widths for four installed LSP mixers before the fix; afterward those entries carry their true output widths. Added native refusal-layout and managed catalogue-filtering checks. The fixed native tree also builds with -O1 -Werror, the local configuration that reproduced CI's diagnostic.

Isolated acceptance completed

These checks used private PipeWire infrastructure with hardware monitors disabled, not the running microphone chain.

• Scanned the installed LSP CLAP bundle and verified unsupported bus layouts receive catalogue refusal reasons.
• Loaded the real LSP stereo sidechain compressor into the native helper.
• Under Xvfb, opened, resized, moved, hid and reopened its editor. Minimum-size clamping worked and helper heartbeats continued while the editor was hidden.
• Ran a test CLAP plugin that deliberately blocks inside processing. Native heartbeats stopped, managed health and chain liveness became false, the old helper was disposed, and a replacement helper was built and healthy through the real PipeWireAdapter path.
• The user's live daemon, audio services, existing plugin helpers and mixer settings remained unchanged. Isolated services and test processes were stopped afterward.

The recovery acceptance used a disposable harness, not a persistent automated full-app test. It verifies helper/adapter recovery, not the complete running daemon sweep and desktop workflow.

Remaining acceptance before ready

• Run the updated full application on the supported hardware.
• Confirm profile recall preserves newer routes, saved mute/level settings reach late connections, and settings survive daemon shutdown/restart.
• Exercise plugin controls, editor resizing/moving/reopening and recovery through the application's normal workflow.

The meter-startup race is fixed structurally but has no deterministic pre-fix reproducer. Several routing and persistence tests cover extracted logic rather than a live hardware mixer. This change does not constitute an equivalent VST3 or LV2 bus-layout audit.